3 ms·

It's a step (and I guess for many, a coping strategy). Getting a BOM about people you don't know/trust lets you know who you don't know/trust: known unknowns.

It's a step (and I guess for many, a coping strategy). Getting a BOM about people you don't know/trust lets you know who you don't know/trust: known unknowns. At the very least it present a quantifiable risk profile that you can use to push for disengaging from untrusted dependencies. At best, it's a stepping stone to start building relationships.

remram 4y ago
It's a step towards what? What's the next step? Some rando's BOM does not give you "known unknowns", it gives you "unknown knows"/"untrusted knows", an untrustable list of stuff they say they know, which only give you a risk profile if the potential attacker is not attacking you, and is definitely not "quantifiable risk".
- lucideer 4y ago
  I'm not really sure what "unknown knowns"/"untrusted knowns" are (or how switching the order of the words is significantly different in this particular context). If I'm using a piece of software from Alice, & Mallory is using a supply-chain attack to compromise that software, I have chosen to trust Alice without knowing who Alice has chosen to trust (unquantified risk). An SBOM tells me that Alice has chosen to trust Mallory - it doesn't necessarily tell me whether Mallory should be trusted, but it allows the risk associated with trusting Alice to be better quantified. The next (out-of-band) step is actively engaging with & trust Mallory (or not).
  - remram 4y ago
    This assumes that you trust the manifest from Alice. You rely on Alice being truthful to evaluate the risk in trusting Alice. This is a catch-22.
    - lucideer 4y ago
      I'm not sure we're talking about the same thing. What manifest are you referring to here? The post is detailing a feature offered by GitHub to generate SBOMs from source code repositories - these will provide machine-readable inventory based on the files within the repository. You can upload a dependency graph to feed the SBOM as an out-of-band step, but trusting Alice's out-of-band dep graph is only a function of access to the source code as a source of truth. Ultimately that's what all if this comes down to: creating a machine-readable graph from a predicable central place that tells us information we could have ascertained ourselves before anyway (just with considerably more effort).
- ahepp 4y ago
  If they're wrong, you don't trust them in the future. Sure, they can just generate a new key. Eventually there will be businesses with good reputations, and ones with unknown reputations. Just like in "real life" right? Maybe I'm misunderstanding the discussion here?
  - remram 4y ago
    We're all already doing this, what benefit does the key provide?

remram 4y ago

It's a step towards what? What's the next step? Some rando's BOM does not give you "known unknowns", it gives you "unknown knows"/"untrusted knows", an untrustable list of stuff they say they know, which only give you a risk profile if the potential attacker is not attacking you, and is definitely not "quantifiable risk".

lucideer 4y ago
I'm not really sure what "unknown knowns"/"untrusted knowns" are (or how switching the order of the words is significantly different in this particular context). If I'm using a piece of software from Alice, & Mallory is using a supply-chain attack to compromise that software, I have chosen to trust Alice without knowing who Alice has chosen to trust (unquantified risk). An SBOM tells me that Alice has chosen to trust Mallory - it doesn't necessarily tell me whether Mallory should be trusted, but it allows the risk associated with trusting Alice to be better quantified. The next (out-of-band) step is actively engaging with & trust Mallory (or not).
- remram 4y ago
  This assumes that you trust the manifest from Alice. You rely on Alice being truthful to evaluate the risk in trusting Alice. This is a catch-22.
  - lucideer 4y ago
    I'm not sure we're talking about the same thing. What manifest are you referring to here? The post is detailing a feature offered by GitHub to generate SBOMs from source code repositories - these will provide machine-readable inventory based on the files within the repository. You can upload a dependency graph to feed the SBOM as an out-of-band step, but trusting Alice's out-of-band dep graph is only a function of access to the source code as a source of truth. Ultimately that's what all if this comes down to: creating a machine-readable graph from a predicable central place that tells us information we could have ascertained ourselves before anyway (just with considerably more effort).
ahepp 4y ago
If they're wrong, you don't trust them in the future. Sure, they can just generate a new key. Eventually there will be businesses with good reputations, and ones with unknown reputations. Just like in "real life" right? Maybe I'm misunderstanding the discussion here?
- remram 4y ago
  We're all already doing this, what benefit does the key provide?