Hacker News Reader

Comment by aftbit | Hacker News Reader

I don't quite understand SBoM. How does this help with something like the Solarwinds attack or a general CI compromise? Or is there another type of attack this helps mitigate or detect?

Their example entry basically just says (very simplified) "Intel both built and supplied the microcode for your Intel CPU". But it says nothing like "Intel used Jenkins version x.y.z which bundled log4j version a.b.c" so you still can't tell if your binary blob was built by a compromised system or not, even once you learn about the potential attack.

View on HN

It won't tell you about malware. It just means when my customers have questions about well publicised vulnerabilities in open source dependencies, they can audit themselves for the presence of that dependency with a set of standard tooling.

That said, my company is moving towards having SBOMs, but seems to be making them available on request only. Which in my mind defeats the point of having them.

The things you mentioned are not solved by a typical "SBOM" but e.g. CycloneDX has extra fields to record provenance and pedigree and things like in-toto (https://in-toto.io/) or SLSA (https://slsa.dev/) also aim to work in this field.

I've spent the last six months in this field and people will tell you that this or that is an industry best practice or "a standard" but in my experience none of that is true. Everyone is still trying to figure out how best to protect the software supply chain security and things are still very much in flux.

If nothing else it tells you that Intel is responsible for whatever version of log4j they decided to include in their dependencies.

I always thought SBoMs _can_ link to all the dependencies a build used, which user can later securely resolve to all the transitive binaries/dependencies like log4j version a.b.c.

In the SolarWinds case, the attack was carried out on the build system itself, so a hypothetical SBoM published by the compromised build system itself would be fairly useless to their customers.

I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not.

Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?

Reply on news.ycombinator.com