4 ms·
SBOMs can't flag vulnerable dependencies until after those are publicly known. Traceability is useful when mitigating a crisis, but it won't prevent one.
by boricj 2y ago
SBOMs can't flag vulnerable dependencies until after those are publicly known. Traceability is useful when mitigating a crisis, but it won't prevent one.
- h4ck_th3_pl4n3t 2y ago> Traceability is useful when mitigating a crisis, but it won't prevent one. So how do you prevent a crisis then without knowing what your software stack has as dependencies?