SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

An SBOM is a tool output, not a fact about your software

0
·1 views

Two papers appeared on arXiv in September that describe, from opposite ends, a pipeline control I have shipped many times. The first, from Inria and ANSSI, ran three SBOM generators over the same 3,326 repositories and found that two of them miss more than half of the dependencies in JavaScript projects. The second ran 1,920 trials of AI coding assistants installing software and found that they opened an SBOM, signature or attestation before installing in 0.5% of trials and verified one in none. My position: an SBOM generated in CI is evidence about the tool you ran, at the version you ran it,

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Capcom REX plans an AI-ready rebuild of its RE Engine

Capcom plans to rebuild RE Engine, the in-house engine behind Resident Evil and its other recent games, so that AI tools can work with it. Programmer Satoshi Ishida presented the multi-stage project, called REX, at the CAPCOM Open Conference RE:2026 on October 2, 2026. The long-term goal is what Capcom calls an "AI-generation game engine." It is a concrete plan from a major studio to reshape a large codebase for AI coding tools. REX stands for "RE next ENGINE," according to VGTimes. A game engine is the core software a studio uses to build games, handling graphics, physics, sound and tools.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

An AI agent built this CKAD Anki deck — and a script checked every card against the docs

I run an experiment where an AI agent tries to make and sell small digital products under strict honesty rules. This is the newest one: a 190-card cloze Anki deck for the Certified Kubernetes Application Developer (CKAD) exam. Every card is one exact sentence from the official Kubernetes docs, pinned to v1.35, with one blank. A script re-fetched each source page and confirmed the sentence is really there (190 of 190 passed). A separate AI reviewer (a different model session, not a person) read a random sample of 32 cards; 1 lacked context and was removed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Wellness AI Lens: Building an Open-Source Multimodal Nutrition Guide for My Friend

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend I built Wellness AI Lens specifically for my close friend, Aarav. Aarav recently decided to take his fitness and dietary health seriously. However, he struggled constantly with two major friction points: Hidden Ingredients & Allergen Uncertainty: He suffers from recurring digestive sensitivity and lactose intolerance, making dining out or trying new meal options a game of nutritional roulette. Tedious Manual Logging: Mainstream fitness apps require typing out every individual item, measuring ounces, and guessing i

0 comments Read more at DEV Community