The State should demand a checksum of a compiled binary from the code they have, and then compare it with what is on the machines.

I'll lay odds ES&S gave code that had been scrubbed, and does not represent the source for the actual deployed binaries.

It would be smarter to use the makefile and compile the source themselves, then generate checksums.

All they have to do is to compile the source and check if the result matches the binaries. Or the government could opt to always install from sources. (this is what some european government agencies are doing and they also proofread the sourcecode to see if it contains any problems, it's quite doable and you could just diff the updates into the trusted tree)

long candidateA=0;

long candidateB=0;

....etc.

int main(int argc, char*[] argv)

{

while(true)

{

char c = getc();

if(c == "A")

candidateA = candidateA + 1;

......etc...

}

}

One really must wonder what all the fuss is about.

Perhaps that is the problem. ES&S handing over code on one sheet of A4 and an invoice for millions wouldent look very good.

Also, WTF are the doing even using a company that is being difficult about handing over sorce code. It should all be in the pubic domain to enshaw transparency. How do we know, without seeing the source code, that there isent, say, code to add more votes for a particular candidate (E.G. Changing every 1000th Repulican vote to Democrate?) Not good of them.

Poor little things, they are unhappy about needing to prove that their software is good enough to ensure democracy.

I feel for them, I really do. I feel that they should all be sent to Abu Graib and discover first-hand what happens when democracy goes wrong.

Maybe when (if?) they come back they'll be more than happy to make sure their code is good enough by allowing public audit.

Depending on what the real goal is you could say that everything is just fine.

It's just working dandy if you want to deliver a system that has unaccountable hack-ability and deliberate vote control so it can be used to rig an election. Not to be content with a political monopoly in the US they would like to have some control of what is left of democracy.

The software shouldn't have the slightest propriatary association with it. The US being turned into one huge service based economy asside, the only thing propriatary for ES&S should the be equipment alone. Everyone should be able to look at the code going into box. No binaries, no libraries, no OS structure. For crying out load this thing shouldn't be any more advanced than a calculator with memory function and paper tape--for audit trail--that's it. To justify the billions being poured into hiring engineering staff for simple jobs, like all American products, even the most simplest concept is overengineered into a complex juggernaught of mostly nifty but useless features.

GPL the code and checksum the resulting program at the start and end of the election. End of story.

If the state is going to go through the trouble of compiling the code, why not install it themselves?