Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source projects could sell SBOM fragments

thomas-huehn.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Open source projects could sell SBOM fragments

#41

Post by mschuster91 »

josteink wrote: post #22
mschuster91 wrote: post #12

Earlier quoted context omitted.

For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.

Which is why enterprises everywhere has software and tooling in place to provide this, for the exact things they do deliver. I don’t see how anyone can «sell» this information when it’s literally available for free already.

> I don’t see how anyone can «sell» this information when it’s literally available for free already.

It's a channel for OSS projects to get money for corporate funding. Not all standard procedures allow for making up shit that the vendor doesn't provide, so you go and pay for the vendor's SBOM shrug

Re: Open source projects could sell SBOM fragments

#44

Post by nocoiner »

chefandy wrote: post #23
wbadart wrote: post #10

Earlier quoted context omitted.

Software bill of materials https://www.cisa.gov/sbom

I love how the logo looks like it could be for a powerlifting gym in 1989.

I wasn’t sure what exactly I would see when I clicked over to view the logo, but yep, you nailed it.

Re: Open source projects could sell SBOM fragments

#45

Post by CrimsonRain »

troymc wrote: post #31
martinsnow wrote: post #29

At my employer we generate sboms for all libraries we use. Why would we pay for them?

It sounds like you and your fellow employees are generating those sboms while on the clock. In other words, your employer is paying for those sboms, indirectly, already. From your employer's point of view, sboms are an expense. Maybe it's a small expense, maybe it's a big one. If it gets big enough, I suppose they might consider outsourcing it.

It's an automated process. Takes a day at most to set it up if you don't have it already

Re: Open source projects could sell SBOM fragments

#46

Post by tsimionescu »

Y_Y wrote: post #14

You downloaded it without knowing the license (or trusting your download tool to tell you correctly) and the solution is to pay a third-party?

Well, do you have any idea what software you're pulling (and under what licenses) if you run `apt install vim`?

Because let me tell you, if you think it's just vim, you're quite mistaken. And if you're distributing a docker image that contains vim, even for non-commercial purposes, it's technically your job to know. And perhaps to extend anyone downloading that docker image the offer of getting the source code for the specific version of any GPL software it might include, which it's up to you to archive.

Re: Open source projects could sell SBOM fragments

#47

Post by DyslexicAtheist »

wongarsu wrote: post #34
hiatus wrote: post #2

This doesn't make much sense to me. Why would someone want to pay each and every open source project to see the SBoM when they could pay a single provider or use an open source tool to get that info for all of their dependencies?

With modern package managers you can just generate your SBOM out of your lock file and call it a day. That misses dependencies that cross language boundaries, but it gets you 98% there for 10% of the effort. But what if you are writing C++, where it's the norm for libraries to vendor their dependencies, with no way to automatically detect them? Sure, that is an opportunity for middleman to sell SBOM databases. But I…

> With modern package managers you can just generate your SBOM out of your

that's how most of the sbom tools work, ...

what is missing is a way to convince companies who provide an SDK that includes 3rd party dependencies to ship a machine redable SBOM as part of every release. otherwise it'll be very hard to figure out how to make sense of that data.

Re: Open source projects could sell SBOM fragments

#48

Post by NegativeK »

holowoodman wrote: post #16
mschuster91 wrote: post #12

Earlier quoted context omitted.

For private usage no one gives a shit about SBOM, but for enterprise usage it's absolutely required.

Enterprise also doesn't really care. It is just another box to tick and an excel sheet to fill out, correctness isn't actually required. You just need something to put in the list, so you may as well purchase something wrong but authoritative-looking in bulk.

When some new version of log4j comes about and everyone is scrambling to find out where it resides, the cybersecurity team is going to hate the crappy checkbox solution that doesn't actually work.

Which is pretty much the norm.

Re: Open source projects could sell SBOM fragments

#49

Post by jcalx »

Syft (https://github.com/anchore/syft) and ScanCode (https://github.com/aboutcode-org/scancode-toolkit) are good open-source tools to generate SBOMs and search repos for licensing information — I'm curious to hear if there are reasons why those wouldn't work for enterprise purposes.
Post reply on HN