Explain like I'm five · Security

What is an SBOM?

Software Bill of Materials, told as a story about the parts list attached to every tool.

Kim: the handlePark: the glassChoi: the wickeven one lantern has three makers

A tool is made of parts from many makers.Even one lantern has a handle, glass and wick from three different makers. Programs are the same.

Park's 3rd-ed. glasshas a crack!which lanterns…?one of a thousand — take each one apart to find out

One part has a crack. Which tools is it in?The crack is announced, but the castle has a thousand tools. Nobody knows which ones hold that glass. You'd take each apart.

handle · Kim 2nd ed.glass · Park 3rd ed.wick · Choi 1st ed.the builder hands it over with the toolwhich parts, which edition, made by whom

An SBOM is the parts list attached to every tool.Which parts, which edition, made by whom. The builder hands it over with the tool.

Part nameglass, handle, wick
Which edition3rd or 2nd
Who made itthe maker's name
Parts inside partsdown to the sand in the glass
Park 3rd ed.crack!handle · Kim 1stglass · Park 2ndwick · Choi 1sthandle · Kim 2nd ed.glass · Park 3rd ed.wick · Choi 1st ed.handle · Kim 1stglass · Park 2ndwick · Choi 1sthandle · Kim 1stglass · Park 2ndwick · Choi 1sthandle · Kim 2nd ed.glass · Park 3rd ed.wick · Choi 1st ed.handle · Kim 1stglass · Park 2ndwick · Choi 1sthandle · Kim 1stglass · Park 2ndwick · Choi 1sthandle · Kim 1stglass · Park 2ndwick · Choi 1stonly these two need fixingno taking apart — just read the lists

When a crack is announced, just read the lists."Park 3rd ed." — search the lists and you know exactly which tools to fix. No taking apart. → the board from the builder

no parts listan old toolhandle · Kim 2nd ed.glass · Park 3rd ed.(last year's)no list, or a stale onehandle · Kim 2nd ed.glass · Park 3rd ed.wick · Choi 1st ed.crack is there, butthis lantern never lightsbeing there and being dangerous differthat goes on a separate note — VEX

A parts list only says a part is there.Whether the part is actually used, or the crack reachable, is a separate question (VEX). And old tools have no list at all.

In one breath

An SBOM = the parts list on every tool. When a part has a crack, you know which tools to fix without taking them apart.

Required since a 2021 US executive order; the log4j crack (2021), when the whole world scrambled to ask which tools have it?, showed why. Formats: SPDX and CycloneDX.

When grown-ups say it

Component
A maker's piece. Libraries, packages. Most of a program is other people's parts.
Version
Which edition. A crack lives in specific editions. Without the number, the list is half useless.
Supplier
The maker. Who made it. If the maker's workshop is robbed, the parts are suspect too.
Transitive dependency
Parts inside parts. The glassmaker buys sand from someone else. The list goes that deep.
SPDX · CycloneDX
List formats. Two forms so every builder writes in the same columns.
VEX
The 'is it actually dangerous' note. Says the part is there, but this tool never reaches the crack.
Supply-chain attack
A bug slipped into the maker's workshop. Bug the part, and every tool using it is bugged. → the bug in the gift box
Vulnerability scan
Matching lists against known cracks. With a list, it's automatic. → the board from the builder
Next story
The Thief We Hired →
Want another term as a picture book? Request →