Re: [open-regulatory-compliance] Publicness of dependencies of a product

[Florian Gilcher <florian.gilcher@xxxxxxxxxxxxxxxxxxx>]

Hello Elizabeth,

I think  we already live in the world where we need to assume that our attackers know our components roughly as well as we do, be they open source or closed.

We can still choose to make the automated form (e.g. SBOM/CSRF) only available to a specific audience - e.g. our customers - but I don’t think that much helps. Code scanners and remote sensing capabilities are good today, so I’d rather operate under the assumption that the attacker will figure out whether we run affected components rather swiftly. Automation enables the defenders to be similarly fast.

Greetings from Berlin,

Florian

-- 

Florian Gilcher

Managing Director

m. +49 172 8122469

Ferrous Systems GmbH

Wallstraße 58/59

D-10179 Berlin

AG Charlottenburg, HRB 200196

Geschäftsführung: Felix Gilcher, Florian Gilcher

Prokura: Sina Krause

 

From: open-regulatory-compliance <open-regulatory-compliance-bounces@xxxxxxxxxxx> on behalf of Elizabeth Mattijsen via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx>
Date: Tuesday, 28. October 2025 at 18:34
To: Open Regulatory Compliance Working Group <open-regulatory-compliance@xxxxxxxxxxx>
Cc: Elizabeth Mattijsen <eclipse@xxxxxx>
Subject: [open-regulatory-compliance] Publicness of dependencies of a product

Hi all,

so this is probably been discussed at length in some places already.

My question: how public will the dependencies of a product be?


For instance, I love what Nginx has done here:

   https://docs.nginx.com/nginx/open-source-components/

Will manufacturers be required to produce such an overview for each of their products?   And would that have to be machine readable?


If either of these answers is "yes", then we've also made it easier for bad people  to find out where a compromised piece of software is being used.  And thus be able to focus their ill deeds on just those products much quicker.


FWIW, I'm not so much worried *if* a vulnerability has been reported through the proper channels, as ideally those vulnerabilities will be fixed within a small timeframe.  I'm more worried about the vulnerabilities that have *not* (yet) been reported.


Is this something we would have to live with?



Elizabeth Mattijsen
_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org