Why Is My Software on Fire?
summary
Argues that missing version metadata breaks vulnerability alerts and forces costly recalls by analogy to airbags and peanut butter, cites recalls spanning 100 million units across 37 million cars and industry costs like $24 billion and $4.4 billion liability to show scale. Demonstrates that Go binaries embed dependency versions in metadata, explains how monkey patches or stripped builds erase version info, and shows tools like Docker Scout and SIFT/Trivy succeed only when SBOMs include accurate versioning.
AI-written summary · about
chapters (5)
- 0:00Introduction to recalls
- 5:25Supply chain parallels
- 7:34Software complexity and SBOMs
- 12:54Call to action for open source
- 13:14Q&A
related talks
32mIs the Internet on Fire? Strategies for Mitigating Open Source...
22mOn the Shoulders of Giants: Security in FOSS
58mAttacking through the Software Supply Chain
30mFueling The Future: Building Robust Engines
51mThe Opposite of Transparency
37mThe Death Star and the Ultimate Vulnerability
50mGame over or game changing? Why software development may never be the same again
27mHow Software Transparency Can Help Save the World