I attended/presented at this event and loved this keynote.
I want to push back on the idea that there is no consensus on what an SBOM is — there are two very popular specs! Yes, quality, content and completeness does vary. And every SBOM does need to be enriched with vulnerability and runtime context. But those don’t need to be in the file itself (and aren’t static anyways).
I want to push back on the idea that there is no consensus on what an SBOM is — there are two very popular specs! Yes, quality, content and completeness does vary. And every SBOM does need to be enriched with vulnerability and runtime context. But those don’t need to be in the file itself (and aren’t static anyways).