News for hackers. Stuff that matters.

A comment on The world needs a software bill of materials. Parent comment

Re:The world needs a software bill of materials by mattcwilson on Sunday March 21, 2021 @09:17AM (#26530168)
Ok, but there would still be some point of contact where an SBOM would show “company X fork of Ruby, company X fork of package Z” etc, right?

And then the choice gets back to how much to trust company X and package Z, weighed against alternative solutions.

[ Parent | on HN ]
Re:The world needs a software bill of materials by mannykannot on Sunday March 21, 2021 @09:40AM (#26530347)
Unless penalties for doing so are legislated, they need not claim that the fork they are actually using is a fork of anything; they could treat it as if part of their proprietary code (though they might be in violation of license agreements if they do this.)
[ Parent | on HN ]
Re:The world needs a software bill of materials by sokoloff on Sunday March 21, 2021 @09:41AM (#26530354)
It seems like it could equally be “internal package UUID1 version X, internal package UUID2 version Y” if malicious compliance and/or industrious laziness was the goal.
[ Parent | on HN ]