Is the definition of a secure system, that it is still secure even if you have the source code?
By Kerckhoffs's principle, yes.
https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
Source code of Polish electoral voting system?
41–50 of 64 posts
Re: Source code of Polish electoral voting system?
#42Haven't we all frowned upon picking on females in tech industry just yesterday?! It is NOT okay to wildly imply that the author of this code is of certain age and gender. EDIT: it was shown by the comment below that it was actually written by someone with a popular Polish female name. I was shaken by the article yesterday and thus oversensitive. Sorry about that.
Well, the implications are pretty well founded: - the binary has strings like `C:\Users\Agnieszka\...\Visual Studio 2013\Projects\Kalkulator1`. Agnieszka is a female Polish name -> the programmer is female. Although nobody really is using this as a discussion point anywhere, but hey, the fact is there if it's interesting to you. - the code logic and layout is pretty convoluted and looks duct taped together, even cons…
What is more, it is possible to find an Agnieszka working at Nabino through a Polish LinkedIn clone...
Re: Source code of Polish electoral voting system?
#43Earlier quoted context omitted.
Uhm, no, it is not. Did you miss the "Pani Agnieszko, naprawdę współczujemy, jesteśmy z panią!"("Ms. Agnes, we're really sorry too, we're here for you")(that's a terrible translation, but oh well) part? There's absolutely no ambiguity here.
I meant the “(female)” remarks in the grand-grandparent post.
There is no way to avoid that in the polish language, as someone else pointed out already. Nouns and sometimes even verbs or adjectives have gender, and you need to use either the male form or female form according to the situation
Re: Source code of Polish electoral voting system?
#44The sourcecode wasn't leaked - an internal website (with the software, written in C#) [1] was leaked, and then the program was decompiled and pushed to GH. EDIT: The website leak itself is actually pretty old news, but the decompilation and public shaming of the code itself is relatively new. “Zaufana Trzecia Strona” has more information [2] about the leak itself (in Polish). [1] - http://zapasdlakbw.home.pl/kalkulat…
Aren't you talking about backend? The code on github is a client used by a polling place and it was publicly available (this is how they've it distributed)
Re: Source code of Polish electoral voting system?
#45Earlier quoted context omitted.
WordPress is also far from the most secure or correct system in the world.
It's getting better. I, for one, am going to begin contributing to the core code :)
A voting counter shouldn't be compiled using hopes and dreams, but using proven coding methodologies.
What you are suggesting, and what I see when I read it: http://www.usmra.com/repository/category/electrical/techsupp... (Indian electrical grid)
Re: Source code of Polish electoral voting system?
#46Earlier quoted context omitted.
Electoral voting system written in PHP. Sounds like a good idea.
Why not? WordPress runs 23% of the Internet. (WordPress is written in PHP of course.)
WordPress (and PHP) are not bad things. They are things that have been designed for very specific purposes, and they actually excel at those things. Both are extremely easy to get up and running. They can run practically anywhere etc.
There are entire languages written with the design goal being security. It's not a matter of whether or not something is a capable tool (ie: runs 23% of the internet), it's whether or not it's the right tool for the job. PHP clearly isn't.
Re: Source code of Polish electoral voting system?
#47Earlier quoted context omitted.
Why not? WordPress runs 23% of the Internet. (WordPress is written in PHP of course.)
WordPress (and PHP) are not bad things. They are things that have been designed for very specific purposes, and they actually excel at those things. Both are extremely easy to get up and running. They can run practically anywhere etc. There are entire languages written with the design goal being security. It's not a matter of whether or not something is a capable tool (ie: runs 23% of the internet), it's whether or n…
I don't think an application written in PHP makes it inherently insecure. Maybe if you're talking about some 2004-style PHP with magicquotes and register globals enabled, but not in 2014 with a modern stack/framework. You could write a shitty ruby app just as easily as you can write a shitty php app.
Re: Source code of Polish electoral voting system?
#48Earlier quoted context omitted.
I meant the “(female)” remarks in the grand-grandparent post.
There is no way to avoid that in the polish language, as someone else pointed out already. Nouns and sometimes even verbs or adjectives have gender, and you need to use either the male form or female form according to the situation
Right, but a translation to English should not include "(female)" unless it's essential information, which it isn't here.
Re: Source code of Polish electoral voting system?
#49Earlier quoted context omitted.
WordPress (and PHP) are not bad things. They are things that have been designed for very specific purposes, and they actually excel at those things. Both are extremely easy to get up and running. They can run practically anywhere etc. There are entire languages written with the design goal being security. It's not a matter of whether or not something is a capable tool (ie: runs 23% of the internet), it's whether or n…
I don't think an application written in PHP makes it inherently insecure. Maybe if you're talking about some 2004-style PHP with magicquotes and register globals enabled, but not in 2014 with a modern stack/framework. You could write a shitty ruby app just as easily as you can write a shitty php app.
Writing your code in PHP, no matter how good of a programmer you are, makes it more likely that your natural level of mistakes will insert security issues into the code, especially when compared to a language with even basic features like static typing. I'm not saying this as some idiot who thinks PHP is bullshit and for noobs, I've worked on pretty large sites using PHP and I have a pretty deep understanding of it.
Everyone likes to say security is mission critical, but for the vast majority of people it really isn't. And for those people the development speed advantage, massive developer market, libraries etc. you get working in Ruby or PHP are well worth it.
Everything is tradeoffs, and it seems to me that in writing voting software deployability, development speed etc., are not nearly as mission critical as security.
Re: Source code of Polish electoral voting system?
#50I'm still amazed that in the century of the Internet people still write stuff like that as a desktop app. Not to mention it was waaaaaay to late to do it in the first place (they picked the company to implement it in August 2014).