Subject: [sacm] [sacmwg/software-identification] Nature of reported software (installed, running, packages, etc.) (#7)

From: Charles Schmidt <[email-masked]>
Date: Thu, 06 Oct 2016 07:47:33 -0700

In discussions on the list (8/5-8/7), there were some questions about the general natures of software that SW M&A reports. Summarizing that discussion:

It sounds like there are actually three types of "software inventories" that people are interested in:
- Installed software (SACM "Software Components") - This is what the SWID M&A currently focuses on (but that document is under revision anyway)
- Running software (SACM "Software Instances") - Per comments by Henk and others, this could be of interest. This would overlap with the installed software but would not be identical since not all installed software would be running, some installed software could be running multiple instances, and some running software might not actually be installed on the device.
- Installation packages - These would be discovered corpus tags, reports of identified RPM or similar packages (installed or not), and the like. These would not necessarily have reliable correlation to installed software, but I believe you are arguing these would be useful in their own right.

Currently (-02) SW M&A is written to focus only on installed software. A decision should be made regarding reporting of other classes of software presence.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/software-identification/issues/7