3 ms·

Technically you are right. Question is who is going to pay for that? In my job we dealt with enterprise customers that required list of all libraries we use a

by ozim 6y ago

Technically you are right. Question is who is going to pay for that? In my job we dealt with enterprise customers that required list of all libraries we use and what license those have. But they had buckets of money to spend on compliance.

fulafel 6y ago
Are you asking if customers are willing to pay more for products that feature a SBOM? I think this is more a regulation idea.
- ozim 6y ago
  My main point is that in places where it is needed software is already regulated because there are people who made their risk management and are willing to pay for it. Automotive and banking do a lot of dependency checking, they have a lot of quality gateways. Of course they still fail because usually they have so much software to check that they would not have enough developers in the world to check all (take into account that you also need developers competent in that area). They have to pick their battles and cover most important parts of their operations. So now volume of software to be checked is more than we have man-hours of developers in the world. Saying that you can do that for every software system and do it at least decently is naive. We can put regulation in place but then we have to stop all software development in the world. This way "You can, in fact, crack open the binaries and look at what's inside." is true if you have a single binary but if we speak about organization that depends on thousands of applications problem is exploding to not managable scale.
  - fulafel 6y ago
    I strongly disagree that it's already regulated where needed. Eg cheap IoT devices. The "stop all software development"... No. You just have the sbom as a design requirement and design it in. It's not rocket science. It's regulation, like always there will be a schedule for it, so compliance can be ready when it comes into force.

by ozim 6y ago

fulafel 6y ago

Are you asking if customers are willing to pay more for products that feature a SBOM? I think this is more a regulation idea.

ozim 6y ago
My main point is that in places where it is needed software is already regulated because there are people who made their risk management and are willing to pay for it. Automotive and banking do a lot of dependency checking, they have a lot of quality gateways. Of course they still fail because usually they have so much software to check that they would not have enough developers in the world to check all (take into account that you also need developers competent in that area). They have to pick their battles and cover most important parts of their operations. So now volume of software to be checked is more than we have man-hours of developers in the world. Saying that you can do that for every software system and do it at least decently is naive. We can put regulation in place but then we have to stop all software development in the world. This way "You can, in fact, crack open the binaries and look at what's inside." is true if you have a single binary but if we speak about organization that depends on thousands of applications problem is exploding to not managable scale.
- fulafel 6y ago
  I strongly disagree that it's already regulated where needed. Eg cheap IoT devices. The "stop all software development"... No. You just have the sbom as a design requirement and design it in. It's not rocket science. It's regulation, like always there will be a schedule for it, so compliance can be ready when it comes into force.