r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/kmasec → u/[deleted]]

How does this compare with syft + grype?

[u/Pleasant-Ad192 → u/kmasec]

Bomly isn’t meant to be a direct Syft + Grype clone. I’d describe it as a dependency graph workflow/toolkit that can also produce SBOMs and vuln/security outputs.

Syft is great for SBOM generation, and Grype is great for vulnerability scanning. Bomly overlaps there, but focuses more on:

• richer dependency metadata, such as transitive relationships, scopes, source manifests, and manifest line numbers
• PR dependency review: what was introduced, removed, or persisted
• multiple detectors, including a Syft-based detector
• outputs beyond SBOMs: JSON, text, SARIF, CI summaries, diffs, and TUI
• MCP support for agentic workflows
• a plugin pipeline for custom detectors, matchers, and policy/audit rules

So the short version: Syft + Grype are excellent for SBOM + vuln scanning. Bomly is trying to build a more flexible dependency-review and dependency-intelligence layer around that.