Antti-Juhani Kaijanaho wrote:
On 20050325T002711+0100, Jeroen van Wolffelaar wrote:Eh, the buyer can demand proof, the same proof a voter has to verify his vote is tallied: ask the secret token.Ouch. Nasty. Bad. (This is one of the reasons why real elections have partisan observers present in vote counting: you cannot give the voter proof of his vote being counted, so you need another way to ensure public trust in the process.)
Yup; but conversely, we can't really manage that in Debian -- we'd have to have partisan observers monitoring the adminning of vote.debian.org's mail handling for three weeks, while at the same time not letting them see the non-anonymized votes.
Sure, and that is a good argument for this kind of secrecy.
AFAICS, you can only choose one of "directly check the vote counters are doing the right thing with your vote" and "be unable to sell your vote". There're too many weird possibilities (especially when you add timing into it) for me to prove that though :)
For those playing along at home, the 1999 election was an example of the latter priority; the 2001 election was an (accidental) example of an entirely non-secret leadership ballot.
Cheers, aj