It is interesting to observe how little distinction non-technical users are aware of between high quality and comically buggy software because of the ease of producing flashy UIs these days. They have no idea how the sausage gets made. No idea.
I have never seen a stronger case for the need to have third-party certification and testing of software and the people involved in building it.
- A license which allows the source code to be redistributed under the same terms as it was received? The problem with these boxes isn't that people can't redistribute it.
- A collaborative model for creating software? Possibly -- though there have been some high-profile cases of security issues sneaking into these, too. Modern voting machines also seem to have a huge stack of dependencies, which mean the surface area for exploit is much larger than the voting software itself. Would you require a fully open-source stack, and how far down?
OSS is great for transparency for the person receiving the software (in this case, the jurisdictions operating the machines), but if those people don't care to audit it (or redistribute it to others who wish to), that doesn't buy them anything.
I'd much rather see a rule requiring voting software to be publicly viewable by any voter in the jurisdiction, regardless of the software license it's sold under.
Transparency, an open license, collaboration, distribution, best practices and more.
Clearly I do not expect districts to independently inspect and verify source code any more that we are inspecting and verifying the web server running this website.
Computers (or at a minimum binaries) could be distributed and have self checking as the boot. They could simply be used to tally paper ballots (as others have mentioned) or to transmit votes.
The overarching point is if we can do 5 trillion dollars of electronic money transfers worldwide per DAY certainly we can use open source to accurately, securely and transparently count and tally votes.
Do we need even more governmental oversight? I would like to see a bulletproof technological solution that I personally can verify if I choose to.
Not there yet, but it's one possibility as long as the company running this server has appropriate levels of security
Which is why it may be wrong to assume naivety. We don't know yet if this was incompetence/naivety or intentional.
Are you proposing that every GitHub repository be certified by a third-party and tested before use? Besides, "high quality" software like Google Maps or iOS don't have anything close to "third-party certification".
https://www.nakedcapitalism.com/2019/08/reminder-dnc-lawyers...