Neither weird nor beatyful

Lutoslaw

A true horror. There were elections in Poland recently... and a software which was supposed to help in counting votes hasn't been working. It came out, that one day BEFORE elections it's source code was released to public on GitHub. It is full of security holes... In an availible manual there is a screenshot with actual login info and basically anyone can log in and manipulate results. The code looks like it was written by a single student who learns c#. ... and it doesn't work, also. It is a few days after elections and still no results. Here are some samples: a constructor of an apparently important class ProtocolForm

	public ProtocolForm(ProtocolsList form, XmlDocument header, string protocolDefinition, string candidates, string committee, string validateDefinition, string save, string OU, string licensePath, string version)
this.InitializeComponent();
this.tooltipErrors = new ToolTip();
this.isKLKCan = true;
this.isKLK = true;
this.isKLKPro = true;
this.isKLKWali = true;

...
string[] p = protocolDefinition.Split(new char[]
{
'\\'
});
this.protocolDefinitionName = p[p.Length - 1].Replace('_', '/').Replace(".xml", "");
string[] p2 = candidates.Split(new char[]
{
'\\'
});
this.candidatesName = p2[p2.Length - 1].Replace('_', '/').Replace(".xml", "");
string[] p3 = committee.Split(new char[]
{
'\\'
});

... (~100 lines)

	foreach (XmlNode xObwod in headerRoot)
	{
		if (xObwod.Attributes\["nr"\].InnerText == obwod)
		{
			foreach (XmlNode xInst in xObwod)
			{
				if (xInst.Attributes\["kod"\].InnerText == inst)
				{
					foreach (XmlNode xobw in xInst)
					{
						if (xobw.Attributes\["nr"\].InnerText == okreg && System.Convert.ToInt32(xInst.Attributes\["inst\_jns"\].InnerText) == System.Convert.ToInt32(this.instJNS))
						{
							organNazwa = xInst.Attributes\["organNazwa"\].InnerText;
							break;
						}
					}
				}
			}
		}
	}

... (lines lines...)
if (inst == "RDA")
{
if (jns.Length < 6)
{
while (jns.Length < 6)
{
jns = "0" + jns;
}
}
if (jns[2] == '7' || jns[2] == '6')
{
if (jns.Substring(0, 4) == "1465" && organNazwa == "m.st.")
{
this.protocolDefinition = new XmlDocument();

... (~200 lines)
}
catch (XmlException e)
{
MessageBox.Show("Nieprawidłowy XML: " + e.Message, "Błąd");
}
... code code...
}

There are three methods: bool saves(int step), string generateSa

Tom Clement

Oh my god. Thanks for posting this. Is this intended to be used for actual election results? I.e. can flaws in this be used to affect the election, or does it just mean it will take longer for the tally?

Tom Clement articles[^]

Lutoslaw

Fortunately, every vote is on paper... somewhere. So theoretically nothing is lost. But depending on the results, an election will be repeated or not. If a current goverment loses, then election are likely to be repeated. This is how it works nowadays. The most tragic part is that people vote on them anyway.

Andy Brummer

holy crap, that is bad.

Curvature of the Mind now with 3D

StM0n

Ok... everyone has to start somewhere... but... :omg:

(yes|no|maybe)*

Bernhard Hiller

Why do you complain? It doesn't use goto statements to leave the inner nested for loop, does it? I know people who'd call that Clean Code, and who won't understand why it so hard to write Unit Tests for such great functions. That's the consequence when code is more valued than concepts.

Lutoslaw

Bernhard Hiller wrote:

Why do you complain? It doesn't use goto statements to leave the inner nested for loop, does it?
I know people who'd call that Clean Code, and who won't understand why it so hard to write Unit Tests for such great functions.
That's the consequence when code is more valued than concepts.

1. Because the app doesn't work and we don't have elections results. 2. Several hundreds of thousands institutions rely on it. 3. This is a freakin country-wide vote counting system, not a simple inside-app which can break and it isn't a big deal.

Richard Deeming

Jacek Gajek wrote:

It came out, that one day BEFORE elections it's source code was released to public on GitHub.

According to this[^], it was decompiled rather than released as open-source. It's still crap, but at least it's not crap that the public were supposed to see. :doh:

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

Lutoslaw

This is true. BTW, people who manage elections have their positions for years. They began their "carreers" in communizm, when they were simply told what results are and it wasn't necessary to count votes. Now, since 25 years we have democracy and it seems that they still didn't get used to a new system. I bet most of them don't know how to receive an e-mail, not talking about testing a computer program.

SortaCore

Richard Deeming wrote:

t was decompiled rather than released as open-source

Apparently it's from a PDB file. That essentially contains the original full code. Notwithstanding tools like .NET Reflector can revert C# apps back to original code as well. They'll have to run ngen to hide anything. Presumably the "winner" had more important matters to deal with, so they gave them the PDB so they could debug anything that went wrong.

Jorgen Andersson

And the procurement went like: My nephew is programming webpages, maybe we should ask him.

Wrong is evil and must be defeated. - Jeff Ello Any organization is like a tree full of monkeys. The monkeys on top look down and see a tree full of smiling faces. The monkeys on the bottom look up and see nothing but assholes.

Lost User

I noticed the error messages are some weird moon man language. Wow, that is messed up.

Tomz_KV

I can see that election is a tough process. It is tougher after voting.

TOMZ_KV

James Jensen

I think Bernhard had his tongue firmly implanted in his cheek. :laugh:

BillWoodruff

Let's give the author a break, shall we: I am almost certain, given the code style, the author learned C# programming here on CP by using QA !

«If you search in Google for 'no-one ever got fired for buying IBM:' the top-hit is the Wikipedia article on 'Fear, uncertainty and doubt'» What does that tell you about sanity in these times?

Lutoslaw

BillWoodruff wrote:

I am almost certain, given the code style, the author learned C# programming here on CP by using QA !

But he/she had mistaken the answers with questions.

Lutoslaw

MehGerbil wrote:

I noticed the error messages are some weird moon man language.

Well, they are in a native language for app's users. To nie jest żaden język z księżyca.

RafagaX

That's really terrible code! oooh! my eyes! they hurt soo much... ;P

CEO at: - Rafaga Systems - Para Facturas - Modern Components for the moment...

Agent__007

:thumbsup: :-D

Your time will come, if you let it be right.