Quote:
|
Originally Posted by ratbastid
That's their defense, but IMO it's a crock.
What "ideas" are we talking about here? Take input and save it? A first-week CS student can do that. It's recently been revealed that they're not even using encryption on the memory cards.
They're refusing to show their source not because of trade secrets but because they're embarrassed at the security swiss cheese they've deployed. And, if you're conspiracy-minded, because they want to keep the backdoors secret so they can continue guaranteeing elections for the candidate of their choice.  |
Well, as someone who works a great deal with lawyers at software companies, I have to tell you that keeping the code secret is a paramount concern for all of them, even if the code itself is not all that complicated. It's a reflex. I am sure there is more to the code than taking input and saving it, but I don't know how much more, and that is no doubt what Diebold doesn't want to show to competitors.
I suspect that one of Diebold's motives is security - they don't want to open up the code to allow people to figure out how to hack it. Security through obscurity, as I mentioned above.
If you think about it, they have a number of pressures:
1) The sales guys know that nobody will buy a system that the engineers will say is hackable. They need to sell a product, so they say it is secure.
2) Engineers know that there must be holes they didn't think of, and they know that releasing it to the public will allow the bad guys to find the holes. So, they keep the code secret.
3) Lawyers don't want to reveal trade secrets and propietary methods to the public, so they can preserve their ability to sue if someone rips off their ideas. So, they keep the code secret, too.
4) Auditing firms (like engineers) know that there must be security holes in the systems, and that they will never be able to identify all of them. So, they refuse to certify systems as secure for fear of taking on liability when/if a flaw is disclosed.
Ultimately, what is needed is an open source software system, created by engineers, computer scientists, election officials and security experts. It will take a while, they will need to be paid, and they will need to be public about what they are doing and open the system up to public review, but ultimately I think it could work.