3 ms·
> [...] "hide" stuff in your binary While legislatively requiring SBOMs is obviously a good idea, it might also unintentionally incentive companies to hide dep
by repelsteeltje 2y ago
> [...] "hide" stuff in your binary
While legislatively requiring SBOMs is obviously a good idea, it might also unintentionally incentive companies to hide dependencies by rolling their own. Afterall, it's not a "dependency" if it's in the main code base you developed yourself.
Not sure how likely this is, but especially in case of network stacks or cryptographic functions that could potentially be disastrous.
- lars_francke 2y agoI agree that there is a chance this could happen. But as a business owner myself it's pretty simple: It's far cheaper for me to take an existing dependency, create SBOMs and patch regularly compared to having to develop and maintain these things myself. But I do get your point that others might make different decisions. But the CRA also has provisions here as you have to do a risk assessment for your product as well and publish the result of that on your documentation and hand rolling crypto should definitely go on there as well. Again... People can just ignore this and probably won't get caught anytime soon....
- twoodfin 2y agoIt’s extremely likely, verging on certitude. In some ways, the pressure of requirements like this may be positive: “Do we really need a dependency on ‘leftpad’?” But it will also add pressure to make unsound NIH choices as you suggest.