Cleaning up a bunch of old equipment today..

I see you too 3620

.. remember when all this was critical

Am wondering if orgs require a separate CBOM or if they're fine using existing SBOM. SBOM explains which components are within the software, but it fails to give any detail about the TLS versions or certificates that were used. Not mentioning the presence of HSM dependencies, mTLS and other concepts. 

In any real org the whole process of using cryptography is scattered through different entities and is cloud-based, in CI/CD environments, libraries, etc. 

For the ones who have to work with mess. Is CBOM going to be useful from the operational point of view or will it merely turn into something expected by the auditors?

What's your worst on call experience?

I had to share this support request that just landed in our queue. Made my day! 🤣🤣🤣

AntiSemVer (ASV)

A deliberately anti-semantic versioning system that communicates deployment risk instead of code changes.

AntiSemVer (ASV) is an experimental versioning specification that intentionally breaks most of the conventions established by Semantic Versioning while remaining practical and internally consistent.