Why SBOMs went over like a bomb

Presented by:

Welcome to Runtime! Today: Chainguard's Dan Lorenc shares his thoughts on the state of open-source software and security challenges in the AI era, believe it or not, but OpenAI might be having trouble getting Project Stargate off the ground, and the latest funding rounds in enterprise tech.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

Open and not-so-shut

More than ten years after the Heartbleed vulnerability rocked the tech industry to its core, the security of the open-source software supply chain has improved a great deal. But recent examples like the Log4shell vulnerability and the XZ-Utils compromise proved that security is an ongoing process, and well-meaning regulatory attempts to help businesses protect themselves haven't made a substantial impact.

In a recent interview with Runtime, Chainguard co-founder and CEO Dan Lorenc estimated that the company has amassed 98% of the container images that its customers use to prevent themselves from downloading something dodgy from the internet. Last month Chainguard raised $356 million in funding to continue that work, and right now the company is adding 50 to 100 new images a month, he said.

"Open source is coming from strangers on the internet," Lorenc said. "You have no idea if the content is safe, how it was built, if it was tampered with along the way, and the attacks are rising."
However, the open-sourceness of the code itself isn't the problem, "it's the consumption model where the safety issues come in," he said.
Lorenc cited the Log4shell panic in November 2021 as an example; after discovering a critical vulnerability in a widely used piece of open-source software, enterprise tech "panicked over the weekend, got everything fixed and deployed and mostly avoided disaster," he said.
However, one year later a report from Tenable found that almost 30% of companies that thought they had fixed the problem had somehow redeployed Log4shell in their environments.

In response to those incidents as well as the SolarWinds debacle, the Biden administration pushed to require software vendors to compile a software bill of materials, known as a SBOM, if they wanted to do business with the federal government. While the current administration seems unlikely to enforce anything proposed by the previous administration on general principles, many security experts argued at the time that SBOMs were not the answer to the software supply-chain problem, and they seem to have been correct, according to Lorenc.

"I haven't seen anybody really get value out of these so far, it's mostly been a regulatory check box where there's not even a reward yet for checking it," Lorenc said.
The idea was to make it easier for companies to speed up their response to a critical security incident by giving them a list of everything they were running inside their networks — tracking that is much harder than it sounds at large companies — but modern software is updated so often that many SBOMs were out of date shortly after they were published.
"The main intended use case is vulnerability management, and we already have that tooling with SCA tools that skip the SBOM step and tell you about the vulnerabilities," Lorenc said.

Right now security companies are excited about the potential of generative AI tools to analyze large amounts of network activity and detect anomalies. There's something to that, Lorenc agreed, but like most things related to generative AI, the overall picture is more complex.

Daniel Stenberg, developer of the cURL utility, recently posted that the project is "effectively being DDoSed" by AI-generated bug reports and "we still have not seen a single valid security report done with AI help."
And while Chainguard is among the many companies using AI tools to generate code, less-experienced developers using AI tools might not know how to identify security flaws in that code, Lorenc said.
"All code has security risks, and the more code you have, the more security risks there are. As this speeds up, we need the other side of tooling to speed up too, to catch those issues," he said.

A MESSAGE FROM CIRCLECI

Enterprise leaders: What's the real cost of slow pipelines? Teams using CircleCI reclaimed $4.5M in productivity annually. Deploy on your cloud or behind your firewall. Learn more

Fault in their stars

OpenAI's audacious $500 billion plan to partner with Oracle and SoftBank to construct new data centers always seemed like a stretch, and it looks like reality is starting to catch up with the troika. Bloomberg reported Monday that "SoftBank has yet to develop a project financing template or begin detailed discussions with banks, private equity investors and asset managers," which puts the $100 billion target the group had in mind for 2025 in jeopardy.

The group announced their plans in the Oval Office in January alongside President Trump, and according to Bloomberg Trump's economic policies are to blame for the hesitancy of bankers and financial services firms to get involved. While the administration rolled back some of the most outlandish tariffs imposed on China on Monday, nobody has any idea what will happen after that 90-day pause is up.

Project Stargate would have been a difficult undertaking even in the best of economic times, given how data-center builders are running into setbacks finding power for their massive buildings and into opposition from locals who are starting to realize that data centers are more intrusive than once imagined. Softbank has never shied away from setting money on fire in pursuit of tech dreams, but even the swashbuckling Masayoshi Son might have to think twice about this one.

Enterprise funding

Rippling raised $450 million in Series G funding, valuing the HR SaaS company at $16.8 billion and giving it a lot of ammunition to pursue its legal claims against Deel.

Ascendx landed $110 million in new funding for its CRM software, which is looking to displace Salesforce in Europe and beyond.

Classiq scored $110 million in Series C funding for its approach to developing software for quantum computers, and the company said the round was "the largest ever for a quantum software company."

Toloka raised $72 million in new funding as it builds out its synthetic data product, which is becoming a more valuable part of AI model training efforts as real data becomes harder to find.

WisdomAI emerged from stealth with $23 million in new funding for its "Agentic Data Insights Platform," which was designed to produce more insightful business intelligence reports.

Theom scored $20 million in Series A funding for its data-centric security software, which sounds a little bit like the approach some observability vendors are taking to security.

The Runtime roundup

Microsoft is laying off 3% of its workforce, which CNBC said would affect about 6,000 employees deemed part of "unnecessary layers" of management just weeks after the company reported excelled earnings results.

AWS will invest up to $5 billion in Saudi Arabia to build infrastructure for Humain, an AI company owned by the country's ruling family.

A MESSAGE FROM CIRCLECI

Stop losing millions to slow deployments. CircleCI's enterprise platform delivers 664% ROI while cutting development time by 50%. See how tech leaders are accelerating innovation. Learn more

Thanks for reading — see you Thursday!

This post was updated to correct the frequency at which Chainguard is adding new container images.