Re: Request 2 CVE-IDs for Zeus Voting System

[DaKnOb <daknob.mac () gmail com>]

Thank you for your interest, replies inline. 

Antonios A. Chariton

> On 14 Μαΐ 2015, at 10:13, Henri Salo <henri () nerv fi> wrote:
>
> > On Wed, May 13, 2015 at 07:09:49PM +0300, DaKnOb wrote:
> > Zeus (https://github.com/grnet/zeus) is a fork of Helios that is actively
> > developed by GRNET (http://www.grnet.gr/) and is considered to be used in
> > Greek Elections (starts with small and rolls out to larger elections).
>
> Really? They are seriously considering open source application in the elections?

Yes, the prime minister rejected the software but their argument is that it's open source and anyone can verify the 
code. 

> Is there english news about this?

I will try to find some. So far the software was used in the university elections (across Greece for important 
decisions, within universities for dean / ...)

> Have they ordered or requested real security
> audits for this product?

Of course not, their argument is that "It is mathematically proven that nobody can alter the votes" yet they forget the 
huge stack from processor errors all the way up to code errors (as I have proved to exist).

> Do you know if there is official contact person who I
> could give my (free) services to get this codebase secured.

I believe in the website https://zeus.grnet.gr/ there are emails but since it's Open Source and you offer your services 
for free, I believe it is a lot better if you do this on GitHub repo because:

1. Everybody can see that you have contributed to this.
2. Everybody can see your findings and do not use this software unless all bugs are closed. 
3. They are easily trackable and assignable to their developers. 
4. If they don't do it, people can fork the code and use your opened issues to make a secure copy of it.
5. [...]

> I have some
> resources from our company, which I probably can assign to audit this for a few
> days.

I believe that would be great!

> -- 
> Henri Salo