And it's time to start, many thanks for everyone being here today.
So this topic about software build of material, maybe not something the most fun, everybody
who has already built.
Some kind of application with dependencies and stuff like that have probably experienced
some trouble.
We have Oli Johamsson together with us today.
So speaker or teacher, consultant doing a lot of things.
Also member of the open world-wide application security project and taking care of this
SBUM from there as well to leaders and this afternoon about this topic here.
Please welcome Oli Johamsson.
Hello, I love seeing everyone around.
I hated you in the pandemic when I had to talk into a computer and not see anyone.
As you hear my voice is really bad, I'm coming from Stockholm's Weedon.
We have rough winters.
So if I get in problems with my voice, I have a co-speaker over there Anthony Harrison
from England, but I have somewhat better weather, not very good weather, but has a voice.
But I'll give it a try.
I've been in the open business for almost 35 years.
I learned unix and stolen Linux, I worked with open protocols, TCP-IP, I worked with open
source.
I'm going to hear a call for people, I'm going to hear do phone calls.
You're all doing phone calls.
Good.
In 10 years, I developed the open source PBX asterisk with a team of really cool developers
who are all better than me.
I've also been working in Boovas now for some time, and especially focusing on the Cyber
Assistance Act and the effects of that.
I mean, looking into what we as open source projects or manufacturers need to do, I
realized that there were still a lot of missing parts.
Some things work very well, but some things doesn't.
So as the chief problem maker that I am, I don't do vast and I started fixing stuff.
I'm going to talk about stuff that needs fixing, because I'm not selling anything, and
that's the beauty, I can tell you what's wrong, and we're going to fix this together.
See nothing about me, let's switch to another topic, I really like that's me and myself.
For facts, open source developer, active in all of us, lives in Solentone, and also Sweden,
that's why I have this voice today, and the owner of the most beautiful dog in the universe.
Right, Gordon, he is beautiful, and I'm lactose intolerant.
Being lactose intolerant means you have to have really good eyesight, because I have to read
all that text before I buy anything in the grocery store, and even if I know how a piece
of food is made, suddenly one day there's milk in it, skin-milk powder, and that would
ruin my body.
So that's one of the allergies, or sensitivities I have, but I also suffer from curl allergy.
This is really hard, and don't tell Daniel, my friend, right, he still believes I'm using
curl.
No, I guess you all know curl, it's part of your life, every single day.
If you drive a modern curl, if you use your cell phone, if you use a laptop, if you
do, whatever you do, both after-risk and Camille, you had curl modules, was really hard
to not compile weed curl, but I can do that.
But this is a tough allergy, because when buying products, how do I know if there's curl
inside, no one is telling me, can you imagine my life, can't buy anything wrong,
it's hard, Daniel makes my life hard, so what's missing is that little text on the package,
that told me if there was any direct products in the food I buy.
When you buy hardware and that assistance software, where is that list?
That's a missing piece, because that list would help us not only with curl allergies,
but when bad things happen, we would be able to know.
And bad things happen, all the time, even there are software vulnerabilities, bugs, that
even get logo types and websites, they're more famous than I am, which hurts me.
But this stuff happens, when logo for J happened, sorry, Piotr, Piotr is part of that,
I'm not a part of the logging project, when that happened, people contacted me about Camelio,
say, oh, I need you to feel informed here to confirm that you don't have this bug, I'm
like, I have no obligation to you to feel in any forms or answer any request, and by the way,
Camelio is written in C, right, but there was so much time spent worldwide trying to find
out if a customer were a platformer service had this vulnerability, manual hours, cooling
vendors, contacting open source projects, I was sitting the whole weekend, both answering
and have been customers to sort out where it hurt them.
Another problem is, when I talk with a patch of logging project, there's still downloads
that vulnerable version of luck for J, it's still in use there's a very, very long time,
long tail, do that, and even more scary was it said, vulnerability, where a foreign actor
forced in bad code, June's years of work, what if another log for J would happen today,
would you, the organization you work for, your customers, able to find out where they are
affected, do they make their own priorities, say, well, all those down printers, they never
work in a way so we can turn them off, but that website, the customer fronting website
that handles our e-business, that's something we need to put all resources on, would they
be able to do that, or would they say, all hands on that everyone call, place calls using
master is can come in you, I wish I would get a sense for every call, so I hear a lot
of that, okay, his solution to all this, the solution to almost everything including sliced
bread is the software bill of materials, right, if you only get the software bill of materials
file, done, you have some XML file or JSON file, no one understands, but you have
to file, it can relax because you solved the problem, I wish, I've custom recalling
what I'm saying, oh we have to file now, are we done, ah, ah, my computer, oh there's some animation
so I get tired when I hear that, just as marketing bullshit, this is just a new file format,
a listing of stuff, there will only need to do, right, and I keep hearing people saying, ah,
so S-bomb doesn't solve anything, it's bad, it's dead, good, good riddance, and we haven't
started, but they already killed it, all right, okay, and I hear the other side saying, oh S-bomb
solves everything, yeah, this makes me a bit worried because there's some sales involved in these
rumors, and if you get them in your social media, wherever you are, master it on or blues guy
or any other thingy, close your ears a bit, so the way I see it, S-bomb usage can be for many
different things, it started really because we needed to map all the open source licenses in
a complex project, we need to make sure that the licenses were compatible and see if if
you worked with a commercial project, if you had any risks involved in using all these components
with these licenses, from there we have gone on to vulnerability management, risk management,
supply chain management, and many other things, and the software bill materials is just one
bill material, you probably know the hardware bill material that been around for a long time,
but within cycle DX as well as S-bDX, we are expanding this group, cycle DX recently launched
a cryptography bill materials, and this is in order to help with the post quantum crypto transition,
trying to figure out what kind of crypto assets you have in your platforms in order to make
priorities on where to start, this crypto harvesting going on right now, so this is something
we need to do and the C-bomb will help you, but as you see there are many other things going on,
and this is all to help us with our complex systems, trying to map them and perform risk assessments
over the platforms, but if we go back to the software bill materials, there are many different types
on the link here you'll find what the American C-SA said a while ago, I kind of agree what they're
saying, but in my world they missed the thing you hand over between organization, the software
bill and materials that I as a manufacturer, the software project hand over, this is of course
something a little bit scary for the lawyers and compliance officers if you're in a commercial
organization, so they want to see that and attest to it, but we have many different versions
I will can focus a little bit on a build thing because you build environment to C-I-C-D-2 chain,
you're testing to chain, all of that need as pumps as well, and vulnerability management,
and that's very different from what you actually deliver, right, your test systems is
proper in a part of your delivery, and then the customer's view, in the last best one forum we've
been hearing a lot of stories from the US medical industry, medical devices, where customers in
large hospitals say that, oh have a whole file system for the less pumps, I can't use them,
but we're happy, they have less pumps, no, I have all these devices in my asset inventory
and there's no way I can match them with a big pile of less pumps, the connection is broken
and this is something we need to work on, how do we relate a thing we bought
with the S-Pone we got from upstream, but if we can do that and have the S-Pone
the S-Pone has a list of a lot of stuff with names, that's the vendor name, the component name
and abortionly identifier, and this is what's needed to verify if there are any vulnerabilities
in the platform we're running, that's very simple isn't it, vendor name, component name,
abortion, the problem is that for one of the mayor vulnerability databases, the national vulnerability
databases, national being USA of course, day decided, the vendor name, and the product name without
asking the open source project or the vendor manufacturer, now the manufacturer who produced
S-Pone's for their product, they have one idea of the name, but they have vulnerability database
have a totally different one, how do you get connection there, many S-Pone tools today, they
guess, they say that, well we have a list of combinations of stuff that I think we may hit something
and we, I don't like that, and the API termed these very nice, because if you ask it to find
a vulnerability for a given identifier, it can say not found, because the product doesn't have
any vulnerabilities, but not found can also mean the product doesn't exist in the database,
which means you had the wrong name, the wrong identifiers, and it's the same answer,
how is that helpful, but it's the US of A, be happy. So we're seeing, every time we talk about this,
even in the light of the Cybersilence Act, there's a flow, the Cybersilence Act doesn't
say anything about giving out S-Pone's to customers, you're not forced to do that,
but as a customer, I would definitely ask for the S-Pone. So we have some upstream
open source projects, and they become virtual products, we have a manufacturer that sells to a
customer. Do we see a chain of flow here of software transparency or the fact, because it's not
just S-Pone, is a couple of other adaptations, is something called the Vexfall, which I can
talk about for hours as well, and other pieces of data that the customer need to do continuous
risk assessment. So I'll try to discuss where we are with S-Pones with my fully new S-Pone
meter, a patent pending trademark registered, you know, S-Pone, a meter. O is for Ulla, of course.
So somehow there's an S-Pone maturity scale, and this is something me and I absolutely over there
in the S-Pone, Europe for them, we keep discussing, so we're not really done yet, it may
change as we move along, but you have a technology that is used by O-led doctors that
love it, start playing for it, see, immediate benefits of using this technology. Then you have
vertical sectors, S-Pones is in use in a medical industry and mandated in a medical industry
the U-S. We have the C-A-A, that says that the manufacturer is required to have an S-Pone,
it doesn't say much more about horizontal standards as coming, we'll tell you more about the details.
Then we have the happy world where everyone is using S-Pone much natural thing, and we don't even
think about it. So let's take a look. The open source license compliance, I think we're all done.
If we just get the data right, this is something you can use and should use in projects where
haven't been a system with S-Pher or Linux or something else, many different components working
together, you need to make sure that the open source licenses work together for you.
And as I said, this is really where much of the history of software build materials started,
of course this is mature technology. I shouldn't be much worried.
With software supply chain risk management, we're not fully there yet.
If you want to assess the open source you're using, you want tools. We then identify as they
can look up projects and you can do manual due diligence for your risk assessment of only
components you rely on. There are some cool stories out there. I know eBay wants told us that
they are created S-Pones of the whole all the services and they found out which open source projects
they relied heavy on. Went through that list and found a few very important projects for them,
but that was without energy, without funding and funding enough and this is very strange.
They said, well we have resources, so we fixed that problem. That's good, right. So
you can do a lot of cool stuff when you get the view of your IT services and support your
products. You can relate into each other, you can see how the organization works.
This is the evil side, I would say. Vulnerability management, a lot of it for open source relies
on a database called OSV, which use identifiers called package URLs, which we are about to bring
to standardization within the OOSP cyclone DX project. We standardize cyclone DS DX in ECMA last year.
Imagine sitting in meeting, after meeting, going through 600 pages of text.
Because that's cyclone DX for you, but we did it and it's done. Now, for other things that is not covered
by OSV, you have to go to MVD. Did I say it the nation that is the nation in the end? I think
I mentioned America, USA, right? MVD, national vulnerability database. So we rely on that.
Last year, they almost stopped working. The open source project and vendors
default their CVs with the CV program. The MVD imports them and adds the product name,
which we need to match our response. Almost nothing has been done since February last year,
but year. And we have no idea why, if the last funding, this was during the Biden administration,
or if the systems crash because they had reload systems, or whatever happened.
And this means when in the blind, you can run all your checks you want with a beautiful perfect
response, but you won't get any new CVs because they're not there. And this is something
I spend way too much time discussing, then various forums and I need help.
As recently as on Wednesday, we had a meeting with the European Commission,
and we very stressed this fact because they're building a European vulnerability database as part of
these two. And we said, we need something that works. Don't build a copy of the national vulnerability
database. We need something that works. So in summary, we're moving along.
Aspons are useful. I'm convinced that aspons is the tool that we need to have a full overview
of the state or software to be able to do risk assessments, to manage the software,
ask the legislation to see a array, will force us to do. But it's still a bay, but still new
technology. And we need to get all the systems in place to be able to move forward with all this,
and not fall down on every step of the way, even if you get the naming right,
when it's systems federated worldwide systems for checking vulnerabilities.
So the question is really, how do we move forward with all this?
Right? We're at Boston. We're used to work together. We create software together. We create
systems solutions together. Right? We're a community. And it's the same way we need to work
to handle this. The legislators are asking us to help them. And I hear from many projects,
not only Apache, Apache is really ahead of the curve, but Python, the mayvening
systems, many others are onto this. They're adding aspons to looking into the infrastructure
and they're joining the work. But we need more, we need more people, more energy.
But I looked, when I thought to look into this, in that chain, I told you earlier,
the flow of software transparency artifacts, and no one was really working on that.
But I found a small kind of sleeping project within Ovas Psyklon DX called Project Koala.
A nice Psy animal. And we kicked out a live again. So what we're doing is we're creating a
standardised API. It will become an ECMA API called T. And anyone in the room that knows
me know that I never drink coffee, I only drink tea. And that's why the call is drinking tea.
The transparency exchange API. This API will be handled able to handle all types of
aspons, not only cyclone DX. In addition, we'll handle various
attestations like in total attestations, European Union certificate compliance for products,
vex files, c-sa files, other files, that needs to follow the supply chain flow
or in an automatic way. And I need help in this project. There's a URL over there
and you have my contact details on the slides and on the first-end website. We need more people
and we will soon need coders for this. I encourage you to play with open source software. There's
so many tools available out there already. There are scanners that can take your darker containers.
You can beneath the platforms, your binaries, your source code, and produce aspons of various types
and kinds. There are tools to work with your aspons and manage and validate quality in them.
Anthony has a large set of tools on GitHub in open source. And there are management platforms
like UbOS, dependency track. Asponify was just released as one of them. And there are many other
platforms like guac from open SSF. So there is a tool set. If you're running an open source
project, it's not playing with this. But if you're like me, an old C developer,
asterisk, can I make a new one or written in C? We need help. Because we have no packaging lists,
vendor packages, bear make files. How do we create proper response? Or should we just let
Red Hat and Debian and other packages sort that out for us? Maybe. Maybe. But there is a lot of work
to be done here. But there are tools already, major tools that you should spend time on.
The way do you go? But all you're free time. The many organizations working, I'll try to
give you an overview. Who was, of course, has a long tradition of working with application security.
There's a conference coming up in Barcelona and on my where you will have application security
specialists. In over us, we do everything from top 10 lists, which I think you all heard about.
These things you can do in software and web applications. But we also do process support in
over us. If you have questions about that, we have Maxine over there. And we do software and
APIs and standards. Open SSF is part of language foundation. They were created as a result
of plotters working in log-for-J. After log-for-J, some people made an assessment of the amount
the money spent on trying to find out whether or not they had log-for-J. All the man hours and said,
if we can take a small percentage of all that funding and help open source to do better.
And that was the start. So open SSF had software projects. They have a service called
sixth door for signatures, digital signatures or commits and artifacts. They create a lot of
best current practices and many other things. They have one person here in Europe that works
a lot with lobbying, interacting with Inisa and the commission to make sure that open source
software gets treated the right way in the installations. But they have a number of working groups
all ranging from sea compiler options for security to diversity and espom management and many
other things. The ORCVG, as well as Open SSF, has started working groups and projects to help open
source projects in the face of these new regulations. So both of them are both working on
guidelines and support for open source projects but also making sure that all the legislation
and implementation guides are going the right way that there is an understanding on how we work in
open source within the legislation bodies. SPDX org is part of Linux Foundation and they maintain
the list of identifiers for open source licenses that all of us use but they also have a format
for various bill and materials. A cool project you should probably look at as well and of course
my home in this world cycle in the EX where we work both with a large range of software tools
the transparency and shape are standards and many different bill materials described by the
cycle in the EX data modeling language. Right now they are working with bread model standardization
encoding of that all of these organizations are very friendly to newcomers. We don't have to be
an expert but there's always something you can do there's always some discussion you can contribute to
if it's about proofreading documents or if it's about action coming up with new ideas and moving
forward. They usually work with Slack, they have meetings regularly, they have GitHub repositories
and many are here at first term of course and they're also also other conferences.
So please join the work we need help to move despondometer forward and by doing this you will
learn new things. There are so many cool guys within this organization. See if you want to learn
more about application security, software transparency, brisk assessments, threat modeling,
join us. All right you will be part of the solution and that's very important to feel that.
So we need you for despond movements. Come on walk despond walk join us.
And that's what I had to say. I think I have extra minutes. I'll be talking more about transparency
change API in the despond Debrunk tomorrow if I still have any voice after this. Do you have any
questions? We have a microphone running. And if I can't answer, I'll ask for help. I have a lot of
people here who knows. First of all thanks for the talk. As you mentioned there is also
real time dependencies and I was wondering if there's any benchmark or any like service to
validate generated s-bombs because there are multiple s-bombs generator and even if I
miss one dependency that's bad right. That's a very good question. I am working as a consultant
with commercial software developers as well and there are many vendors now trying to say
sell platforms that create the exponents all over your problems and we tested a few of them
and I know Anthony you have more of an answer to this and no one is right so you will have to use
many tools immediate between them and what can you say. Turn on the microphone.
A few weeks ago s-e-i-n-e-s we were contracted by CISA to look at various s-bombs generators
and they came up with nine target applications across a range of languages so Python,
Roscoe, that work is currently being reviewed. We've had early sight of some of the results
that were looking at the differences between cyclone dx and s-pdx.
They're looking at the difference between a source s-bomb and a build s-bomb and they're trying to
understand where the challenges are and some of the highlights are some languages are far better than others.
Particularly languages with good strong language ecosystems. He won't surprise you that languages
like C are real struggle and so I'm hoping that what will come out in the next
maybe later this month depends on what CISA's deadlines are because CISA's in a little bit
change at the moment. We'll publish a summary for us to then take as a community to work out
where we need to end hands. But I think it's a bit we've had a fringe event yesterday
and one of the common things is we really need to have a benchmark of data that we can use our
tools against. So there is a if you want to go out onto the Google SEI harmonization plug
fast I think is you'll find it you'll find the website then you'll see the nine targets
well on get up if you want to go and have a play. But yeah there's some really interesting results
so some are very noisy have lots of data some are very limited the challenges if you are a vendor
or if you're a manufacturer don't just choose one to choose a variety because you're going to
get that enrichment and enrichment in sites. I should have a picture of that I have too many slides
until at the time now but I think I'll continue this talk for another three hours to start the
cable. But you have to have various genres and we have to find ways to mediate that.
By the way our next speaker is the ride and she's going to talk about different things but
Kate Stewart here is one of the leaders for the SPDX projects so if you have any questions about
SPDX is here but I would say what we spend most time on right now or at least I am
is the naming problem. How do we name open source software and commercial software
the old days MVD work with something called CPE and I think we have to live it out for a while
but we can lowly I think modify CPE's works in a worldwide perspective.
The other alternative package URLs is something we're working hard on standardizing
within all of us by an echema. The package URLs was created at start as a way to name stuff
that exists in PIPI, Mavon, all those kind of registers debently in its red hat fedora
where you have a controlled namespace but for the rest of the products where we haven't got
a controlled namespace I will say using the inest names and relying on that controlled namespace
instead of creating a new one is the best way forward but the naming is something we all need to work
on fixing. Another question. So just wanted to follow up on what you actually started talking
about here with the CPE URL thing. First of all thank you within the Clips Adoptium project
we're working on creating an s-bomb for the JDK and we didn't have a Purl or CPE for the actual
source code for the JDK and we were using the cyclone DX dependency track and we noticed that we didn't
get any vulnerabilities until we put a CPE and then dependency track went to the nest database
and found vulnerabilities. So the question is is the nest database still key to only on CPE
is there a mapping between PURLs and CPE's how do we get value out of this fast?
Okay I'll ask the last questions how do we get value of this fast help us okay but CPE's if you look
into that database you'll find Microsoft spacing Microsoft comma spacing Microsoft dot
they had no control of the namespace in history and right now they haven't added many names
they added a handful of names to the CPE's last year so that's a bit out of the picture
the CPE program which is I would say a global federation in east side in Europe has actually
signed up to become a CNA contribute CPE's they are now encouraging their CNAs to add the names
the CPE's when they file a port but this is raw the new there are new guidelines out for the CNAs
it'll take time for them to change the systems and their ways of working but when doing that
the names will actually come from the right place not by from a third party but meanwhile I think
during a transition period you need in your response both a package URL because you want to
check in OSV and a CPE or a couple of CPE patterns to check the other databases that are CPE focused
the CPE program is allowing now the CNAs both add a CPE and a package URL
there is something missing though because in the MED if Daniel the awful Daniel who creates curl which
I told you about earlier if he has a bug there are many other products affected they have
young curl packaging lip curl packaging all the way out to severe or I would say yokto there are so many
curls and in MED they could add a list of affected products which we can't if I understand it
right in the CNA program and that's something we need to get there as well did I randomly answer
your questions the most important one is come down here and sign up with Kate and me and
we'll take care of you another question we still have we hear this way hello it's a follow-up
question I think talking about NVD there's the thing that they stop working last year or it's
unknown what the future of NVDS and so you mentioned that the European Commission or someone in
the European Union also has ideas to make European copy or similar structure and question what what
does the NVD deliver that could not be distributed before what what's the key benefit of using NVD all the
time well if you look at it the database can last year got 40,000 new CVs a large part of that was
that the Linux kernel changed the mind and suddenly followed CV for any bug they have another
large group of CVs was WordPress but historically I would say the MED took the data from CV and added
a few missing items and everyone relied on them doing that so they made a severity assessment
the CVS that we can also discuss for the old afternoon they had something called the CWE which is
weakness enumeration a category of bug if it's a buffer overflow or something else and they had
the name the CP and we all relied on them for doing that we have no idea what's going on and that's
the bad part so most of the community are saying that well if NVD every comes back that's fine
but we've got to move we've got to have this working so a lot of focus is on the CV program
under the needs to regulation that was supposed to come into acting October last year but in
Sweden we haven't seen the 500 proposed so yet it will come at some point to time it's a priority
to say in east I got money to create something called the EU vulnerability database and we were
real scared that it would be a new thing that would mean that as open source developers in Europe
we have to report the multiple places and we can't handle that we have to report it one place
and be done and I think they're getting there I don't think they're going to add on a new
structure they have registered as a CNA they want the country level C-Sorts to become sub CNAs
and report to them as mandated in the needs to and the CNAs so needs to direct them so we'll see
this week I got the first couple of glimpse but we'll continue the dialogue and see what they're
up to in Indonesia but they haven't published any details yet
it's okay for questions maybe underneath you if you can give it to my question
hi this is a question I asked at people working on NSBOM's at configuration management
can't last year and they couldn't give me an answer at some point you mentioned
that there is an SBOM for the software you give to the customer but there is an SBOM for the
test environment there is an SBOM I guess also for the dev environment look how happy thanks
so to talk with this last thing's moving on that front because since last year I couldn't find
much about it yes so there's various types of SBOM's design source build
deploy and run time as well as the analyze which the SAA tools pretty much produce
we're starting to see tooling emerge for the types other than source and build okay
certainly the deploy how things have been configured how things have been deployed we need to put
hooks into the actual deployment tools to record this accurately I haven't seen a good
example of that one yet but I do know that on the SBOM dev room tomorrow you will see one of the
first tools that's actually creating a design SBOM which is looking the tests to the code to the
requirements evidence so we're actually moving in that direction now there are runtime SBOMs out there
again various levels of maturity but we've got to start somewhere
we have half a minute left and he last minutes question otherwise I suggest that you just
come to Oli I see's closing yeah I just want to thank you for all for listening
and thank Kate and Anthony for helping me with questions as I said earlier these are really
early days we're all convinced that this is a core tool moving forward with software transparency
with risk assessments and many other things so please join us in this moment walk best
on walk thank you