A Software Bill of Materials is a boring data structure that became a legal requirement. Here is what an SBOM actually is at the bit level, the SPDX versus CycloneDX split, the generation and consumption workflow that matters, and what the EU CRA and US procurement rules are actually asking for in 2026.
Compliance
-
SBOMs and the Compliance Wave: From Acronym to Legal Obligation -
Open-Source Licensing, Actually Explained What you can ship and what you must share: permissive versus copyleft mechanics, the linking question, why SaaS broke the GPL and created the AGPL, the relicensing wars of Elastic, Redis, MongoDB, and HashiCorp and the forks that answered them, source-available versus open source, CLAs versus DCOs, and a practical compliance checklist.
-
Cloud Security Posture Management CSPM finds the misconfiguration before an attacker does — agentless API scanning, open-source tools like Prowler, ScoutSuite, and Steampipe/Powerpipe, and how to wire continuous assessment into CI and alerting pipelines.
-
auditd: Linux's Syscall Logger A practical guide to Linux's audit daemon — how auditd logs security-relevant events at the syscall level, how to write rules that capture what compliance and threat detection need, and how to turn its verbose output into something usable.