David Nalley - The struggle for software transparency
Channel: southeastlinuxfest
Date: 2019-09-05

SouthEast Linux Fest 2019
In the old days we knew every component on our systems. Today, even OSS packages can be a morass if included dependencies making them effective black boxes. Even proprietary software has taken to including hundreds or thousands of open source components in a single product. Regardless of whether the software included is open source or proprietary the reality is that the security surface area is exponentially  larger. Compounding the problem is that you have no way to know what is actually running in your software and products. 

Enter SBOM or Software Bill of Materials; an effort to make software and hardware distributors to disclose what software they are delivering to you.