One of our local activists quickly put together a Power Point about L & A Testing, based on SCOTTXYZ great explanation. Address given with permission:
http://www.nas.com/beddill/fairvoting/l-and-a.pptUse page down key to advance through sequence.
This was done very quickly, so forgive a few typos here and there.
Scottxyz original post on L&A:
scottxyz Thu Sep-25-03 06:53 AM
Response to Original message
93. Random example #1 of how the SAIC report is a high-tech whitewash
Edited on Thu Sep-25-03 06:56 AM by scottxyz
"Recommendation: Modify procedures for the Logic and Accuracy (L&A) testing to include testing of time-oriented exploits (e.g., Trojans)."
Easter-eggs (as time-oriented exploits are commonly called in the industry) can't be 100% precluded via a so-called "Logic and Accuracy" test.
Observing the BEHAVIOR of a computer program in a finite number of runs yields a guess as to what its SPECIFICATION might be.
For example, consider a program that produces the following output for a (necessarily finite) series of test runs:
INPUT 2
INPUT 3
OUTPUT 5
INPUT 3
INPUT 4
OUTPUT 7
INPUT 12345
INPUT 11111
OUTPUT 23456
INPUT -1
INPUT 100
OUTPUT 99
What does this program do? Or, even more simply, what would the output be for the following run:
INPUT 555
INPUT 444
Well, if you're being asked this question on the math portion of the SAT test (which is known NOT to be malicious) you can safely answer: "It adds the two inputted numbers!" So the answer would be
INPUT 555
INPUT 444
OUTPUT 999
However, the code for this program could be:
(
INPUT X
INPUT Y
( IF ( X = 555 AND Y = 444 )
THEN ( OUTPUT "HOLY SMOKE BATMAN!")
ELSE ( OUTPUT X+Y ) )
)
in which case, this particular run would look like:
INPUT 555
INPUT 444
OUTPUT HOLY SMOKE BATMAN!
Remember in geometry when you had to do a proof? It wasn't enough to show lots and lots of cases where the proof held - you had to "prove" that it holds in ALL cases (and there's usually an infinite number of them).
For all intents and purposes, there is an infinite number of ways a program can be run - an infinite number of inputs that can be fed into it.
You don't test what a program does (particularly a potentially "malicious" one, where the goal is to rule out the possibilities of "Trojan horses" and other spyware as the SAIC report naively claims to do) by running it a bunch of times.
You VERIFY what a program does by reading its source code. "Logic and Accuracy" testing is a meaningless, made-up, official-sounding name which is completely useless to check against Trojans or "malicious code".
Many educated clients demand to see and own the source code of any program they are purchasing. We the people, if we are going to purchase voting-system software, are perfectly within law and custom to demand to see and own the source code of this software.
And SAIC should know this. That's one example of how to tell this report is a whitewash. A high-tech whitewash.
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
