HackerThe machine says it passed. Who can check?
Follow a ballot into a voting machine, then follow a read request across a motherboard. At each step ask what was examined, who delivered the answer and whether someone else can inspect the same evidence.
Questions in this reading · 12
- From reviewed code to the machine in the booth
- Why would a clean flash chip miss the implant?
- Where does a reinstall begin?
- One purchase, two accounts of success
- What sort of consent can a signature establish?
- Which check did a correct number pass?
- Should a toaster sense itself or the bread?
- Who can repeat the check behind a photograph or a match?
- What did the boot logo actually check?
- Where can an independent check put its probe?
- Can trust in a contributor replace checking a change?
- The checking tool can inherit the same mistake
From reviewed code to the machine in the booth
Suppose both parties reviewed the source code and the expected checksum is posted by the booth. Scott asks what a voter learns if the machine itself reads the program, computes the hash and prints the answer. Could the voter distinguish that procedure from a machine that simply displayed the string on the poster? Huang follows a similar gap into fabrication. A design file and the chip delivered to the buyer are two different objects. Reviewing the file leaves the buyer with a question about the specimen in hand.
Passages and timestamps · 3
what's actually loaded on that voting machineyou have to trust the software that's checking that hash.you can't hash hardware.Why would a clean flash chip miss the implant?
Hudson places a device between flash storage and the component reading it. Remove the flash and its contents can look fine. Put it back and the bytes travel along another path. Rutkowska comes at this from the opposite end: if the motherboard itself is suspect, starting a minimal system on it to query the firmware still routes the answer through that board. Mark the probe on a diagram before comparing two reads. Both may appear to check “the firmware” while observing different places. Hudson explicitly leaves open whether the incident described in a news report actually happened.
Passages and timestamps · 3
because it's outside of the ROM chip.I will not get reliable answers.So did it happen? I don't know.Where does a reinstall begin?
Wiping a disk and reinstalling the OS removes programs left on that disk. Rutkowska asks for an inventory of every other place where state can survive a restart. On the platform investigated by the AMD researchers, the Secure Processor already executes code before the x86 cores start. A check performed by the later OS must account for that earlier execution. The demonstration also required physical access. Before transferring its conclusion to your own deployment, identify who can actually reach the device.
Passages and timestamps · 3
So you reinstall the OS, but the malware still can re-infect.executing code even before the x86 cores have executed anything.everything we did requires physical access to the device.One purchase, two accounts of success
In Anderson’s demonstration, an intermediary tells the terminal that the card accepted a PIN while telling the card this is a signature transaction. A receipt saying “success” discards the distinction. Rewrite the audit record as two complete statements: which party confirmed which amount, using what verification method? If the terms differ, two devices reaching the end of their local procedures still leave the customer’s authorization unaccounted for.
Passages and timestamps · 2
the pin was accepted by the cardthat it was a chip and signature transactionWhat sort of consent can a signature establish?
In Olson’s example a deceived holder really did sign, and consensus accepted the transfer. The holder may then ask a marketplace to delist the token. Write two operations on separate lines: register a transfer, and allow a listing. They have different decision makers and accept different evidence on appeal. Before a product tells a reader that ownership was verified, ask which line that reader will think was checked.
Passages and timestamps · 2
transactions followed the rules of the software.delisting stolen tokens.Which check did a correct number pass?
Grey describes institutions using a Social Security number to locate a record and treating knowledge of the number as a credential. A form with the right number can identify the record while leaving open who handed it over. Compare Olson’s example of a signed token transfer. The next person needs to know whether the system checked a number, a signature, or authorization from the individual involved.
Passages and timestamps · 3
a card with a unique number that many places will ask for to prove who you are.ask for the last four digits as a code to identify you as youtransactions followed the rules of the software.Should a toaster sense itself or the bread?
A second slice enters an already-hot toaster. A timer counts seconds while a thermostat aimed at the bread can respond to the food itself. A windshield rain sensor likewise observes an optical consequence of wet glass. For each design, name conditions under which a functioning sensor could report a signal that diverges from the state you care about.
Passages and timestamps · 4
Having the thermostat react to the surface temperature of the breadIt not only compensates for a hot toaster, but for cold bread.it leverages the effect of total internal reflection.Wet glass will allow some of the light produced by the LEDs to actually escapeWho can repeat the check behind a photograph or a match?
The cloning documentary recounts numbers of eggs and cell lines claimed at the time. Public photographs travel easily; connecting a cell line to a donor needs source material others can check. In Galef’s handwriting story, another sample changes the comparison itself. Preserve both the independently accessible object and a plausible competing match when designing a verification step.
Passages and timestamps · 4
professional photographers.This new paper used just 185 eggs, and made 11 stem cell lines.they compared Dreyfus's handwriting to that on the memoMuch closer than Dreyfus's handwriting.What did the boot logo actually check?
Steil explains that the Game Boy displays a logo read from the cartridge and also compares that pattern. An apparent branding screen has a concrete input check behind it. Contrast the uniform in Abagnale’s account: a person can recognize the clothing, and a supplier can request an employee number. In both examples ask where the reference for comparison comes from. Reproducing a pattern, supplying a number and obtaining independent confirmation are distinct conditions. Abagnale’s source here is his account in the talk.
Passages and timestamps · 4
It compares the logo because the game has to have a copy of that Nintendo logo inside.that logo, though, is actually presented from the cartridge.I certainly looked old enough to be the pilotPut your employee number.Where can an independent check put its probe?
The firmware examples ask which path a check actually observes. Restoring the Apollo computer turns that question into a physical procedure. Most modules in this development unit are unpotted, so the team can locate pins from schematics, vary inputs and inspect each NOR gate’s output. Where surrounding connections prevent an isolated test, they probe intermediate states. The additional evidence comes from accessible electrical signals, rather than a machine’s own declaration that it is healthy. The scope still matters. Gates switching correctly in one module does not establish that memory, interfaces and mission software work together. The sealed memory makes that boundary tangible.
Passages and timestamps · 2
we can get right in and check the signals on the chipsee every nor gate function with every inputCan trust in a contributor replace checking a change?
Independent checking depends not only on access to a machine but also on whether someone still examines changes. In an explicitly fictional scenario, Kamp describes a longstanding contributor earning direct commit access while familiarity reduces scrutiny. The useful element is that possible failure path, not the satire’s named organizations or operations as factual evidence. Compared with physical probing, two conditions emerge: a system must expose observable evidence, and a team must retain a process that actually examines it. When reading an audit, ask both whether a checking mechanism exists and which changes passed through it. This does not make every contributor untrustworthy or establish that any particular real project was compromised.
Passages and timestamps · 2
you should imagine a junior NSA stafferpeople will start to trust you and not check your patchesThe checking tool can inherit the same mistake
Domas does not first assume that disassembly is processor behavior. He executes candidate inputs, observes decoding length and exceptions, then compares those observations with a disassembler. The two kinds of evidence can disagree. Disagreement does not yet identify a hardware fault: the tool acting as a reference can have bugs, including assumptions shared by several tools. Independent checking therefore requires more than counting checkers; trace whether their grounds for judgment are actually different. Outputs derived from the same manual or architectural assumption are not automatically independent confirmations. The talk offers a way to discover discrepancies; interpreting them still requires the particular chip, execution environment and manual analysis.
Passages and timestamps · 2
I just used a disassembler as my ground truthall of them were absolutely littered with bugsTry it on your own example
Take a “verified” message you see every day. Hand someone else the record. What can they check for themselves? If they can only ask the same machine for a second answer, name one independent observation they could make.