The Usual Security Excellence from Bruce Schneier

I'm thrilled to read that the Calif. Sec'y of State has decertified these systems, especially the appalling Diebold, and I'm appalled to find she's conditionally re-certifying them. (See the SOS's reports here.)

Assurance

While this is a good effort, it has security completely backward. It begins with a presumption of security: If there are no known vulnerabilities, the system must be secure. If there is a vulnerability, then once it's fixed, the system is again secure. How anyone comes to this presumption is a mystery to me. Is there any version of any operating system anywhere where the last security bug was found and fixed? Is there a major piece of software anywhere that has been, and continues to be, vulnerability-free?

Exactly. The proper assumption is that your system is vulnerable until shown otherwise, not the other way around.