Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world needs a software bill of materials

drrispens.medium.com

Post reply on HN
Print view View original

31–40 of 138 posts

Re: The world needs a software bill of materials

#31

Post by pessimizer »

rixrax wrote: post #19
wpietri wrote: post #5

At least on first reading, I find this unpersuasive. He correctly lists a variety of problems. But he doesn't explain how his proposed solution, listing all the components of a technological product, would make a practical difference. Creating a list is valuable only if people a) read the list, b) recognize problems, and c) do something based on that. And for some of the examples he gives, it seems pretty obvious to…

In my mind SBOM is similar to food ingredients being listed on the packaging. FDA or someone requires them, very few read them or cares what is in there. BUT now that they are listed on every food product, those who care can read them and make informed decisions. And raise alarm when it is found that someone uses unhealthy amounts of whatever in their cakes or sausages. As for software, if I had up to date reliable S…

> In my mind SBOM is similar to food ingredients being listed on the packaging. FDA or someone requires them, very few read them or cares what is in there. BUT now that they are listed on every food product, those who care can read them and make informed decisions. And raise alarm when it is found that someone uses unhealthy amounts of whatever in their cakes or sausages.

And sue them if they lie about it. I think a lot of the benefit of these types of regulations is to force businesses to commit active frauds instead of passive frauds. Not doing something you were supposed to do is incompetence. Lying on a form about doing something that you haven't is deceit.

The profits from incompetence and deceit are equal until one gets caught, then the lesser punishment for incompetence as compared to deceit makes deceit more expensive. Smart businesses will choose incompetence every time, and engineer it into the system everywhere where fraud would be profitable.

Of course, they can also hire temps to sign forms, like the banks did in 2008[1], but the current administration has to really want you to get away with it for that to work.

[1] https://www.nolo.com/legal-encyclopedia/false-affidavits-for... Note: it was strangely difficult to find information on this still on the web.

-----

edit: https://news.ycombinator.com/item?id=26530786

Re: The world needs a software bill of materials

#32

Post by rjknight »

varispeed wrote: post #21

I find it obscene that there are some important software tools that are often developed by one guy in his rented basement and big corporations make billions on the back of it without sharing a penny. We need a royalty system for open source software, so that these companies will have to start paying fair share to the developers they exploit. This will also ensure the overall safety as developers will have funds to do…

A different approach might be insurance markets. If I want to use component X, but the use of that component creates a risk (however small) that my business will be hacked, then my business could buy an insurance policy to cover that risk. If the software is maintained by an unpaid guy in a basement, the insurance is likely to be relatively expensive. The insurance company then has a strong incentive to pay basement guy to do maintenance of the software so as to reduce the risk of an insurance claim.

This is grossly over-simplified, but if we accept the notion that businesses can have real liabilities if they get hacked, then they're going to want insurance and the insurance companies are going to want to drive rapid improvements in quality in order to reduce the number of claims. This effect has been a significant factor in improvements in safety in a wide range of other industries.

Re: The world needs a software bill of materials

#33

Post by mannykannot »

mattcwilson wrote: post #18
spacemanmatt wrote: post #14

Earlier quoted context omitted.

True story: They already do. I know one company that forked Ruby, and would likely claim every library they run under it is thereby forked for the sake of reporting.

Ok, but there would still be some point of contact where an SBOM would show “company X fork of Ruby, company X fork of package Z” etc, right? And then the choice gets back to how much to trust company X and package Z, weighed against alternative solutions.

Unless penalties for doing so are legislated, they need not claim that the fork they are actually using is a fork of anything; they could treat it as if part of their proprietary code (though they might be in violation of license agreements if they do this.)

Re: The world needs a software bill of materials

#34

Post by sokoloff »

mattcwilson wrote: post #18
spacemanmatt wrote: post #14

Earlier quoted context omitted.

True story: They already do. I know one company that forked Ruby, and would likely claim every library they run under it is thereby forked for the sake of reporting.

Ok, but there would still be some point of contact where an SBOM would show “company X fork of Ruby, company X fork of package Z” etc, right? And then the choice gets back to how much to trust company X and package Z, weighed against alternative solutions.

It seems like it could equally be “internal package UUID1 version X, internal package UUID2 version Y” if malicious compliance and/or industrious laziness was the goal.

Re: The world needs a software bill of materials

#36

Post by JohnJamesRambo »

varispeed wrote: post #21

I find it obscene that there are some important software tools that are often developed by one guy in his rented basement and big corporations make billions on the back of it without sharing a penny. We need a royalty system for open source software, so that these companies will have to start paying fair share to the developers they exploit. This will also ensure the overall safety as developers will have funds to do…

> developed by one guy in his rented basement and big corporations make billions on the back of it without sharing a penny. We need a royalty system

I mean isn’t this what a software patent is for? And you guys hate those. It’s how you are properly compensated for your inventions.

Re: The world needs a software bill of materials

#37

Post by LockAndLol »

So basically reproducible builds with a dependency list and the CVE list could provide more certainty about the tools we use?

What about websites though? Hash-summed files aren't going to save us, because resources can be loaded dynamically and the client can't know the hash before retrieval.

Reproducible builds would be a great first start. Forcing governments to use opensource may be another step.

Re: The world needs a software bill of materials

#38

Post by fulafel »

dlor wrote: post #23
fulafel wrote: post #17

Earlier quoted context omitted.

You can, in fact, crack open the binaries and look at what's inside. The field of tooling for it is called SCA (software composition analysis).

Sort of. The quality of the data this tooling generates varies GREATLY among languages, build systems and environments. For packaged software like Solarwinds, sure you can try to run an SCA tool. But is anyone claiming an SBOM or SCA tool could have prevented that attack? The bigger issue is services and hosted software. You can't crack open an API or website that stores your data to see what database they're using.…

I feel you're moving the goalposts a bit. Perfect is the enemy of good, etc. Also surely the tooling would get a lot of investment and improvement poured into it if the proposal went through.

Anyway, if this kind of thing really took off, I could well imagine there being regulation for SaaS products having to do audits involving this, for example.

Re: The world needs a software bill of materials

#39

Post by Roark66 »

If the author was serious about promoting the idea the article would be published in an open manner (not behind a pay wall).

The concept is good, but good luck enforcing it with closed source software companies.

Anyone that is really interested can already find that info for OS software but where it would really be useful is with closed source software. Where I personally would really love to see it implemented is with embedded devices.

I've been recently hacking a not so old IP cam in my spare time. Hardware is great... It has 600mhz 32bit cpu with 64mb ram, hardware h264 (1080p 30fps close to real-time) encoding, bi-directional audio, WiFi, USB host, ptz, free gpio, Ethernet all for around $20 (indoor version) but software is abysmal. It runs Linux Kernel v3 (almost a decade old). Upon startup immediately starts streaming video/audio to a server in China while the mobile app requires you to "register" for an account with a phone number. The only way it can receive the video is from the Chinese server and it displays ads on 20% of its screen. Ridiculous. Thankfully it is pretty easy to hack, but what about all non technical people who buy it?

Re: The world needs a software bill of materials

#40

Post by icegreentea2 »

lambda_obrien wrote: post #22

From experience in medical equipment, a BOM was about as useful as a piece of toilet paper. Trying to keep one up to date when every resistor and nut and bolt is included is a pain and about 20 percent was probably wrong. An SBOM is just more beauracracy, what you need is due companies to actually want to pay for developers to use the right tools for the job. If you have security requirements that don't allow for usi…

From my experience in medical equipment, I wouldn't have guessed 20% wrong... maybe closer to sub 5% wrong. Though I guess we weren't tracking individual components on boards... but we were definitely counting every nut, bolt and screw that we were using in assembly.

I definitely hear your second part though. Having cobbled together an SBOM, it's definitely a pain. We got some value of it, since it really did give us a sense of the scale and shape of our dependencies.

Post reply on HN