The world needs a software bill of materials
Let me tell you a secret (not really):<p>- supply chain attacks are not new<p>- sophisticated attacks are not new<p>- what made microsoft call it the most sophisticated attack was *not* because of it using a supply chain attack, or waiting or any of the major bullet points listed when speaking about it but the combination of them and all the small details skipped<p>- through it might be the first sophisticated attack using supply chains *which we know of and which got a lot of press&#x2F;success*.<p>- Neither new are attack which are possible at massive, potential global scale, even without supply chain attacks. So there has been a long time a lot potential for people losing, trust. There is a reason why many tech affine people don&#x27;t trust governments or large institutions which sensitive data, we know the even the largest institutions will not always manage to keep our data safe.<p>- &quot;does not take the coordinated effort of thousands of engineers in a nation-state&quot; all sophisticated large scale attacks do *not* need thousands of engineers. Most times it&#x27;s done by teams with noticeable less then 100 people. Nation-scal agressors are not that because they have so many (evil;) programmers but because they have access to nation-scale resources, like access to internet infrastructure, vulnerabilities known by the secret service  or just money they can use for probing or obfuscating DDOS attacks. Lastly  governments can have an easier job to bring a lot of expertise together, by bringing very qualified people together, not very many.<p>- &quot;load external modules&quot; has nothing to do with supply chain attacks, while it sometimes can make thinks simpler if you can affect the source-code (which is what supply chain attacks are about) you can do everything you need without any &quot;module loading&quot;.<p>- &quot;few risks unique to the software domain&quot;, I would say more than a few, and they are well known since over a decade<p>- &quot;others are proprietary&quot;, which is a problem as it undermines many ways a user can try to detect&#x2F;catch supply chain attacks. Non of which are perfect, like non would have   cough this attack. But it still makes attacks of this kind harder.<p>- &quot;Dependency hell&quot; the only real problem, libraries with non-clear and brittle and to much much changing interfaces, at the same time surprisingly language dependent.<p>- &quot;easier automated than what defenders need to do.&quot;, I wouldn&#x27;t be sure about it, the same way attackers can scan for problem you can do so (and if you find something fix it). Tools like fuzz testing and other kinds automatic software analysis are widely underused.<p>- &quot;96% of all software products included third-party software components and commercial&quot; it tries to make this look like a problem but actually the only way to avoid security vulnerability (and build modern software) is by using external tools. If everyone would implement e.g. their own crypto there would be more vulnerabilities and automatic scanning for them would *still* work as people tend to make similar mistakes when writing similar code.<p>- &quot;and now also by nation state actor&quot;, not it should be &quot;and since the beginning&quot;. Just look at crypto wars, or how currently the US&#x2F;EU governments again try to undermine software security for questionable reasons.<p>- &quot;a bill of materials protects best against supply chain vulnerabilities when it is set up as a holistic cross-domain effort&quot;... no it doesn&#x27;t. There is nothing in a bill of materials which is able to prevent supply chain attacks. I have no idea why the author believes it. At best it can make it easier to catch if a known-to-be-vulnerable dependency is used. But supply chain attacks are about about making a dependency vulnerable without anyone knowing and *by changing it*. Not just by adding code. I guess this is build on the misconception that not having &quot;loading of external modules&quot; would help against supply chain attacks. It doesn&#x27;t. It just makes it negligible harder.<p>-by the way open accessible source does imply a bill of materials (being derivable form the source) and allows you to automatically run software analysis tools on the source code etc.<p>- &quot;medical industry has been targeted for years&quot; and banking systems, operating systems, mail programs and games have been attacked even longer. The medical industry is interested in this to *avoid legal problems by using absurdities like software being &quot;certified&quot; to be secure (e.g. by using SBOM&#x27;s) and similar*. A concept which is known to not actually work but tends to work to avoid legal responsibility. If they would care they would push for open accessible source, proper bug bounty programs and similar.<p>- &quot;What needs to be done?&quot; (In my opinion:) Push for at least open accessible source (!= open source). Push for more usage of software analysis tools. Push for proper bug bounty programs (many existing ones are questionable). *Enforce legal liability IF it&#x27;s clear the software &quot;seller&quot; didn&#x27;t care for making and keeping the software secure.* (I.e. Liability if negligent). Push for using additional protection which reduce attackers gain even if there are vulnerabilities. E.g. migrations like address layout randomization and shadow stack, sandboxing, dropping privileges, etc. WebASM might play a major role in this.
Push for responsible choice of language, libraries and tooling. Push companies to take more responsibility for open source tools they use (!= open accessible source).<p>Lastly sometimes (not seldom) they *way* you use a certain dependency and for what you use it is making a *extreme* difference wrt. security. One example would be alternative hash algorithms in the rust eco system. Use them for certain internal use-case and all is fine. Use them at the wrong place and they enable hash map based DOS attacks. Another example would be openssl which you can use responsible, but also can use in horrible insecure ways.<p>In the end a SBOM is a thing which *should* be cheap to create (potentially automatized) but will only yield a slim improvement in general. It is IMHO *by far* not the most important step to do, but I guess it&#x27;s one of the most easiest steps to do.<p>So why not, but don&#x27;t believe it will make any major difference.