Is it morally correct to publish flaws in voting machines?

[Kytro]

Originally Posted by JaJae

Most of these machines run on a network and almost all run on popular operating systems. There's a huge risk that someone could go in and tamper with the machine/s. If the source code is open source you're just opening yourself up for disaster on election day.

How so? Open source applications have not historically been more vulnerable.

[JaJae]

Originally Posted by Kytro

Hand counting is more "accurate" ?

The Diebold machines are a joke and should not be used. They should have a paper audit trail as well.

Everytime they added up the polls in FL they got a different number each time. Hand voting is not more accurate than a solid electronic voting system. The question is, do we have one?

[JaJae]

Originally Posted by Kytro

How so? Open source applications have not historically been more vulnerable.

Open source systems typically aren't as widely used. Have you ever run a phpNuke website? Far less secure than a paid CMS system.

Open source system are much easier to exploit. If the coding of the system is under lock and key nobody can come in prepared to hack it. Once they have access to it, it makes it all the world easier.

[Kytro]

Originally Posted by JaJae

Everytime they added up the polls in FL they got a different number each time. Hand voting is not more accurate than a solid electronic voting system. The question is, do we have one?

Not with diebold. I am not sure about the others.

However any system should have a paper trail backup. For some reason diebold don't seem to want to implement one.

[motivez]

Open source is NOT less secure. I don't know why that myth prevails with so many people because it's simply not true.

Does it make exploits potentially easier to find? Well, sure. But that has the added bonus of letting it all "be out there" for everyone to see, and for the white hat coders and people interested in security of a project to fix it.

With a large enough development community, and lets face it, open source voting would have a large following, bad coding would be purged with ease, as would exploits.

With closed source, the problem is that no one knows how to fix the bugs that exist yet aren't fixed because they think hiding the source is somehow a measure of security. That's just not the case. If someone wants to fiddle around with a voting machine for the purpose of stealing an election, closed source isn't going to stop them.

Look at the recent revelation that it was possible to completely screw up a Diebold voting machine and hide any evidence that the vote was tampered with.. that problem would never be allowed to exist in an open source environment because as soon as it was found out that it was possible, it'd be patched and people would move on with working on other things.

Everyone who's had a chance to look at the Diebold software has said it's amateurish and riddled with problems that make it possible to exploit, the worry comes from people who rely on those systems not being able to see where an attack might come from.

Transparency has its benefits. There's a reason we push for it in Government and so many other aspects of our society. Source code is NO different.