When to Send Flowers? End of Life and End of Support Across the Ecosystem
summary
Argues for separate data from policy by publishing time-varying EOL/EOS metadata (who, what, when) as machine-readable JSON linked to SBOMs but managed via federation not a single registry. Cites tool and standards building: VEX-style assertions, OSV/NVD parallels, OASIS work, and a maintained site covering ~300 projects. Notes empirical risks: a Synopsys scan finds 91% had outdated components, ChainGuard shows container risk from dependencies, and rejects “rip-and-replace” as impractical.
AI-written summary · about
chapters (19)
- 0:00End of life basics
- 2:08Aging tech risks
- 5:39Why this topic matters to national cybersecurity
- 7:22Proprietary support timelines
- 9:32Safety-critical EOL
- 11:43End of life is risk but not necessarily vulnerability
- 13:06Open source support
- 16:12Does software improve or decay with age?
- 18:39Legal compliance
- 21:53Data-driven EOL policies
- 24:44Active security support
- 26:30Tracking EOL status
- 28:15Software identity challenges
- 30:47Machine-readable EOL data
- 32:56Aggregating EOL data
- 35:09Risk mitigation beyond updates
- 36:52Trusting third-party EOL data
- 37:36Next steps and engagement
- 45:13Q&A: SBOM and obsolescence
related talks
10mThe Hidden Cost of Open Source
37mSecuring OSS across the whole supply chain and beyond
11mOSS Supply Chain Security
41mArchitecting for the Long Haul: Technical Strategies for Sustainable Open-Source Support Models
45mRegulated and Sovereign : Impact to the Open Source Developer
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
42mBoF: State of SBOM Tools
33mDecommissioning the Kill Switch: Securing the Energy Grid’s...