Home Blog Page 10224

FreeDeveloper.net’s eVote project struggles over code release

Author: JT Smith

By Grant Gross

Sometimes, building the tools to fix democracy can be as messy as democracy itself. For the past week, developers interested in working on an Internet voting system with FreeDevelopers.net have been locked in an argument over when the primary author should release some of the source code.

Marilyn Davis has created the Clerk, a software module “designed to emulate ‘The Clerk’ of a Quaker meeting for business,” on which FreeDevelopers is basing its eVote project. But Davis has so far declined to release the source code, saying she’s concerned about the possibility of coders building in ways to cheat the voting system.

Davis has urged other programmers to be patient while she trusts her inner voice to develop the project further before releasing the code. About seven years ago, Richard M. Stallman, the founder of the Free Software Foundation himself, unsuccessfully tried to convince her to release the code she’s been working on for 12 years, she says.

Davis doesn’t want “a rigged direct democracy poll in a community group using eVote.
One guy pulling the wool over all our eyes, If big brother … had the source, maybe he could rig the politics,” she adds. “Like [one developer] says, he wants the source so that he can hack. He can’t without it. Everyone running eVote is running an uncorrupted eVote.”

The debate about the release of the Clerk’s source code has been happening on the eVote discussion list through the FreeDevelopers.net Web site for about a week. FreeDevelopers.net has been making discussions on its mailing list public by archiving them monthly.

“What can I say to convince you to GPL it now?” asked developer Daniel Baumann on the list. “I would just like to ask that you release it now so that we may get comfortable with the code and get others to join in our efforts and/or we can get a hold on what’s there. In my mind this the only way an organization like this is going to get anywhere. How can we say this is a free software entity and yet not have the code for one of the most important projects readily
available? Surely, we must be more open than this?”

Tony Stanco, a former Security Exchange Commission attorney who heads the democratically run FreeDevelopers.net, says eVote will eventually be GPL’d. All projects on FreeDevelopers.net must be GPL’d or get a waiver from the Free Software Foundation, and eVote won’t seek the waiver, Stanco says.

Stanco says he received Stallman’s blessing to work with Davis’ project. “I understand your concern,” Stanco wrote developers on the list. “We all had it at the beginning and on
an objective standard, there is still a risk to us, because Marilyn has control over the situation. But I trust Marilyn COMPLETELY on this. She strikes me as particularly honorable and I don’t think anyone can corrupt her by even promising her the world once she gives her word.”

eVote is one of several Internet voting projects being developed. In fact, Jason Kitcat of the Java-based free software project FREE (Free Referenda & Elections Electronically) is on the eVote discussion list. While Kitcat argues that Internet voting systems should be open, the coordinator of FREE has been talking about how to work with eVote.

“I have difficulty being convinced by security arguments for keeping software NOT Free,” he wrote late last week. “Surely if the code is freely available it will be easier to detect malicious changes in a particular implementation? I think this issue needs to be resolved before people start
contributing time and effort to something.”

FREE is database independent, so Kitcat and Davis believe it will work with eVote. “While the Clerk/eVote were written from inside out, by starting from first principles and the server, Jason is building a fancy Java user interface that can work on any database,” Davis says in an email interview. “Sort of a flower meets the bee kind of thing, if we take advantage of it.”

The Clerk, the foundation for eVote, as Davis describes it: “More than a vote-counter, The Clerk of a Quaker meeting *facilitates* the meeting, impartially allowing each person equal access to the floor, equal ability to bring an issue to the group’s attention, equal ability to call a vote. S/he allows show-of-hand votes, transparent for all to count, as well as secret ballot. S/he allows discussion and voting to go on simultaneously, with repeated calls-to-vote on the same issue, to facilitate consensus.”

Stanco, who describes premature code sharing for the Clerk as “releasing a monster on the world,” describes the Clerk as a specialized vote-server, as opposed to the generalized vote-server of other systems. “Specializing the server grants more power to the user, i.e., the power to check the vote, to change the vote before the poll closes, and to trigger a recount of the statistics,” he says. “Our plan is to network Clerks together for election voting. Besides
the security of having the ballots distributed over many machines, this will enable the Clerks to check each other, ensuring absolute accuracy and giving each ballot the respect it deserves.”

Stanco says enhancements such as external executable verification or networking of Clerks to check on each other would solve the “big-brother” worries about eVote. “Davis, who authored The Clerk, and who believes in its awesome power, is afraid of it,” Stanco says. “Marilyn believes we need to have at least one of these facilities in place before we publicly release the source. When we are funded, there will be an internal release on a need-to-know basis.”

FreeDevelopers.net expects to release some ports of the system, and possibly some enhancements, maybe even before the project is funded and security layers are in place, Stanco added. Those releases would be marked “beta” and, he says, “we will warn our users of the dangers, both of the big-brother model, and the secret source model.”

Stanco, while acknowledging issues with security and equal access with Internet voting, predicts eVote will be ready to use for the 2004 presidential election.

But the eVote project first has to get beyond the issue of releasing the code. Lyn Headley, a developer who’s been working on electronic voting* for a year and a half, wrote Friday that developers are dying to work on the project.

Headley compared closed source code to strict gun ownership laws. “Personally I think Marilyn should release the code because … I think voting software, guns, and computers are all the same thing: power, which can be used for or against the people,” Headley wrote. “The way I see it if the people don’t take the power they will be screwed by it. I think many of us feel the same way about software.”

*This is the google cached link; the page itself, www.hacktree.org, did not load consistently when we tested it.

NewsForge editors read and respond to comments posted on our discussion page.

Category:

  • Open Source

Disclosure of JSP source code

Author: JT Smith

Under a particular configuration, ServletExec AS v3.0C will disclose
the source code of JSP pages when some special characters are
appended to HTTP requests. Net-security.org reports.

Development news from LWN

Author: JT Smith

Browers, databases, education, and more, at LWN.net.

Category:

  • Linux

MP3 Players about to become obsolete?

Author: JT Smith

UpsideToday reader says PDAs and cell phones will be capable of playing MP3s soon.

MS bug of the day: checking Outlook 2000 appointments

Author: JT Smith

MSNBC tells us, “all times may be off by two hours
during daylight savings time in these versions:
Outlook 2000, 98 8.5, 97 8.x, or SR-1 Enterprise
Update.”

Compaq ships Linux-equipped servers

Author: JT Smith

“Keeping a promise it made last summer, Compaq Computer released a pair of ProLiant servers that come preloaded with Red Hat Inc.’s version of the Linux operating system,” reports Computerworld.

HASP CD9 released with Linux support

Author: JT Smith

LinuxPR: HASP CD9 is an upgrade to HASP4,
Aladdin’s family of software protection keys. In addition to
the encryption mechanisms HASP4 hardware offers, HASP CD9
software introduces Linux support and security enhancements
to the HASP Device Driver and the HASP Envelope Utility.

Linux Mandrake – joe update

Author: JT Smith

From netsecuritybugs.com: “When exiting joe in a non-standard way (such as a system crash,
closing an xterm, or a network connection going down), joe will
unconditionally append its open buffers to the file DEADJOE.”

Category:

  • Linux

Security news from LWN

Author: JT Smith

“One question that has been asked of us a few times is why we cover BSD security
reports in LWN, including FreeBSD, NetBSD and OpenBSD. After all, LWN is dedicated to the Linux
community, right? Well, in many ways, our community is the Free Software and Open Source community, to
which the BSD operating systems definitely belong. So reporting on BSD is not totally outside our mandate.
On the other hand, it could be quickly pointed out that other Free Software operating systems exist that we
don’t cover.” Read more at LWN.net.

Category:

  • Open Source

Full-fledged Linux VAR supplier emerges

Author: JT Smith

32bitsonline reports that Ebiz takes advantage of Caldera’s acquisition of SCO to acquire one othe largest private VAR resellers of UNIX computer products. EBiz’s hopes corporate extend its reach away from the low end and into the high margin segment.

Category:

  • Linux