3 ms·

For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.

holowoodman 2y ago
Enterprise also doesn't really care. It is just another box to tick and an excel sheet to fill out, correctness isn't actually required. You just need something to put in the list, so you may as well purchase something wrong but authoritative-looking in bulk.
- tpm 2y ago
  It might be required and audited for software deployed to / interacting with government cloud. Eventually it will have to be correct too, as otherwise would be a security risk.
  - holowoodman 2y ago
    Yes, but that is an expense for a future faraway fiscal year.
- NegativeK 2y ago
  When some new version of log4j comes about and everyone is scrambling to find out where it resides, the cybersecurity team is going to hate the crappy checkbox solution that doesn't actually work. Which is pretty much the norm.
  - mnau 2y ago
    40% of all log4j downloads are still vulnerable versions. Nobody cares, it's just another checkbox/policy. Security team is just another compliance department. It does not bring in money.
    - ATechGuy 2y ago
      > Security team is just another compliance department. It does not bring in money. This. Thanks for highlight it!
josteink 2y ago
Which is why enterprises everywhere has software and tooling in place to provide this, for the exact things they do deliver. I don’t see how anyone can «sell» this information when it’s literally available for free already.
- indymike 2y ago
  > I don’t see how anyone can «sell» this information when it’s literally available for free already. I think this has been repeated thousands of times in history.
- mschuster91 2y ago
  > I don’t see how anyone can «sell» this information when it’s literally available for free already. It's a channel for OSS projects to get money for corporate funding. Not all standard procedures allow for making up shit that the vendor doesn't provide, so you go and pay for the vendor's SBOM shrug

Enterprise also doesn't really care. It is just another box to tick and an excel sheet to fill out, correctness isn't actually required. You just need something to put in the list, so you may as well purchase something wrong but authoritative-looking in bulk.

tpm 2y ago
It might be required and audited for software deployed to / interacting with government cloud. Eventually it will have to be correct too, as otherwise would be a security risk.
- holowoodman 2y ago
  Yes, but that is an expense for a future faraway fiscal year.
NegativeK 2y ago
When some new version of log4j comes about and everyone is scrambling to find out where it resides, the cybersecurity team is going to hate the crappy checkbox solution that doesn't actually work. Which is pretty much the norm.
- mnau 2y ago
  40% of all log4j downloads are still vulnerable versions. Nobody cares, it's just another checkbox/policy. Security team is just another compliance department. It does not bring in money.
  - ATechGuy 2y ago
    > Security team is just another compliance department. It does not bring in money. This. Thanks for highlight it!

josteink 2y ago

Which is why enterprises everywhere has software and tooling in place to provide this, for the exact things they do deliver. I don’t see how anyone can «sell» this information when it’s literally available for free already.

indymike 2y ago
> I don’t see how anyone can «sell» this information when it’s literally available for free already. I think this has been repeated thousands of times in history.
mschuster91 2y ago
> I don’t see how anyone can «sell» this information when it’s literally available for free already. It's a channel for OSS projects to get money for corporate funding. Not all standard procedures allow for making up shit that the vendor doesn't provide, so you go and pay for the vendor's SBOM shrug