News for hackers. Stuff that matters.

A comment on Open Source projects could sell SBoM fragments.

Re:Open Source projects could sell SBoM fragments by transpute on Monday February 17, 2025 @12:00PM (#43080977)
How would transitive dependencies be handled?

EU CRA is trying to mandate certification of some dependencies, which may result in fees going to 3rd-party certifying orgs, rather than OSS projects.

[ Parent | on HN ]
Re:Open Source projects could sell SBoM fragments by rlupi on Tuesday February 18, 2025 @12:07AM (#43086250)
> How would transitive dependencies be handled?

Have a SBOM format whose license requires truthful reporting (or the license is null and defaults to open source), then trust only those SBOM formats with this property.

Taleb's minority law will do the rest. Pretty soom, most SBOM formats will adopt this rule.

[ Parent | on HN ]