Words at war presents multi-spitfire by flying officer George F. Burling and Leslie Roberts. Brother in-law, tell him to let me touch him. This way, sir. Quick, does it? Here we are, sir. In we go. Now, driver, hop on it. You're all in one piece, aren't you, sir? I guess so, sir. They did rough you up a bit. Lucky they didn't tear your uniform to shreds. I was scared. I never did see such a public demonstration of affection. Well, you can't hardly blame them. They do love you, sir, for all you've done. Look, I'm shaking all over. That's the first time I've ever really been scared. Imagine you saying that after all you've been through, shooting down them twenty-eight planes over mortar, and being shot down yourself, and then being received here at Buckingham Palace. Listen, I'm not saying I wasn't scared over Malta, but this. I need something to steady my nerves. Officer, you wouldn't happen to know where I could get a good fist full of hot dogs. Birds at War. The national broadcasting company in cooperation with the Council on Books in War Time brings you another in its series of radio treatments of important books of this war. Tonight, we hear the story of one of the greatest living fighter pilots, a 21-year-old boy, one of a handful who saved Malta in her time of peril. This is the story of flying officer George F. Burling, as told by himself and Leslie Roberts in Malta Spitfire. This story belongs to George Burling. The same way the future belongs to kids like him. You hear that? Can you tell what make of plane that is? No? Neither could I. That's a Douglas transport. There, you see? Well, here comes another one. How about that one? That's a thunderbolt. You see? The kid knows. It sure as a farmer's wife knows the sound of her own ring on a rural phone line. George Burling, up in Vanitine in Canada, knew every plane that flew over his head, just for the sound of its motor. This door, do you hear? Just a minute, Mother. No, just a minute. You open this door. Yes, Mother. How did you have the door locked?  I was working on my model plane. I thought so. And you weren't in school today, either, were you? Answer me. No, ma'am. But where were you? No, I know, out at the airport. Weren't you? Oh, gee, yes, Mother. I was. And Mother, a pilot, spoke to me. He did, Honest Mother. He said, just as plane, hello. A pilot, Mother. Your father will pilot you when he gets back, and right where it'll do the most good, too.   No, it won't. Yeah, I'll get another licking tomorrow in school. All right, I'll take the licking.  I'm going to be a pilot. Nothing's going to stop me. Hear that? Do you hear it, everybody? You'll get over it. I was going to be a fireman once. You'll get over it. Hey, kid. Hey, kid. Yes, sir. What is it, sir? Come on in, other rain. You're getting soaked. You mean in there? Inside in the hangar? Sure, why not?  You'd think this was the holy of holies.  You think a lot of flying, don't you? Yes, sir. I've been watching you hang around here for months. I've been watching you, too, sir. I think you're a wonderful flyer, sir. I'll pass, I guess. Say, kid, how'd you like to take a flip someday? In a plane? All right. Sure.  Mom, hey, Mom! Mom! The pilot. He says he'll take me up. Can I go, Mom? Can I fly? Sure, you can fly. You can fly to the moon. I can go! Hooray! I can go! I can fly! Hooray! I can go! It was wonderful, Mom. I'm going to be a flyer. But, Georgie, I want you to be a doctor. And Dad wants me to be a commercial artist. My kid is the only lie. Well, now, where would you ever get money to take flying lessons? I'll earn it. First, I'll sell papers and run errands. And when I'm older, I'll get a regular job. And, believe me, I'll get one, too. George Burling is older now. And he's got himself a job working in a radio plant. Salary? Twenty-eight cents an hour. Room rent? One fifty a week. Food? One seventy-five a week. I'll make out. One cup of coffee coming up. Hi, kid. Well, I'll be, kid. Oh, don't tell me. A hot dog and a cup of coffee. Gee, kid, you'll begin to bark soon. I like hot dogs. All right, here you are, then. Thank you. Hey, mister. Yeah? You see that kid up at the end of the corner? Yeah, skinny one, sure. He's been eating in this diner every night for weeks.  Bro, on his stomach. Is he broke? No. He's got a job. Over to the radio plant. No, why don't he eat right? Probably spends his money on the girls and having a good time. See you later. Hey, you certainly wolf that down in a hurry. All right, guess so. I've got a date. See, what did I tell you? A date. That's where his money goes. No ambition to kids these days. Well, I don't suppose he even knows there's a war on over in China. Kids like him wouldn't be much help if that war was over here. I don't know. But I do. I know for sure. I know. Well, say something, George, will you? I got to get to China. I can fly and fight there. You said that a half a mile back. I want to fly, and I can't save more than $10 a week out of what I make to save my soul. $10 is only enough to pay for one hour solo time.  It's quite a mouthful out of you. I tell you, I've got to... I know you told me. Get to China. Now, listen. I had a small brainwave a couple of minutes ago. You ever heard of a place called Gravenhurst up in Ontario? I don't want to talk geography. I gave all that up in school. Well, you keep still. Now, there's a guy up there who has a kind of freighting contract with the Goldfields up north. By plane? Sure by plane. He needs men. I was thinking. Maybe you could trundle freight up there in exchange for solo time. Well, that is to get your license. Then you could... Hey, where are you going? I'm on my way. But you haven't any dough, George. No dough needed. I'll ride the rides. Yes, it belongs to kids like George. First, Gravenhurst, Ontario. In six weeks, a pilot's license. Then on to China, riding the rides again, westward for the Pacific coast of the USA. For a ship pointed for China and the war against the Japs. Well, I... What are you doing around these yards anyway? I've been afraid. Oh, no, sir. I was only... With the pretty choo-choo's? Sure. Okay, but where are you from? The last town I was in was Sumos. Well, that's Canada. Sure it is. This is the United States. Plan to stay long? Oh, no, sir. Just as soon as I can find a ship, I'm heading for China. I'm a flyer. China? Well, well, well. Hey, uh... How old are you, son? Seventeen.  How about it, son? We'll drop in and have a chat with the precinct captain. Your mind? Too bad. Deported back to Canada. All that way out and back for nothing. Too bad, George. Sound pretty smart, don't I? I was one of the people who met George after he got back. But the world I was a sure of and the one they were a sure of was cracking up and a new world was shaping up. One for that young man. Did I mention the date? September 1939. Britain at war with Germany. And Canada was headed in. Why did that lead to smug people? You and me. Is this where I joined the Royal Canadian Air Force? And this is the recruiting office, yes. That's what I want. What do I sign? Name is George Burling, age 18, born in Canada. Here's my logbook to show how many hours I've had in the air. Is there anything else? Just tell me where to report. Now, about just a moment, young man. We can leave the logbook till later. Oh, sure. I don't want you to think I'm boasting. It's just that I'm anxious. Screwing, please. Oh, I chucked that a long time ago when I was 15. No college then. Oh, sir, I didn't have time. Is something wrong? I'm afraid, Burling, a cadet in the RCAF requires a college education. But I'm a flyer. That's what you're recruiting, isn't it, flyers? Now look here, young man. You mean if I was a glassblower and had passed college algebra, I'd stand a chance. Hardly the way to put it, but the regulations state... Why don't you take your regular... Now, now, young man. You did. It does seem a shame. Poor old Duffer. That officer didn't make the regulations. And the men who did didn't know what makes a plane stay up any more than I do now. They learned, eventually, from kids like Burling.  Yeah, maybe someday somebody will let me push a broom around the barracks by trigonometry. I know how you feel, but remember, George, this is going to be everybody's war sooner or later. This is the big show. Now, why don't you bone up on the book knowledge? You'll get your chance. Meantime, how about a hot dog? I don't feel like a hot dog right now. Hey, wait a minute. You must be sick. What you need for that is a good hot dog.    Except one thing. I want to fly. I want to get over there where they're flying. All right. Why don't you go? That's a fine thing to say to me. I thought you were a friend of mine. I know you get tired of hearing. Okay, kid, okay. Maybe that wasn't the way to break it to you. But you can get over there. You can get into the RAF.  By working your way over on one of the neutral freighters, they're begging for a man. Can't get them. Maybe it was a bad way to break the good news to you. A boy who didn't know one end of a ship from another signed on as a deckhand to get over to England. Worked four on and four hours off through the marauding sub-packs. And when he'd see a plane overhead, he'd think of the sea. Ah, this is not my element. It's not my element. Boy, I wish I wasn't that plane up there. No, it's not your element. But it'll get you there, to Liverpool anyway.  And on the dock, you'll meet a policeman. How you fix for flyers over here? By the look of things, we ruddy well need as ruddy many as we can ruddy well get. Seems to me I've landed in Great Ruddy, Britain. Where do I find the air recruiting station?  Story, sir. How will you tell me the shortest way to get into the RAF? Splendid, splendid. Simple as pie now. Let's have a look at your papers. Oh, I haven't got any papers. It's not my logbook. No, it's not the logbook that worries me, old chap. It's your birth certificate. Now, what about your birth certificate? I never saw one in my life. True bad, old boy, true bad. I'm afraid I'll have to ask you to go back and get it. Oh, now, now, don't look so black, old chap. Where do you think the Burlings live, across the street? I came here from Canada. Sorry to cause you all the trouble, old boy. Regulations, you know. Got to have a birth certificate. Don't blame me. Just the ruddy old regs. And if he didn't do it, worked his way back to Canada, across the Atlantic and back again to Liverpool with his birth certificate and his logbook. He plunked them down on the officer's desk in the middle of an air raid. There. Is that satisfying you? There's my ruddy birth certificate and there's my ruddy logbook. Hey, sorry, old chap. All this noise popping can't hear you. It took you quite a while to get those papers, old boy.  Ruddy regulations, you know. And now you'll have the privilege of wearing the motto of the RAF. Veradjua at Astra. I can't hear you. Veradjua at Astra. Latin, old boy. Latin. I don't know any Latin. Hey, do I have to know Latin? Hey, what does it mean? Well, I guess you could say it meant to the stars the hard way. He made it. And that's just the beginning.  Well, it maybe it takes a while to put you in the shape you belong in. Because there are others like you, too, with the same determinations and desires who've all got to be trained to fight, not each for himself, but together as a perfect team. That's rank insubordination, Berling. I didn't come all the way over here to learn how to parade. I came to fly. I don't claim telling you it was a pretty poor business up there today. I got Jerry, though, didn't I? Naturally. Pulling off from formation, any of us can be a hero, part one for ourselves. Your job's to keep the tail of the plane ahead of you clear. And just be a sitting duck for any Nazi, sure. If you don't mind my saying so, pretty poor sportsmanship, Berling. Good day.  Why doesn't he cut out all these regulations and let us stick to our work? The fact remains, Berling, the sergeant has a black eye. Oh, I'm sorry, sir. He must have run into a door. You know, there's a lot of doors around here who don't take to him, sir. Come in, Berling. Sit down. Yes, sir. I'm going to recommend you for a commissioned rank. In spite of some difficulties, I think you'll offer some material. No, thank you, sir. I'd better stay the way I am. I feel like a pilot, but not like an officer. Like a pilot, eh, do you? I hope I am, sir, a pilot. You'll be a pilot, Berling. If you remember, this war is won by teamwork. And I think, too, you would do better to save your natural belligerency for the Nazis. They'll be where you're going. I agree, sir. I hope you do. Good luck. Where was he going? It's no secret now. He was going to Malta, where there were 250,000 prisoners. That's what the Axis called the people on Malta. But that bit of rock stuck like a pit in the craw of the Axis, preventing it from swallowing the whole of Africa. It's easy at this date now to forget that tiny, bomb-blasted piece of rock in the Mediterranean between Italy and Africa. And the handful of planes that defended it. But George Berling won't forget it. The scrambles when ops announced. Enemy planes approaching. Scramble. And the mugs of Koker that went flying out of the man's hands as they plunged out of the canteen. Chairs overturned, poker games interrupted, heading for their planes to rise over Malta to meet the superior numbers of the enemy and their bombers, relentlessly trying to blast Malta into submission. And in there is part of the RAF team, George Berling, getting his share of the enemy plane. Sometimes it's just one burst of fire from his gun, so accurate was his aim. Willie, a clean hammer up your tail for air. You all right? Would you watch it? Thanks, young man. Do the same for you someday. For crying out loud, keep your eyes pale. I can't see everything. Be back later. You see, he's learned he's part of a team, not just George Berling against a stubborn world that won't let him fly, but a part of the RAF against the fascists. But life in Malta was no setup. Malta was a besieged block in an axis-controlled sea. And planes have got to have oil and gas to fight with. And wings on their shoulder blades to fly against well-supplied stucas and measurements. Where's the oil coming from? Where is it coming from? Like bumps on a log, we sit here. Uh-uh. Read your magazine, Georgie. Look at the pretty pictures. I read it from cover to cover. Three times. No, now take it easy. This is a big lull. Yeah, before the kill. And Malta's a bishop called me for the juries to slice up any time they want to.  What do you mean? I said I don't want that car just from the bottom of the deck. Are you trying to tell me that I would? Yes. That's the second time I've read it. You're not the only one that has a freight edge, George. I don't see how you can keep calm. Don't you want to get up there and paste them flat against the blue? Can't use that precious gas just spitting around. Then why don't they get it to us, oil and gas? What do they expect us to do? Better start reading your magazine again, George. I'm speaking. Convoy approaching. Under enemy attack. Scramble. Scramble, George. Scramble. I was on a ship once a prayer. I know what it means to feel trapped down there. You won't be now. I'm in my own element now. Suppose you had been one of the people in Malta. You can see off on the horizon the cargo ships bringing oil and food. Oil for the planes that mean your life. Food for all of you, pilot and civilian, for the life of Malta. You can see the bombs falling. You can see the Nazi planes diving. To bomb the ships that mean your life, the machine gun, the deck. You can see two of those kids of the RAF and their planes. Your plane, zooming up to fight for those ships. For your life. You wouldn't be able to hear those kids talking to each other on their phones as they fight. George! George! You see him? Dying like a stone. I saw him, Willie. Damage for sure. A damage? A destroyed? A wreck? Well, trick to potting these jerry's if you keep your wits about you. The plane is almost asking to shoot him down.  Ah, that's from Burling. The boy who gets his daily dust. Take on a flock of 20. Indy, leave some for the rest of us. Why you ready? Standing below on Malta, watching, hoping, praying.   You see that ship, Willie? Flared up like a sheet of flimsy. And out. I saw it. I'm off for a little target package myself. Now, where on you tell?  Thinking ship after ship, the oil in them and the men. Well, any of that battered convoy ever get in, ever. It's going to.  Hey!  Yeah, George? You see what I did? Those guys machine gunning one of their own men in his parachute. I saw it, George. Maybe he thought it was one of us. As if he were a dummy. Look at him hanging there. Wimples are strung up duck. I suppose that had been you, Willie. You're tough to endure me. Just as they say, George, good being. I know what I'm fighting. Now I know why I'm fighting.    My life of willies are the guys down there in Malta. Even their hatred of their own lives. All right, I'll fight them. I'll fight them till I can't fight anymore. Now on out. It's me or them. Life depends on men like George Burling. You stand and watch that spitfire of his twist down through the sky. 3,000 feet. 2,500 feet. 2,000 feet. You want to yell with Willie. 1,500 feet. 1,000 only above the Mediterranean. And then he jumps. You see his parachute open like a burst of flak against the sky. He's floating down to safety. I've got you covered, boy. He's drifting down, held by a parachute. He hits the water. Manages to crawl into his rubber dinghy. The bottom of that dinghy fills red with the blood of George Burling. Who to cheer the most now as the remaining ships of the convoy pull safely into the dock at Malta? Those battered ships are the pilots like George Burling who help save the ship. Now you just cheer anyway. And you hear the pumps get going. Sucking the oil out of the holes of those ships so those RAF planes can keep Malta still safe for the United Nations. But George Burling has chunks of cannon shell in his ribs. The future belongs to men like George Burling. He was in the hospital for weeks, yes, and convalescing for months. But not now. He's back over there now, in the fight. When you think of him, when you think of how he and others like him were a team, a team that helped the convoys through the turning of the tide and held Malta. Then think also of that earlier kid. That's an era cobra. The future belongs to him. The future of a world that kids like George Burling are helping rid forever of fascists and fascism. Heard the 10th program of Words at War, a series based on the leading war books. This evening we presented Malta Spitfire by flying officer George F. Burling and Leslie Roberts. The adaptation was by Kenneth White. Next week, listen to Words at War at our new time, Thursday evening, 11.30 p.m. Eastern wartime over most of these stations. You'll hear Burma Surgeon by Dr. Gordon S. Seagrave. In our play tonight, Don McLaughlin was the narrator. Joe Julian was George Burling. Other members of the cast were Irene Hubbard, Lon Clark, John Griggs, Peter Hernandez, Ian McAllister, Maurice Tarplin, and Harold Young. The original music was written and conducted by Frank Black. The production was under the direction of Joseph Losi. It's been presented in cooperation with the Council on Books in Wartime by the national broadcasting company and the independent radio stations associated with the NBC network. The program came to you from New York. This is the national broadcasting company.


My name's Isaac Hepworth. I'm a product manager at Google. I work a lot on supply chain stuff. I work on Google's own internal supply chain. I do a lot of work in open source as well. I chair the supply chain integrity working group in open SSF. I work closely with the Salsa team, SigStore, and so on. And I'm here with my colleague Brandon, who I'll introduce himself to. Hi, I'm Brandon. I'm a software engineer at Google. I work on software supply chain. As well as open source security, both concentrating on metadata, what to do with it, a lot of S-bombs, as we're going to talk a lot about today, S-bombs, Vax, Salsa, and other jazz. Also involved with the CNCF tax security as well. All right, great. Well, thanks for turning out to talk about S-bombs. Quick show of hands before we get started. Who's heard of S-bombs? Awesome. OK. Who has heard of the US executive order, which specifies an S-bomb requirement? OK, good showing. All right, this is good context. Let's begin. So we've got three things to talk about today. We're going to talk generally about Google's journey through the S-bomb landscape over the last couple of years, driven primarily in response to the executive order in the United States. I'll talk a little bit about how we iteratively understood the assignment. What are we supposed to be doing? What does the executive order even say? What does it mean? How should we approach it? Brandon is going to talk a little bit about our journey into the technical parts of S-bomb land, the tooling and infrastructure we built, how that played out, the types of properties we were looking for in S-bombs, how we guaranteed quality, and so on. And then at the end, Brandon and I are both going to share just a few of our hot takes, some kind of insights or surprising things that we've learned on the journey, and give you a sense of what's next. So let's get started, understanding assignment. I started, I joined Google a few years ago, and within a week or two of me joining Google, I received this email. And the subject line is, producing an S-bomb for various ecosystems to meet the executive order. And it had this ominous line at the bottom, Isaac, do you have bandwidth to drive this? I was a couple of weeks in to Google, and apart from training and everything, turns out I did have bandwidth to drive it. And so let's dive in. And I kind of figured I should start by understanding what is the executive order. Turns out there's an executive order that came out from the Biden administration. In May 2021, executive order 14.028 on improving the nation's cybersecurity. And it's a long document. And I've linked each slide, which has a URL on the footnote, also has a QR code, which will take you to that URL if you want to look up the primary source here. But the executive order, amongst other things, has an implication for software companies that supply products to the US federal government. And the implication is that these software producers have to be ready to provide S-bombs for their products. And there's an obvious question. What is an S-bomb? And how should we understand that? Well, it turns out that CISA, a part of the US government, has got your back here. And cisa.gov.slash S-bomb has actually got a great set of resources on understanding software bills of materials. And I love this quote here. An S-bomb is a nested inventory. It's a list of ingredients. And it turns out that looking at software supply chain and looking at the supply chain for, say, packaged foods, there's a set of really rich parallels there. And hey, think about Salsa. It could be that the tamper-proof seals on your food. Or it could be the food handling processes you use in your food manufacturing. And amongst these rich parallels, I think that thinking of an S-bomb as a list of ingredients for software is actually a really useful way to think about it. And CISA will guide you and give you a list of, what are they useful for? And again, like foods, if I'm a producer of food, I should be keeping track of what's in it. So that's kind of my basic responsibility. If I'm in the grocery store and I'm picking things off the shelves and I'm looking at ingredients labels, I can use the ingredients labels on foods to select foods which I'm going to enjoy, which are going to be good for me. And when I'm at home with those foods, as I'm consuming them, I can make sure, again, looking at the ingredients that are not allergic to any of the ingredients. These ingredients don't have any known contaminants in them. You can think of those as vulnerabilities, maybe. But I can assess that ingredients list at the point of consumption and decide, do I want to consume this food? The same is true for software. And so CISA lays out use cases for S-bombs in these, sorry, NTIA lays out use cases for S-bombs in these three categories here. Mentioning NTIA, I just confused CISA and NTIA, one of the aspects of my journey through this world was making a whole load of new friends with a bunch of government acronyms, many of which I didn't know existed when I started off here, some of which I really not quite sure how they fit into the picture today. And I would really struggle to demonstrate or join up a diagram of how will these various pieces fit together, how they interact, which ones produce normative requirements, which ones not, which ones are guidelines, which ones are specifications, where does regulation come from, where does legislation come from? There's a whole story here, which is probably an entire other talk. But as a product person, I started off thinking, let's think about the requirements, OK? I got this email, we're going to do something with S-bombs to the executive order. How should I think about what the actual requirements are here? And I started here simple enough. For each Google product, we're going to produce an S-bomb, and we're going to identify the dependencies of that product. It's simple enough. And then you look a little bit closer at this, and you kind of highlight, well, an S-bomb. Maybe some more specificity is needed there, exactly. Again, writing requirements, I need to kind of give engineering teams at Google a sense of exactly what are they going to have to do. So it turns out that NTIA, again, has your back. There's a document called the Minimum Elements for a Software Bill of Materials. This is a great document, super approachable, super sure, very understandable. And it lays out from the US government's perspective what makes for a kind of a baseline adequate S-bomb. And it talks about the minimum set of data fields that an S-bomb should include about each dependency. It has some mention of automation support, what serialization formats and interchange formats you should be thinking about. Highlighted SPDX here, and Brandon's going to talk a little bit more about that. And I really love this thing down the bottom right about the accommodation of mistakes. It was a welcome discovery to see the US government thinking this way that this idea that as S-bombs become operationalized at scale, there will be hiccups from time to time. And S-bomb consumers should be fairly lenient with respect to genuine errors made in good faith. And I thought, again, highly pragmatic, really approachable as a baseline specification document. So I love this document. Definitely recommend you check it out if you haven't before. So we have some idea about what S-bomb is. And we can go back to our requirements and produce a second draft. So now for each Google product, we're going to produce an S-bomb in line with NTI's minimum requirements, identifying dependencies. And you may think, OK, we're done. Great. But actually, you look a little bit closer in this. And you go, well, each Google product, that's a lot of Google products. Wing, Google Wing, Wave, Waze, Waymo, Workspace, the Pixel Watch. These are just the ones starting with W. And so there's a whole ton of Google products to think about. And again, as a product person, again, as someone on a timeline, I'm thinking about how can we scope this? How should we think about, from the universe of Google products, where should we begin? Well, in this case, NIST shows up and has this document here, again, linked from the slide, and has actual guidance on what NIST defines as EO-critical software and a list of characteristics which software has to be considered critical in the context of the EO. And that gives some great guidance as to where we should focus our efforts to begin with, which products we should prioritize, how we should phase our approach to building S-bombs across Google's product portfolio. So we'll go back and revisit our requirements again. And we'll now just make this slight tweak here for each Google product in scope. We're going to produce an S-bom, NTI's minimum requirements. I don't know if I get dependencies. And again, you may think, well, we're done, right? Well, not quite, because there's nuance lurking in this word dependencies here. And S-bombs were originally conceived for a world of package software, where you get software on maybe a floppy disk, like that Chrome floppy disk that we saw with the S-bom illustration. And in that sense, you look at what are the bits and bytes on that distribution? What are the bits and bytes you give to a customer? And you can kind of imagine notionally starting at the middle of the floppy disk, working your way out to the edge. And when you got to the edge, you're done. You've inventoried the whole thing, and all of everything you've captured is your dependency set. Well, you've talked there about, perhaps, you've talked about the bundled runtime dependencies. But there are other dependency types, too. Your software may have shared dependencies with other pieces of software on the same deployed platform. There may be build dependencies. What tools were used to build the software? What tools used to test it, to link it, to integrate it, to sign it, to package it? And this is important, again, from a think of it in the food analogy. Yes, I want to know the ingredients in my peanut butter. And they also want to know what machinery in the factory made that peanut butter. Was it leaking engine oil into the peanut butter while it did so? And so the build tools you use do have an implication about product quality. Service dependencies. Again, the Chrome example. Sure, you may imagine Chrome on a floppy disk, but Chrome itself syncs to the cloud. Syncs, bookmarks, cookies, passwords. So there's a hidden server side of Chrome which you may not consider. But it's a dependency of the product. So service dependencies perhaps come into scope. There's platform dependencies, too. What about the operating system? What about infrastructure or middleware? This stuff runs on. Is that a dependency, also? And then configuration as well. Configuration can change the behavior of software. It can change what it's vulnerable to. And so there are implications there for how you think about dependencies. Again, as a pragmatic product person, I decide to scope in. Let's try and focus on the most critical part of the S-bomb, which we identified as the bundled runtime dependencies, including transitive one. So we come back to this idea of we're shipping a piece of software, inventory all the bits and bytes of the software, and you're done. But we're not quite done.  How should we actually have an S-bomb which identifies the components? What identification scheme do we use for software components? A given piece of software, log4j, in this case, may be referred to by a bunch of different names, different capitalizations, maybe including version numbers as a combinatorical explosion of ways to even think about log4j. And then when you try and boil that down to an actual, unambiguous, externally referenceable identifier, there's more to it than meets the eye. And I've linked from the bottom here. Ciccer actually put out a request for comments in October last year asking the industry for input as to, how should this problem be approached? For open source, it actually turns out that Perl's PURL is a great identification scheme. For closed source components, it's a relatively unsolved problem. It's not solved terribly well right now. And there are active efforts to try and do better here. We ended up using Perl's. And so we're going to say our requirements here now say not just identifying the components, but using unambiguous, external identifiers. And you know what, we're going to add one more thing as well, which is we're going to add, why are we doing this? And the focus of this initial effort was to make vulnerability management easier for customers. Why is that important? Because it turns out that one of the primary things you need to think about when generating S-bombs is, how do I join up my S-bomb data set to a vulnerability data set? And if your vulnerabilities are indexed using one set of software IDs, and your S-bombs are indexed using a different set of software IDs, you're going to have trouble. And so again, landing on Perl's as a way to identify software allowed us to do that joining and allowed us to say, OK, now consumers of this S-bomb can join it to vulnerability databases and guide themselves down their vulnerability management journey. And at this point, we kind of are done. And a version of this, actually a 12 or 13 page version of this statement here, became the requirement doc for S-bombs at Google in service of the EO. But even there, there are a few other considerations. I'm not going to go into great detail here. I'll talk a little about these mythical creatures, S-bombs, later on in the talk. But you need to think about a number of other factors here, non-functional requirements for how are these S-bombs going to meet the world? How are you going to support them? What are they going to look like when they're outside? But I'm going to hand over to Brandon now, talk more a little bit more about the technical details of what went into our approach. Awesome. Thanks, Isaac. Cool. So let's get into how we actually did this, what services, what systems were involved. But before we go into the details of that, we kind of looked at the problem and wanted to figure out what are the big questions we are going to ask that will eventually influence the designs that we're making. So the first thing we started off was, what is along Isaac's kind of thinking? What is the S-bomb? What do we want on the S-bomb from a technical generation perspective? And the thing we came up with was both for the EO, but also for vulnerability management, is accuracy and completeness. And this is around, does my S-bomb contain the right dependency information so I can make vulnerability decisions? And the second one was something called trustworthiness. And this really boils down to the question, can I, in good faith, use this S-bomb for important decisions, or in this case, give them to the government for compliance? And around these properties, we came up with a list of best practices and kind of trade-offs for all the things that we could do. And we'll talk and highlight a few throughout this section. So the second broad question we were asking is, along the lines of many people were asking when the EO came out, SPDX or Cyclone DX, which standard should I use? But this really led to a little bit of a broader question is, how opinionated do we want to be? And in this case, given that the scope, as Isaac has pointed out, is huge, and Google is huge, and has many products, anytime we can use less, so less is more in this case. So there are a lot of ecosystems, products, organizations, tech techs. Whenever we say that there's only one common denominator, this means that we have better shared tooling and fewer integration points. So coming back to the question of SPDX or Cyclone DX, in this case, we said, you know what? Based on the expertise we have and the familiarity and analyzing the ecosystems of these two standards, SPDX is the standard that we're going to go with and no exceptions at all. So there are many other kind of such decisions that we have to make, and we'll go through this again throughout the process. So technically, not about what's included in fulfilling the EO, from an engineering perspective, is one generation of S-bombs, two, storing the S-bombs, and then finally, whenever a request comes in from a compliance officer or a federal agency, we want to be able to retrieve the S-bombs that they want. So breaking this down to three, and let's start with generation. So in generation, I think we've seen a lot of different definitions of S-bombs. We have like source S-bombs, build S-bombs, analysis S-bombs, and like, you know, document was produced sometime last year talking about the different things and how they are all important. But if we just scope this down to dependency information, we can kind of do a comparison across all these. And so we have source, build, and analysis S-bombs, which analysis S-bombs are really around artifact, getting S-bombs information from artifacts. And we took a look at this, and if we look at, you know, on the far left, if we start looking at source, right, if we take source and try and create the S-bombs from it, what we found is we got a lot of dependencies. And like, a lot of dependencies is good, in means it's complete, but not necessarily accurate in the case of what we noticed was, you know, things from tests and plugins, and for example, Java build plugins were all included in the S-bombs. So this doesn't necessarily reflect accurately the information in the artifact. And then again, if we go all the way to the other corner where we take analysis S-bombs, where we are scanning the artifact, you know, we find that the S-bombs is incomplete, and we showed this two years ago, we had a talk in a Q-con, and we showed like, if you had built a Rust binary and then you copied it into the container, you would see no dependency information of the Rust binary at all. And this is part of the process, I think like built inherently lossy, and therefore we run into the problem of incompleteness. So we are in a little bit of a go-de-lock situation here, right, on one hand, it's too inaccurate, and on the other hand, it's too incomplete, right? And so the only place where we really know how the software or the sausage is truly made is where the sausage is made, in which in this case is the built process, and more specifically, the built tool. So what we ended up with, and in the spirit of being as close to built, right? So this was our first mandate, we said, all EOS bombs that are produced can only be produced by a builder, right? So saying that only built processes can produce S-Bomb builders was the first step. Having S-Bomb generation be the default in these builders went a really long way in kind of getting that, and on the team of less is small, we had many, many products, but we only had maybe a handful of builders, and therefore it made sense. And number two is like, what did we end up with generation tooling? And following the same philosophy, right? We wanna focus on built tools as much as possible. And so in certain cases, so for example, like Android, where we had very specific constraints, we were able to say, you know, Android has its own builder, it's written mostly with the Gradle package manager, and so we created S-BX Gradle plugin, which we then donated to the community, and this built tool generates very accurate and very complete S-Bombs. Another case where this is possible, and I know most of you may have heard of the Google Tree Mono repo, that's where we keep a lot of code. And in this repo, there's something called Blaze, and which is similar to Bazel, the open source version, where you declare your dependencies, you declare annotations, you kind of have a lot of metadata about your software. And so from this, we were also able to just pass the metadata and generate accurate and complete S-Bombs. But Google is still like many, many, it's still a tech company, and there's always a long tail of software where we have different use cases, we have specific needs, and we end up with a long tail of the many different ecosystems that we may not fully understand, or we may not have the correct tools to deal with. And for that long tail of software, we use generic composition tooling, SIF is one of them, we also have an internal tool that does that as well. So with generation out of the way, Nick's a storage, and storage is easy, right, the S-Bombs just put them in the database. Yeah, Blob-Saw. But unfortunately, this wouldn't be an interesting talk. So let's talk a little bit of, if we had the S-Bombs database, what would we want out of it? And the question we want to ask is, how do we create an S-Bombs database that we trust? We will end up, and federal agencies will end up using these S-Bombs to make security remediation decisions. How do I know that I can trust it? And the same way we decide what food we want to eat, we depend on the labels that are on them, right? And in this case, in this picture here, provided by Isaac, there was this, apparently this Amazon rep, which God knows what's in it, because it's a default template. So to achieve this, for storage, we have a project called SIDO, or Supply Chain Integrity Log. And contrary to the name, it's a bit of irony, but the purpose of the project is to break down metadata silos. And so this component is in charge of gathering all the software metadata together and then from all these events that happen in Google Supply Chain and then make the metadata usable. And for those that are familiar with the OpenSSF Quark project, this project has some similarities and it's also worked on by the same team. So let's take a little bit into SIDO. And so pre-EO, what does SIDO do, right? So traditionally, when builders build an artifact, they generate something called Salsa Providence, which is a now OpenSSF project. And the TRDR, if you're not familiar with Salsa, is basically this document. It says, hey, I'm a builder. I build this artifact securely. Here's some additional build information about the build. Here you go and signed off by the builder. And so what happens here is then SIDO then validates and says, okay, great, this artifact with hash A, B, C, D is good. And it was built by a trusted builder that I verified the signature on. So that was SIDO's purpose, right, day to day. And so when it came to S-Bomb, so you're like, okay, let's try it out, right? So let's do the first iteration. Let's say, okay, builders send the S-Bomb to SIDO. And in this case, it doesn't actually work quite well for multiple reasons. But the biggest reason in this case, the first problem we ran into is that S-Bombs are not naturally very good at self-describing. And so the S-Bomb may not be able to accurately describe which package or which piece of software that it's generated for. And this is especially so if you're using analysis S-Bomb tooling, because they are always based on file system, so they don't have the logical view of what the software they're actually scanning is.  I'm here, what's in these files. Here are all the dependencies, but I don't actually know what these files are for. And most of the time, the artifact analysis engine does not have the context to be able to put that in the S-Bomb. So what we ended up with is an in-total attestation. We create the custom predicate called reference attestation. And this reference attestation allows us to say, here's the S-Bomb, here's where it's located, here's the hash, and this is for software with hash ABCD. So this is great because now we can say, if I have an artifact, here's the S-Bomb for it, but we're still missing something. It's like, how do I know whether this S-Bomb was generated by the builder, or I downloaded a bunch of files, I ran SIFT and then I uploaded it to SIDO. And this is where we do the same as in Solstice, where we assign the attestation and then the signature is validated by SIDO. And this gives us two properties. One is that the S-Bombs hold their integrity. We know they haven't been tampered with since they left the builder. And the second is we know that all the S-Bombs come from a proof builder because they were assigned by a builder key. And we know that for all these builders that we've actually have in our allow list, that we've bettered the S-Bomb generation process. And this is more like the engineering exercise where we talk to the different builders and I ensure that what their tooling strategy was okay, they're doing the right things. Awesome, so with all the builders now sending their S-Bombs and attestations, we get this really nice mapping of like, here's the URI of Artifact, here's the URI of the software, here's the hash and here's the path to the S-Bomb. Now, with this, which free role should be simple as well, right? And as usual, famous last words, we also thought so. We thought it would be straightforward. So let's talk about it. So we wanna be able to say here that I have a path to a container or hash in this case we say like some GKE container image A, B, C, D. In this case, we wanna say, okay, look up this container ID, give me back an S-BDX document. We ran this and then we got nothing. So, right, where's the S-Bombs, they're like sneaking out somewhere. So why is this a case? And kind of it boils down to, you know, there are many cases we'll talk about a little bit more, but they all stem from this idea of like, it is a supply chain, and what we're doing is you're just looking at one part of the graph. And so we need to look at it in terms of the graph. And in this case, we look at the supply chain and we notice that, oh look, the last step of it was actually image promotion, right? It was like, I took a staging image and then I copied it to production. It wasn't a build, well, depends how you define build, but it wasn't like building a piece of software in terms of compilation. And so it didn't have an S-Bomb. So we didn't have an S-Bomb for it. So let's kind of follow the graph back, right? So we go back, next step, look for S-Bombs, still no S-Bombs. So what's happening here? So let's go back further. And in this case, in fact, we find two S-Bombs, right? Over here we see, you know, staging, we have two staging S-Bombs being built, one, each of them for different architectures. And then there's a seminal step where they become a multi-architecture image and then the multi-architecture image just then gets promoted, right? So this is what happens and if we can just keep on doing this, going back and back, and you know, we may find out, oh, there's a Rust binary or some other binary that's opaque that's built early in the chain and we return all the S-Bombs that we find, right? And this is exactly what we did. We implemented this, we said, and thankfully the S-Bombs appeared. So all was well, we didn't do all that for nothing. And this is what we're using today. So this is how we're returning S-Bombs. We don't do anything fancy with composing them, we just zip them up and say, here's all the S-Bombs that you need. But yeah, what were some of these things, right? And here are some of the issues, type of issues that we ran into. And we found that a lot of this was including repackaging, re-tagging, signing. But our best practice here, take away is compose S-Bombs to obtain more complete S-Bombs. And we find that each ecosystem generally knows what it's doing, right? Python knows what it's doing, NPM when it's building something, knows what it's doing. But where a lot of the incompleteness comes out is from packaging, where you're going across ecosystem. And the same way we don't expect like the mailman to know what's in our Amazon package, we can't expect like a pack, a Docker build to know what's in the Rust binary. Awesome. So all this work, it was great, but I skimmed a pretty big detail here, which is like, what's this graph that we're traversing? How did we get it? Where's this magic coming from? Like, how do I get one of these? And for that, we can go back to the build. So as a quick recap, we saw this slide earlier, which is what Scyler was doing pre-year, basically it's generating Salsa provenance. And part of the attestations that are built with Salsa in the Salsa provenance is including what was also used to build the artifact. So the materials that went into the artifact. So in this case, we have both the inputs and outputs of the build, and what we can do is we can take the Salsa provenances and kind of just like chain them up, one, the output being the input of the next one, and we can construct the graph of the supply chain. And we all do this by hashes, by source repositories and so on. So this is how we're doing the graph composition analysis. And if you wanna read more in detail, there's also a blog post that Isaac and I wrote about a couple years back about how to do this and kind of like just a high level concept of it. Great, and last but not least, just to wrap up this retrieval section, one of the things that I talked about so far is that you have a URI, you have a hash, like what do I do with it? But I think the question that as we're doing run truths of the EO to try around this with compliance, we notice that the requests may look, maybe a little bit different, right? So in this case, they may be asking something more like, give me the S1s for Pixel OS, they're not gonna say give me the S1s for Shara 256, DEF, because that's what they're understanding from their use of the software. And what we found about this is, this is really hard, and this is where we lean a lot on the product owners themselves to kind of have a sense of like, how do I translate these requirements? But one thing we found that is very effective, we found like successful teams do, is if they kept an inventory of the product they had and the product mapping. So to sum up, in generating S-bombs, always use builders and build tools when possible. You can do the composition analysis otherwise and generate S-bombs in all steps. In storage, ensure S-bombs are tested and signed. Sousa, it's a good thing to have, to store them, use good software identifiers like URIs and artifact caches. And lastly, in retrieval, compose S-bombs whenever you can because they're using Sousa and have product teams maintain some type of inventory mapping for their products. Awesome, and the fun section. All right, thanks, Brendan. I think Brendan and I, having spent a few years looking at this and working together on this, we could talk pretty much forever about S-bombs and definitely if you are looking for more, come and find us afterwards, I'm happy to take more questions and follow up. We've got a few things that we wanted to just highlight. Some things that stood out to me, I'm gonna start with a couple of things and Brendan has a couple of observations and we'll close. The first one that I thought hard about and I've come to some realization about is that I don't think that S-bombs are the goal of the executive order S-bombs requirement. People ask, hey, one day when the executive order deadline kicks in and everyone's producing S-bombs and giving them to the federal government, they're gonna wake up to three-quarters of a million S-bombs in their inbox and wonder what to do and probably they're just gonna take them and put them in a filing cabinet somewhere at which point you may ask, well, what good was the executive order S-bombs requirement? And I think there are a couple of things that stand out to me. Number one is getting something like S-bombs off the ground in an industry is a really difficult chicken and egg problem. There's a cold start problem here that no one wants to produce S-bombs if no one's gonna bother consuming them. And no one is gonna build consumption tools or great tools to consume them if no one's producing them. The great way or a great way to solve problems like this is with regulation where the government will come in and say, okay, we're going to decide that we're gonna use the purchasing power of the federal government. And those words are used literally verbatim in the executive order, the purchasing power of the federal government to catalyze the industry to start producing S-bombs, to break this deadlock. The government is gonna say, well, we now require S-bombs. And that means suppliers to government are gonna need to build them. And that means suppliers to those suppliers are gonna need to build them. And so on, transitively, up the chain. And so it's a catalysis motion to get S-bombs to begin to be operationalized in the industry, whether or not, and that's independent from whether or not the federal government actually gets individual utility from S-bombs. So that's number one on this point. Number two on this point is I think that generally, discovery that we've made along the way is that it is rather difficult to produce an S-bomb unless you have a certain amount of just basic baseline operational hygiene and operational discipline in your software supply chain. And so again, this is a way of forcing that into the industry. So I'm just saying, this is now the new acceptable baseline. You need to at least know what the ingredients are in this software. That's a place to start. I really see it like this is a starting point for an entire decade-long journey. If I think back to the US food supply chain, the equivalent to this regulation came in 1939 in the United States and that was the legislation that brought in the mandate for ingredients labels on packaged foods. And it took about 20 years, following that regulation, to get to 50% of the US food supply chain in compliance with that legislation. This is a long process. And so I think the executive order S-bomb requirement is a catalysis motion and it's a requirement for people to start to pay attention to this domain. The other observation I'd share, and this is a little bit spicy, is that I think that S-bombs are a poor fit for SAS products and why do I think that? Well, I think that if you're in the world of packaged software, you've got that floppy disk, you look at the bits and bytes, you inventory them, say, here's the ingredients of this thing I just gave you and when you run that software and when you operate it, you know that the totality of the components you're exposed to. How do you solve that problem for SAS? Like let's imagine that I go to docs.google.com, Google Docs on the web. What is the totality of computing infrastructure I'm now exposed to in using that software? Well gosh, obviously there's the Google front end which serves the web, there's all the JavaScript, there's the Google identity system which has seamlessly logged me in, there's Google Drive which is used for storage below Google Docs, there's Google infrastructure like Spanner which is used for storing the data behind this thing.  And so I think there's a consideration that S-bombs are a good fit for SAS. I don't think they're there yet. I think we need more specificity about how do we reason about this transitive dependency footprint in a risk-centric way? How do we think about the risks involved? And there's a question about agency who's operating the software, who's responsible for vulnerability management and so on. So anyway, spicy take, there's more work to come. Ciccer itself is gonna be putting out a white paper on this topic in the coming weeks and months and I think there's much more work to do here. Yeah, just like the last quick one, like Isaac said, S-bombs don't need a beginning. We found a lot of these use cases internally that have been kind of what people are interested with S-bombs and it provides a unique opportunity because we've gathered all this information of different products all in one place. And an example of that is, we use guac to kind of do some analysis and we took all the container S-bombs that we had and we said, okay, give me this open SSF scorecard of all the third-party upstream dependencies and now we have this mapping of like which are the most frequently used third-party packages which on this top left-hand quadrant also have a really, really bad like open SSF scorecard score and then we can make this action to say, okay, let's create, let's have more efficient security investment to fix things which are used more widely. Awesome. And that's it. Thank you so much.


So I wanna do a short recap of what we have seen so far with these trigonometric integrals. If we have an integral that only involves signs and cosines, so we have some integral sine to the A of x times cosine of B to the x, dx, if you have something like that, if the power of the sign is odd, if the power of the sign is odd, you're gonna borrow one of the signs so you do a du, and that's gonna force then the u to be cosine of x. And then you can transition all the other signs into cosines using the Pythagorean identity sine squared x is equal to one minus cosine squared x. Now, if the roles are reversed, if the power of the cosine is odd, right, in that situation, you're gonna borrow one of the cosines to do a u substitution, so you want du to be negative cosine. You might need a double negative as the sign's not there. So du's gonna be negative cosine, then you want u to be sine, and then you have to transition all of the cosines into signs using the Pythagorean identity cosine squared x equals one minus sine squared. Now, what if the power of sine and cosine are both odd? Well, then you get a pick. You can do whichever one you want. Isn't life great when you have choices? Now, the third possibility is, what if this is the one we don't like as much? What if both the powers of sine and cosine, what if they're both even? Well, in that situation, you're gonna have to use the half-angle identities. Sine squared x equals one half one minus cosine of 2x, and cosine squared of x equals one half one plus cosine 2x. So what you're gonna do is if you have only even powers of sines and cosines, you have to transition using the half-angle. You're gonna replace the sine, you'll replace the sine squared with this cosine 2x, this cosine squared with the cosine 2x, multiply, foil out that thing if you have to, and this will now give you a new expression involving cosines of 2x, and then reevaluate the situation at that moment. If you have an odd cosines, then you go back to case B right here. If you after this have an even number of cosines, then you're gonna have to repeat this process, rinse and repeat until you're completed. So what this strategy does is it tells us that if we have any product of sine and cosines, who cares what the exponents are? We can calculate its anti-derivative. Now, the higher the exponents are, the harder this process is, but using u substitutions and the appropriate trigonometric identities, that is the Pythagorean and half-angle identities, we can calculate any integral involving a product of sine x and cosine x. And that'll then end our lecture 10. We'll talk some more about trigonometric integrals in the next lecture number 11, so stay tuned for that. If you have any questions on any part of this lecture or any part of this lecture series, feel free to post those questions in the comments below. I'll be glad to answer them. Click the like button, subscribe if you wanna learn more about these calculus videos in the future, and I will see you then. Bye, everyone.


Today's episode is going to attempt to break away from a lot of the tension and anxiety that much of us have felt with recent events. So we thought it would add some levity and be a fun exercise to look at a different type of presidential fight. Which American president would beat all others in unarmed combat? Who would win in a hand-to-hand presidential fight? So right off the bat, I just want to ask that we don't delve into any political debates or fights on this topic. This is just for fun. We're trying to add some levity to the situation and this is in no way a commentary on current events. So I'm asking that we leave that out of this. This is looking at the martial arts and the presidents that may have studied them in practice them, so I trust you guys, I trust this audience with this topic, let's keep it civil, let's keep it fun, and let's get into it. So the conditions for this list is we are looking at presidents who have known martial arts experience or some sort of hand-to-hand combat training. Many were athletes and many also fought in wars. The presidents on this list are our picks of those with unarmed hand-to-hand fighting experience and at the end of this video we're going to pick who we feel would win among the group. We are also excluding both candidates that are currently in the news. First of all, like I said, this is supposed to be fun and this is not an attempt to capitalize on either name so you're not going to see either one referenced in the topic, in tags, in thumbnails, or in the description. This is just for fun. And second and even more importantly, neither one of those candidates, we could even find any martial arts experience on so they wouldn't even have made this list anyway. So with that out of the way, let's have some fun. So one quick note is that most of the presidents on this list are old school, which means they were exposed to a very different fighting landscape than what we see in America today. So that means topics such as Kempo, Karate, Brazilian Jiu-Jitsu all came after their time or most of their time. So that's just something they keep into perspective is that we're talking about different eras here. However, you know, even that being said, many of them were still very skilled grapplers and wrestlers. So let's take a look at our player roster. This list is composed of presidents that we were able to find any mention or specific history involving grappling or striking skills. But before we can crown one of these commanders in chief, let's do a few quick rounds of elimination. Round one, fight. The first two to be eliminated are presidents Calvin Coolidge and Andrew Jackson. Calvin Coolidge, the 30th president of the United States, had a long history of practicing law and politics. However, while he makes a list of wrestlers, he was known to have wrestled in his youth, but since we placed the condition of the fighters being in their prime, it seems like his experience would have paled compared to the others on this list. There is a quote from his father, Colonel John Coolidge, that says that his son was a tolerable, good wrestler until around the age of 14 when he took the duty in a round and daydreaming about being a big city lawyer. In one such instance, he challenged one of his critics, Charles Dickinson, to a duel, with the strategy of allowing Dickinson to turn and fire first, hoping that in his rush to shoot, he would be less accurate. Dickinson did in fact fire first and the bullet struck Andrew Jackson in the chest. Unfortunately, under the rules of this duel, Dickinson had to stand still while Andrew Jackson took his turn, which means Jackson took his time, aimed carefully and fired, making and killing his challenger. Although Jackson survived the shot through the chest, he earned himself the reputation of being a vindictive, cold-blooded killer. In any case, regardless of any skills he may have had with a firearm, this list is really committed to those with hand-to-hand combat, so unfortunately, that's not enough for him to make this list. Dwight D. Eisenhower was the 34th president, as well as holding the rank of five-star general during World War II. He was also a fan of boxing and wrestling. Gerald Ford, the 38th president of the United States, also held an affinity for boxing and served as a boxing coach at Yale, as well as the United States Navy during World War II. Barack Obama was the 44th president and also only one of two presidents on this list to hold a belt rank in a formal martial art. President Obama practiced Taekwondo and earned his way to Greenbelt. In 2009, he was given an honorary black belt, making him the only one on this list to technically hold a black belt of any kind. So we already did an episode on honorary black belts, so if you're interested in a further discussion on that topic, go check out that episode. Ulysses S. Grant was the 18th president and often engaged in casual wrestling. Okay, so while these four took a little bit more consideration compared to the rest of the combatants on this list, this is as far as they go. Barack Obama is definitely focused on fitness, and I feel that his experience in Taekwondo was more fitness-based than combat. And while Ford and Eisenhower seem to have good boxing skills in their prime, they are products of a more contemporary time and more civilized fighting. Ulysses S. Grant is from an older and rougher time, but he didn't have the formal wrestling experience as some of the others and was of a smaller stature, standing at about 5'8". When put up against who's left on this list, it's my personal opinion that these four men wouldn't go much further than this. So now it gets harder to eliminate because the guys on the left come from a much rougher time, roll around in the dirt type of time, and many of them are known for their aggression, unwavering focus, and sometimes just their sheer size and stature. Also many of these presidents engage in an older, Irish-style type of wrestling called collar and elbow. Now this may be a topic we can expand on further if that's something you guys want to see, but collar and elbow wrestling is very different than what you might find today in high school or collegiate level wrestling. Typically, each opponent would wear jackets or thick garments that could be grabbed and pulled, and the objective was to throw your opponent onto their backs. Collar and elbow wrestling also typically allowed trips, kicking, throws, chokes, and submissions. The first president, George Washington, was very well versed in collar and elbow and grew up using his wrestling to fend off bullies. Zachary Taylor was the 12th president, a career military officer, and also skillful collar and elbow wrestler. Abraham Lincoln, the 16th president, not only was also versed in collar and elbow, but his size, reach, and sheer strength made him a formidable foe. James Garfield was the 20th president, and grew up an avid wrestler. His father was the grand champion wrestler in Northeast Ohio, and Garfield himself was the unofficial champion at Hiram College. Theodore Roosevelt, the 26th president, was known as the Rough Rider, and he had extensive experience in boxing and grappling. Along with Brock Obama, Roosevelt held a formal belt, earning a brown belt in judo. William Howard Taft was a large man, adept at collar and elbow, and was a heavyweight wrestling champion at Yale. Now, picking who would advance to the final round was a little bit more of a challenge, because many of them were sizable, and pretty much most of these guys here had some sort of experience and some really rough fighting. So after careful consideration, the presidents that we choose to advance to the final round are George Washington, Abraham Lincoln, and Theodore Roosevelt, which, coincidentally enough, all three of these men are on Mount Rushmore. Maybe it's because they're stone cold. So quite honestly, what it came down to is that these three men not only had good fighting skills, but they were also known to be scrappy, no nonsense, and quick to join a fight. Finish him. As they used, George Washington found himself faced with bullies at the age of 15 when he entered finishing school. But the thing is, the bullies did not have much success, because with Washington having experience in collar and elbow, he made quick work out of them and he put them in their place, and later went on to become a wrestling champion. Oh yeah, and there was that whole revolutionary war thing in which Washington helped defeat the British and established the United States, so credit where credit is due. Abraham Lincoln also did not take any crap from bullies, and he was actually known as a bully hunter. As a young man, he was recruited by his town to take on a local formidable bully. They agreed to a wrestling match, and Lincoln supposedly folded them into a pretzel. Honest Abe was a large man, a veteran of the Black Hawk War, and known to be very strong. During the war, he defended the native that his troops wanted to kill, but everyone was too afraid to challenge Abe. He was also very proficient with the axe, and it was said that he showed off his chopping skills and one-arm swinging techniques. Oh, and he also hunted vampires, so there's that. Now, as rough as both of these guys are, personally speaking, I feel that we have to give the title of champion to Rough Rider Theodore Roosevelt. Now, this guy, in my opinion, is the epitome of toughness. He was not only a wrestler, a boxer, and a judoka, but he never let anything stop him. He was frail and weak and stricken with asthma as a child, and the doctors did not expect him to live past age four. His father encouraged him to engage in athletics, and Roosevelt was able to get stronger and defy his prognosis by working out with weights in the punching bag.  Even when he served as governor and disapproval of his staff, he often held secret wrestling matches. He sought out to learn judo as a more serious art and an effort to lose weight, as well as to learn the way of this new Eastern art that was gaining a lot of attention at the time. He sustained several injuries while fighting, including a detached retina on his left eye for boxing, but this man was known first and foremost for his unwavering determination and assertion. This is a man who once had his boat stolen, and he responded by hand building another boat, chasing them down, catching them, beating them up, and walking them back to authorities over the course of 40 hours. This is also a man who rode on the back of a moose through a river. This is also a man who was shot in the chest in an assassination attempt on a way to a speech, and he went he did the 90 minute speech anyway, bleeding and delivering a badass quote, it takes more than that to kill a bull moose. He died at age 60 in 1919 of a blood clot that traveled to his lungs, and one of my favorite quotes ever was from Thomas Marshall, governor of Indiana and vice president to Woodrow Wilson. He said that death had to take him in sleep, for if Roosevelt had been awake, there would have been a fight. Mr. Roosevelt was one tough dude, and I personally feel, given the combatants on this list, it is my personal belief that Theodore Roosevelt would have taken the title. Thank you so much for watching. Like I said, this was just a fun exploration topic, and I'm curious to know if you agree with my assessment or if you feel a different president would emerge victor. So please let me know in the comments below. Again, please keep it civil. Any flamethrowing, any political debates or anything, any ugliness will be deleted. So I'm asking you guys to all be civil, because there's no reason not to be. So thank you so much for watching, and we'll see you guys next week.


tired of the everyday grind, ever dream of a life of romantic adventure, want to get away from it all? We offer you escape. Escape designed to free you from the four walls of today for a half hour of high adventure. The frozen slopes of the great mountain, terrified and caught in a blizzard, while the thing for which you've been hunting has suddenly become the hunter. And if it finds you, then for you and your companions, there can be no escape. So listen now as escape brings you Anthony Ellis's exciting story, The Abominable Snowman. Our first bit of luck was when we hired our shepherd guide, Nassang. That was in Darjeeling. When I told Nassang what we were after, he hesitated for a moment and then he said, The Sybes have not come to climb Shomolongma? Oh no, we're a little late for that. It's already been done. The other two Sybes and myself are here for the reason I told you. Meto Akangmi? That's right. The Sybes always hired me to climb the mountain with them, but never this. Are you afraid of them? I have seen one. You've seen one? Yes, many of us have seen them. Wait a minute, Alan. Yeah, what's up? I meant of viewing a Sherpa in here. He says he's seen one of the things. Where's rank? We're not to get some tobacco. All right, come on in. I think this is our man. All right. Nassang, this is Mr. Ferris. Saib. Hello Nassang. Nassang was telling me about what he'd seen. Go ahead Nassang.  Sometimes leaping, sometimes running with great strides. It was dusk and after a moment I lost sight of it in the snow. Where were you? With the French expedition. It was at nineteen thousand feet on Shomolongma. How far were you from it? Thirty feet, perhaps thirty five. You're sure it wasn't an ape? I am sure. There is no ape in the Himalaya to make such a track. What about bears? These two I have been asked. But does a bear walk always upon its hind legs? Well, that's enough for me. Alan? Yeah, he'll do. But if you want the job Nassang, you're hired. You are going to try to capture a Yeti? Yes. It will be a difficult thing, but I will serve with you. Yeti, wild man, Netokangmi, abominable snowman. That's the name the natives had for the things and Alan Ferris, Frank Davis and I were going to try to get one. We'd all done some climbing but climbing was secondary here. Expeditions since the beginning of the 20th century had heard of the abominable snowman, observed their tracks, and one or two white men claimed to have seen them. Great ape, bear, monkey, wild men. We didn't know but we were going to find out. Four weeks later we were in the wrong book valley for our interview at the monastery with the lama. The journey from our base had been uneventful, the weather was good and our spirits were high. From the lama's wonder we could see the great peak of Everest in the distance. Why, gentlemen, do you desire to capture Netokangmi? Because, sir, we believe it will be an invaluable aid in our prehistoric research, that is, if these things are in any way human. And for this reason then you have formed the expedition? Yes. You are all familiar with climbing? Yes, we are. You would need to be. The Yeti move at high places, dangerous places, so my people tell me. Also, the monsoons are arriving in a short time. I understand that. Then do we have your permission to investigate in the valley and beyond? You have my permission. Thank you. There is one point, however. I must request that no wild animal or being in this valley be shot. Our religion does not allow it. We'll respect your wishes, sir. Now may I ask you one more thing? Of course, my son. Do you believe in the existence of Netokangmi? I myself have never seen them, but I know that they live here above the valley on the goddess mother of the world. It is also true that at least five and possibly more inhabit the upper wrong book and its glaciers. Thank you. Do you have portals? Our guide Nassang is hiring them now. Yeah. I trust that he meets with good fortune. The old man with great dignity bowed slightly to us and we were dismissed. But I thought I saw the shadow of a smile on his lips as he turned away and it wasn't long before I found out why. Nassang returned to us in our quarters and his face warned of bad news. Sir, I am unable to hire any porters. Why not? They know the purpose of the expedition. They will not go. Why? They are afraid. The snowmen? Yes. They live in peace with them. They wish no trouble. They are afraid. Well, all right. It'll be rough but we can't waste time talking them into it. The monsoons will be coming in a couple of weeks. It's not the same as climbing Everest. We'll travel light just the four of us set up a base and start hunting. All right with you fellas? Yeah, sure. Nassang? I will go with you. I am not afraid. Good. Well, let's take a look at the map. Now we'll each carry a capacity load. We should be able to make this point below the glacier in two days. That's 16,000 feet. And if our abominable snowmen are in the vicinity, we've got two weeks to find them. When do we start? Tomorrow. Good. Well, that's it. Paul? Yes, Frank? One thing. What do the natives mean when they say they don't want any trouble with the thing? That's superstition probably. Oh, no, sir. It is not superstition. It is because the yeti are cannibals. That is why the porters are afraid. The weather turned ugly the day we left the village. A cold Tibetan wind blew down from the west and with our heavy packs it took us much longer than we thought to arrive at the point just below the wrong book glacier. We set up a camp and made ourselves as comfortable as we could. The next morning wasn't so bad. There was a heavy overcast, a promise of snow, and the peak of Everest looming over us was shrouded in clouds. The four of us sat in the tent looking at our charts and drinking hot tea. I figured it'd be easiest if we started at the East Glacier. It's only about three miles from here and with the weather as stinking as it is, we won't run too much of a risk. What do you think, Paul? Well, that sounds all right. What do you say we split up? You and Nassong, Alan and me, will work up on either side of the ridge here. And if we spot any tracks, fire two shots. Yeah, good enough. Now the big thing, though, no matter what, don't shoot at the thing if you do see it. Okay? Okay. All right. If we lose touch with each other, we'll meet back here at five. All right, let's get going. Left the base at six that morning and the going was rough. Alan was pretty well shot by the time we got to the 17,000 foot mark. He was having a tough time breathing and the wind had come up again. And with it, a fine powdery snow that blinded Chotis. Hey, I gotta take five. All right. Yeah, move over here. It might cut some of the wind. That's better. Oh, we might as well start back for the base. We couldn't see anything in this anyhow. You know, right now, I don't care what are we doing now. This is good weather. Wait until the monsoon start. No, no, not me. Cool. I never been so cold in all my life. We stayed in the half shoulder of an overhang for 10 minutes. And the wind was quieter and the snow had let up. I noticed that the tracks we'd made coming into the shoulder were gone now. But we didn't have any worry finding our way back. I figured that Frank and Nassang had met pretty much the same thing on their side of the ridge and we'd meet them at the base. So Alan and I picked ourselves up and started off. Boy, I thought I wasn't pretty good shape. But up here, boy, I'm nothing. Well, I'm tired again. We'll just take it easy going down. You haven't got frostbite, have you? No, no, not yet. But what? The left there. Yeah. They're not our tracks, are they? Not unless you took your boots off on the way up. Must have just passed by. Must have seen us. Yeah. Come on. We were looking at a set of tracks newly made in the fresh snow and they'd passed so close to our shoulder that the thing must have known we were there. They weren't the tracks of a bear or an ape, but more like a splay-footed naked foot. The tracks of the abominable snowman. We will return to escape in just a moment. But first, 30 million school children make their way back to class this year. There are just 10 million too many for existing school facilities. Contact better schools to West 45th Street, New York 19 for information on ending this menace to America's educational standards. And now back to escape. And to follow the tracks and for a while perhaps 150 yards it was easy. And then the thing made a leftward traverse down a deep slope. We could see the prince clearly angling with a sidestep as sure-footed as a mountain goat except that it was walking on two legs. This way, Paul. Take it easy, Al. It's getting steeper. Boy, that thing sure can climb. Hold up. And he dropped out of sight over the lip of the crevasse. We weren't roped together. I got as close as I dared to the edge. The loose snow crumbled away from my outstretched body and I looked down into the blue black darkness below falling away into nothingness. He was gone, finished. All I could think of was the noise he'd made when he went over. Surprised, angry, then silence. The crevasse might have been 500 feet or 5,000. Snow started to fall again. Big flakes this time and wet. I stood up. And across the gap 20 feet away I saw the tracks of the thing continuing on and away until they became lost in the blank whiteness of the glacier. It had jumped and landed still upright on the opposite side. I went back to the base and an hour later Frank and Nassong returned. I told them and we were quiet for a long time. Then? Paul, are we going out again tomorrow? Why not? I just wanted it. We should go back. It is an omen. I tell you it was going too fast. He didn't have a chance to see the crevasse. That's not an omen. It's bad sense. Maitokangmi cannot be caught. We'll catch him. But there are only three of us if we had a few more men. I tell you the thing was so close that we'd looked up at the right time we'd have seen it. You think I'm gonna give up now? Next time we'll get it. There was no chance to get Alan out. No. You think if we went back? Listen, you think I don't want to? He's gone. I tried but he's gone. Okay, okay. Wish that wind had let up. Maybe by morning we'll try again tomorrow. It was cold that night and somehow colder because Alan was gone. I heard Frank tossing around and I knew he was thinking about a body broken and lonely lost somewhere in a deep and dark place. In the morning the three of us packed our gear, camera, food. There was a light pack and we started up again. This time to a crest above the ridge. It was tougher than it looked and we weren't even halfway up before we had to rest. But as I looked to the west I saw clouds boiling up. Not white but somber threatening. And below the valley looked grim. Ugly gray. And then the sun was gone. And we kept on going up and then I had a strange feeling. It was nothing I could see, nothing I could hear only a sensation of being watched, followed. Wait a minute. See something? No. I have felt it too, sir. Something following us? Yes. It is made to con me. How do you know? It can be nothing else at this site. There is nothing else that leaves. Maybe it's curious. No, don't turn around Frank. Listen, when we get up to the crest you too flop down, stay inside of the slope here. What are you gonna do? Move around the hump and watch. If it thinks we're all together it may come close enough to give us a chance to get it. You better watch your step. It looks nasty. I will. Now come on. It took us another 15 minutes to get up to the crest and then Frank and Nassang hunched down to rest. They were in clear view of the slope we just ascended. I moved back out of sight and made my way toward the hump which backed a long shelf on the north side of the crest. In a couple of minutes I lost sight of them and of the slope. The wind had increased and the clouds had spread now to become an iron gray canopy over the mountain. It was getting colder again. I don't think it took over five minutes to reach my lookout point and when I did I had a perfect view of the ground we'd covered. There was nothing there. The men were out of sight and I waited a minute, two. There was nothing until on the wind a cry and then shots. I scrambled back to where I'd left them and when I got there, when I got there, Frank was lying on his back and I couldn't look at what was left of his face. There were terrible deep rints in his clothing and he was dead. Nassang lay huddled a few feet beyond a gun in his hand. Saib. What is it? What? Metal gun me came from behind us. I thought I could throw the gun. It had killed and it sprang at me. It is strong Saib with a strength of ten men. All right. All right. Can you sit up? My leg. It struck at me. My leg broken. I shot at it but I missed. It jumped away and was gone. Okay. We'll have to figure out a way to get you down. We were four hours from camp and with Nassang practically helpless it could well be four days or never. I buried Frank where he was lying then began to work down the slope. Nassang was in great pain. He half slid and crawled as best he could. That part of it wasn't too bad then we were at the bottom and there was a ledge to climb. It took well over two hours to do that and we still had three miles of difficult terrain to cover. The stops became more frequent. Stop. Leave me here. Go back. No. My leg is frozen. There is no feeling anymore. I shall not live much longer.  After a rest you'll be able to go on. Soon the night comes. If we are both caught here we both die. There will be snow. Much snow. Leave me. No we're going back together. Please let me sleep. Let me sleep here. I cannot go on. You've got to Nassang. No. No more. The ridge is only about a half mile from there it won't be too bad. No. No let me stay. Nassang. Let me sleep. No. No come on Nassang. Come on you're not going to sleep. You'll be all right. I turned and for an instant I saw it outlined against the snow crotching of medium height. It was covered with thick hair. The face was reddish and bare. A semi-human face. And it was not an ape. The thing made it tremendous sleep and was gone but I'd hid it. I knew I hid it. Did you kill it? No I don't think so. Then it will be back. It has tested blood. You must leave me.   Come on. Let's go. Nassang. I am very sorry sir. Will you ask the lama to make a prayer for me? Sure. Sure I will Nassang but... If I pay to my wife in daddy's healing. I'm sorry sir. I die. Nassang. Nassang. Darkness came and with its shadows and the snow every hillock mound became the thing motionless waiting. In my mind I kept seeing it. Its long arms powerful and the dreadful claws it must have possessed. I carried my gun and my gloved hand but I knew that I couldn't fire it unless I was bare handed. And that meant my hand would freeze to the gun. And then suddenly I felt myself slipping. It was a short incline but when I reached the bottom the gun was gone. I'd lost it. I've got to find it. I've got to find it. I saw a glint of metal in the snow 10 feet away. And at the same time above me at the top of the bank the thing it stood swaying a little looking down at me. I moved slowly slowly inch my way toward the gun. And as I drew closer I kept my eyes looking up but it didn't move only stared down at me. And I thought I saw its little eyes glittering. And I thought if the gun's frozen now if it's frozen it doesn't fire. And I was nearer to it near enough to tick off my glove. But that moment in which I'd have to bend to pick it up that's when it would leap down at me tear my throat out tear and I had the gun and I pulled the trigger. Terrifying its blood staining the snow until the sound died away. It was dead but the eyes kept on staring. It must have been the shots that loosened the snow and ice on the ridge above. I heard the sound and I ran ran past me and swept on down toward the valley the thunder of a dying in the distance. And when I went back there was nothing there it was buried somewhere under tons of snow. I made my way back to the wrong book village. I don't remember how I didn't remember anything for two weeks after but I'm alive and I'm not going back there again. That's all I know or want to know about the abominable snowman. Escape has brought you the abominable snowman written and directed by Anthony Ellis starring William Conrad as Lane. Featured in the cast were Anthony Barrett, Pye Everback, Jack Krushen and Edgar Berrier. The special music for escape was composed and conducted by Leith Stevens. Next week. A passenger aboard a submarine making its last peaceful voyage across the sea. While unknown to you the captain has a plan which if it succeeds will mean for you and the entire crew a fate from which there can be no escape. So listen next week when Escape will bring you Marion Mosner and Francis Rosenwald's exciting story The Log. The station is right, the network is right too. Check all timepieces and then check your local radio schedule. Let's have no slip-ups. Everybody wants to hear the Jack Benny show right from the beginning when it returns to CBS Radio tonight. This is Roy Rowan speaking. Is the CBS Radio Network.