So, I just voted in the Eclipse Board elections. I encourage everyone entitled to a vote to do the same.
I'm not feeling the greatest about the security of the whole thing though. My password to login to the voting system was sent via email, which is not a very secure protocol given that the contents are sent out in the clear. Why couldn't I just login using my SSH credentials, which are relatively secure? Granted, the likelihood that someone is sniffing committers' email in an attempt to fraudulently login and rig the board elections is pretty low, but it's the principle of the thing.
Even worse, was that after I voted, the system told me to expect a confirmation email. Ok, great. Except, the confirmation email contains a listing of how I voted for all the candidates. So much for secret ballots. Oy.
Subscribe to:
Post Comments (Atom)
4 comments:
+1. I had a couple of login failures using my committer id until I noticed the password was in the e-mail. Definitely odd.
Hmmm. I didn't think we needed bank-level security for something like this.
+1. I also think that the voting system should be integrated into the portal. I assume that the portal code is already available in Eclipse CVS. Everybody can then verify that the voting result may be stored in a database but not associated with the voter other then a confirmation which would be presented on screen and that's it.
The issue is historical. There are two elections: the committers and the AIP reps. Committers have userid+password and SSH access to the portal and are used to accessing Eclipse's systems pretty much every day. The corporate members are not. At least not yet. And we cannot afford the effort required to implement two different election systems with our limited resources.
All that said, this is an excellent point and we will look into changing this for next year. We do have the infrastructure in place for the corporate members to use the portal. We just need to get them more used to doing so.
Post a Comment