Eliot Lear's Ramblings

Ode to Di Fi

Diane Feinstein was a force to be reckoned with, and she gave her all for San Franciscans, Californians, women, the LBGTQ community, and America.

I want to say a few words about our late Senator and my late neighbor, Diane Feinstein.

I remember when Di Fi ran for governor and lost to Pete Wilson in 1990, and how disappointed I was for her, and how excited we all were when she and Barbara Boxer were both elected to the Senate in 1992, along with Bill Clinton. We all departed some friends’ Election Night party, and piled onto Castro Street, and then the party really began; and she was there. She was always there for California and for Americans.

A common “social” event in those years in the Bay Area was a funeral for a person who died of AIDS, and Di Fi was right there for the LGBT community, as it was called back then. She was also there to defend a woman’s right to choose, and she was there to govern, as she had with San Francisco, having been the person who found Mayor George Moscone and Supervisor Harvey Milk shot dead by Dan White. That’s where she learned that to govern, you have to find common ground with those who don’t always agree with you. It’s an important lesson that is lost on many in the House of Representatives these days.

The brutal death of her friends shaped her politics, to be sure. She was a hawk in the same vein as Sam Nunn, although they didn’t agree on social issues. She viewed encryption as a threat, and I was witness to one side of a conversation in which she lambasted one of my friends who was a policy maker at the time. She had no truck with those she thought were in the wrong. That is not to say I agreed with her on encryption- I did not. She could often be blunt, but she understood that we are all Americans, and that we had to work together for the good of the country, and that did mean crossing the aisle on occasion.

I do think she stayed at least one term too many. Some records should not be broken. If this is her biggest failing, as a long time constituent, I could easily forgive her this fault.

“Neighbor”, you ask? Yes. In 1992, Di Fi was my neighbor on the other side of Temple Emanuel. She lived on one of the wealthiest streets in San Francisco, Presidio Terrace, while I lived in a broken down flat on Arguello Blvd. We didn’t exchange calling cards back then, but I had visited her Senate office a few times.

Republicans, pick one: win at any cost or support Democracy and rule of law?

Our way of life and form of government require the sternest possible punishment for those who would attack either. Republicans need to support America, and not just winning.

The charges that have been leveled against Trump are political but not in the sense that Republicans claim. Our way of life requires that those who attain high office be severely punished when they attack our American system of democracy and justice, as Trump and his lackeys did.

Some people might say, “Well, these are just Democratic prosecutors going after a Republican they don’t like.” Let’s look at the accusations:

In New York, Trump stands accused of felony bank fraud for having falsified records in his attempt to cover up his affair with a porn star. He is accused of doing this to win not just any election, but a presidential election.
In Washington, Trump and others stand accused attempting to fraudulantly thwart the peaceful and legal transfer of power, and the prosecutors have produced overwhelming evidence, including Trump’s own words.
In Atlanta, Trump and others stand accused of fraudulently attempting to “find” over 11,000 votes, once again in an attempt to overturn an election.

In short, Trump attempted to steal an election. It is undeniable.

Trump’s own tactics have been to accuse others of exactly the crimes he has knowingly committed. Thus we hear the rhetoric of “Stop the Steal”, when he himself attempted to do the stealing, as the evidence overwhelmingly demonstrates. The idea that Trump started his own social network called “Truth” demonstrates the depths of his depravity. He and truth rarely have met, and only ever to his disadvantage, as these indictments and the facts behind them demonstrate.

Trump had many co-conspirators, many of whom remain unindicted, such as the so-called “news” organizations like Fox News, who had to settle with Dominion voting for the lies they perpetuated; NewsMax, whose day is coming; and Republican office holders who disgraced themselves by violating their oaths to protect the Constitution. Many of those people have yet to be held accountable by their constituents. That in itself reflects the depths of trouble in which American democracy finds itself.

I note that not all Republicans are in disgrace. Former Governor Chris Christie stands out as the most vocal and consistent of Trump’s critics. But judging by the polls, Christie is in a small minority.

So, Republican citizens: the day of reckoning is here. Is the object simply to have your guy remain in power, no matter the lies and cheating? Will you put country before winning and before worship of this grifter and once again make America a beacon of democracy? That is what will make America great again.

It’s that simple.

Thanks, Sam.

On Aoril 27th, we said להתראות to my dear Uncle Samuel Lear. Sam leaves very big shoes to fill. He is seen below with my aunt his wife and girlfriend, my indefatigable Aunt Joan Lear.

Here are a few of my own memories.

You know that fancy digital watch you have on your wrist? In 1973 Sam was the first on his block (and nearly every block) to wear a Pulsar P2 LED watch. That matched the car phone that he had. He was a futurist in many ways.

Sam and other friends started Temple M’kor Shalom, and was very active in the Jewish community for a good part of his life. He was a staunch supporter of Israel at the time, commuting back and forth from Cherry Hill. One of my earliest memories is dropping him and Joan off at JFK. One of my favorite pictures of him is shaking hands with Menacham Begin. Begin was grateful for his support. He had great friends in Israel, and least two of his granddaughters visited through the Birthright program. And it was no surprise to see Israelis present today. I was wrong to think I had come the farthest.

While I can’t say that it was Sam alone that instilled in me a need to be politically involved, he had a role. He and I would regularly talk politics from an early age. On my wall to this day hangs a letter to a 9 year old Eliot from the Nixon White House, thanking me for my letter, in which I suggested that they lock the Israeli PM and the Egyptian president in a room, and not let either out until they had a peace. Food optional. Sam would discuss and debate, and if one listened, one would learn a thing or two.

Eventually Sam would break with Israel. I learned of his discontent one day in the 1990s when I was perusing the Jerusalem Post, and there was a letter to the editor from a man berating the ultra-conservatives for them trying to dictate to him and others about who is and is not a Jew. It was Sam. It wasn’t chutzpah, but protection of his family that motivated him.

It was family – מִשׁפָּחָה – that was most important to him, and he and Joan put it all on the line for us. Times weren’t always easy, but he and Joan were always – always – there. Most importantly his values live on in his daughters and grand daughters. And I must say, as testimony to this fact, a funeral was NOT needed to bring us all together.

And his friendships were only of one type: life long. Friends WERE family. It was wonderful to see friends of his from Lear-Mellick like Rita. To those who were his friends, I can only say, .שָׁלוֹם חברים

I don’t believe in the Orthodox Jewish notion of righteous ones, or צדיקים. Some strive to be righteous. Sam was about as righteous as they come, and religion was but a part of that. Sadness washes over me at the magnitude of this loss. I am eternally grateful for every moment we had together.

Creating standard inventories for Ubuntu systems

Here’s a tool to create standard SBOMs from Ubuntu distribution information.

As I’ve previously mentioned on this blog, software bills of materials (SBOMs) are software ingredient lists similar to what you would find on a can of soup. The purpose of these lists is to determine if something bad is in the mix, so that administrators can figure out where their risks are. This is why President Biden’s Executive Order from last May specifically called them out.

Here now is a tool that I’ve just posted to pypi called apt2sbom. This tool is specific to Ubuntu. Similar tools can be built for other distributions. This tool will take the already existing information on a Ubuntu system and collect it into one of the standard formats, such as SPDX or CycloneDX.

% pip3 install apt2sbom
[...]
% apt2sbom -h

usage: apt2sbom [-h] (-j | -y | -c) [-p]

generate SPDX file from APT inventory

optional arguments:
  -h, --help       show this help message and exit
  -j, --json       Generate JSON SPDX output
  -y, --yaml       Generate YAML SPDX output
  -c, --cyclonedx  Generate CycloneDX JSON output
  -p, --pip        Include PIP files

The resulting file is then suitable for import into tooling that can spot vulnerabilities in particular versions of software.

The package is a little on the early side. There might still be a few bugs here or there. If you find one, just post it to the source repository as an issue.

Would this be considered a complete SBOM? Probably not, because there may be software installed on a system that is not part of either the apt or python distributions. However, it’s fairly easy to add additional elements into these files, particular the JSON ones.

Keeping that software up to date: how hard could it be?

Think you can keep everything up to date with the latest security fixes? Think again.

One common piece of advice you will hear from cybersecurity experts is that you should always keep your software up-to-date, so that vulnerabilities can be corrected. We like to believe that consumers are the biggest offenders in terms of keeping old software around. After all, Grandpa doesn’t always know how to upgrade his iPhone.

This isn’t so easy for professionals. Let’s take a web site. Your average web site is composed of numerous servers, each running all manner of code, from the operating system to standard applications like Apache to web support code such as Python, PHP, and back end services, like MongoDB. ALL of it has to be updated.

What does the inventory look like? This has been the work of a group of people who have created something known as software bills of materials or SBOMs. One could think of an SBOM as the ingredient list on the back of a can of soup, only there’s software inside.

So how does one generate the inventory? And this is where things can get a bit interesting. On any reasonable UNIX machine there exists a package manager. In the case of Ubuntu, that would be apt, which is built on top of Debian’s dpkg. One can simply type “apt list –installed” to get the installed packages on a system, right?

WRONG.

Of course that will get you software that apt has installed, but if your site runs with python, then you might need to get a software list by using Python’s package manager, pip. In fact, “pip freeze” provides this information, and that will get you most, but likely not all, python packages. Now repeat for node.js’s npm, and others (assuming you can find all of them).

Now you might want to update those packages. That was the problem statement, after all. This should be simple enough, right? Well, let’s start with apt. It generally is simple enough, at least to start with: one simply runs, “apt upgrade -y” and software package upgrades happen. Of course, you have to test all of your code after this, as apt won’t do that for you. Your CI/CD process is hopefully doing this for you.

Next we go to Python. pip’s upgrade command requires a list of packages. Conveniently, we have one that we froze from above. However, it turns out that not all python packages are managed by pip; and it knows this, and pip will happily blow chunks when you try to upgrade a package it does own that requires an upgrade for something it doesn’t own. In the Ubuntu world, there are a few good examples of this, Cairo and MongoDB to name a few. Instead, these packages are managed by apt. Well that’s all good, since we can use the apt upgrade process, right?

WRONG.

Often times these packages are installed have or meet dependencies of their won that might go unmet as part of an upgrade.

Alpine Linux has applied an interesting solution to all of this: provide common python packages in their own ‘apk’ package manager. By using apk, you assuredly will not get the latest version of a package, but you will get consistent upgrade behavior. But this presents its own set of problems:

A publication hierarchy, starting from your source on Github, and then going who knows where..

What you are looking at is a publication hierarchy. Now we have software in multiple distributions, deriving from a repository, probably from different branches. It’s possible that there are even multiple repositories for the same code. If we are lucky, the repo owner is doing the integration to push updates to Ubuntu, Pypi, and Alpine. But we are almost never going to be that lucky, if for no other reason, a lack of authorization for all of them. And so we’ll end up with a mix of push and pull. It’s the pull that causes the version skew, and this is just a single distribution.

Now, I’ve picked on Python in this post, but pip and pypi actually do a pretty reasonable job of managing what packages it installed, so long as there aren’t dependencies to stuff it didn’t install.

So what does this mean in terms of managing your product or package?

I’m not ready to make any sweeping recommendations about what to do. One option is to just deal, and upgrade when you can. The problem is that your velocity will be slower than if you pull all source from their repos directly. On the other hand, doing the latter is a whole lot of work, requiring a whole lot of expertise when builds blow up.

This is a good example of where OSS needs to mature a bit more.

Chicken Noodle Soup by By Willis Lam – Campbell’s Chicken Noodle Soup, CC BY-SA 2.0.