Ramblings on these topics... Exposing SBOM on every piece of delivered software will just make a hackers job easier and quicker... Since by design they are mac

Ramblings on these topics... Exposing SBOM on every piece of delivered software will just make a hackers job easier and quicker... Since by design they are machine readable, SBOMs will make querying for specific vulnerabilities trivial. This is not a top-down problem! Any upper layer can be compromised by a lower layer (os, build tool, library, reporting tool, etc.) this problem can only be solved Botton up : from verified OS, to verified (bootstrap) build tools of that OS, to every library installed on that OS, etc. We currently have decades of software resting atop of unverified libraries resting atop of unverified operating systems, all built with unverified tooling. We can't even build verification tools that are, themselves, verified! And if we could, can we even say they verify every potential vulnerability? (mitm, boundaries, race conditions, cpu cache, etc.) I know there is research at some universitys into formally verified OS's, but it's a long way off IMO. This is the problem of our time. But, unfortunately, the industry seems consumed with velocity and cleverness over stability and security.