[HN Gopher] Open source projects could sell SBOM fragments
___________________________________________________________________
Open source projects could sell SBOM fragments
Author : Tomte
Score : 76 points
Date : 2025-02-17 16:09 UTC (6 hours ago)
(HTM) web link (www.thomas-huehn.com)
(TXT) w3m dump (www.thomas-huehn.com)
| hiatus wrote:
| This doesn't make much sense to me. Why would someone want to pay
| each and every open source project to see the SBoM when they
| could pay a single provider or use an open source tool to get
| that info for all of their dependencies?
| hyperpape wrote:
| Right. A significant part of the reason open source wins so
| handily isn't that the money for a proprietary solution is
| always more than it's worth, it's that you can just pull open
| source dependencies without going through purchasing.
| rdtsc wrote:
| Exactly. Going from $0 purchase cost to $0.01 is a nearly
| impossible problem in many organizations. Paradoxically,
| they'll find a way to waste $100k on an "enterprise" stack to
| do the same though.
| Spivak wrote:
| If you're going to pay you might as well buy the best. Not
| saying that the enterprise stack is such a thing but that's
| how it's perceived.
| verdverm wrote:
| $100k is on the cheap side, I've seen millions spent before
| upper management is convinced they should have gone with
| the open source solution that was already in place and
| working
| mschuster91 wrote:
| For private usage no one gives a shit about SBOM, but for
| enterprise usage it's absolutely required.
| holowoodman wrote:
| Enterprise also doesn't really care. It is just another box
| to tick and an excel sheet to fill out, correctness isn't
| actually required. You just need something to put in the
| list, so you may as well purchase something wrong but
| authoritative-looking in bulk.
| tpm wrote:
| It might be required and audited for software deployed to /
| interacting with government cloud. Eventually it will have
| to be correct too, as otherwise would be a security risk.
| holowoodman wrote:
| Yes, but that is an expense for a future faraway fiscal
| year.
| NegativeK wrote:
| When some new version of log4j comes about and everyone is
| scrambling to find out where it resides, the cybersecurity
| team is going to hate the crappy checkbox solution that
| doesn't actually work.
|
| Which is pretty much the norm.
| josteink wrote:
| Which is why enterprises everywhere has software and tooling
| in place to provide this, for the exact things they do
| deliver.
|
| I don't see how anyone can <<sell>> this information when
| it's literally available for free already.
| indymike wrote:
| > I don't see how anyone can <<sell>> this information when
| it's literally available for free already.
|
| I think this has been repeated thousands of times in
| history.
| mschuster91 wrote:
| > I don't see how anyone can <<sell>> this information when
| it's literally available for free already.
|
| It's a channel for OSS projects to get money for corporate
| funding. Not all standard procedures allow for making up
| shit that the vendor doesn't provide, so you go and pay for
| the vendor's SBOM _shrug_
| wongarsu wrote:
| With modern package managers you can just generate your SBOM
| out of your lock file and call it a day. That misses
| dependencies that cross language boundaries, but it gets you
| 98% there for 10% of the effort. But what if you are writing
| C++, where it's the norm for libraries to vendor their
| dependencies, with no way to automatically detect them?
|
| Sure, that is an opportunity for middleman to sell SBOM
| databases. But I could equally well see large c++ projects
| selling a subscription that offers an SBOM for each release,
| along with a couple bullet points to pad the offer (phone
| support, priority for feature requests and bug reports, early
| testing for new releases, etc).
|
| Similar to how every SaaS has an Enterprise plan that is
| ridiculously expensive because big companies will pay anything
| to get SSO and an audit trail. And the provider adds a couple
| more enterprise features so nobody has to justify why they pay
| 5x the regular price just to get those two features. Same,
| idea, but with companies paying $100/month to get an SBOM and
| nice-to-haves for software they could get for free
| DyslexicAtheist wrote:
| > With modern package managers you can just generate your
| SBOM out of your
|
| that's how most of the sbom tools work, ...
|
| what is missing is a way to convince companies who provide an
| SDK that includes 3rd party dependencies to ship a machine
| redable SBOM as part of every release. otherwise it'll be
| very hard to figure out how to make sense of that data.
| transpute wrote:
| How would transitive dependencies be handled?
|
| EU CRA is trying to mandate certification of some dependencies,
| which may result in fees going to 3rd-party certifying orgs,
| rather than OSS projects.
|
| In theory, customers with budget for improving their OSS supply
| chain could configure an OSS micropayment allocator to parse a
| graph of dependent: * SBOMs * roadmaps
| * requirements * bug reports * test reports *
| compliance rules
|
| then distribute funds based on performance metrics defined by
| each customer. That could move SBOMs from cost center to
| revenue/operations center, without centralization.
|
| LF OpenSSF 2024 report covers centralized efforts to improve OSS
| supply chains, https://openssf.org/download-the-2024-openssf-
| annual-report/
| The28thDuck wrote:
| Why not have some sort of VCS provider do something similar to
| Medium/Substack/etc. where access is generally free but
| frequently prompts you to subscribe/donate before access?
| andrewflnr wrote:
| Because tooling would route around it immediately. Among other
| reasons, you can't have interactive prompts for support gumming
| up your CI (and if they're not interactive, then they're
| trivial to ignore). NPM does something close to this, but it's
| much more opt-in for the user.
| anonnon wrote:
| Github or some other third party would Hoover up whatever money
| could made from this. Also, a lot of projects can be surprisingly
| sloppy when it comes to this. (For example, treating MIT-licensed
| code as if it's public domain and neglecting to include the
| license and copyright notice.)
| arccy wrote:
| would you even trust the dependency if it's not reproducible? if
| it is reproducible, then the package manager is sufficient to
| generate a sbom
| TheRealPomax wrote:
| What's SBOM?
| wbadart wrote:
| Software bill of materials
|
| https://www.cisa.gov/sbom
| chefandy wrote:
| I love how the logo looks like it could be for a powerlifting
| gym in 1989.
| nocoiner wrote:
| I wasn't sure what exactly I would see when I clicked over
| to view the logo, but yep, you nailed it.
| TheRealPomax wrote:
| Damn, this article needs a few {{when}} and {{citation
| needed}} O_o
| stackskipton wrote:
| They could but few people seem to care about SBoM past getting
| InfoSec to shut up about it. So I imagine return would not be
| worth the effort.
| otterz wrote:
| In GNU Guix declaring the license(s) of a package is mandatory so
| it kinda automates the process of creating SBoM.
| captn3m0 wrote:
| True for many other distros as well, such as Debian.
| Y_Y wrote:
| You downloaded it without knowing the license (or trusting your
| download tool to tell you correctly) and the solution is to pay a
| third-party?
| ATechGuy wrote:
| Yes, that's the state of the art unfortunately. There are a
| number of vendors who can scan your source code and generate a
| list of FOSS libraries with licensing info (SBOMs). If we can
| find a way to get this money flowing to our fellow FOSS devs,
| that would be a huge win for the community.
| tsimionescu wrote:
| Well, do you have any idea what software you're pulling (and
| under what licenses) if you run `apt install vim`?
|
| Because let me tell you, if you think it's just vim, you're
| quite mistaken. And if you're distributing a docker image that
| contains vim, even for non-commercial purposes, it's
| technically your job to know. And perhaps to extend anyone
| downloading that docker image the offer of getting the source
| code for the specific version of any GPL software it might
| include, which it's up to you to archive.
| tuananh wrote:
| it could never work with corporate using micro transactions like
| that
| transpute wrote:
| Not yet, which is why OpenSSF is disbursing millions in small
| amounts, on behalf of large corporates,
| https://openssf.org/download-the-2024-openssf-annual-report/.
| But digital payments are progressing as slowly and steadily as
| SBOMs, so they could potentially converge in the future.
| ghostoftiber wrote:
| The providence of the SBOM is important. If you can't say "I made
| this" in reference to the SBOM then it's pretty much worthless.
|
| Or, flip the script, if you're concerned enough about supply
| chain security to mandate an SBOM, you probably don't trust the
| supplier anyway.
|
| There's the "but I signed it" crowd, but the wheels fall off when
| they've signed compromised artifacts too.
|
| I just don't see a scenario where an SBOM that cannot be
| inspected and verified would be useful. If you have the
| infrastructure to do it, you're generating SBOMs anyway.
| martinsnow wrote:
| It's not so much about who made what. It's about knowing what
| versions where used and which CVEs are attached.
| troymc wrote:
| CVEs are very important, of course, especially nowadays,
| but...
|
| Many licenses, such as the MIT license, are very open. All
| you have to do is include the license text and the names of
| the software creators, because they want attribution. In
| other words, _it really is about who made what_ , even with
| some of the most open licenses.
|
| Licenses matter, a lot. After all, some licenses are share-
| alike/viral: if you "use" code with such a license, your code
| might inherit that license. (I put "use" in scare quotes
| because this is where the lawyers get involved. It depends
| how exactly you use the code.)
| kkarpkkarp wrote:
| after reading it I automatically desired to increase the number
| of dependencies in my OS software, not to bring any new features,
| but to increase the income :)
|
| and I think it defined amount of time it would happen globally if
| the idea would be accepted
| neilv wrote:
| Some of the demand will disappear, when, instead of adding a
| dependency on an open source package, to get that function you
| want, you use your LLM "assistant".
|
| (The assistant will effectively plagiarize open source code, and
| then you don't have a dependency, and you slap your own copyright
| notice on it.)
|
| LLM-generated/laundered code could move code bases a little bit
| back in the direction of low-dependency monoliths, like a lot of
| software was before the wild popularity of open source code (and,
| especially, modern Web dev).
| pipo234 wrote:
| This is a genuine concern, especially now that managers
| discovered that _" llm assistence 10x-es developer
| productivity"_. (Where kLoCs are a measure of productivity and
| a world with more code is an obvious, axiomatic good).
| phicoh wrote:
| Sounds like a disaster waiting to happen. There will be a bug
| in that LLM generated code and then what? Ask the LLM to fix
| the bug?
| karparov wrote:
| That's an option.
|
| What with a human? "Asking" FOSS maintainers might not give
| the result you want either. Well, depends how you ask I
| guess. Perhaps attaching an attractive price offer could help
| things along.
|
| But depending on how LLMs improve, asking one of those could
| help.
| martinsnow wrote:
| At my employer we generate sboms for all libraries we use. Why
| would we pay for them?
| troymc wrote:
| It sounds like you and your fellow employees are generating
| those sboms while on the clock. In other words, your employer
| is paying for those sboms, indirectly, already. From your
| employer's point of view, sboms are an expense. Maybe it's a
| small expense, maybe it's a big one. If it gets big enough, I
| suppose they might consider outsourcing it.
| CrimsonRain wrote:
| It's an automated process. Takes a day at most to set it up
| if you don't have it already
| deng wrote:
| And those OSS maintainers would also, in writing, assure that if
| there's an error or something missing from that SBOM, they are
| liable for all legal fees and other costs associated with a
| license violation which might occur due to that error? Because
| otherwise, what's the point in paying for an SBOM?
|
| In any case, since surely not all maintainers will provide this
| service, you need to scan your codebase anyway. And it's not that
| difficult, really. I recommend https://github.com/aboutcode-
| org/scancode-toolkit.
| stevage wrote:
| And, uh, what is an SBOM fragment? Lots of acronyms here that
| don't really work out context.
___________________________________________________________________
(page generated 2025-02-17 23:00 UTC)