3 ms·
I think it helps to think of SBOMs as extracts or projections from an underlying knowledgebase which is updateable. There's certainly no sense in saying that a
by jacques_chester 6y ago
I think it helps to think of SBOMs as extracts or projections from an underlying knowledgebase which is updateable.
There's certainly no sense in saying that any SBOM is truly final. Merely "this is our best knowledge at time X".
- Ericson2314 6y agoSure, but does a bunch of "best effort" guesses without enforcement or auditability actually converge? My experience trying to package things in Nixpkgs by upstreams that don't care about knowing their dependencies says no. Remember that sloppiness is infectious: if I can't wrangle my deps there is little marginal benefit from trying to keep my own packages in good shape. Also Docker being total snake oil. All these things tell me it's loosing battle without a severe course correction.
- jacques_chester 6y agoI disagree about it being a losing battle. It's a classic network effect / epidemic shaped model. Once a threshold is reached, the reinforcing loop takes over. What's needed is the money and elbow grease to get the loop turning in the first place. That's where the major companies will need to put up or shut up.