#sboms — Public Fediverse posts

Meanwhile in DevOps No.80

Secure your curls.

#MWID #SBOMs

Meanwhile in DevOps No.80

Secure your curls.

#MWID #SBOMs

Wer heute Abhängigkeiten verwaltet, verwaltet auch Risiken. Genau deshalb reichen Versionsnummern in der Parent POM längst nicht mehr aus. Mit @svenruppert erfährst du, wie #SBOMs, CRA & NIS2 das Dependency Management in #Java verändern: https://javapro.io/de/die-parent-pom-vom-build-werkzeug-zum-fundament-der-software-supply-chain-security/

#DevSecOps #Maven

Wer heute Abhängigkeiten verwaltet, verwaltet auch Risiken. Genau deshalb reichen Versionsnummern in der Parent POM längst nicht mehr aus. Mit @svenruppert erfährst du, wie #SBOMs, CRA & NIS2 das Dependency Management in #Java verändern: https://javapro.io/de/die-parent-pom-vom-build-werkzeug-zum-fundament-der-software-supply-chain-security/

#DevSecOps #Maven

Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.

Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/

#Maven #Gradle #CycloneDX

Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.

Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/

#Maven #Gradle #CycloneDX

Wer heute Abhängigkeiten verwaltet, verwaltet auch Risiken. Genau deshalb reichen Versionsnummern in der Parent POM längst nicht mehr aus. Mit Sven Ruppert erfährst du, wie #SBOMs, CRA & NIS2 das Dependency Management in #Java verändern: https://javapro.io/de/die-parent-pom-vom-build-werkzeug-zum-fundament-der-software-supply-chain-security/

#DevSecOps #Maven

Wer heute Abhängigkeiten verwaltet, verwaltet auch Risiken. Genau deshalb reichen Versionsnummern in der Parent POM längst nicht mehr aus. Mit Sven Ruppert erfährst du, wie #SBOMs, CRA & NIS2 das Dependency Management in #Java verändern: https://javapro.io/de/die-parent-pom-vom-build-werkzeug-zum-fundament-der-software-supply-chain-security/

#DevSecOps #Maven

Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.

Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/

#Maven #Gradle #CycloneDX

Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.

Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/

#Maven #Gradle #CycloneDX

Third-Party Notices (TPNs) are often the only verifiable record when source code or #SBOMs are inaccessible, yet they’re usually trapped in unstructured PDFs.

A new guest blog by Devashri Datta discusses transforming TPNs into "Security Intelligence."

https://openssf.org/blog/2026/04/17/why-third-party-notices-are-breaking-at-scale-what-the-ecosystem-needs-next/

Third-Party Notices (TPNs) are often the only verifiable record when source code or #SBOMs are inaccessible, yet they’re usually trapped in unstructured PDFs.

A new guest blog by Devashri Datta discusses transforming TPNs into "Security Intelligence."

https://openssf.org/blog/2026/04/17/why-third-party-notices-are-breaking-at-scale-what-the-ecosystem-needs-next/

Again for the evening (CET) crowd:

The recording from NYC*BUG (Properly pronounced "Nice Bug") Saturday January 10th, 2026 session "The Book of PF 4th ed + EU CRA: It's time to Engineer up" is now available:

Youtube: https://youtu.be/HOCsvcCm1Ec
Peertube: https://toobnix.org/w/bQPtKXKqJMdeYDbzhrrkEa

#bookofpf #OpenBSD #freebsd #packetfilter #EUCRA #CRA #SBOMS #dependency #supplychain #security @nostarch

Again for the evening (CET) crowd:

The recording from NYC*BUG (Properly pronounced "Nice Bug") Saturday January 10th, 2026 session "The Book of PF 4th ed + EU CRA: It's time to Engineer up" is now available:

Youtube: https://youtu.be/HOCsvcCm1Ec
Peertube: https://toobnix.org/w/bQPtKXKqJMdeYDbzhrrkEa

#bookofpf #OpenBSD #freebsd #packetfilter #EUCRA #CRA #SBOMS #dependency #supplychain #security @nostarch

Andrew Nesbitt takes us on a thrilling journey through the dazzling world of #lockfiles, asking the earth-shattering question: could they be SBOMs? 🚀✨ Spoiler alert: the answer is yes, but in formats as unique as snowflakes. ❄️ Meanwhile, the rest of the world waits with bated breath for the EU to dictate our digital lives! 🇪🇺🔒
https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html #SBOMs #digitaltransformation #EUregulations #cybersecurity #HackerNews #ngated

Andrew Nesbitt takes us on a thrilling journey through the dazzling world of #lockfiles, asking the earth-shattering question: could they be SBOMs? 🚀✨ Spoiler alert: the answer is yes, but in formats as unique as snowflakes. ❄️ Meanwhile, the rest of the world waits with bated breath for the EU to dictate our digital lives! 🇪🇺🔒
https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html #SBOMs #digitaltransformation #EUregulations #cybersecurity #HackerNews #ngated

Could lockfiles just be SBOMs?

https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html

#HackerNews #lockfiles #SBOMs #softwaredevelopment #cybersecurity #open_source

Could lockfiles just be SBOMs?

https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html

#HackerNews #lockfiles #SBOMs #softwaredevelopment #cybersecurity #open_source

🧑‍🌾 bomctl makes SBOMs easier to work with by handling format and version differences for you. Convert between SPDX and CycloneDX, upgrade spec versions, and link #SBOMs across suppliers and systems.

Watch the OpenSSF Project Spotlight about #bomctl: https://youtu.be/Tax1pNaySYQ?si=98Cg8V73m7uHzTMu

🧑‍🌾 bomctl makes SBOMs easier to work with by handling format and version differences for you. Convert between SPDX and CycloneDX, upgrade spec versions, and link #SBOMs across suppliers and systems.

Watch the OpenSSF Project Spotlight about #bomctl: https://youtu.be/Tax1pNaySYQ?si=98Cg8V73m7uHzTMu

When a new vulnerability drops, the first question is always: Is this in my supply chain? 🔍

By ingesting and enriching #SBOMs with vulnerability and dependency data, #GUAC lets you query your entire application portfolio and pinpoint where action is needed immediately.

🎥 https://youtu.be/uDT0xes5ico?si=3qMKMsRk0lYcL8fS

When a new vulnerability drops, the first question is always: Is this in my supply chain? 🔍

By ingesting and enriching #SBOMs with vulnerability and dependency data, #GUAC lets you query your entire application portfolio and pinpoint where action is needed immediately.

🎥 https://youtu.be/uDT0xes5ico?si=3qMKMsRk0lYcL8fS

I chat with @mbarbero about security happenings at the @EclipseFdn

My favorite project they have is helping projects generate #SBOMs, but there's a lot happening. If you want to see some public examples of how to do security right, give it a listen!

https://opensourcesecurity.io/2025/2025-10-eclipse-sbom-mikael-barbero/

I chat with @mbarbero about security happenings at the @EclipseFdn

My favorite project they have is helping projects generate #SBOMs, but there's a lot happening. If you want to see some public examples of how to do security right, give it a listen!

https://opensourcesecurity.io/2025/2025-10-eclipse-sbom-mikael-barbero/

Our next #JCON2025 session is live: 'SBOMs Are Not Enough' with Brian Demers

Software Bill of Materials #SBOMs have emerged as a #critical component of #software supply chain #security, promising transparency about the #dependencies in our…

Grab your coffee and hit play: https://youtu.be/4jtf9ATNyx8

Our next #JCON2025 session is live: 'SBOMs Are Not Enough' with Brian Demers

Software Bill of Materials #SBOMs have emerged as a #critical component of #software supply chain #security, promising transparency about the #dependencies in our…

Grab your coffee and hit play: https://youtu.be/4jtf9ATNyx8

Next week I will attend to #osseu 2025 from @linuxfoundation to talk about osskb.org , the service that allow OSS devs and projects to detect open source software, so they can curate it, then create accurate and complete #sboms with their tooling of choice, in a reasonable amount of time https://osseu2025.sched.com/event/25VuV/the-sbom-era-leaving-no-open-source-project-behind-with-osskborg-agustin-benito-bethencourt-toscalix-consulting-matias-daloia-scanoss?iframe=no

Next week I will attend to #osseu 2025 from @linuxfoundation to talk about osskb.org , the service that allow OSS devs and projects to detect open source software, so they can curate it, then create accurate and complete #sboms with their tooling of choice, in a reasonable amount of time https://osseu2025.sched.com/event/25VuV/the-sbom-era-leaving-no-open-source-project-behind-with-osskborg-agustin-benito-bethencourt-toscalix-consulting-matias-daloia-scanoss?iframe=no

Great podcast to learn how open source assessment is leveraged in mergers and aquisitions, and the value of SBOM for license compliance: My Open Source Experience Podcast: From Law to OSPOs https://shows.acast.com/my-open-source-experience-podcast/episodes/from-law-to-ospos-my-open-source-experience-podcast #OpenSource #SBOMs #podcast

Great podcast to learn how open source assessment is leveraged in mergers and aquisitions, and the value of SBOM for license compliance: My Open Source Experience Podcast: From Law to OSPOs https://shows.acast.com/my-open-source-experience-podcast/episodes/from-law-to-ospos-my-open-source-experience-podcast #OpenSource #SBOMs #podcast

Love #SBOMs ☕ Hate Mondays 😒
Join us TODAY at 11 AM ET — we’ve got the meeting for you! https://openssf.org/getinvolved/

Love #SBOMs ☕ Hate Mondays 😒
Join us TODAY at 11 AM ET — we’ve got the meeting for you! https://openssf.org/getinvolved/

Stop with gut feelings. Part 3 of Steve Poole’s series brings the facts your #AI & software pipelines need. From #SBOMs to audit trails, AI risk levels & vendor checks—get compliant, stay ready.

👉 Read now: javapro.io/2025/04/08/move-fast-break-laws-ai-open-source-and-devs-part-3/

#DevSecOps #AICompliance #SupplyChainSecurity

Stop with gut feelings. Part 3 of Steve Poole’s series brings the facts your #AI & software pipelines need. From #SBOMs to audit trails, AI risk levels & vendor checks—get compliant, stay ready.

👉 Read now: javapro.io/2025/04/08/move-fast-break-laws-ai-open-source-and-devs-part-3/

#DevSecOps #AICompliance #SupplyChainSecurity

Ever tried to patch a vulnerable #Java image hours before release? @MohammadAliEN shares how #SBOMs, multi-stage builds, and attestations keep your pipeline clean—so you never scramble last minute again.

Check it out: https://javapro.io/2025/07/03/how-to-containerize-a-java-application-securely/

#SpringBoot #DockerScout #DevSecOps

Ever tried to patch a vulnerable #Java image hours before release? @MohammadAliEN shares how #SBOMs, multi-stage builds, and attestations keep your pipeline clean—so you never scramble last minute again.

Check it out: https://javapro.io/2025/07/03/how-to-containerize-a-java-application-securely/

#SpringBoot #DockerScout #DevSecOps

Discover how eBPF, Cilium, and Tetragon enhance container security with real-time kernel-level insights. Learn to combine these tools with SBOMs for robust security monitoring. Boost your skills with OS-SCi education programs! #ContainerSecurity #eBPF #Cilium #Tetragon #SBOMs https://dub.sh/cZVQvk6

Discover how eBPF, Cilium, and Tetragon enhance container security with real-time kernel-level insights. Learn to combine these tools with SBOMs for robust security monitoring. Boost your skills with OS-SCi education programs! #ContainerSecurity #eBPF #Cilium #Tetragon #SBOMs https://dub.sh/cZVQvk6

🔍 Secure your #software supply chain!

See how #ScanCode, #VulnerableCode & #SBOMs help find licenses & vulnerabilities for safe #FOSS reuse. Watch Benjamin Aronov share practical tips for safer development.

Click here: https://youtu.be/-uKyckLPSQc

🔍 Secure your #software supply chain!

See how #ScanCode, #VulnerableCode & #SBOMs help find licenses & vulnerabilities for safe #FOSS reuse. Watch Benjamin Aronov share practical tips for safer development.

Click here: https://youtu.be/-uKyckLPSQc

🔍 Secure your #software supply chain!

See how #ScanCode, #VulnerableCode & #SBOMs help find licenses & vulnerabilities for safe #FOSS reuse. Watch Benjamin Aronov share practical tips for safer development.

Click here: https://youtu.be/-uKyckLPSQc

🧰 #SBOMs are the foundation of understanding your software supply chain, but picking the right tool can be tricky. In a new blog post, Nathan walks through key SBOM generation tools—from single-language options to multi-language solutions like cdxgen, syft, and tern.

Read the guest blog: https://openssf.org/blog/2025/06/05/choosing-an-sbom-generation-tool/

#OpenSSF #OSSSecurity

Join the @swheritage team at Mining Software Repositories 2025 to learn about their latest work on: understanding the historical trajectory of Programming Language Evolution over 50 years, advancements in achieving Reproducible Builds at Scale & Wild #SBOMs. Full program: https://2025.msrconf.org #MSR2025

Excited for #JCON EUROPE 2025? See Brian Demers at #JCON2025 in Cologne talking about '#SBOMs Are Not Enough'

Software Bill of Materials (SBOMs) have emerged as a #critical component …

Get your free #JUG Ticket: http://www.jcon.one

Last month, the SBOMit community explored how attestations can enhance #SBOMs to secure the software supply chain. Learn why SBOMs alone aren’t enough and how attestations help ensure integrity! 🔐 Read the recap:
🔗 https://openssf.org/blog/2025/03/25/beyond-the-software-bill-of-materials-sbom-ensuring-integrity-with-attestations-event-recap/
#SoftwareSecurity

#SBOMs are buzzy for sure but why? Join us tomorrow on our series "Understanding SBOMs" - we are demo'ing:
1. How to automate SBOM generation
2. How to integrate SBOMs into #CICD
3. How to control costs
Register today https://get.anchore.com/automate-generate-manage-sboms/

#Sigstore creator, #Chainguard CEO, #OpenSSF TAC member and Season 1 guest Dan Lorenc returns to the #ITOps Query podcast to discuss the year in #opensource and #cybersecurity. Topics range from #softwaresupplychain management, hardening #containerimages and #SBOMs in limbo to #openproduct companies and business models, including his own company's shift in focus this year. Plus: a look ahead to #SecOps and #AI in 2025. #yearinreview #2024yearinreview

https://www.podbean.com/ew/pb-ivy26-1778bf6

Bloggingsaturday?

"Das Spiel mit dem Open Source Feuer"?

https://blog.security-manufaktur.de/sbom/cyclonedx/spdx/opensource/oss/kehl/2024/12/07/sbom-security-insider.html

Mich störte die Formulierung massiv, also schrieb ich einen Blog Eintrag dazu.

#SBOM #SBOMs #opensource #security #softwarebillofmaterials #linux #spdx #cyclonedx #owasp #linuxfoundation