4 ms·

I think I follow now. Source availability is preferable but it will take a while to become normal. It will be even longer bit-for-bit reproducibility is a comm

I think I follow now. Source availability is preferable but it will take a while to become normal. It will be even longer bit-for-bit reproducibility is a commercial norm. SBOMs still give us value in the meantime. If I buy product X, which asserts using dependency Y, then when a vulnerability is asserted for Y, I can pester the vendor to show that they have updated. At this point if they claim to upgrade but haven't, that becomes fraud. The economic incentives vs our current anything-goes world are differently weighted.

Ericson2314 6y ago
I kind of buy that, but I think it's important that SBOMs be designed such that it is clear what the gold standard is. The worst outcome is a standard that enforces a bunch of annoying metadata even in the all source and build steps are public case. The other problem is I don't think people without reproducible builds can deliver a correct SBOM. There must be some severe penalties for missing dependencies or something to steer people towards reproducible builds whether or not they are sharing source and packaging.
- jacques_chester 6y ago
  I think it helps to think of SBOMs as extracts or projections from an underlying knowledgebase which is updateable. There's certainly no sense in saying that any SBOM is truly final. Merely "this is our best knowledge at time X".
  - Ericson2314 6y ago
    Sure, but does a bunch of "best effort" guesses without enforcement or auditability actually converge? My experience trying to package things in Nixpkgs by upstreams that don't care about knowing their dependencies says no. Remember that sloppiness is infectious: if I can't wrangle my deps there is little marginal benefit from trying to keep my own packages in good shape. Also Docker being total snake oil. All these things tell me it's loosing battle without a severe course correction.
    - jacques_chester 6y ago
      I disagree about it being a losing battle. It's a classic network effect / epidemic shaped model. Once a threshold is reached, the reinforcing loop takes over. What's needed is the money and elbow grease to get the loop turning in the first place. That's where the major companies will need to put up or shut up.

Ericson2314 6y ago

I kind of buy that, but I think it's important that SBOMs be designed such that it is clear what the gold standard is. The worst outcome is a standard that enforces a bunch of annoying metadata even in the all source and build steps are public case. The other problem is I don't think people without reproducible builds can deliver a correct SBOM. There must be some severe penalties for missing dependencies or something to steer people towards reproducible builds whether or not they are sharing source and packaging.

jacques_chester 6y ago
I think it helps to think of SBOMs as extracts or projections from an underlying knowledgebase which is updateable. There's certainly no sense in saying that any SBOM is truly final. Merely "this is our best knowledge at time X".
- Ericson2314 6y ago
  Sure, but does a bunch of "best effort" guesses without enforcement or auditability actually converge? My experience trying to package things in Nixpkgs by upstreams that don't care about knowing their dependencies says no. Remember that sloppiness is infectious: if I can't wrangle my deps there is little marginal benefit from trying to keep my own packages in good shape. Also Docker being total snake oil. All these things tell me it's loosing battle without a severe course correction.
  - jacques_chester 6y ago
    I disagree about it being a losing battle. It's a classic network effect / epidemic shaped model. Once a threshold is reached, the reinforcing loop takes over. What's needed is the money and elbow grease to get the loop turning in the first place. That's where the major companies will need to put up or shut up.