Text 24203, 71 rader
Skriven 2008-11-28 13:25:44 av Robert Bashe (2:2448/44)
  Kommentar till text 24182 av Dale Shipp (1:261/1466.0)
Ärende: Code
============
Dale Shipp wrote to Robert Bashe on Thursday November 27 2008 at 22:56:

RB>> You know, in the late 1980s I typed code into a computer to get a
RB>> program too, but it was a bitch to get everything right, and one typo
RB>> could ruin the whole thing.

DS> Actually, in the 80's it was not so bad.  You typed the code into a
DS> computer console, and compiled it immediately.  You could then correct
DS> the typographical errors and try again in minutes.

Hours. After you checked everything manually to see where the error was.

DS> The 60's and early 70's were much worse.  You typed your programs onto
DS> punched cards and submitted the deck to a computer center over the
DS> counter.  THAT was when a single small type could ruin your whole
DS> day:-}}

I did that too, but wrote the (short) programs myself (in Fortran).

RB>> That was 20 years ago, and nowadays _nobody_ types code into a
RB>> computer. You send code files.

DS> I type my code into my computer now, compile and run.

If you program yourself. But try to take the printed source code of a _real_
application - I mean something that printed out is several hundreds if not
thousands of pages long - and transform that into a file you can compile.

RB>> And I'm meanwhile 67 years old. So who are the "some people" who
RB>> supposedly can't deal with source code? And what kind of an excuse is
RB>> that for not making it available to people who _can_ deal with it,
RB>> pick it over and look for weaknesses?

DS> That is a necessary way to verify an important program and gain trust
DS> that it is doing what it is supposed to do, no more and no less.

You're confusing a printout with code you can compile on a computer.

RB>> Something like that would make me more, not less sceptical as to the
RB>> validity of the electronic results.

DS> What is it that makes you more skeptical?  Verifying the code by in
DS> independent party or the not allowing it to be looked at by others. I
DS> hope you meant the later.

Anything that makes it more difficult to verify the code, such as merely
supplying it as a printout, makes me skeptical. People who write good code have
no fear of having it independently checked, and supply open source code in a
form that can be compiled.

Again: don't confuse a printout with source code that can be directly compiled.

In at least one case I've read about, really dedicated people have taken a
printout of source code and turned it into a compilable code file - but that
wasn't easy, took lots of time and effort, and the possibility of typos was
always present.

Merely supplying a printout, which in that form is unverifiable, is no way to
generate trust. But in the case of voting machines, the manufacturers are
generally more interested in protecting proprietary software than in generating
trust. They leave the latter to the politicians, who with nebulous claims of
"security" attempt to allay justified concern. The fact that they don't know
what they're talking about only surfaces later, after people like those in the
Chaos Computer Club definitely prove the systems are NOT secure. And even then,
manufacturers and politicians do their best to claim otherwise. Luckily, not
everyone believes them.

Cheers, Bob

--- GoldED+/W32 1.1.5-0613
 * Origin: Jabberwocky System - 02363-56073 ISDN/V34 (2:2448/44)