[<prev] [next>] [day] [month] [year] [list]
Message-Id: <8F31836E-B883-469C-A4D4-54A1C91DA217@gmail.com>
Date: Thu, 14 May 2015 10:39:42 +0300
From: DaKnOb <daknob.mac@...il.com>
To: Henri Salo <henri@...v.fi>
Cc: OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: Request 2 CVE-IDs for Zeus Voting System
Thank you for your interest, replies inline.
Antonios A. Chariton
> On 14 Μαΐ 2015, at 10:13, Henri Salo <henri@...v.fi> wrote:
>
>> On Wed, May 13, 2015 at 07:09:49PM +0300, DaKnOb wrote:
>> Zeus (https://github.com/grnet/zeus) is a fork of Helios that is actively
>> developed by GRNET (http://www.grnet.gr/) and is considered to be used in
>> Greek Elections (starts with small and rolls out to larger elections).
>
> Really? They are seriously considering open source application in the elections?
Yes, the prime minister rejected the software but their argument is that it's open source and anyone can verify the code.
> Is there english news about this?
I will try to find some. So far the software was used in the university elections (across Greece for important decisions, within universities for dean / ...)
> Have they ordered or requested real security
> audits for this product?
Of course not, their argument is that "It is mathematically proven that nobody can alter the votes" yet they forget the huge stack from processor errors all the way up to code errors (as I have proved to exist).
> Do you know if there is official contact person who I
> could give my (free) services to get this codebase secured.
I believe in the website https://zeus.grnet.gr/ there are emails but since it's Open Source and you offer your services for free, I believe it is a lot better if you do this on GitHub repo because:
1. Everybody can see that you have contributed to this.
2. Everybody can see your findings and do not use this software unless all bugs are closed.
3. They are easily trackable and assignable to their developers.
4. If they don't do it, people can fork the code and use your opened issues to make a secure copy of it.
5. [...]
> I have some
> resources from our company, which I probably can assign to audit this for a few
> days.
I believe that would be great!
>
> --
> Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
