Why Building Your Ship (Application) with Raw Materials is a Bad Idea!
summary
Companies are silently labeling unknown third party libraries as raw materials to bypass SBOM and policy checks allowing unverified code into products; Sonatype demonstrates concrete tooling with Bomb Doctor visual dependency visualization and Lift static scans plus CycloneDX SBOM export; surprising scale figures appear — about 90% of application code is open source, an average Java app has 150 dependencies and 1,500 updates yearly, and 29% vulnerable log4j downloads persist — this practice risks regulatory fines and catastrophic breaches.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:45About Sonotype
- 3:22About Open Source
- 5:50Problems with Open Source
- 8:12Software Composition Analysis
- 11:32Scary Facts
- 13:54Legislation
- 15:36Sbombs
- 16:22Security
- 17:44Raw Materials
- 20:01Static Analysis Tools
- 24:39Check your dependencies
- 25:43Useful links
- 27:46Get in touch
- 28:55Outro
related talks
21mWhy Building Your Ship (Application) with Raw Materials is a Bad Idea!
37mThe Death Star and the Ultimate Vulnerability
06mIgnite - Managing Your Software Supply Chain
43mThe Burden of Knowledge: Dealing With Open Source Risks
33mThree Things That Each Developer Should Know to Help Secure Code Base
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
39mTrust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J...
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...