[CramHacks] Newsletter #12: Debian is displeased with proposed EU Legislation (CRA & PLD)

🥳 Happy Monday! 🥳

My Birthday is on Monday 😀

Software Supply Chain Security

Debian: Statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

Debian, an open-source project since 1993, published a public statement about the EU Cyber Resilience Act stating, “Free Software has proven to be an asset in our digital age, and the proposed EU Cyber Resilience Act is going to be detrimental to it.”

👋 The CRA has to be the most outrageous piece of proposed legislation I have seen. Here are more details.

VulnerableCode: an open database of vulnerable packages

I recently came across this project, which “provides an open database of software packages that are affected by known security vulnerabilities,” which users can search by package or vulnerability. Queries can be made via the web app or API.

The project is also fully open-source, so you can host it if preferred. There’s also conveniently a public instance if you want to jump right in.

SBOM Hall of Fame

“What if we had a community-maintained source-of-truth about real examples of organizations using SBOMs (or any type of BOM) to achieve positive outcomes in meaningful ways?”

👋 what if? This would be interesting. First and foremost, I’d love to learn practical use cases of SBOMs. Secondly, I want to see more SBOMs to assess them for risk and understand reasonable expectations. Unfortunately, it has been a week, and no examples have been shared.

Mercedes-Benz: FOSS SBOM Management

Nicolas Krischker shares Mercedes-Benz’s FOSS Manifesto, which relates to its FOSS Disclosure Portal design, intended to “facilitate the exchange FOSS information directly & frequently from the CI/CD pipeline for developers, product & application owners, and suppliers.”

👋 it’s always nice to learn more about how larger institutions tackle supply chain security concerns. There’s so much talk about producing SBOMs, but honestly, there’s not nearly enough talk about ingesting them and their practical use.

OpenSSF: Becoming a CNA as an Open Source Organization or Project

A CNA, or CVE Numbering Authority, reviews and ultimately assigns CVEs. Due to mishaps with invalid CVEs being published, there is a growing trend for open-source organizations, or even projects, to become CNAs. This ideally ensures these mishaps don’t impact their hard work. The main benefit, but also perhaps the concerning piece, is that becoming a CNA means you can:

“Assign CVE IDs without needing to share embargoed information with other organizations. This allows the project to determine for themselves who, if anyone, needs or gets pre-disclosure information.”

Additionally, this is used as an advantage by commercial tools and services.

👋 If you are curious, the CNA onboarding documentation can be found here.

Until Next Time! 👋 

Hey, you made it to the bottom – thanks for sticking around!

Questions, ideas, or just want to chat? Slide into my inbox! 💌

If you think someone could benefit from this, don’t hesitate to forward.

See you next Monday!
-Kyle