[quote user="Alex Papadimoulis"]
[quote user="asuffield"]Diebold is a WTF job because they build an election system on Access - heck, because they use Access at all. [/quote]
So let me get this straight - a company uses {insert product that you think is stupid here} and they're an instant WTF? I use Access for several things around here - it's a great tool and gets the job done - I guess that makes my company a WTF? Every company I've ever worked for has used several Access databases. WTFs, too, eh?
[/quote]
Alex,
(I'm the OP) I had a huge response written, but my PC ate it when I rebooted due to a malfunctioning TightVNC. But the main point you're not getting: we're not complaining about the use of Access per-se; we're complaining about the use of Access in something as vital as an election system.
Alex, would you trust your bank account to an ATM written with Access? How about a pacemaker - if someone figured out a way to shoehorn an Access runtime into a pacemaker, would you let doctors install it so that it could control your heart? If so, then your arguments are completely valid here. But I suspect you know that Access is nowhere near acceptable for such mission-critical work. The outcome of elections have direct impacts on many millions of lives, not just one - so it's that much more important that elections have software that runs properly. I'd argue that election software is just as important as pacemaker software, and much more important than the ATM software (that Diebold actually seems to be good at writing).
I'm not sure what your background is, but I would guess that it isn't security. You mentioned that, after having read the Diebold reports and their rebuttals, you agreed with Diebold in that the Princeton study was unrealistic. This doesn't matter - someone who thinks about security ought to be paranoid, as many of us who work in large corporations with excellent security and network admins know. As history has proven over and over again, nothing is unrealistic when it comes to people wanting to steal elections.
I disagree with your assertion that paper ballot voting is equally as secure, or less secure, than the Diebold systems. If someone with an offset printer and an axe to grind wants to throw an election, that person needs to get an official ballot box, AND print up ballots, AND mark on each of those ballots by hand the candidate he wants (because during a recount they'd notice that the vote-marks did not indent the paper), AND figure out a way to make the number of ballots match the people who voted in that precinct on that day, AND find some way to break in and replace the real ballot box with his. If you want to throw an election on a national scale, you need to repeat this process with lots of guys.
On the other hand, if your precinct uses the Diebold system, all you need to do is break into the polling place before the election and budget about 30 seconds per system to insert your own vote-throwing, log-covering-up code. Heck, many polling places are in schools; so you just hire a highschooler to do the same. The total time invested is much, much smaller, as is the ease with which you can do this. (One of the election-day news stories from central Ohio was that a school housing voting machines had been broken into. They said that there was no evidence of vote machine tampering, but because Diebold machines are so easy to get into there is no way to say this with certainty.)
If anything, an electronic voting machine should consist of an embedded computer with a very small OS (or preferably no OS) and the software certified and burned into ROM, so that there is absolutely no way to tamper with it.