/Cinny
UN: everyone should be able to have the chance to see a puppy if they want
US: No
Israel: No
Everyone Else: Yes
/Cinny
/Cinny
/Cinny
@EeveeEuphoria this is kinda /srs because like
it would never get my pronouns right
/Cinny
“Hey automated vuln scanners. we are not affected by this vuln”
from what i heard about vuln scanners this info could be entirely ignored too
/Cinny
in general the SBOM formats seem to be a lot more than just providing a dependency tree with like unique package IDs and the role and license each dependency has
/Cinny
i guess this is comparable to errata lists in hardware but
spinning up a new revision for some hardware is quite expensive
releasing a new software version is free
/Cinny
anyways what is the point of including vulnerability information in the SBOM? Outside of “Hey automated vuln scanners. we are not affected by this vuln”. this is basically immediately out of date when there is an actual vulnerability, and if you continue shipping the software at this point you are shipping known insecure code
/Cinny
RDF was invented by Big WWW to make harder to understand, more complex formats
/Cinny