fisadev

> This is the "broken windows" effect in real life.

Had to point this out: windows are real, the broken windows effect is something from "real life".

If you read the comments on the article you will understand those tweets.

> "I don't understand why I am to give her my money."

Maybe because you are a good human being who wants to help another human being in need?

> "Why particularly her, what about the rest of customer reps at Yelp"

She's asking for help because she needs it, as much as the rest. She isn't telling you that you shouldn't help the others. She is even proposing things that would benefit all of them.

If you can help them all, great! If you can help just one, help one, either she, or any of the others. Nobody here is telling you "you should help her instead". Not even her.

And "if I help one I'm not helping the others" is no excuse to not to help anyone. Not being able to help them all is no excuse to not to help at least somebody.

Harry Potter and the Methods of Rationality. Don't know if "great", but quite interesting and fun free book at hpmor.com

s/where/were/g :)

No, because it's not a website with a network between the backend and frontend. It's a desktop app, with no network connection, just using html for the gui. Nobody can send packages to it.

1) Here you make a lot of false statements, and then conclude on the lack of security based on them. So let me answer to each of them:

> they don't even use SSL in their site logins.

Which sites? The only one I can think of having a login is the transmission site, and it not only uses SSL, it even has two way certs validation, so even the client has to have valid SSL certs which the server validates.

> You use md5 to check firmware

No. They use SHA256, not MD5, and to check the CD software, not firmware (there is no way you can checksum a firmware securely if the firmware wants to lie to you).

> and the coders are obviously capable of using proper cryptography, but they won't

Yes, they use encryption, where it makes sense, like the double SSL in transmission.

But I guess you are referring to the unencrypted chip data. It would be useless to encrypt that. Think for a second: the machine needs to be able to read that chip on the counting step. So you are distributing the unencryption keys in hundreeds of public CDs that very same day. Having the data on the chips encrypted would accomplish nothing, they keys to unencrypt them would be public. It's like puting a padlock in your bike, but leaving the key along the padlock.

So no, nobody has given up on security, you just probably have read misleading things.

2) Again, several wrong things, will answer separatedly:

> why not a qr-code? it's hard to read?

This is the only one I can't answer with full knowledge, but I think it had something to do with them being hard to read because of the quality of the print (thermical fast printing)

> they can be unlocked, re-written

No, they can't. It's a physical process that burns and cuts connections on the chip, you can't "rebuild" them to unlock it again.

The thing you probably saw was people rewriting demo ballots, which are created with the machine configured in demo mode, in which it doesn't burn the chips, to be able to reuse the same in several demos. The people claiming that even published photos of the supposed "real" ballots they where rewritting, and the ballots had in really big letters crossing all the print, the text "DEMOSTRACION USO NO OFICIAL". So, no, they weren't rewriting real ballots, it's obvious those where demo ones.

> with a weird faraday cage that do not work correctly

Reallity doesn't agree with you, hehe. Even people opposing the system had tried and weren't able to read the chips through the shield. It's simply a shield which has enough mass to absorb the signal that the chip emits.

Ex-developer of that system here (not working in MSA anymore since 3 years ago). Can answer questions if there aren't hundreds of them.

> Its killer feature is that the same code can run on the client and the server.

In most cases that's not even completely true. Try to run in the browser anything with a node require... That's why we have to use ugly hacks like browserify :/ (not meant to bash browserify, it's really useful. The ugly thing is having to bundle 10s of thousands of javascript lines of multiple packages in a single file)

Also know Lindybeige and Skall, but Tim and Metatron are new to me. I'll watch them later, thanks for the data!

Let me guess: you are also addicted to Matt Easton videos :)

Not sure about him, but pretty sure he already did more for humanity than Obama when he received the award. (disclaimer: south american here)