The tool that spots issues before hackers do


Hi Reader,

This week we have yet-another episode on the topic of supply chain security. This time, I sit down with Niklas Düster, the co-lead of Dependency-Track (the creator and other co-lead being Steve Springett that I've had on the show before).

Why does this matter?

I build every app on top of other people’s code. Those outside pieces can hide holes that bad actors love. Dependency-Track shines a bright light on every part I borrow. It finds weak spots fast, so I can fix them before trouble shows up.

Why now?

Attacks on open-source jumped 156% last year. Fresh rules in the US and the EU now say many teams must ship a clear Software Bill of Materials (SBOM). Dependency-Track 4.12 already makes SBOM work painless. Version 5 is right around the corner and will scale for huge shops. Learning it today keeps me ahead of both hackers and auditors.

Episode Summary

I sat down with Niklas and we covered:

  • How he found the project. His old security crew was drowning. They switched to Dependency-Track and baked an SBOM into every build.
  • A real win. When Log4j blew up, they searched Dependency-Track and knew in seconds which products were in danger.
  • Best practices. Push SBOMs straight from your CI/CD, let the tool keep watch, and don’t block hot-fix deploys unless you’re sure.
  • What’s next. Version 5 will run on plain PostgreSQL, scale sideways, and cut down noise with smarter rules.
“Dependency-Track was the reason we started using SBOMs in the first place.”
- Niklas Düster

show
Navigating SBOMs at Scale: I...
Jul 16 · Nerding Out With Viktor
41:02
Spotify Logo
 

Visit the episode home page for all platform links.

(Ir)Relevant Links

Many thanks,
Viktor

Social: Connect with me on Twitter, LinkedIn or Mastadon.
Podcast: Subscribe on YouTube, Spotify or Apple Podcast.

Nerding Out with Viktor

This podcast and newsletter focus on clear conversations about technology, security, and modern software. Experts share insights on DevOps tips, open source projects, cybersecurity, and Europe's move toward its own cloud services. You will hear about continuous integration, airplane hacking, and new laws that affect the tech industry. Each show explores real problems and fresh solutions in the digital world. By subscribing, you will keep up with the latest trends in software, gain helpful advice from pros, and stay current in a fast-changing environment. We also talk about supply chain security, IoT, and the details of building strong systems. This blend of technical ideas with real-world viewpoints is a great resource if you want to grow your skills, learn about new technology, and connect with others who love all things tech.

Read more from Nerding Out with Viktor

Hi Reader, Why does this matter? Last year I launched Viktopia Studio, my tiny one-man-army startup studio that runs on an open-core plan. I have loved the studio idea ever since Kevin Rose tried it with Milk. I even played with this model back in 2009. My co-founder and I built WireLoad as a software lab that could spin out many products. We scored some early hits with Blotter, once a top-10 productivity app for macOS, and YippieMove, an email-migration tool. Both later faded, but Screenly...

Hi Reader, In this episode, I sit down with Carl Richell from System76 to talk all things Linux. Carl is the guy that Michael Dell called for advice when Dell ventured into the Linux on the desktop world. They've done Linux on the desktop longer than anyone (and they are our new hardware vendor for Screenly). Why does this matter? I want kids, teachers, makers, and pros to have computers they can trust and fix. Carl Richell, the founder of System76, shows how open firmware and open hardware...

Hi Reader, This week we talk about remote work and how it has shaped the world in a post-COVID world. As someone who as worked remotely for over 15 years, I just can't imagine commuting into an office every day. And I'm not alone. COVID was the catalyst that to normalized remote work for the masses. Why does this matter? Big names just doubled down on office life. Amazon and Dell now want folks at their desks five days a week. (reuters.com, reuters.com) Remote roles are scarce but hot. Only...