SBOMs Why Trusting Your Software Tools Is a HUGE Flaw

We're keeping this, right? Yes. We're keeping this. It's going live. Not live, but we're keeping this for sure. Yeah. And the way they're done now is, like, they're generated by a tool, and they're as dependent on that tool as anything else. We've already had tools like that for decades, software composition analysis. If someone gave you software and you didn't know what was inside of it, you could have run your own version of that tool or 10 of those tools. Now you're stuck trusting the vendor to run one of them. You don't know if it's good or not. They miss things all the time. The only way they can have more information than those tools is if they're actually integrated into the build process itself.

Like, if every compiler in the world were generating some SBOM format that could be passed along that actually had all of the correct information.

But that's hard, and build systems are a pain, and nobody's doing that. They're all just kind of, you know, running an SCA tool and stapling on this piece of paper that no one looks at at the end.

And you still have to trust that that tool did it right and wasn't itself compromised. And so, there's still trust to be trusted.