HNHacker News
TopNewBestAskShowJobs

drewmol

993 karma · joined September 29, 2016

submissionscomments
drewmol··on Security analysis of the Dominion ImageCast X
I agree plausible deniability may guard against political coercion, but only when all votes are anonymous - that is not the case. The ability to vote in private should be a protected right in a democratic society.

I’m referring to citizens being allowed to confirm their ballot on record, verifiably, and publicly if they so choose. It’s already completely legal to share filled out ballot photographs in 30 states…(in 5 of them only photos of mail-in ballots allowed)[0].

I hope my state modifies it’s laws to allow this, currently it’s outlawed - as it is in Georgia. One commentator suggested members of the public would manually validate some of the ballot QR codes and easily detect fraud, but Georgia outlaws it - I think that’s bad law. In spite of this variation on how “secret ballots” are implemented by member states, US is still a democracy, which you seem to agree.

There is a balance that has to be struck between election transparency and voting secrecy. Where I live, all recording of any ballot and in any polling location is outlawed. I think the only recording that should be illegal is that of other peoples ballots - as where and when you voted is already of public record, and I think one should be free to share their own ballot however they choose.

[0]https://www.businessinsider.com/can-i-post-photo-of-my-ballo...

drewmol··on Security analysis of the Dominion ImageCast X
What’s the implication being made, is it that Dominion won? As far as I’m aware: Fact: the machines are flawed Fact: Judge ruled Fox had made false statements which harmed Dominion, sent Fox’s level of culpability to be weighed by the jury but the case was settled before deliberations.
drewmol··on Security analysis of the Dominion ImageCast X
I’m not ready to abandon representative democracy, but I agree technological advances have made a more direct democracy system sound feasible. I’m in the US where the design rules stated congressional representatives were never to exceed a 35,000:1 ratio, but the representatives removed that rule.
drewmol··on Security analysis of the Dominion ImageCast X
On your last point, if you voted and in which elections is already public record. Government has a pretty good idea who you voted for and can and already does this to the extent they can get away with it.

>You can’t have a democracy without secret voting

You could before 1890 in the US, and plenty of other countries, what’s changed?

About 25 percent of voters voted by mail in the 2020 election. Mandatory secrecy that couldn’t be enforced for a quarter of voters didn’t ruin our democracy. I’m not sure secrecy should be mandatory, maybe it should be optional.

drewmol··on Security analysis of the Dominion ImageCast X
What’s MITRE?
drewmol··on Security analysis of the Dominion ImageCast X
I don’t think it would be legal to do that (record). EDIT: It’s illegal, GA 21-2-413. I’m not sure how the validation works, but I assume that there is an identifier in the QR code, and it likely doesn’t have plaintext candidate names so I’m not sure if you could even validate the QR code with available data, but it would most certainly be a crime.

The scenario they exposed as possible is : voter receives a printout paper ballot with the vote selection printed correctly in text, but the included QR code has modified selection(s). That paper is then fed into the reader/scanner/tabulation machine. No further confirmation.

The whole point of the printout is for voters to confirm their selections, the whole QR code step is a design flaw. Just print regular ballots with filled in circles that can go through a standard tabulation machine and still be read/checked by humans if you really need to add a (required) touchscreen interface to the process.

“If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.”

It seems very unlikely that lots of votes getting changed would get noticed to me. Maybe I have a misunderstanding of the process. An RLA would help, but Georgia has had difficulty in conducting audits due to incompetence of officials and people not following process rules, QR codes seem like unnecessary complexity.

drewmol··on Security analysis of the Dominion ImageCast X
It would seem that root access to the ICX BMD’s running android 5.1.1 would provide sufficient privileges to cover one tracks, I’d assume state level attackers would have the required knowledge to do so.
drewmol··on Security analysis of the Dominion ImageCast X
Are you open to eliminating the secret ballot? I would be, I think the verifiably and integrity of election results would be greatly improved by making voting records public, I see no easy way to do the same while maintaining ballot secrecy. I’m open to the possibility there is a good transparent secret ballot system, but I haven’t heard of one that isn’t massively vulnerable to the possibility of fraudulent efforts by election administration officials.
drewmol··on Security analysis of the Dominion ImageCast X
The section titled “Isn’t there a paper trail? Why is malware a risk?” explains a bit about this. The printout is read by QR code so it’s possible to list the correct selections but modify the QR code that gets read. It also addresses the percentage of voters who verify and how thoroughly (it’s not many).

“If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.”

Also it’s a poor decision by Georgia to not install security updates until after next election, but that’s the state’s position currently. I watched some of the Georgia congressional hearings regarding election security, audits, and safe guards after the 2020 election and it seems like their board of election was a total shit show. It seems like paper ballots and counting could prevent all of the problems or alleged problems they experienced in the last two major elections.

drewmol··on Reddit CEO doubles down on attack on Apollo developer in drama-filled AMA
Fwiw, if you get a call from a debt collector and would prefer not to speak to them, tell them the call will be recorded and ask for their permission. It’s been some time since I’ve had this happen but I’ve been 6 for 6 on them not giving permission and the conversation ending. (Yes, even after I consented to them recording the call)
drewmol··on Mark Zuckerberg on Apple’s Vision Pro headset
Agreed. But there are much fewer people who pay for pornhub. Fewer who would buy a $3500 device just for a more immersive pornhub experience. I highly doubt these people are in apple’s target market.
drewmol··on Flipper Zero Self Destructs an Electricity Smart Meter
Even if the designers valued tamper-resistance and/or direct control of the device over broad durability and/or protection against intentional vandalism? It seems burn out after being switched on and off repeatedly under load may be an acceptable failure mode in this type of device.
drewmol··on Flipper Zero Self Destructs an Electricity Smart Meter
The expense of your desk motor burning out has a cap though. The expense of a utility controlling device not shutting off after intentionally being stressed/hacked is potentially very high and may require human intervention to detect, maybe they decided it’s better if the device fails under this type of abuse which will bring humans into the loop to detect the problem.
drewmol··on Flipper Zero Self Destructs an Electricity Smart Meter
One could argue the ability control power under load is a safety feature. What if they hardened the wireless attack surface and added a manual safety switch which could also be used to intentionally brake the device, would that be better? I don’t think it would. I really don’t think the device needs to be stupid proof at the expense of the ability to be directly controlled by not-stupid persons and above.
drewmol··on Mark Zuckerberg on Apple’s Vision Pro headset
Explode?!? Do you think people who don’t already pay for porn/sexual IOT devices/digital sexual pleasure content will start to enter this emerging market? Do you think the same customer base will drastically increase spending?

- I’m genuinely curious and surprised by the confidence.

drewmol··on Is there a wider internet outage today?
I’ve come to love powerline adapters when expanding Wi-Fi coverage just in case you haven’t looked into them. Speeds of the latest adapters are up to 2.4Gbps!
drewmol··on Automatic emergency braking should become mandatory, feds say
That’s what a disabling trigger on the steering wheel would be for, one of the reasons at least. There may be situations where I want to ensure it is off, such as in an environment where it has often detected false positives in the past.
drewmol··on Judge rules Wyoming corner crossers did not trespass
Mostly from railroad land grants in the late 1800’s. Land along routes was checkerboard divided, odd lots stayed feds, even went to railroad companies.
drewmol··on Automatic emergency braking should become mandatory, feds say
An eye tracking feature would be nice if incorporated into the AEB where it could be set to only activate if I’m not looking at the road in front of me. This plus have a disabling trigger on the steering wheel and auto disabled if you punch the gas from a stop. Uhhg… just imagine someone pointing a gun at you from the front of your car to carjack you, you duck while stepping on the gas - only for your tires to squeal and not go anywhere!
drewmol··on Judge rules Wyoming corner crossers did not trespass
An offer of compensatory acreage adjacent to and redraw of property lines may entice support.
drewmol··on Judge rules Wyoming corner crossers did not trespass
Yes a public access easement should suffice, similar to how beaches are defied in some areas, waterways usually are. But how big is reasonable? Is it for vehicle access and/or larger equipment or only human sized objects?
drewmol··on Killer whales wreck boat in latest attack off Spain
I always found this story[1] of orcas helping whalers pull whales by biting the harpoon ropes with their teeth truly fascinating.

[1] https://www.australiangeographic.com.au/topics/history-cultu...

drewmol··on Killer whales wreck boat in latest attack off Spain
It seems that they are building artificial reefs.
drewmol··on Killer whales wreck boat in latest attack off Spain
I wonder if it has to do with the sails. Reflection is annoying to their hunting? Illuminating areas or providing shadow cover to their prey somehow?
drewmol··on Killer whales wreck boat in latest attack off Spain
I was recently thinking about the potential failure modes of a worldwide sailing trip on a 60-80 ft vessel. Marooned by Orcas was not on the list… but it is now!
drewmol··on Ask Wirecutter: Can you recommend a not-smart TV for me?
Very tangential, but this reminded me of a much more obscene [0] Wi-Fi name controversy.

https://gothamist.com/news/park-slope-childrens-salon-trolle...

drewmol··on We need to tell people ChatGPT will lie to them, not debate linguistics
What are your thoughts on something like this [0], where ChatGPT is accused of delivering allegations of impropriety or criminal behavior citing seemingly non existent sources?

https://www.washingtonpost.com/technology/2023/04/05/chatgpt...

drewmol··on Image obtained with high-speed camera shows how lightning rods work
Interesting. While in high school, a friend and I sailed his boat to the Lake Erie islands for the weekend. On our return trip a storm came up on us very quickly, we headed for the closest harbor but got caught in the thick of it anyways. I saw a lightning bolt hit the water 6 feet in front of me and split in two to hit two massive boulders in the river bed, the whole river illuminated for a second during the strike, coolest and scariest moment of my life.
drewmol··on With ships, birds find an easier way to travel
I’d assume they do (get in the way) but I don’t have confirmation. A mile is 5 thousand 200 and eighty feet.

When I visualize the bird’s experience, I would hesitate to cross the Atlantic.

drewmol··on With ships, birds find an easier way to travel
For those wondering, some of these birds can fly over 5 miles high. From 5 miles above sea level, the distance to horizon is 200 miles. From 5 miles high, you could see the tip of mount Everest above the horizon from 410 miles. Great snipes can fly thousands of miles in one continuous 60-90 hour flight.

https://www.inverse.com/science/migratory-birds-flying-ocean

https://www.omnicalculator.com/physics/earth-curvature

← PreviousPage 2 of 22Next →