1. 4

    Theory. I think the confusion stems from using the same symbol to denote two different functions. If we denote addition by a, multiplication by m and inverse by i then the problem can be summarised as follows:

    1. a and m are functions from K × K to K.
    2. i is a function from K \ { 0 } to K.
    3. When we see x / y we usually think of a function d(x, y) = m(x, i(y)) and this is a function from K × K \ { 0 } to K.
    4. However, we can define a different function d’ from K × K to K such that the restriction of d’ to K × K \ { 0 } is d.

    Using / to denote both d and d’ is what is causing confusion. Some people see 1 / 0 = 1 and assume it means 1 · 0⁻¹ = 1 (and I find this thought natural) but what is really meant is f(1, 0) = 0 where f could be d or d’ or something else entirely.

    Here’s an unsurprising summary: You can define an arbitrary function f on a field and it won’t “break” the field in any way. You can introduce an inconsistency if in addition to the definition you add some claims about it’s properties that are related to the field but a definition alone cannot wreak havoc.

    Practice. There are practical implications though. This whole discussion proves that there’s a lot of confusion over what the / symbol actually means. People assume it’s function d written using an infix notation. I think that making / denote d’ can be surprising to lots of people and cause them to introduce bugs.

    If I see code like

    if a / b == 0:
      ...
    

    then it is natural for me to conclude that: a is zero and b is non-zero. In other words, it’s natural for me to think of function d and not of d’ or any other function. However, if / means d’ then my reasoning does not hold.

    We can define / to mean anything we want, swap + and -, swap the meaning of digits, and do all sorts of syntactic changes without changing the meaning of these symbols. Computers don’t care but programmers do and this whole discussion is the best evidence that this change will cause lots of confusion.

    1. 2

      Mathematicians generally avoid defining this d’ in any way because there is no canonical choice of what the extra value should be. In category theoretic terms, there is no universal property that such a function satisfies that forces a choice unique up to isomorphism.

      This means that everyone is free to pick their own value that makes sense for them, which leads to inconsistencies and, for the lack of a better word, portability problems of theorems between theories that picked different values. That’s again why we generally don’t see people picking any value to define a d’, and when they do anything of the sort they usually have their sights set on things that don’t depend heavily on that value.

    1. 18

      Odd, because I didn’t read the XKCD comic as making fun of security people for saying ‘voting machines won’t work, stay away’ at all. I read it as saying voting machines won’t work and that we should stay away from them. And to that I have to say: I totally agree. Voting works fine as it is: done by humans, counted by humans, entirely on paper with not a computer or network in sight.

      1. 4

        Elections are really hard regardless if it’s done by computers or not, but we didn’t get to the point where we figured out the computer side of it at all. What’s worse, is that adding computers into the mix was an excuse to go back on well-tested election related rules, such as secret voting. No, we can’t have voting over the internet or via mobile phones or anything like that.

        We should really go back to limiting computer involvement in elections to UI, with the papertrail as the official record of votes. Involving computers in the actual process adds such a huge leap of complexity that it excludes most people from ever being able to verify results. Everyone can verify paper ballots.

        1. 6

          Not really sure why you’d even want computers as UI. The ‘UI’ of a piece of paper you tick a box on really is quite good.

          All I can say is that I’m glad that New Zealand has never (as least to my knowledge) involved computers in actual voting. Not even UI. I hope that the complete disaster that was our recent attempt at doing a census online[0] will help dissuade anyone from trying to do elections online as well.

          [0]: Somehow they managed to simplify the census, put it online, reduce the number of questions and get fewer responses than before even though it’s still mandatory. What. And in return for significantly reducing the amount of information we get from the census, now they have a mandatory incredibly invasive survey of a randomly selected few percent of the population.

          1. 3

            The reason for fewer responses may have little to do with technology and more to do with that notorious citizenship question.

          2. 1

            What’s worse, is that adding computers into the mix was an excuse to go back on well-tested election related rules, such as secret voting. No, we can’t have voting over the internet or via mobile phones or anything like that.

            There’s designs and protocols for that. We could even have diverse suppliers on the hardware side to mitigate the oligopoly risks. The question is, “Should we?” I think traditional, in-person methods combined with optical scanning is still the best tradeoff. The remote protocols might still be useful to reduce cost or improve accuracy on some mail-in votes, though.

          3. 4

            I absolutely agree. Voting should be as simple for voters to understand as possible. Introducing an electronic device makes it auditable only to experts and even they might have a difficult job given the many layers at which things can go wrong (including hardware vulnerabilities).

            One of the reasons people are advocating electronic voting is their lower cost. Personally, I think this argument is totally wrong. Cost is a factor but not the most important one - not having elections would be cheaper.

            1. 2

              And let’s face it, how significant is the cost of having elections really? The 2008 general election in NZ cost about $36 million. Sounds like a lot, but that’s $12 million per year: 1/1719th of the Government’s budget. Spending 0.058% of the budget to ensure we have safe and fair elections is pretty insignificant really, it’s about as much as is spent on Parliament and its services and buildings etc, and about half as much as the Police earn the Government in fines from summary infringement notices (speeding tickets etc).

              1. 4

                Exactly. Also, lots of good things can be said about software but not that it’s inexpensive.

            2. 3

              100% agree. I counted votes in the last federal election of Germany and that is some serious work, but totally worth it and very hard to tamper with.

            1. 2

              This is great! Are you aware of any desktop tools like that?

              1. 2

                The constituent compiler/toolchain tools are what’s in use under the covers. gcc/clang/objdump etc.

              1. 4

                A few tips:

                • Definitely read Working Effectively with Legacy Code by Michael Feathers. He shares many techniques that should help you start adding tests in small pieces.
                • When rewriting a function run the old and new code and compare results (note isEqual can be implemented with === only for primitive types):
                    function newFunction() { ... }
                    function oldFunction() { ... }
                    function tryFunction() {
                      const newResult = newFunction();
                      const oldResult = oldFunction();
                      if (isEqual(newResult, oldResult)) {
                        return newResult;
                      }
                
                      logMismatch();
                      return oldResult;
                    }
                
                • Applied at a high level this technique can mean routing the same request to two instance of the same app and comparing the results on the fly - a sort of runtime golden master testing.
                • Explain what you’re doing to the users. This will help you manage their expectations. Most likely, they’ll be happy to help you.
                • Add the ability to deploy the code to each company separately to limit the potential damage.
                • Make it easy for you to rollback a broken build. This will help you avoid embarrassment if you mess something up.

                Computer science trivia: the halting problem is trivially solvable for finite-memory Turning machines. Proof: if you have b bits of memory then you can represent 2^b states. Load the program and step it 2^b + 1 times. If it’s halted then you’re done. If not then according to the pigeonhole principle there are two steps corresponding to the same state. This proves the existence of an infinite loop.

                Unfortunately, I’m not aware of any tools that could help you prove the equivalence of two programs.

                1. 4

                  I was watching Rogue One and saw Grand Moff Tarkin, the commander of the Death Star, portrayed by the same actor as in A New Hope. What I found surprising is he looked exactly the same despite 39 years separating the two movies. It turned out the original actor passed away in 1994 and he was recreated using a computer! WIRED published a short video about that.

                  1. 6

                    I absolutely understand the economic motivations behind this move. I’m concerned because it seems that if other smaller players do the same (migrate over to established players like Reddit) then it’ll drive more users to incumbent companies. Someone in the thread included a link to an instruction how to deal with GDPR trolling which I’m bookmarking right now just in case.

                    1. 6

                      If you get a data request and it’s reasonable to do so, simply answer it. “Hi, my online identifier is ‘geocar’ what information do you have on me?” - I only have the information you already know about1. If that’s true, it’s easy. If you’re building a profile of me, likes/preferences and whether you sell them individually or in aggregate, then you have to tell me that, but if it’s just my own comments and my own email address (which I entered) then I should already know about that.

                      If it’s worded in legalese, or you find it otherwise difficult, you can ask for administrative costs to be posted with the request to you. That way you’ll know they’re at least serious too. You’re not required to figure out what information might be connected to the person2, so if you buy some audience data from somebody like Lotame to show targeted ads to your users, even though you have a online identifier (username) you aren’t required to link them if you don’t ordinarily do this, and only very big websites will do this.

                      Finally, if it’s onerous, you can ask for further “reasonable fees”. Trolls will get bored, but if you need to pull logs out of your s3 glacier and it’s going to take a week (or more) without paying the expedited fees there’s no reason you have to be on the hook for this.

                      Right now, all this seems scary because it’s “new”, but eventually it will become normal, and we’ll realise the GDPR isn’t the boogeyman out to get us.

                      1. 2

                        “Hi, my online identifier is ‘geocar’ what information do you have on me?”

                        You also need to prove that you are indeed geocar, otherwise anyone could have requested to view/delete the personal data. So some kind of vetting needs to be done.

                        1. 1

                          Indeed, but in this case, I think of at least one way to do that :)

                        2. 2

                          This is reasonable, but when you’re a tiny little startup (I’m pretty sure drone.io is a one man operation) any of this could still be onerous.

                          1. 0

                            Like already stated in another comment before, you can simply ask people to use predefined forms of request from your website once logged in, and have pre-defined answers to them.

                        3. 2

                          Seems like there’s a business opportunity here - “we will host and run your forum / comments / community in a fully GDPR-compliant fashion” or “we give you all the tools to easily comply with GDPR requests”

                          1. 3

                            The link I posted above also suggests another solution which might be a better fit for smaller companies and projects: provide a self-service interface for users where they’ll be able to access all GDPR-related stuff. I’d love to see this approach gain traction so that we’d avoid centralization.

                            1. 2

                              In other words: “pay us money or the government will shut you down”.

                              All to “protect the consumers” of course. The very same consumers who willingly put all their information up on facebook.

                              1. 0

                                That’s what Im thinking. Lets them pool resources on legal and maybe operational side. Even an existing seller of forum software might make it an extra servicevor differentiator. Alternatively, this stuff might get outsourced to specialized firms.

                            1. 1

                              This reminds me of my assembly and reverse engineering days. On 64-bit Intels whole registers are referenced using RAX, RBX, etc. while EAX, EBX, etc. refer to the lower 32 bits. There are also 8 more general purpose registers named from R8 to R15.

                              1. 4

                                I recommend reading the discussion in Redmine. It seems the rational is that Integer(string) rescue default_value:

                                1. is slower than Integer(string, exception: false) || default_value.
                                2. generates a lot of noise in debug mode.

                                I have mixed feelings about that.

                                1. 6

                                  Noise in debug mode can be a significant usability issue. Performance as well. Even though Ruby isn’t traditionally used for ultra high performance code, doesn’t mean someone somewhere won’t benefit from parsing integers faster.

                                  I’m more interested in exception: true for calls like system. Getting the exact error for an execution is super helpful, like the ENOENT example.

                                  1. 1

                                    Noise in debug mode can be a significant usability issue. Performance as well. Even though Ruby isn’t traditionally used for ultra high performance code, doesn’t mean someone somewhere won’t benefit from parsing integers faster.

                                    “Someone somewhere” isn’t a good enough criterion to add a feature to the language. It can easily lead to a ton of hacks being piled onto the language.

                                    My biggest concern is the conflation of a language and a runtime. Performance and debugging are first and foremost runtime issues. I realize not all language constructs can be implemented effectively but in this case it seems Ruby is modified to address purely runtime-related issues.

                                    Regarding exception: true for system it seems you’re conflating two things - returning error information and raising an exception. Errors can easily be returned as objects instead of being raised an exception.

                                    My feeling is this addition makes the language less elegant although I understand the underlying motivation.

                                    1. 1

                                      “Someone somewhere” was meant to be generous, but I am quite certain this will be useful for many people.

                                      I think other languages frequently do this worse than this. At the very worst, some have different functions with synonymous names that do one or the other thing. Either way, Ruby can’t just stop throwing ArgumentError in Integer by default, since that would break most code that actually error handles that conversion. This is a pretty good solution given the constraints, and fixing it in the runtime would be hot garbage.

                                      How would that even work? Right now there is a runtime flag, # frozen_string_literal: true, but that doesn’t really reduce the readability or workability of code. Having something like # kernel_throws_exceptions: true/false would make code outrageously difficult to read. If you alter the behavior of Kernel module functions you’d have to check the header of every file to figure out what the behavior was. If you made it a vm flag, developers would have to know which setting is used when writing code, and users would have to know which setting they have to use when running the code. It just doesn’t work.

                                      Even if they wanted to break back compat, which they don’t, using things like option types or multiple returns aren’t really idiomatic in ruby. It would be a lot sillier to blatantly go against the grain of the language in order to avoid a slightly awkward optional keyword flag.

                                      Performance and debugging are first and foremost runtime issues.

                                      I haven’t disagreed with anything this much in a long long long time. But I’d also prefer not to get into it.

                                      I realize not all language constructs can be implemented effectively but in this case it seems Ruby is modified to address purely runtime-related issues.

                                      Not really. Raising exceptions will be slower than returns, always. Unless you deliberately slow down returns to match exceptions, or your language has such weird semantics that returns are necessarily also slow. But both of those situations, aside from not applying to ruby, are ridiculous.

                                      1. 1

                                        Just as if (false) ... is dead code and can be eliminated, so too my_method rescue my_value can disable exceptions in my_method. This will be difficult to implement in general (you’d need to enable/disable exceptions at various stack levels depending on how the call site looks like) but should be totally doable for functions implemented in C.

                                        Option types or multiple returns aren’t idiomatic Ruby and I think this might be my problem here.

                                1. 7

                                  These kinds of “Falsehood” articles often raise more questions than they (seem to) attempt answering. Take the last point for example

                                  People have names.

                                  What is this supposed to tell me? Why not at least link to some resource or source explaining the issue with suggestions for peoole who want to solve X-related problems. All I could conclude from this would to be just to forget about names beyond these just being metadata… or was that the point?

                                  1. 3

                                    I think raising questions is precisely the goal of such articles. To make implicit assumptions explicit and verify them in the context of a particular project.

                                  1. 2

                                    This reminds me of the probabilistic method in mathematics.

                                    1. 13

                                      Hi Lobsters! This blog post is about Project Sistine, a hack that I worked on with @antimatter15, Guillermo Webster, and @loganengstrom. We turned a MacBook into a touchscreen using only $1 of hardware (a small mirror, some pieces of a rigid paper plate, and a door hinge).

                                      We built this prototype some time ago, but we never wrote up the details of how we did it, and so we thought we should share. We’re happy to answer any questions you might have about the project!

                                      1. 3

                                        Great work. I love the idea. Does it work on the whole screen? Looking at the pictures in the article, it seems that the areas near the left and right edges are uncovered.

                                        1. 3

                                          Thanks, glad you liked our hack :)

                                          Yeah, the current prototype doesn’t capture the whole screen (it probably captures ~1/2 to 1/3 of the screen area), due to the positioning of our flat mirror. We tried moving it farther away so it would capture more screen area, but with the low quality webcam we were using (480p), the resolution wasn’t good enough. A higher resolution webcam might be enough to solve this problem. Another solution might be using a curved mirror.

                                          1. 2

                                            Did you try with a convex mirror to capture a wider view? Will probably drive the dollar cost up - but would be interesting to see if you could find success with it.

                                            Great work, by the way!

                                            1. 4

                                              Thanks, glad you liked our work!

                                              Nope, we haven’t tried a convex mirror yet. I think convex mirror + 720p camera (standard on today’s MBPs) could make this system work a lot better. It would probably complicate the math a little bit, but it should be reasonably straightforward to handle as long as the optics of the mirror aren’t too weird.

                                      1. 3

                                        If you want to avoid metaprogramming then I recommend setting up a snippet in your editor that expands to a memoized method. For example, when I type memo<TAB> (I use UltiSnips) then the following appears:

                                        def name
                                          @name ||= value
                                        end
                                        

                                        UltiSnips keeps name in sync both in the method name and attribute name. Pressing <TAB> one more time takes me to value. You can of course do the same for the more bullet-proof approach described in the article.

                                        1. 2

                                          That’s a good point. I do use RubyMine live templates, and there’s a way to do something like that in most editors.

                                          1. 5

                                            I think this is a very naive view. Corporations are major buyers of software and if this is implemented it may raise the costs and risks associated with operating it. Only a tiny minority of corporations are expecting to benefit from it.

                                            All government policies are a result of different lobbying groups. I bet this legislation is being pushed by the movie and music industry. They’re trying to shift the cost of copyright enforcement onto content distributors.

                                            The IT industry (including GitHub) is lobbying the other way via the Save Code Share! campaign. GitHub lists several reasons against upload filters (privacy, free speech, ineffectiveness) and try to sound like defenders of civilization but when you go to the call to action at the end of the post it’s a bit disappointing (same for the Save Code Share):

                                            Write to EU policymakers (MEPs, Council Members, or Commissioners) and ask them to exclude “software repositories” from Article 13. Please explain how important the ability to freely share code is for software developers and how important open source software is to the software industry and the EU economy

                                            Is GitHub okay with content filtering (which they said violate privacy, free speech and are ineffective) as long as it applies to things other than software? I think the answer is “no” - they’re simply lobbying the other way to avoid increasing their expenses and exposure to legal risk.

                                            1. 6

                                              This isn’t pro-corporate, it’s pro-copyright. That’s arguably much more destructive.

                                              1. 2

                                                Which again gains corporate, or might I be mistaken?

                                                1. 8

                                                  You aren’t mistaken. This is corporate before humankind.

                                                  The proposal is aimed at music and videos on streaming platforms, based on a theory of a “value gap” between the profits those platforms make from uploaded works and what copyright holders of some uploaded works receive. However, the way it’s written captures many other types of content, including code.

                                                  Wyager might be referring to the fact that it is good for some corporations and bad for others, but that’s often the point for corporations manipulating our governments to gain a market edge. It’s still corporate manipulation of our legislative process.

                                                  1. 5

                                                    Most companies don’t benefit from insanely aggressive copyright enforcement, only a few large IP holders.

                                                    1. 1

                                                      Most corporations are large IP holders though. I can’t even think of one off hand that isn’t, especially in tech.

                                                      1. 2

                                                        99% of IP-holding tech companies hold IP specifically for defensive litigation. They don’t benefit from the law in the OP.

                                                        1. 1

                                                          If I can defend against something and the little guys can’t I would be ahead even if I didn’t use it offensively, and therefore I benefit passively from its existence without ever having to actually be the “bad guy”. I’m not saying that’s their intention, but I think it is incorrect to say they don’t benefit from the law in OP at least passively.

                                                          I think though when people are talking about pro-corporate they don’t mean as a unified perfect body. They are talking about pro-(some specific corporation) at some cost to society and at little or no cost to other corporations. As long as no corporation is hitting other corporations and everyone is hitting the public then corporate interests move forward on average together.

                                              1. 16

                                                Depressing that something so widely depended-upon (by companies with deep pockets, no less) can’t even keep the tests in the software renderer green. This is why we can’t have nice things.

                                                1. 3

                                                  That’s the biggest pathology of the free (as in beer) software. People with budgets are probably unaware of this project’s existence and it’s the project’s job to promote itself. It’s the same when you build a commercial product: it can be the best product in the world but you need to reach out and ask people to give you money to use it.

                                                1. 1

                                                  Interesting findings. I might have missed something but did it actually establish causation? If less parameters and more tests tend to occur together then it might be the case that it’s easier to test methods with fewer parameters hence they’re tested more frequently. In general if A correlates with B then 1. A causes B, 2. B causes A, 3.there’s C that causes A and B.

                                                  Im curious what experimental design should be used to establish a casual link between testing and various code outcomes. Any papers you would recommend on the topic?

                                                  1. 8

                                                    I did a talk about this called ‘The Deep Synergy Between Testability And Good Design.’ The case I made was that difficulty in unit testing often indicates design problems. I listed about 10 cases where that appeared to be the case. The crux of my argument was: writing tests is writing a program to understand your code. If it’s hard to do that, it’s probably hard to understand the code also.

                                                    I like this paper because it shows some real empirical correlation. The places where it fails are very interesting, particularly the cases of long methods and complexity. I suspect that testing enables complexity because tests allow us to write code that is ‘correct’ but still not easy to understand at a glance, whereas something like parameter count for methods tends to go lower because it’s extra work to write tests for methods with more parameters.

                                                    This space where the ergonomics of practice ‘nudge’ design is very interesting.

                                                    1. 5

                                                      I think I tried out the tests-first approach to unit testing probably 5 times until I finally understood it. Tests-first helped me to write better software not only because the unit tests would have my back when refactoring, but becuse tests-first unit testing made me write software with a better structure.

                                                      1. 1

                                                        Would you be willing to share your experiences? What mistakes did you make during the first 4 attempts? What made it finally clicked?

                                                        1. 1

                                                          I think I had several misconception on unit tests. I was under the impression that unit tests must test at the implementation-detail level, when now I am mostly working on a functional level. So in my first attempts I would think of a solution in my head, then write a test for that solution (that contained assumptions on the implementation of the function) and then I wrote the implementation, so in fact it wasn’t really tests first. Then I would write several tests at once in that style. then implement instead of writing one test and making a minimal implementation that would just fullfil the test. I also tried to use mocks/fakes for tests a lot, and that made matters worse. Nowadays I use is very rarely. I still see to it, that my test suite runs fast enough though. I am not involved too much writing client code for services though, so that I can work this way may be an aspect of the kind of programming I do.

                                                          Does that make sense?

                                                          It finally clicked when I got an introduction to TDD in a Kent Beck style red-green-refactor workflow. Now I am a TDD zealot :) Forever grateful for the colleague who showed me the good way.

                                                          Also https://www.youtube.com/watch?v=Xu5EhKVZdV8 taught me a lot and brought me on a better track to unit testing I think.

                                                      1. 6

                                                        Great patching and write up.

                                                        Trying to save as much space as possible reminded me of my high school years. I was involved in the crack scene and tried to build the smallest crack template possible. I ended up putting assembly instructions in headers and jumping between them to save a few bytes more. I even managed to include the group’s logo. There’s also an article about producing the smallest possible ELF binary.

                                                        1. 2

                                                          What’s the “crack scene”?

                                                          1. 4

                                                            A part of / spin-off from the broad warez scene. The demoscene is also related.

                                                        1. 4

                                                          Is preact a viable alternative from a technical standpoint?

                                                          1. 3

                                                            Preact is an excellent library. It does most of what React does for a fraction of the weight, and with a nicer license too.

                                                            1. 0

                                                              MIT license is nicer than BSD? Why?

                                                              1. 3

                                                                That’s off-topic, sorry. Let’s keep that troll for another thread about BSD vs MIT. :p

                                                                1. 1

                                                                  See above for the patent “grant”.

                                                            1. 7

                                                              In think it’s clear at this point that anyone who takes mobile security seriously has to be using an Apple device. Samsung didn’t even respond to OPs outreach.

                                                              1. 2

                                                                CopperheadOS is pretty good about mobile security. Unfortunately they don’t have an update for this vulnerability quite yet, but it’s because the base AOSP project is being slow for some reason. There’s a thread about it here.

                                                                Fortunately, kernels built with -fstack-protector-strong (as the Copperhead kernel is) will kernel panic instead of allowing the exploit to succeed. So Copperhead is fairly protected even without the update.

                                                                Edit: I have the update now.

                                                                1. 2

                                                                  For those who don’t know why @vosper makes this claim:

                                                                  All iPhone, iPad and iPod touch devices with iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower are affected by the remote code execution vulnerability. This vulnerability was already mitigated by Apple in iOS 10, so no new patch is needed to mitigate it. We recommend you upgrade to the latest iOS or tvOS available.

                                                                  1. 1

                                                                    Well, Android is a surveillance platform, isn’t it? Just one more tool in the toolbox. ;) I wonder what Blackphone’s and Cryptophone’s response is on these kinds of things. If they’re not doing better, then Apple it is for safer mobile.

                                                                    1. 2

                                                                      As for the Blackphone 2, we receive every month an OTA update including the fixes from google. Just received the september update so I am patched.

                                                                      1. 1

                                                                        So, that’s up to 30 day wait. Anyone know what Apple’s average is?

                                                                  1. 9

                                                                    In my opinion electronic voting systems don’t make much sense because they’re opaque to an ordinary citizen (hence non-auditable) and optimize a tiny fraction of government spending. It’s a case of modernititis where it’s assumed that modern is by necessity better.

                                                                    1. 2

                                                                      I think computer literacy will grow fast enough that we can have more efficient systems that are also secure. Maybe not just yet though.

                                                                      1. 1

                                                                        Secure and auditable voting systems are aIready (technically, but not politically) possible. I don’t really see computer literacy among the voting public as the limiting factor here. Public elections have a lot of big stakeholders, and they’re not all nice people. Some of them are not even especially visible.

                                                                        Barbara Simons’ work is a good starting place if you’re interested in learning more about the issue.

                                                                        1. 1

                                                                          I don’t really see computer literacy among the voting public as the limiting factor here.

                                                                          They have to trust the system. Many won’t. These range from tech-savy folks who know computers can be hacked/subverted to rural folks who won’t trust a black box no matter what. The options like Scantegrity that balance these concerns have had usability issues. About the only one they understand without much potential for hacking is optical scan with diverse suppliers of scanners. There’s a question, there’s multiple choices with a letter, they fill it out, and it gets counted with paper-based recounts. Gotta design for lowest, common denominator in a society with conflicting beliefs about what’s trustworthy. That one works pretty well.

                                                                          1. 2

                                                                            Even if we suppose that the actual voting public (rather than the decision-making officials acting in their name, let’s assume in good faith) must trust the system, that doesn’t imply that their trusted system is “trustworthy” by security-expert standards. There are lots of ways to influence public opinion.

                                                                            So, we’d want a system that honest, well-intentioned experts can trust (for their expert reasons) and that the voting public will trust (for whatever their reasons). Tall order! Care to comment on Travis County’s STAR-Vote system?

                                                                            1. 1

                                                                              I know many areas would reject such “gibberish” like El Gamal and hash chains immediately when paper stuff is more understandable. Let’s say they’ll accept a computer solution if they can at least get a paper copy they can understand. From that view, I love what I see in the slides of STAR-vote. The combo of a touchscreen, standardizing as much as possible, thermal printers, removing extraneous info on receipts, QR codes, and public ledgers are all good ideas. The INFOSEC needs improvements on subversion side to deal with attacks where people there want to manipulate the election and will be the ones deciding which ballots to look at. Already seen that happen.

                                                                              I can’t say much more about the protocols since that takes a lot of time and effort to review. I do appreciate you telling me about it, though, since it’s work worth building on.

                                                                      2. 1

                                                                        optimize a tiny fraction of government spending

                                                                        Is this actually an optimization? I’m pretty sure serious money was spent “designing” and creating these systems (looking at total cost). Not sure how many elections are needed to break even on those costs, compared to simple paper in voting office and letters for remote voting, especially if there is still a paper trail anyway…

                                                                        In e.g. Netherlands they “optimized” this further by having no paper trail, so I guess some trees were saved there [/s].