Hard agree... It's sheer madness.

There's two huge problems though. Requirements for voting machines are created by people who don't understand technology, which means we have a ton of arbitrary rules for how they work. Likely largely written by voting machine manufacturers trying to create barriers of entry

Second... There's programmers who write really good code, and there's programmers who think flawless code is possible for humans. There's no overlap.

If you encounter a programmer who thinks they can write flawless code, they've never released anything to the public.

The thing is, humans cannot handle the full problem space of anything more useful than a calculator. The being that can do that is to a human as we are to a cicada.

We envision how it will work, we test it with that bias, and we hand it to someone who sees the world very differently and they instantly break it.

I don't know why I keep coming across this opinion on lemmy lately... But let's use the example of key crypto libraries, I think it's just about the best example you could give.

I agree, they're pretty damn rock solid. They're based on math, with pre designed inputs and outputs. We trust it so much that the first thing we tell a programmer that needs to encrypt something "NEVER roll your own". The entire world is based around it, we trust everything to it.

Pick a crypto library and look at their security patches. They've been broken mathematically, they've been broken due to typos, they've been broken due to hardware interactions or assumptions about the amount of computing power we think will be feasible in the next decade.

We know they're defeatable.

The reason why we trust them so much isn't because they're flawless, it's because they're constantly under a spotlight. There's a lot of money and reputation to be gained across several fields just devoted to this one issue.

We trust them, because we can't do better.

Voting machine software is terrible, and we could do much better - simplification of requirements, parallel implementations from isolated teams looking for discrepancies, standardizing the requirements (worldwide even), review by unrelated subject matter experts... Hell, we should be using them for everything from grade school elections to stockholder votes, and posting huge bug bounties. They should be open source from top to bottom - the second rule of security is "security through obscurity is obfuscation, and obfuscation isn't security"

There's a ton we could do to make it better, but most every bug is a wild edge case - the recent investigation results in Virginia suggest it works correctly more than 99.9991% of the time. Let's call it 99.99% to account for anything undiscovered

There's no way a new project does better than that - this was human error due to being confused over the district borders... New software isn't going to fix that

The only way to get down to single digit margin of errors is to deploy it widely and frequently, add in more redundancy, and patch the crazy edge cases as they come up.

And most importantly, we need to simplify the problem and look at the human elements

Redundancy and mitigation is all there is.

Fun fact, we discovered that cosmic rays flip bits at a predictable rate on every modern computer because of a voting machine showing impossible results... We can mitigate even that with redundancy and error checks, but the only way to approach perfection is to reduce single points of failure and learn by proactively looking for the holes to patch