Lightning Talk: Software Dark Matter is the Enemy of Software Transparency
summary
Claims that untracked files — called software dark matter — make SBOMs incomplete and reduce scanner utility. Uses the static analysis tool Trevi and a measurement of 350 popular Docker Hub images to quantify the gap: average container is ~30% dark matter and, weighted by file count, a typical container is ~60% dark matter. Argues current SCA tools can’t fix provenance gaps and calls for builders to change how artifacts record components so SBOMs become accurate.
AI-written summary · about
related talks
32mAsleep at the Wheel: Getting your SBOMs to pay attention...
25mA Primer on Software Bill of Materials for DevSecOps
51mThe Opposite of Transparency
46mSCA for Containers: The Good, the Bad, and the Truth
06mRethinking the Software Supply Chain: Trust, Minimalism, and Resili...
45mPractical Software Supply Chain Security Solutions
09mLightning Talk: What’s Inside Your Container Image? How to Audit All the Dependencies...
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...