Eliot Lear's Ramblings

Republicans, pick one: win at any cost or support Democracy and rule of law?

Our way of life and form of government require the sternest possible punishment for those who would attack either. Republicans need to support America, and not just winning.

The charges that have been leveled against Trump are political but not in the sense that Republicans claim. Our way of life requires that those who attain high office be severely punished when they attack our American system of democracy and justice, as Trump and his lackeys did.

Some people might say, “Well, these are just Democratic prosecutors going after a Republican they don’t like.” Let’s look at the accusations:

In New York, Trump stands accused of felony bank fraud for having falsified records in his attempt to cover up his affair with a porn star. He is accused of doing this to win not just any election, but a presidential election.
In Washington, Trump and others stand accused attempting to fraudulantly thwart the peaceful and legal transfer of power, and the prosecutors have produced overwhelming evidence, including Trump’s own words.
In Atlanta, Trump and others stand accused of fraudulently attempting to “find” over 11,000 votes, once again in an attempt to overturn an election.

In short, Trump attempted to steal an election. It is undeniable.

Trump’s own tactics have been to accuse others of exactly the crimes he has knowingly committed. Thus we hear the rhetoric of “Stop the Steal”, when he himself attempted to do the stealing, as the evidence overwhelmingly demonstrates. The idea that Trump started his own social network called “Truth” demonstrates the depths of his depravity. He and truth rarely have met, and only ever to his disadvantage, as these indictments and the facts behind them demonstrate.

Trump had many co-conspirators, many of whom remain unindicted, such as the so-called “news” organizations like Fox News, who had to settle with Dominion voting for the lies they perpetuated; NewsMax, whose day is coming; and Republican office holders who disgraced themselves by violating their oaths to protect the Constitution. Many of those people have yet to be held accountable by their constituents. That in itself reflects the depths of trouble in which American democracy finds itself.

I note that not all Republicans are in disgrace. Former Governor Chris Christie stands out as the most vocal and consistent of Trump’s critics. But judging by the polls, Christie is in a small minority.

So, Republican citizens: the day of reckoning is here. Is the object simply to have your guy remain in power, no matter the lies and cheating? Will you put country before winning and before worship of this grifter and once again make America a beacon of democracy? That is what will make America great again.

It’s that simple.

Thanks, Sam.

On Aoril 27th, we said להתראות to my dear Uncle Samuel Lear. Sam leaves very big shoes to fill. He is seen below with my aunt his wife and girlfriend, my indefatigable Aunt Joan Lear.

Here are a few of my own memories.

You know that fancy digital watch you have on your wrist? In 1973 Sam was the first on his block (and nearly every block) to wear a Pulsar P2 LED watch. That matched the car phone that he had. He was a futurist in many ways.

Sam and other friends started Temple M’kor Shalom, and was very active in the Jewish community for a good part of his life. He was a staunch supporter of Israel at the time, commuting back and forth from Cherry Hill. One of my earliest memories is dropping him and Joan off at JFK. One of my favorite pictures of him is shaking hands with Menacham Begin. Begin was grateful for his support. He had great friends in Israel, and least two of his granddaughters visited through the Birthright program. And it was no surprise to see Israelis present today. I was wrong to think I had come the farthest.

While I can’t say that it was Sam alone that instilled in me a need to be politically involved, he had a role. He and I would regularly talk politics from an early age. On my wall to this day hangs a letter to a 9 year old Eliot from the Nixon White House, thanking me for my letter, in which I suggested that they lock the Israeli PM and the Egyptian president in a room, and not let either out until they had a peace. Food optional. Sam would discuss and debate, and if one listened, one would learn a thing or two.

Eventually Sam would break with Israel. I learned of his discontent one day in the 1990s when I was perusing the Jerusalem Post, and there was a letter to the editor from a man berating the ultra-conservatives for them trying to dictate to him and others about who is and is not a Jew. It was Sam. It wasn’t chutzpah, but protection of his family that motivated him.

It was family – מִשׁפָּחָה – that was most important to him, and he and Joan put it all on the line for us. Times weren’t always easy, but he and Joan were always – always – there. Most importantly his values live on in his daughters and grand daughters. And I must say, as testimony to this fact, a funeral was NOT needed to bring us all together.

And his friendships were only of one type: life long. Friends WERE family. It was wonderful to see friends of his from Lear-Mellick like Rita. To those who were his friends, I can only say, .שָׁלוֹם חברים

I don’t believe in the Orthodox Jewish notion of righteous ones, or צדיקים. Some strive to be righteous. Sam was about as righteous as they come, and religion was but a part of that. Sadness washes over me at the magnitude of this loss. I am eternally grateful for every moment we had together.

Creating standard inventories for Ubuntu systems

Here’s a tool to create standard SBOMs from Ubuntu distribution information.

As I’ve previously mentioned on this blog, software bills of materials (SBOMs) are software ingredient lists similar to what you would find on a can of soup. The purpose of these lists is to determine if something bad is in the mix, so that administrators can figure out where their risks are. This is why President Biden’s Executive Order from last May specifically called them out.

Here now is a tool that I’ve just posted to pypi called apt2sbom. This tool is specific to Ubuntu. Similar tools can be built for other distributions. This tool will take the already existing information on a Ubuntu system and collect it into one of the standard formats, such as SPDX or CycloneDX.

% pip3 install apt2sbom
[...]
% apt2sbom -h

usage: apt2sbom [-h] (-j | -y | -c) [-p]

generate SPDX file from APT inventory

optional arguments:
  -h, --help       show this help message and exit
  -j, --json       Generate JSON SPDX output
  -y, --yaml       Generate YAML SPDX output
  -c, --cyclonedx  Generate CycloneDX JSON output
  -p, --pip        Include PIP files

The resulting file is then suitable for import into tooling that can spot vulnerabilities in particular versions of software.

The package is a little on the early side. There might still be a few bugs here or there. If you find one, just post it to the source repository as an issue.

Would this be considered a complete SBOM? Probably not, because there may be software installed on a system that is not part of either the apt or python distributions. However, it’s fairly easy to add additional elements into these files, particular the JSON ones.

Keeping that software up to date: how hard could it be?

Think you can keep everything up to date with the latest security fixes? Think again.

One common piece of advice you will hear from cybersecurity experts is that you should always keep your software up-to-date, so that vulnerabilities can be corrected. We like to believe that consumers are the biggest offenders in terms of keeping old software around. After all, Grandpa doesn’t always know how to upgrade his iPhone.

This isn’t so easy for professionals. Let’s take a web site. Your average web site is composed of numerous servers, each running all manner of code, from the operating system to standard applications like Apache to web support code such as Python, PHP, and back end services, like MongoDB. ALL of it has to be updated.

What does the inventory look like? This has been the work of a group of people who have created something known as software bills of materials or SBOMs. One could think of an SBOM as the ingredient list on the back of a can of soup, only there’s software inside.

So how does one generate the inventory? And this is where things can get a bit interesting. On any reasonable UNIX machine there exists a package manager. In the case of Ubuntu, that would be apt, which is built on top of Debian’s dpkg. One can simply type “apt list –installed” to get the installed packages on a system, right?

WRONG.

Of course that will get you software that apt has installed, but if your site runs with python, then you might need to get a software list by using Python’s package manager, pip. In fact, “pip freeze” provides this information, and that will get you most, but likely not all, python packages. Now repeat for node.js’s npm, and others (assuming you can find all of them).

Now you might want to update those packages. That was the problem statement, after all. This should be simple enough, right? Well, let’s start with apt. It generally is simple enough, at least to start with: one simply runs, “apt upgrade -y” and software package upgrades happen. Of course, you have to test all of your code after this, as apt won’t do that for you. Your CI/CD process is hopefully doing this for you.

Next we go to Python. pip’s upgrade command requires a list of packages. Conveniently, we have one that we froze from above. However, it turns out that not all python packages are managed by pip; and it knows this, and pip will happily blow chunks when you try to upgrade a package it does own that requires an upgrade for something it doesn’t own. In the Ubuntu world, there are a few good examples of this, Cairo and MongoDB to name a few. Instead, these packages are managed by apt. Well that’s all good, since we can use the apt upgrade process, right?

WRONG.

Often times these packages are installed have or meet dependencies of their won that might go unmet as part of an upgrade.

Alpine Linux has applied an interesting solution to all of this: provide common python packages in their own ‘apk’ package manager. By using apk, you assuredly will not get the latest version of a package, but you will get consistent upgrade behavior. But this presents its own set of problems:

A publication hierarchy, starting from your source on Github, and then going who knows where..

What you are looking at is a publication hierarchy. Now we have software in multiple distributions, deriving from a repository, probably from different branches. It’s possible that there are even multiple repositories for the same code. If we are lucky, the repo owner is doing the integration to push updates to Ubuntu, Pypi, and Alpine. But we are almost never going to be that lucky, if for no other reason, a lack of authorization for all of them. And so we’ll end up with a mix of push and pull. It’s the pull that causes the version skew, and this is just a single distribution.

Now, I’ve picked on Python in this post, but pip and pypi actually do a pretty reasonable job of managing what packages it installed, so long as there aren’t dependencies to stuff it didn’t install.

So what does this mean in terms of managing your product or package?

I’m not ready to make any sweeping recommendations about what to do. One option is to just deal, and upgrade when you can. The problem is that your velocity will be slower than if you pull all source from their repos directly. On the other hand, doing the latter is a whole lot of work, requiring a whole lot of expertise when builds blow up.

This is a good example of where OSS needs to mature a bit more.

Chicken Noodle Soup by By Willis Lam – Campbell’s Chicken Noodle Soup, CC BY-SA 2.0.

Cyber-policing again: where is the social compact?

Private companies are making public policy, with no societal agreement on what powers governments should and should not have to address cybercrime.

A few of us have been having a rather public discussion about who should be policing the Internet and how. This began with someone saying that he had a good conversation with a mature law enforcement official who was not himself troubled by data encryption in the context of Child Sexual Abuse Material (CSAM) on the Internet.

I have no doubt about the professionalism of the officer or his colleagues. It is dogma in our community that child online protection is a crutch upon which policy makers and senior members of the law enforcement agencies rest, and we certainly have seen grandstanding by those who say, “protect the children”. But that doesn’t mean there isn’t a problem.

Perhaps in that same time frame you may have seen this report by Michael Keller and Gabriel Dance in the New York Times. That would be 45 million images, 12 million reports of which were at the time passing through FB messenger. Those were the numbers in 2019, and they were exploding then. In some cases these images were hiding in plain sight. Is 45 million a large number? Who gets to say?

Law enforcement will use the tools they have.

We have also seen people object to June’s massive sting operation that led to the bust of hundreds of people, disrupting a drug gang network. At the same time, leading legal scholars have highlighted that the sixth amendment of the US Constitution (amongst others) has been gutted with regard to electronic evidence, because the courts in America have said that private entities cannot be compelled to produce their source or methods, even when those entities are used by law enforcement. In one case, a conviction stood, even though the police contracted the software and then couldn’t produce it.

By my score, then, many don’t like the tools law enforcement doesn’t have, and many don’t like the tools law enforcement does have. Seems like the basis for a healthy dialog.

Friend and colleague John Levine pointed out that people aren’t having dialog but are talking past each other, and concluding the other side is being unreasonable because of “some fundamental incompatible assumptions”. You can read his entire commentary here.

I agree, and it may well be due to some fundamental incompatible assumptions, as John described. I have said in the past that engineers make lousy politicians and politicians make lousy engineers. Put in a less pejorative form, the generalization of that statement is that people are expert in their own disciplines, and inexpert elsewhere. We have seen politicians playing the role of doctors too, and they don’t do a good job there either; but the US is in a mess because most doctors aren’t political animals. And don’t get me started on engineers, given the recent string of legislation around encryption in places like Australia and the UK.

John added:

It’s not like we haven’t tried to explain this, but the people who believe in the wiretap model believe in it very strongly, leading them to tell us to nerd harder until we make it work their way, which of course we cannot.

This relates to a concern that I have heard, that some politicians want the issue and not the solution. That may well be true. But in the meantime, FaceBook and Google have indeed found ways to reduce CSAM on their platforms; and it seems to me that Apple has come up with an innovative approach to do the same, while still encrypting communications and data at rest. They have all “nerded harder”, trying to strike a balance between the individual’s privacy and other hazards such as CSAM (amongst other problems). Good for them!

Is there a risk with the Apple approach? Potentially, but it is not as John described, that we are one disaffected clerk away from catastrophe. What I think we heard from at least some corners wasn’t that, but rather a slippery slope argument in which Apple’s willingness to prevent CSAM might be exploited to limit political speech; and (2) that the approach will be gotten around through double encryption.

I have some sympathy for both arguments, but even if we add the catastrophe theory back into the mix, the fundamental question I asked some time ago remains: who gets to judge all of these risks and decide? The tech companies? A government? Multiple governments? Citizens? Consumers?

The other question is whether some standard (a’la the 6th Amendment) should be in play prior to anyone giving up any information. To that I would only say that government exists as a compact, and that foundational documents such as the Constitution must serve the practical needs of society, and that includes both law enforcement and preventing governmental abuse. If the compact of the 18th century can’t be held, what does a compact of the 21st century look like?

Yet more research and yet more dialogue is required.