21–30 of 64 posts
and I think it defined amount of time it would happen globally if the idea would be accepted
This doesn't make much sense to me. Why would someone want to pay each and every open source project to see the SBoM when they could pay a single provider or use an open source tool to get that info for all of their dependencies?
For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.
I don’t see how anyone can «sell» this information when it’s literally available for free already.
(The assistant will effectively plagiarize open source code, and then you don't have a dependency, and you slap your own copyright notice on it.)
LLM-generated/laundered code could move code bases a little bit back in the direction of low-dependency monoliths, like a lot of software was before the wild popularity of open source code (and, especially, modern Web dev).
Earlier quoted context omitted.
For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.
Enterprise also doesn't really care. It is just another box to tick and an excel sheet to fill out, correctness isn't actually required. You just need something to put in the list, so you may as well purchase something wrong but authoritative-looking in bulk.
Some of the demand will disappear, when, instead of adding a dependency on an open source package, to get that function you want, you use your LLM "assistant". (The assistant will effectively plagiarize open source code, and then you don't have a dependency, and you slap your own copyright notice on it.) LLM-generated/laundered code could move code bases a little bit back in the direction of low-dependency monoliths,…
You downloaded it without knowing the license (or trusting your download tool to tell you correctly) and the solution is to pay a third-party?
Earlier quoted context omitted.
For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.
Which is why enterprises everywhere has software and tooling in place to provide this, for the exact things they do deliver. I don’t see how anyone can «sell» this information when it’s literally available for free already.
I think this has been repeated thousands of times in history.
The providence of the SBOM is important. If you can't say "I made this" in reference to the SBOM then it's pretty much worthless. Or, flip the script, if you're concerned enough about supply chain security to mandate an SBOM, you probably don't trust the supplier anyway. There's the "but I signed it" crowd, but the wheels fall off when they've signed compromised artifacts too. I just don't see a scenario where an SBO…