6 ms·

Self-Service SBOMs

63 points by zvr 4y ago

zdw 4y ago
How much of this functionality only works when both the dependency and the code that depends on it are both hosted on GitHub? I'm not looking forward to a "Code must be hosted (or at least mirrored) on Github" future.
- nerdponx 4y ago
  You know that Microsoft would love this outcome and will gladly use the need for regulatory compliance as a mechanism to push for it.
- lucideer 4y ago
  As much as that's always a possibility, there's so much competition in this space that Github is just entering into that I don't see it happening anytime soon. The angle for Microsoft here is they're probably going to charge enterprise GH customers a severe premium to avail of this - it will only be freely available to users who aren't the primary target audience.
- acdha 4y ago
  They note that you can upload SBOMs to GitHub, which makes sense given how many places have their own build infrastructure and may not be able or comfortable posting all of their dependencies.
candiddevmike 4y ago
Was the screenshot in the blog post a mockup, or is GitHub changing to that style? https://github.blog/wp-content/uploads/2023/03/sbom1.png?w=1024&resize=1024%2C664 https://github.blog/wp-content/uploads/2023/03/sbom1.png?w=1... Also what is a "cloud repository"? > As part of GitHub’s supply chain security solution, self-service SBOMs are free for all cloud repositories on GitHub.
- nerdponx 4y ago
  I assume it's in comparison to on-prem repositories that are available through the Github Enterprise product.
- samcat116 4y ago
  That is the "Light High Contrast" theme that you can set on GitHub under Settings -> Appearance.
  - candiddevmike 4y ago
    That's neat, maybe I'm getting old but it's a lot easier to browse GitHub this way.
remram 4y ago
I don't understand all this modern "supply chain security" stuff. What is the point of getting cryptographic signatures and bills of material from people you don't know and don't trust?
- pxc 4y ago
  One useful thing you can do with an SBOM is quickly check whether your dependencies carry any known vulnerabilities. That kind of thing can be harder than you'd think to track, especially across large organizations with many projects.
- lucideer 4y ago
  It's a step (and I guess for many, a coping strategy). Getting a BOM about people you don't know/trust lets you know who you don't know/trust: known unknowns. At the very least it present a quantifiable risk profile that you can use to push for disengaging from untrusted dependencies. At best, it's a stepping stone to start building relationships.
  - remram 4y ago
    It's a step towards what? What's the next step? Some rando's BOM does not give you "known unknowns", it gives you "unknown knows"/"untrusted knows", an untrustable list of stuff they say they know, which only give you a risk profile if the potential attacker is not attacking you, and is definitely not "quantifiable risk".
    - lucideer 4y ago
      I'm not really sure what "unknown knowns"/"untrusted knowns" are (or how switching the order of the words is significantly different in this particular context). If I'm using a piece of software from Alice, & Mallory is using a supply-chain attack to compromise that software, I have chosen to trust Alice without knowing who Alice has chosen to trust (unquantified risk). An SBOM tells me that Alice has chosen to trust Mallory - it doesn't necessarily tell me whether Mallory should be trusted, but it allows the risk associated with trusting Alice to be better quantified. The next (out-of-band) step is actively engaging with & trust Mallory (or not).
cxr 4y ago
> The resulting JSON file [...] can then be [... blah blah blah...] or reviewed in Microsoft Excel (use a JSON-to-CSV converter for compatibility with Google Sheets) GitHub's status as a Microsoft-owned subsidiary is showing. What a dig to manage to slip in—that one of your competitors, ostensibly a vanguard for openness and interoperability (and known esp. for favoring tech solutions that have a Web-y flavor in particular), hasn't taught its competing product to interoperate with JSON.
- mousetree 4y ago
  I actually found that callout quite useful. I've often had to send SBOMs to lawyers, auditors etc. and typically in Excel.
  - pxc 4y ago
    Aren't these things basically incompatible formats, since JSON can be arbitrarily nested and spreadsheets have no depth?
    - emmelaich 4y ago
      There is a JSON 'schema' that is popular that makes it more compatible. Sorry, forgotten the name. And I'm not sure if this adhere's to it.
      - pxc 4y ago
        Kinda sounds to me like the format should just be CSV in the first place, then. If anyone has reasons why they prefer constrained JSON, I'd like to hear it, though. :)
    - zvr 4y ago
      No, the format is SPDX which can be serialized in JSON or in a spreadsheet (as well as RDF, XML, YAML, tag-value text, etc.)
    - cxr 4y ago
      Although you can't reliably handle arbitrary JSON, they're not ipso facto incompatible formats; the fact that you can run a CSV-to-JSON is proof. (If you have a tool that operates on the kind of data that CSV is used for, then you can, of course, implement JSON support in the same tool at least to the extent that it is able to handle any JSON of the form that a CSV-to-JSON converter would produce...)
captaindiego 4y ago
Too bad the ability to understand dependencies is quite poor and not extensible. The dependency graph in GitHub Enterprise is useless, especially for the price - which makes any SBOM also equally useless.
- pxc 4y ago
  Could you describe its defects in more detail?
  - captaindiego 4y ago
    Simple example: using advanced security in GitHub Enterprise with dependabot, it understands our usage of actions and their depndencies - it can understand that action workflow X depends on Y and there's a new version. But if we use a docker image in those workflows, hosted in GitHub packages, it isn't able to understand that. This is a fairly basic case I would have expected to work - but it doesn't. For anything C++ or more complex examples it's less useful... And dependabot is no longer extensible so this can't even be solved by using open source additions. Currently looking at things like Mend's Renovate as an alternative
- courtneycl 4y ago
  What does "understand dependencies" mean to you? What kinds of things would help you understand dependencies better?
pseudotrash 4y ago
There are essentially 2 approaches to SBOM. 1) scanning source code: it will generate also lot of false positive and a need to manually edit (ammend/correct) the SBOM. This works best with containers. One Foss tool that does this is Anchore's syft/grype. Others have jumped onto the sbom bandwagon simply because they thought it's easy (they were already offering SAST/DAST) The other class of tools actually only looks at a binary artifact (firmware, executable, library etc) and then tries to extract the SBOM from that. I am not aware of any FOSS tool here and would br cool to learn of anything out there. But chances are some custom work is needed for each specific firmware. Only vendor I know today are Binare.io, cybellum) For firmware and embedded this really the only way that IMHO makes sense for embedded engineering. Because you can't just scan an SDK and say "yepp it has mbedtls xyz or c-json in it ...". It won't find it because there is no specfile or something that cam be parsed reliably. Your only option would be to strong-arm the silicon vendor into supplying a machine readable sbom along with the SDK. It also has less false positive and doesn't find vulnerabilities (or license issues D depending on what you match for) you don't care about. The NTIA envisions the SBOM as a key element in building a risk based approach to devsecops with Vuln Exchange (VEX) and much more. We're still far from thus. Fact though it's already becoming part of regulation (RED, CRA) in Europe and the US (Executive Order Biden signed not too long ago)
- acdha 4y ago
  > scanning source code: it will generate also lot of false positive and a need to manually edit (ammend/correct) the SBOM Can you give any examples of this? I’ve never seen a tool like this report a true-false positive but based on your mention of embedded tools I’m guessing you might be referring to something like a build dependency which is completely optimized out such as a debugging feature on a production build? In such cases I would be inclined to either prepare separate SBOMs or otherwise indicate when something is present but not reachable. My concern about editing the files is that these are intended in a somewhat legalistic context and if something blew up it’s not hard to imagine someone’s lawyer using those changes to argue that you were aware of a problem and tried to cover it up. Even if you could defend your policy, that’s not a conversation anyone wants to have.
  - 4y ago

63 points by zvr 4y ago

zdw 4y ago

How much of this functionality only works when both the dependency and the code that depends on it are both hosted on GitHub? I'm not looking forward to a "Code must be hosted (or at least mirrored) on Github" future.

nerdponx 4y ago
You know that Microsoft would love this outcome and will gladly use the need for regulatory compliance as a mechanism to push for it.
lucideer 4y ago
As much as that's always a possibility, there's so much competition in this space that Github is just entering into that I don't see it happening anytime soon. The angle for Microsoft here is they're probably going to charge enterprise GH customers a severe premium to avail of this - it will only be freely available to users who aren't the primary target audience.
acdha 4y ago
They note that you can upload SBOMs to GitHub, which makes sense given how many places have their own build infrastructure and may not be able or comfortable posting all of their dependencies.

candiddevmike 4y ago

Was the screenshot in the blog post a mockup, or is GitHub changing to that style? https://github.blog/wp-content/uploads/2023/03/sbom1.png?w=1024&resize=1024%2C664 https://github.blog/wp-content/uploads/2023/03/sbom1.png?w=1... Also what is a "cloud repository"? > As part of GitHub’s supply chain security solution, self-service SBOMs are free for all cloud repositories on GitHub.

nerdponx 4y ago
I assume it's in comparison to on-prem repositories that are available through the Github Enterprise product.
samcat116 4y ago
That is the "Light High Contrast" theme that you can set on GitHub under Settings -> Appearance.
- candiddevmike 4y ago
  That's neat, maybe I'm getting old but it's a lot easier to browse GitHub this way.

remram 4y ago

I don't understand all this modern "supply chain security" stuff. What is the point of getting cryptographic signatures and bills of material from people you don't know and don't trust?

pxc 4y ago
One useful thing you can do with an SBOM is quickly check whether your dependencies carry any known vulnerabilities. That kind of thing can be harder than you'd think to track, especially across large organizations with many projects.
lucideer 4y ago
It's a step (and I guess for many, a coping strategy). Getting a BOM about people you don't know/trust lets you know who you don't know/trust: known unknowns. At the very least it present a quantifiable risk profile that you can use to push for disengaging from untrusted dependencies. At best, it's a stepping stone to start building relationships.
- remram 4y ago
  It's a step towards what? What's the next step? Some rando's BOM does not give you "known unknowns", it gives you "unknown knows"/"untrusted knows", an untrustable list of stuff they say they know, which only give you a risk profile if the potential attacker is not attacking you, and is definitely not "quantifiable risk".
  - lucideer 4y ago
    I'm not really sure what "unknown knowns"/"untrusted knowns" are (or how switching the order of the words is significantly different in this particular context). If I'm using a piece of software from Alice, & Mallory is using a supply-chain attack to compromise that software, I have chosen to trust Alice without knowing who Alice has chosen to trust (unquantified risk). An SBOM tells me that Alice has chosen to trust Mallory - it doesn't necessarily tell me whether Mallory should be trusted, but it allows the risk associated with trusting Alice to be better quantified. The next (out-of-band) step is actively engaging with & trust Mallory (or not).

cxr 4y ago

> The resulting JSON file [...] can then be [... blah blah blah...] or reviewed in Microsoft Excel (use a JSON-to-CSV converter for compatibility with Google Sheets) GitHub's status as a Microsoft-owned subsidiary is showing. What a dig to manage to slip in—that one of your competitors, ostensibly a vanguard for openness and interoperability (and known esp. for favoring tech solutions that have a Web-y flavor in particular), hasn't taught its competing product to interoperate with JSON.

mousetree 4y ago
I actually found that callout quite useful. I've often had to send SBOMs to lawyers, auditors etc. and typically in Excel.
- pxc 4y ago
  Aren't these things basically incompatible formats, since JSON can be arbitrarily nested and spreadsheets have no depth?
  - emmelaich 4y ago
    There is a JSON 'schema' that is popular that makes it more compatible. Sorry, forgotten the name. And I'm not sure if this adhere's to it.
    - pxc 4y ago
      Kinda sounds to me like the format should just be CSV in the first place, then. If anyone has reasons why they prefer constrained JSON, I'd like to hear it, though. :)
  - zvr 4y ago
    No, the format is SPDX which can be serialized in JSON or in a spreadsheet (as well as RDF, XML, YAML, tag-value text, etc.)
  - cxr 4y ago
    Although you can't reliably handle arbitrary JSON, they're not ipso facto incompatible formats; the fact that you can run a CSV-to-JSON is proof. (If you have a tool that operates on the kind of data that CSV is used for, then you can, of course, implement JSON support in the same tool at least to the extent that it is able to handle any JSON of the form that a CSV-to-JSON converter would produce...)

captaindiego 4y ago

Too bad the ability to understand dependencies is quite poor and not extensible. The dependency graph in GitHub Enterprise is useless, especially for the price - which makes any SBOM also equally useless.

pxc 4y ago
Could you describe its defects in more detail?
- captaindiego 4y ago
  Simple example: using advanced security in GitHub Enterprise with dependabot, it understands our usage of actions and their depndencies - it can understand that action workflow X depends on Y and there's a new version. But if we use a docker image in those workflows, hosted in GitHub packages, it isn't able to understand that. This is a fairly basic case I would have expected to work - but it doesn't. For anything C++ or more complex examples it's less useful... And dependabot is no longer extensible so this can't even be solved by using open source additions. Currently looking at things like Mend's Renovate as an alternative
courtneycl 4y ago
What does "understand dependencies" mean to you? What kinds of things would help you understand dependencies better?

pseudotrash 4y ago

There are essentially 2 approaches to SBOM. 1) scanning source code: it will generate also lot of false positive and a need to manually edit (ammend/correct) the SBOM. This works best with containers. One Foss tool that does this is Anchore's syft/grype. Others have jumped onto the sbom bandwagon simply because they thought it's easy (they were already offering SAST/DAST) The other class of tools actually only looks at a binary artifact (firmware, executable, library etc) and then tries to extract the SBOM from that. I am not aware of any FOSS tool here and would br cool to learn of anything out there. But chances are some custom work is needed for each specific firmware. Only vendor I know today are Binare.io, cybellum) For firmware and embedded this really the only way that IMHO makes sense for embedded engineering. Because you can't just scan an SDK and say "yepp it has mbedtls xyz or c-json in it ...". It won't find it because there is no specfile or something that cam be parsed reliably. Your only option would be to strong-arm the silicon vendor into supplying a machine readable sbom along with the SDK. It also has less false positive and doesn't find vulnerabilities (or license issues D depending on what you match for) you don't care about. The NTIA envisions the SBOM as a key element in building a risk based approach to devsecops with Vuln Exchange (VEX) and much more. We're still far from thus. Fact though it's already becoming part of regulation (RED, CRA) in Europe and the US (Executive Order Biden signed not too long ago)

acdha 4y ago
> scanning source code: it will generate also lot of false positive and a need to manually edit (ammend/correct) the SBOM Can you give any examples of this? I’ve never seen a tool like this report a true-false positive but based on your mention of embedded tools I’m guessing you might be referring to something like a build dependency which is completely optimized out such as a debugging feature on a production build? In such cases I would be inclined to either prepare separate SBOMs or otherwise indicate when something is present but not reachable. My concern about editing the files is that these are intended in a somewhat legalistic context and if something blew up it’s not hard to imagine someone’s lawyer using those changes to argue that you were aware of a problem and tried to cover it up. Even if you could defend your policy, that’s not a conversation anyone wants to have.
- 4y ago