Electronic Voting

Hobart

Bonkey. People who purchase MS Exchange as an apllication probably have no idea that the Jet engine is used as a background engine. If they did they would not purchase it. It is a bad Enterprise DB application. Good for sompililing mailging shots and creating labels, but a totally useless high-end DB application, when compared to Sybase, Oracle, Interbase and the like. Fact is that any DB manager or IT manager worth his salt would ran a million miles from MS Access as the basis for a mission critical system, never mind its' use as the calculator for the votes of the populous.

The fact that it's DB "engine" is hidden or used in a enterprise application is beside the point and I think its' choice as the "mission critical" system is totally unforgiveable.

bonkey

Originally posted by Hobart
People who purchase MS Exchange as an apllication probably have no idea that the Jet engine is used as a background engine.

Indeed, surely that lack of knowledge is testament to the fact that its not as flaky as you suggest. After all, if it was that flaky, people would want to know why, and tell others why.

I mean, if it was as flaky as you suggest, wouldn't everyone be moving off it once they discovered it was flaky even if they didn't know why? They aren't....people are not flocking away from Exchange, and those that do leave it in my experience are generally doing so for reasons other than data-corruption.

If they did they would not purchase it.

Right. But they have purchased it, and are happy enough with it that huge numbers of them upgrade to the next version every time its released, and enough of them stick with it to make it the no.1 mail server in (as an example) Fortune500 companies, Fortune1000 companies, and so on.

If it was as crap as you're suggesting, then surely it would cause enough problems that they'd move off it, even if they were too stupid to be able to find out why it was so crap.

It is a bad Enterprise DB application.

So thats why so many Fortune 500 companies and other massively successful enterprises have been using it for years.....because its bad. Thanks for clearing that up.

Fact is that any DB manager or IT manager worth his salt would ran a million miles from MS Access as the basis for a mission critical system, never mind its' use as the calculator for the votes of the populous.

Thats all well and good to say, but the simple truth is that Access and the Jet engine are used in so many mission-critical applications on a regular basis without causing problems that your insistence that its crap and no-one worth their salt uses it just doesn't hold up....unless what you're really meaning is "anyone who doesn't do what I think is right isn't worth their salt".

But it not just Exchange. No, no. Do a google search on "Microsoft Active Directory Jet Engine". Goodness, whats that? The entire backbone of the Windows 2000 (and newer) networking system is also reliant on a Jet engine? Say it isn't so.

Surely that can't be possible. Surely that means that anyone who uses a current Microsoft network is also clearly not worth their salt and risking their entire system on something incredibly flaky and unreliable.

So where are all the horror stories, I ask? Why are there so relatively few big news stories about people moving away from MS because its security and networking backbone is so unreliable and crap because of being based on a dodgy database engine????? Could it possibly because the database engine isn't all that crap and unreliable? Why do we not hear of all these big companies moving back to NT4's domain model or completely off the MS path entirely because the ADS is so unreliable????

Why don't we hear it? Because its not happening. Why isn't it happening? Because the ADS is actually pretty damned stable, and what bugs it has are generally not related to data-storage.

So, we now have two of the most mission-critical aspects of MS' arsenal dependant on the engine that you say no-one worth their salt would use....and yet ADS and Exchange are used in so many places, by so many successful companies, with so relatively few database-related problems that it would seem to undermine your statement.

Or can you show that ADS and Exchange have hopelessly unreliable data-storage systems???

The simple fact that these two systems are not universally considered unstable because of the problems that JET causes them is testament to the fact that Jet is actually not all that bad. There are certain things it does well, much and all as it may gall some to admit.

The fact that it's DB "engine" is hidden or used in a enterprise application is beside the point and I think its' choice as the "mission critical" system is totally unforgiveable.

Its your personal entitlement to think that, but I can assure you that it is far from beside the point.

If the "hidden" DB was crap in these systems, then these systems would be notorious for unreliable data-storage. They aren't. Thats hardly beside the point - it is the point.


You can continue to insist that its crap, and you're completely entitled to believe that too.

I'm simply pointing out that the Jet engine is used in some of the most widely-implemented mission-critical systems around the world and while it is not perfect (what software is), it is by no means something which is considered unacceptably unstable when used in the right way.

The simple fact is that as a standalone database, (where it does not have to support more than a single connection process) the Jet Engine is actually pretty solid....and if you look at the design of the system in question, you will see that the database is not required to support multiple concurrent processes. Thats why its also a suitable back-end for ADS and Exchange - because once you cut out concurrency, its pretty damned solid and performant.

You mightn't agree, but like I said - thats your perogative. I am simply pointing out that there is a completely seperate side of the argument about how bad a choice Access may be that most people who consider themselves tech-savvy are completely unaware of.

There are plenty of reasons to criticise the system favoured by the Irish government. Maligning Access to be worse than it has been proven to be in the type of environment (i.e. non-concurrent or single-connection) that it will be used in is simply not one of the better ones in my opinion.

jc

Victor

Originally posted by ReefBreak
France, for example?

I think they are only thinking about it, it still takes them weeks to run an election, because they use FPTP rounds rather than PR-STV (much the same thing except theirs involves voting several times).

Hobart

Don't try to muddy the waters bonkey. MS Exchange is not an Enterprise Database Management system. What I am saying, and what I will continue to say is that in my 8 years designing, implementing, testing and deploying RDBMS I have never come across anybody who uses, has used or ever intends to Microsoft Access in a "Mission Critical" system. Of those Fortune 500/1000 companies you quote. How many use "Microsoft Access" as a mission critical datbase system, or MS Exchange for that matter?

bonkey

Originally posted by Hobart
Don't try to muddy the waters bonkey. MS Exchange is not an Enterprise Database Management system.

The Vote-Counting operation is not an Enterprise-level operation itself, so who's muddying waters here. It does not need to support more than a single process, which would make it equivalent to a single-user system, not an enterprise-level one...

So, if anything, the entire Enterprise-level criticism is whats doing the muddying. I'm just trying to shift through that mud and explain what bits are relevant and why, when you look at those relevant bits, Access is not as bad a choice as you are alleging, as my examples show it is used in systems the world over which demand high volume and high reliability and high availability.

What I am saying, and what I will continue to say is that in my 8 years designing, implementing, testing and deploying RDBMS I have never come across anybody who uses, has used or ever intends to Microsoft Access in a "Mission Critical" system.

And I'm saying that if you have ever used ADS or Exchance, then that assertion is misleading. Whether or not you were aware of it, a Jet database was used in those systems.

What you probably mean is that you have never met anyone who designs mission critical systems which depend on Access....which is irrelevant. Jet databases are widely used in mission-critical areas whether you like it or not, and the fact its not widely known and condemned only adds credence to the suggestion that this is because it does its job as required, as opposed to your suggestion that its not used because if it was it wouldn't be up to the job.

Of those Fortune 500/1000 companies you quote. How many use "Microsoft Access" as a mission critical datbase system, or MS Exchange for that matter?

Fair question. From this link we can see that about 18 months ago, 52% of F500 companies had standardised on Exchange, and 44% among the F1000 companies - more than any other mail system.

So, unless you are telling me that email is not mission-critical, I gues I can say that at least 52% of F500 companies had mission-critical systems reliant on Jet databases as of 2002. Thats without considering that the odds are very good indeed that some of the remainder use MS ADS for their domain-management, which is also Jet based.

So - the short version - I think I can safely say "at least 40% of the most successful companies in the world do".

Look, MS Access as a development tool is a POS. Jet databases in a multi-user environment is a POS. I'm not questioning any of that.

However, a Jet database (such as MS-Access) as a data store for a dedicated single-process system which does not rely on the database security for system security is a tried, tested and successful configuration at scales vastly beyond anything which the vote-counting system in Ireland will ever need to cope with. That is a fact, as evidenced by ADS and Exchange.

Whether you want to accept that fact or not is not my concern, but I will continue to counter the assertion that Access is unsuitable for mission-critical systems with the proof taken from industry-wide standard systems that Jet databases have been and are successfully used in systems which demand data integrity and reliability on a 24/7 basis at a scale vastly beyond what is required for this new vote-counting system.

All I'm doing is offering the other side of the coin...with examples. If you think I'm wrong, thats entirely your perogative, but offering factual information (which Im guessing you weren't entirely aware of before this) which shows that your assertions are at least questionable is not muddying the water, its showing that this is not a cut-and-dried issue like you seem to believe it is.

jc

Sparks

Originally posted by bonkey
Jet databases have been and are successfully used in systems which demand data integrity and reliability on a 24/7 basis at a scale vastly beyond what is required for this new vote-counting system.

What about the more important property of security?

Paddyo

Why use Access97 - surely if Access was to be used at all one should use 2000 or XP?

Am I wrong or would a lot of the integrety be dependant on the MDAC version that is being used or am I talking through my rear end.

Paddyo

bonkey

Originally posted by Sparks
What about the more important property of security?

Access can be properly secured for an application like this.

This particular application isn't secured appropriately.

So the application has a security issue, but it is not one which is intrinsically a problem with the choice of database, just like - as I previously pointed out - the fact that there are no Primary keys on the database tables is a cause for concern, but is also not an indictment of the DB system chosen.

As for why Access 97 was chosen...No clue Paddyo....but I would guess that thats what was currently available (or currently old enough to be considered stable) when the project started, and I can understand the logic behind not changing versions mid-stream.

At this stage, I'm not going to go further into debating the technical merits or demerits of the system here. If ppl are interested, lets go start a thread over on Programming or somewhere relevant, and I'll set a link to it from here or something.

I still stand by my original position - there are plenty of reasons to be concerned about the system, but I do not believe that the choice of data-storage is a significant one.

Ultimately, I simply believe that attacking the easily defensible only weakens the case against the system, when there are plenty of relatively indefensible issues which can be levelled against it instead.

jc

Hobart

Originally posted by bonkey
The Vote-Counting operation is not an Enterprise-level operation itself, so who's muddying waters here. It does not need to support more than a single process, which would make it equivalent to a single-user system, not an enterprise-level one...

What exactly do you mean by Enterprise Level Application and how do you know that it does not need to handle more than one process? Just because a single user will be using a single database at any one time does not mean that there are not multiple updates going on in the background. So how do you know this?

So, if anything, the entire Enterprise-level criticism is whats doing the muddying. I'm just trying to shift through that mud and explain what bits are relevant and why, when you look at those relevant bits, Access is not as bad a choice as you are alleging, as my examples show it is used in systems the world over which demand high volume and high reliability and high availability.

I'm sorry bonkey but that is not the crux of my arguement at all. I am talkiong about the stability, reliabuility and security of MS Access. You are introducing the fact that MS Access as an application uses the JDE. You have introduced MS Exchange into the debate. Who is muddying here?? Ans as for relevance, MS Access is relevant. JDE is relevant, but only in relation to MS Access.

What you probably mean is that you have never met anyone who designs mission critical systems which depend on Access....which is irrelevant.

Eh... No. That's not what I mean. I mean what I have said. Design??? No not design. Implement, use, support, rely on all of those Yes. Design. No. In fact I have yet to meet any DB dev who designs on the basis of a sigle DB application. It would probably be considered bad design.

Jet databases are widely used in mission-critical areas whether you like it or not, and the fact its not widely known and condemned only adds credence to the suggestion that this is because it does its job as required, as opposed to your suggestion that its not used because if it was it wouldn't be up to the job.

Where are they used and for what purpose? Give me an example of where MS Access is used as a mission critical DB application.

Fair question. From this link we can see that about 18 months ago, 52% of F500 companies had standardised on Exchange, and 44% among the F1000 companies - more than any other mail system.

Mail? Mail mission critical? Really? Where?

So, unless you are telling me that email is not mission-critical, I gues I can say that at least 52% of F500 companies had mission-critical systems reliant on Jet databases as of 2002. Thats without considering that the odds are very good indeed that some of the remainder use MS ADS for their domain-management, which is also Jet based.

See above.

Hobart

Originally posted by Paddyo
Why use Access97 - surely if Access was to be used at all one should use 2000 or XP?

Am I wrong or would a lot of the integrety be dependant on the MDAC version that is being used or am I talking through my rear end.

Paddyo

Not sure of the design myself in relation to the DB. I actually did not realise that they were using MSAccess 97. I believe, I will google to check this, that it utilises the Jet V2.0 eng. Again from memory I believe that the current version of MS Acces is on V3 or poss V4. Boggle???

As for MDAC, yes it does have an impact, but should not if the version is 97 (and depending on design). I think the current version of MDAC is 2.7 and is a non issue with this DB.

bonkey

Originally posted by Hobart
What exactly do you mean by Enterprise Level Application and how do you know that it does not need to handle more than one process?

Because there is no requirement for concurrency in what the system is designed to do. If the authors have built concurrency in, then that is a needless extra risk, not a fault of the choice of database.

I am talking about the stability, reliabuility and security of MS Access. You are introducing the fact that MS Access as an application uses the JDE.

Yes, I am talking about that. Why? Because unless the entire application was written in MS Access using Access Basic (which it wasnt - we know this), then it is irrelevant to discuss MS Access.

The program is accessing an MS Access database over an MDAC-based connection. That is correctly termed a JDE-based application. In fact, whether or not MS Access - the office product - is even installed on the machine is irrelevant to the way that architecture works.

I would have thought that with whatever-number-of-years industry experience you have and the knowledge to confidently condemn MS Access, you would at least know how an application which uses an MS-Access database over an MDAC link actually works.

The application uses the Jet Engine, not MS Access. It is a JDE-based application, just like the ones I'm talking about. MS Access, the application, is entirely irrelevant to the design.

But again, I suppose pointing out what is relevant is muddying the waters because it doesn't suit your argument.....

You have introduced MS Exchange into the debate.

Yes, because, for the umpteenth time it shows that your claims of this type of system not being used in the real world at a certain level are incorrect.

Who is muddying here??

The more you argue, the more I'm convinced its you. All I'm trying to do is clear up misconceptions.

Either that, or you haven't read the code-review of the system so you don' t know that its not using MS Access, or you are vastly over-inflating your own level of expertise.

Personally, I doubt its the latter.

Ans as for relevance, MS Access is relevant. JDE is relevant, but only in relation to MS Access.

Incorrect. As pointed out above, unless the database is accessed through a code-base executing inside an MS Access process, then MS Access is irrelevant. It is a JDE-based system, accessed over an MDAC-based connection. In fact, whether MS Access is installed or not is also irrelevant, as it won't be used by the process anyway.

But again, I suppose clarifying your incorrectness is muddying things again.

Implement, use, support, rely on all of those

Yes, and as I've pointed out, you are mistaken on every count except possibly the implementation one....because of Exchange and ADS...and they show that someone has successfully implemented designs with JDE, which would fill that last checkbox I'm missing.

Give me an example of where MS Access is used as a mission critical DB application.

How many times do I have to repeat myself?

MS Exchange has a back-end database. ADS has a back-end database. Both have JDE backend databases. Both are used in mission critical roles.

Mail? Mail mission critical? Really? Where?

Oh please.

Business revolves around E-mail. Just look at the impact that mail-crippling viruses and worms have and the costs they inflict on businesses. Look at the fact that e-mail correspondance is used in courts of law when resolving issues as serious as the MS monopoly.

If you still don't believe me, go ask your boss whether or not he would consider it a problem if his mail system did not reliably store, protect, and retrieve e-mails. Ask him if it would be a problem for the business if - say - the CEOs email got randomly distributed to everyone in the company whenever they logged on.

I suppose next you'll tell me that ADS isn't mission critical either, or have you stopped mentioning it because you haven't a hope of arguing that it isn't.

jc

bonkey

Originally posted by Hobart
I believe, I will google to check this, that it utilises the Jet V2.0 eng.

This coming from the man who said that discussing the JDE was irrelevant, but that discussing MS Access was????

Bravo. Well done. I couldn't contradict you better myself if I tried.

jc

star gazer

The irish computer society has released a statement that there should be no electronic voting system without a voter verifiead audit trail. The government have outright refused to accept this up until now, it doesn't look like they will let this change their minds either.

The ICS calls for audit trail in e-voting system
3rd March 2004

Michael O'Duffy is Chairman of the Public Policy Committee of the Irish Computer Society and Chief Executive of the Centre for Software Engineering.

In response to feedback from society members and the general public on the ICS's statement of 20 February regarding electronic voting, the ICS Council has appointed a panel of serving and former Council members to consider the points raised and review its position.

The ICS's stance remains that it is in favour of electronic voting in principle. The benefits of a properly implemented system include:

- improved accuracy;
- the elimination of unintentionally spoiled votes;
- faster counts, which may in turn make it possible to put matters to the people in referenda more often, thereby improving the quality of our democracy;
- the potential to improve accessibility and privacy for persons with visual impairment, reading difficulties, etc.

However, any electronic voting system must include a paper-based voter verified audit trail. This means that when voters cast their votes on a voting machine a permanent paper record of their votes must be made, which can be checked by voters before the electronic record is made of the vote. The paper records must be retained and used in a number of randomly selected constituencies at each election to audit the accuracy of the electronically prepared result, as well as any cases where a result is in dispute. Where there is a discrepancy between the paper and electronic records, the paper version must take precedence. There is a number of reasons why the audit trail is required:

(1) It is the only way to prove or disprove the accuracy of the electronic count. No amount of testing and/or review is sufficient to guarantee that every voting machine and the associated counting software have no operational failure modes undetected by test but discoverable in use. It is axiomatic that while testing may detect some errors, it cannot prove their complete absence. This being so, it is vital that a method exists to independently audit the electronically prepared result. The audit trail must be voter verified, as the individual voters are the only people entitled to know how their votes were cast and therefore confirm the accuracy of the records made.

(2) It reassures the voters, many of whom will have little or no knowledge of computers, that their votes have been accurately recorded.

(3) It protects the electoral officials and makers of the voting systems against disputes about the accuracy of election counts, which in the absence of an audit trail will be impossible to disprove, but which will cast unanswerable doubts on the results.

It is the unanimous view of the electronic voting panel of the Irish Computer Society that no electronic voting system should be implemented which does not include a voter verified audit trail.

The ICS welcomes the Government's announcement of the appointment of the Independent Electronic Voting and Counting Commission, and looks forward to making a submission to the Commission in due course, not just on the question of auditability, but other issues that ensure accurate and secure operation.

(ends)

the minister doesn't appear to have a lot of respect for the group...
http://debates.oireachtas.ie/DDebate.aspx?F=DAL20040304.xml
prirority questions, electronic voting

Sparks

Originally posted by star gazer
the minister doesn't appear to have a lot of respect for the group...
http://debates.oireachtas.ie/DDebate.aspx?F=DAL20040304.xml
prirority questions, electronic voting

Yeah. That was impressive, snubbing the biggest Irish professional computing association....
And there was this :

Mr. Cullen: These are the points I want to make. The group is not dealing with the system about which we are talking. If it wants to deal with a paper trail system, of which there is none anywhere in the world - the Deputy referred to Brazil, on which I commented directly——

So in the one sentence he says that there's no VVAT anywhere and mentions Brazil where there is a VVAT (he's mentioned that less than two minutes earlier) and ignoring Austrailia where eVACS does have a VVAT...

Man shouldn't be allowed programme a VCR and he's making technical decisions he's unqualified to make and trashing the electoral system in the process. Nice work if you can get it...

alleepally

Just want to throw my tuppence worth in here.

As someone who has exercised his franchise for every election and referendum since he turned 18 I am NOT going to vote in elections in June for the first time in 16 years.

WHY?

The simple fundamental fact that NO record of my vote is produced in a harcopy audit trail.

The point has no doubt been made before about this but the reality of the governments ill advised adventure translates into removing my confidence in the electoral system and I am not happy about and my td's will know about it.

Victor

The total estimated cost of the project, excluding training costs, is €44 million, including VAT.

Hmmm, more costs.

Originally posted by alleepally
As someone who has exercised his franchise for every election and referendum since he turned 18 I am NOT going to vote in elections in June for the first time in 16 years. WHY? The simple fundamental fact that NO record of my vote is produced in a harcopy audit trail.

Pretend not to vote, say you won't, but do. don't let the Minister ride rough-shod over you.

Hobart

Originally posted by bonkey
This coming from the man who said that discussing the JDE was irrelevant, but that discussing MS Access was????

Bravo. Well done. I couldn't contradict you better myself if I tried.

jc

Where did I say that? Now would you do me the courtesy of not mis-quoting me in such a hysterical manner.

Originally posted by bonkey
Because there is no requirement for concurrency in what the system is designed to do. If the authors have built concurrency in, then that is a needless extra risk, not a fault of the choice of database.

To quote yourself. "Oh Please". So let me get this right. Because the DB does not have to support concurency you believe that it is relieved of any need to carry out multiple processes? Is that correct? And while your at it you may like to address my initial question of "What exactly do you mean by Enterprise Level Application "?

I would have thought that with whatever-number-of-years industry experience you have and the knowledge to confidently condemn MS Access, you would at least know how an application which uses an MS-Access database over an MDAC link actually works.

I'm sorry. You have lost me here!! What has my experience got to do with the way an MSAccess DB works? Would you care to expand?

Or let me, although this is not the forum. MDAC, or Microsoft Data Access Components are a set of "tools" which allow access from applications to databases. However MDAC on it's own is not sufficent for DB access. In order to access data stored in a data repository one also needs a provider of some sort to retieve and manipulate data. In the case of Access, it is the OLE provider which is used. Basically the use of JDE or Access is not as "simple" as your ditty makes it out to be.

The application uses the Jet Engine, not MS Access.

So MS Access is not used in this voting application then? Is that what you are saying?[/QUOTE][/B]

But again, I suppose pointing out what is relevant is muddying the waters because it doesn't suit your argument.....

On the contary. I find your reposte quite amusing. It's the mis-quotinq, the thinely veiled insults and incorrect technical assumptions which are actually muddying the waters. But keep going.

Yes, because, for the umpteenth time it shows that your claims of this type of system not being used in the real world at a certain level are incorrect.

Ah!!! Another mis-quote. Would you care to point out where I have said this?

All I'm trying to do is clear up misconceptions.

Indeed.

Either that, or you haven't read the code-review of the system so you don' t know that its not using MS Access, or you are vastly over-inflating your own level of expertise.Personally, I doubt its the latter.

No I have not read the code review. I have read the FS on the hardware, however. And again. No need for the flaming, is it not possible for you to have a debate without the thinly veiled threats?

Oh please.

Business revolves around E-mail. Just look at the impact that mail-crippling viruses and worms have and the costs they inflict on businesses. Look at the fact that e-mail correspondance is used in courts of law when resolving issues as serious as the MS monopoly.

Business does not revolve around e-mail. That is a paintently untrue statement. It is a very useful tool in work, however I cannot think of 1 business which would go "out of business" if e-mail was down for say a month. Not one. Now, bring down the client DB and you have another issue.

If you still don't believe me, go ask your boss

I am the boss.

whether or not he would consider it a problem if his mail system did not reliably store, protect, and retrieve e-mails.

A problem? Yes. It would also be a problem if MSWord stopped working. But a mission critcal one? No.

I suppose next you'll tell me that ADS isn't mission critical either, or have you stopped mentioning it because you haven't a hope of arguing that it isn't.

No, I won't. But I will tell you it is not an application. So why don't you stop quoting useless examples and respond to my original question:

"Give me an example of where MS Access is used as a mission critical DB application." and I'll tell you what. For the sake of clarification why don'y you swap out the word access for Jet. But try answer it anyhow.

dahamsta

The total estimated cost of the project, excluding training costs, is €44 million, including VAT.

Hmmm, more costs.

When you add the cost of storage for the machines, it's about double that.

adam

bonkey

Originally posted by Hobart
Where did I say that? Now would you do me the courtesy of not mis-quoting me in such a hysterical manner.

Here's the bit I was referring to :

I am talkiong about the stability, reliabuility and security of MS Access. You are introducing the fact that MS Access as an application uses the JDE. You have introduced MS Exchange into the debate. Who is muddying here?? Ans as for relevance, MS Access is relevant. JDE is relevant, but only in relation to MS Access.

So, the only relevance of JDE in this discussion, according to you, is that it is part of MS Acccess - which you explicitly quantify as "the application". You are also clearly saying that discussing the JDE is only relevant in relation to MS Access - which I can only assume to mean "MS Access the application" given both the stance and the preceeding reference to it in this paragraph mentioned above.

Then you go on to say :

I believe, I will google to check this, that it utilises the Jet V2.0 eng

So you clarify to someone else that it is the engine that it uses, despite having insisted to me that the engine is only relevant as part of the application.

Clearer? In one post, it is the engine which is relevant, not the application, in the other it is the application.

Because the DB does not have to support concurency you believe that it is relieved of any need to carry out multiple processes? Is that correct?

Yes.

Each voting machine has a dedicated "ballot module" which is what stores the votes made on that machine. Each module is later processed - one at a time - by the vote-counting system (which is a seperate windows machine), I think it is reasonable to assume that at any given time there will only be one read/write process which needs access to the database.

Why, would you design it differently, even if you had your choice of database?

One physical store of votes to read from, one database to put them into.....how many concurrent database connections would you use????

What has my experience got to do with the way an MSAccess DB works? Would you care to expand?

Well, you are basing a lot of your proclamative statements on the experience your 8 years experience in the industry has apparently given you....and yet by repeatedly insisting that we discuss MS Access - the application - instead of the Jet Engine (and by insisting that discussing the engine seperately to the Office Application is muddying the waters) you are suggesting that you do not fully understand the technology that you are attempting to rubbish.

Basically the use of JDE or Access is not as "simple" as your ditty makes it out to be.

My "ditty" didn't claim anything was simple.

What I said was that MS Access is not required to be installed on the machine at all, which further questioned the basis of your insistence that we talk about it (MS Access) rather than the one component of it which is required to be installed (and which can be installed seperately to the application), that being the JDE.

So MS Access is not used in this voting application then? Is that what you are saying?

What I have said is that MS Access is not required to be installed on the machine.

The database was more than likely developed using MS Access (although even that is not strictly necessary), and is more than likely a .mdb file, which means that it is stored as an MS Access database file, but there is a world of a difference between that and saying that the application uses MS Access.

And just in case you're still not clear : No, MS Access is not used in this voting application. It is a Delphi application, using 'Opus DirectAccess' to talk to a Jet Engine which allows the use of a .mdb database file.

Business does not revolve around e-mail. That is a paintently untrue statement.

There is a legal obligation on businesses to keep all correspondance of a certain nature for a minimum period of time. This includes e-mail, or do you not recall the issues that arose over this during the last MS anti-trust case in the US?

If you do not see fulfulling legal obligations as a critical role of a company, nor how it is one of the single-most relevant aspects of a company ("legal obligation" as opposed to "essential to making profit") relative to what we are discussing, then there is not much I'm even interested in doing to change your mind.

But I will tell you it is not an application.

So because you'd prefer to call it a Service, or something else, that somehow means that it doesn't show that the JDE is up to the job?

So why don't you stop quoting useless examples

The only relevant issue here is whether or not a JDE database can do the job which is required of it in this system. My examples show that there is good reason to believe it can : it is trusted for use in systems which need to ensure data-integrity for legal purpses and it is trusted for use in systems that form the backbone of entire network security policies.

If you think that some sophistry over whether or not something should be called an application rather than a service or a process or something else is more important or somehow changes the relevancy to the point of making these examples useless, then clearly I'm wasting my time.

jc

star gazer

originally posted by victor
Pretend not to vote, say you won't, but do. don't let the Minister ride rough-shod over you.

originally posted by alleepally[/I]
The point has no doubt been made before about this but the reality of the governments ill advised adventure translates into removing my confidence in the electoral system and I am not happy about and my td's will know about it.

If everybody that disagrees with evoting doesn't vote and that number becomes substantial, it will suit the government, Fianna Fail do well in low turnouts. Don't give up your democratic right, attempt to hold onto it. Talk to your friends, write to your local representatives and the Minister and Taoiseach. If there are others out there that think similarly and do the same thing, it may be very hard for the government to resist the pressure. ICTE are also trying to ensure a trustworthy system read about them:
http://www.boards.ie/vbulletin/showthread.php?s=&threadid=131386

Hobart

Originally posted by bonkey
Here's the bit I was referring to :

so you retract it then? Or what. I will ask you once more where did I say that the JDE was irrelevant? Where? You have come up with some "i will read between the lines" have story. But nowhere close bonkey. Either point it out or retract it please. I did not say those words and your eagerness to try to say I did is pathetic.

So, the only relevance of JDE in this discussion, according to you, is that it is part of MS Acccess

I never said it was part of MSAccess. You did. This mis-quoting is becoming a bit of a habit, isn't it?

- which you explicitly quantify as "the application".

Where did I explicity quantify it as the applictaion? I said it was "an application". But I never "explicity quantified it as "the application". Did I?

You are also clearly saying that discussing the JDE is only relevant in relation to MS Access - which I can only assume to mean "MS Access the application" given both the stance and the preceeding reference to it in this paragraph mentioned above.

In the context of this debate. Yes. Why would it not be? What are you trying to say here? First of all you quote me as saying that JDE is irrelevant. And know you quote me as saying it is relevant. Which is it bonkey?

Then you go on to say :

[/b]

So you clarify to someone else that it is the engine that it uses, despite having insisted to me that the engine is only relevant as part of the application.

Clearer? In one post, it is the engine which is relevant, not the application, in the other it is the application.

So I am saying that the JDE is relevant then? Is that correct? You accept that?and of course it is only relevant to MSAccess, in this context. What else would it be relevant to?

Yes.

Each voting machine has a dedicated "ballot module" which is what stores the votes made on that machine. Each module is later processed - one at a time - by the vote-counting system (which is a seperate windows machine), I think it is reasonable to assume that at any given time there will only be one read/write process which needs access to the database.

I would contend that you know very little about the workings of a database from the above quote. Just because it is a single user using the databse, it does not necessarily follow that only a single process would be executed by the DB. In fact I would wager that this is definetly not the case. As you have pointed out I have not read the DB design doc. But if you would care to post a link to it I will review it and point out the obvios flaws in your contention.

Why, would you design it differently, even if you had your choice of database?[

See above.

One physical store of votes to read from, one database to put them into.....how many concurrent database connections would you use????

Why are you mixing up concurrency with DB devices or tables? would you like to expand. I would refer you back to your inital contention of a non-concurrent DB not having the need for multiple processes and ask you once more to expand on this theory of yours.

Well, you are basing a lot of your proclamative statements on the experience your 8 years experience in the industry has apparently given you....and yet by repeatedly insisting that we discuss MS Access - the application - instead of the Jet Engine (and by insisting that discussing the engine seperately to the Office Application is muddying the waters) you are suggesting that you do not fully understand the technology that you are attempting to rubbish.

So you can gleen my DB experience from the above 8/9 paragraphs. Really? I hope I don't come across you as an interviewer. you must be so perceptive. However I thought that I pointed out that my experience was based in "high-end" DB applications such as Sybase, Oracle and Interbase? Or is this a detail you have chosen to overlook. let me make this simple for you. Access is a low-end DB application. The one's I have listed above are high-end DB apps. I do not deal in "Access or JDE". Is that clear?

My "ditty" didn't claim anything was simple.

you contended that MDAC was the access mech for JDE in a quite simplistic manner. I pointed out it was not.

What I said was that MS Access is not required to be installed on the machine at all, which further questioned the basis of your insistence that we talk about it (MS Access) rather than the one component of it which is required to be installed (and which can be installed seperately to the application), that being the JDE.
What I have said is that MS Access is not required to be installed on the machine.

So it's not installed?

And just in case you're still not clear : No, MS Access is not used in this voting application. It is a Delphi application, using 'Opus DirectAccess' to talk to a Jet Engine which allows the use of a .mdb database file.

Your sure that MSAccess97 is not installed on these voting machines then? I just want to make sure that this is what you are saying.

There is a legal obligation on businesses to keep all correspondance of a certain nature for a minimum period of time. This includes e-mail, or do you not recall the issues that arose over this during the last MS anti-trust case in the US?

Please show me the relevant linkage to say that a company exists whereby mail is a mission criticqal system.

So because you'd prefer to call it a Service, or something else, that somehow means that it doesn't show that the JDE is up to the job?

I could call it a rabbit. But it is no more a rabbit then it is an application. So back to my original question.

The only relevant issue here is whether or not a JDE database can do the job which is required of it in this system. My examples show that there is good reason to believe it can : it is trusted for use in systems which need to ensure data-integrity for legal purpses and it is trusted for use in systems that form the backbone of entire network security policies.

It is not the only relevant issue, no matter how much you repeat it. please answer the questions posed to you and stop avoiding the issue.

Sparks

You guys do realise that you're arguing over the technical details of a system whose source code you've not seen and ignoring the more serious problems with that system, right?

Hobart

Originally posted by Sparks
You guys do realise that you're arguing over the technical details of a system whose source code you've not seen and ignoring the more serious problems with that system, right?

I have already admitted as much. My impression is that Bonkey has a more indept knowledge of the workings of this system.

bonkey

Originally posted by Hobart
I will ask you once more where did I say that the JDE was irrelevant?

<and countless bits of other pedantry deleted>

Hobart...I've tried clarifying where my comment came from. If you don't want to accept that, thats fine, but all you are doing is desperately trying to get further and further away from what we're supposed to be discussing which is the suitability of Access for this project.....and every attempt I make has you trying to squirm further and further into verbal pedantry about what was and was not said/meant/quoted.

Whats wrong? I'm trying to get us somewhat back on topic here, and you seem to be shying away from that in favour of discussing trivial side-points which have nothing that I can see to do with the topic at hand....whicih, if you recall, was your (and others) insistence that MS Access is just not suitable, and my insistence that it is acceeptably good.

So it's not installed?

How many times to I have to repeat myself. I said that there is no requirement for it to be installed.

And in case that distinction still isn't clear enough : I also can't guarantee you that Max Payne 2 isn't installed on the voting machines, but I can guarantee you that - just like MS Access - that it is not required.

If MS Access is installed, it is still not a reflection on the suitability of using a JDE-based database, it is a reflection on the inability of the designers to remove unnecessary components from their build.

Your sure that MSAccess97 is not installed on these voting machines then? I just want to make sure that this is what you are saying.

Aagain...MS Access 97 - or any other version of Access - [/i]is not required to be installed.

I know for a fact that the design - as quoted in the available documents - does not require MS Access to be installed. The application uses Delphi, connected to the database over a third-party "bridge" which hooks to DAO. None of that requires MS Access, it requires the JDE. So, if they have installed MS Access, its as relevant as if they had - as mentioned above - instsalled Max Payne 2.

That is based on the architecture that is outlined, as well as the software components which are listed as forming the data-access layer.

This, incidentally, would be from the Functional Info paper released in January of this year.

Please show me the relevant linkage to say that a company exists whereby mail is a mission criticqal system.

I've already supplied you with the evidence : legal requirements for document retention, as already evidenced at the Microsoft monopolies trial. It was Gates' own e-mail account which was at issue I believe.

If you can't remember the events, then a quick google should turn up the references you want.

AS I said, if you don't want to accept a legal requirement as being mission-critical, thats your perogative. I'm just glad you're not my boss if your attitude to the legal compliance of your company is that its not mission-critical.

If you want to take me telling you to use google to research something as not providing linkage then fine. In that case, I'll retract mail as being mission critical and simply maintain that its an example of a JDE database being used in real-world environments which demonstrates sufficient reliability, scalability, robustness, resiliency and security to make it appropriate for use in the voting application.

Lets not forget, after all, that people encrypt mail because they don't trust it being sent over the internet in clear-text, but they do trust MS Exchange enough to keep it secure in their mailbox.

It is not the only relevant issue, no matter how much you repeat it.

What else is relevant to the topic of electronic voting or to the specific implementation of the proposed system then?

Whether or not ADS is an application is relevant to Electronic Voting? How?

What exactly an Enterprise-Level Application is, is relevant to electronic voting? How?

I fail to see how, so maybe you could enlighten me.

The same applies for all of your other points that I've been dropping. They have nothing to do with Electronic Voting and the appropriateness of a JDE database

please answer the questions posed to you and stop avoiding the issue.

Which issue is that? Electronic Voting? The implementation of the proposed system?

jc

Hobart

Originally posted by bonkey
How many times to I have to repeat myself. I said that there is no requirement for it to be installed.

Nice twist. But you also said

And just in case you're still not clear : No, MS Access is not used in this voting application.

quite a convienient shift. It also looks like a number of experts who actually went to the trouble of reviewing the system, under documents supplied via FOI, disagree with you and I quote:

The operating system environment is open to bugs – the Microsoft Windows
operating system and the MS Access database should not be used in mission critical systems.

Heres the relevant linkage should you need to have a look. It's strange that this short and concise report only references MS Access and not JDE or Delphi. But maybe thats just a convenient co-incidence.

And in case that distinction still isn't clear enough : I also can't guarantee you that Max Payne 2 isn't installed on the voting machines, but I can guarantee you that - just like MS Access - that it is not required.

But neither is MsAccess. Is it? And a refernce back to the linkage above will also show that some testers went through the utterly useless task of upgrading the DB from Access97 to Access2000. Developers eh!! What do they know??

If MS Access is installed, it is still not a reflection on the suitability of using a JDE-based database, it is a reflection on the inability of the designers to remove unnecessary components from their build.

So let me get this right. the testers don't know thier stuff. The designers don't know thier stuff. But you know that the installation of this particular application is a waste of time? So you have reviewed the technical documentation on this DB design then?

I've already supplied you with the evidence : legal requirements for document retention, as already evidenced at the Microsoft monopolies trial. It was Gates' own e-mail account which was at issue I believe.

Really? there was a legal obligation of BG to retain his e-mails? And there still is?

AS I said, if you don't want to accept a legal requirement as being mission-critical, thats your perogative. I'm just glad you're not my boss if your attitude to the legal compliance of your company is that its not mission-critical.

I can categorically assure you that there is no legal requirement upon me to retain any electronic documentation for any fixed period of time. And this is speaking as the MD of a Limited Liability company based in Ireland.

Lets not forget, after all, that people encrypt mail because they don't trust it being sent over the internet in clear-text, but they do trust MS Exchange enough to keep it secure in their mailbox.

People who know no better, you probably mean

bonkey

Originally posted by Sparks
You guys do realise that you're arguing over the technical details of a system whose source code you've not seen

I'm only arguing over technical details which are known - the database system in use, the method of access to that database, and whether or not the chosen system is suitable to the task at hand.

The first two points are known. The information is available on that site Victor linked to some time ago (possibly even in this thread).

The third point is whats key, and you don't need the source-code for that, because its at a level above the source-code in terms of design - whether or not the code makes a good job of talking to the database is irrelevant if the chosen database is not up to the job in the first place....which is what so many people were saying.

and ignoring the more serious problems with that system, right?

Well, up to that point, there were two main objections. One was the lack of VVAT, which is a serious issue, but lets face it....its been discussed, and there's SFA new to say.

The second was that MS Access was being used. As I tried to point out at the start, that is not necessarily a valid critique in my opinion and experience.

For my money, the best way to scupper any set of objections is to include the ones which don't stand up, because these will be the ones which are attacked. Once you can show that one or two are unreasonable objections, then you can just dismiss the list as being politically rather than technically motivated.....which is what the government would presumably dearly like to do.

So, VVAT aside....

If I wanted to criticise the app, I would criticise the lack of openness in terms of the design and operating procedure. We know how the voter will use it, but how friendly is it to the operator? How foolproof is it in terms of coping with people not following procedures to the letter?

I would criticise the fact that it has been accepted that identified issues from a previous code-review will not be addressed until after the next election (i.e. after when these machines will be used). While I am willing to accept that it is possible the app is coded in such a way that these issues may not be critical, I would still maintain that for a system of this importance, if it was worth raising as an issue, then it should be worth resolving before the system goes into productive use.

I would criticise the fact that the mandated data-retention period is apparently due to expire before the next review of the system is scheduled (as pointed out previously by Victor, I believe).

I would criticise the government that there isn't a FAQ available which details the "what could go wrong and how the system will cope" in sufficient detail, which ties back somewhat to my first criticism.

I would criticise how the code has been so tightly protected - only one external cmopany (if I'm not mistaken) has been allowed to review it.

I would not criticise the choice of database, because I do not believe that it is a real problem, simply a perceived one.....and yet one which is so incredibly popular to jump on that it detracts from the real issues.

I made the mistake of trying to explain why that is, and have ended up with the opposite effect - that we are now stuck discussing the one criticism of the system which I believe can be defended against any detailed criticism.....not that its had any of that...its all been delectably vague in nature.

At best, the criticism seems to boild down to "well, Access is bad at X, and without the source-code, you can't say that X isn't being used". Correct. I can't. But the opposite holds true - we also can't say that X is being used. And every database has its limitations and problems, so the same logic would make them all unacceptable.

jc

Lemming

I wonder if anyone has read this today?

Summed up: Californian E-Voting system goes pear-shaped and there's no audit-trail to figure out what went wrong.

*cough cough* Beeeeeeeeeeeeeertie. Would you like to sit up and pay attention now? :rolleyes:

Sparks

Originally posted by Lemming
I wonder if anyone has read this today?

Yup.

capistrano

The e-voting system's authenticity has been validated by system testing. This is how all computer systems are validated. You test the system by applying known votes and then verifying that the system's output is the same as would happen if the votes were made manually. There is no need for a paper audit trail.

The only thing I would like to see is that the manufacturers make the source code available for review by an independent panel of experts. This would be nice but still not absolutely necessary.

Most objectors to e-voting either don't understand the technology ot are making the points for purely political reasons.

oscarBravo

Originally posted by capistrano
The e-voting system's authenticity has been validated by system testing. This is how all computer systems are validated. You test the system by applying known votes and then verifying that the system's output is the same as would happen if the votes were made manually. There is no need for a paper audit trail.

If you got a bank statement with just an opening and a closing balance, and a note in between saying "trust us - we tested the system" - would that be good enough for you? Dunno about you, but I want to see an audit trail.

And that's leaving aside the question of what was tested, by whom, to what standards...

The only thing I would like to see is that the manufacturers make the source code available for review by an independent panel of experts. This would be nice but still not absolutely necessary.

It should be made available to anyone - along with a way of proving that the source code published is that actually used in the election.

Most objectors to e-voting either don't understand the technology ot are making the points for purely political reasons.

On the contrary, most objectors understand the technology better than those responsible for introducing it, which is precisely why they're objecting. Ministerial comments to the effect that the voting machine is not a computer don't exactly inspire confidence.

Haven't you seen any of the stories coming from America about Diebold et al?