haven't been in a company which uses them in a very long time (20 years). I have the impression it's a blast from the past, ie client/server or two tier desktop applications.

eso no es un gato Barteke! es una almohada de sofá 🤣🤣🤣😹😹😹

usually these json files are fed to vulnerability scanners and other security tools on build pipelines, there are some tools to verify the quality of the sbom like

sbom-scorecard
or ntia-conformance-checker

Chainguard folks explain it really well:

edu.chainguard.dev/open-source/...

Large scale distributed systems are hard. They will go down.

Teams need disaster response scenarios, so if GitHub is still down, they can still deploy, even if it's manual.

Mirror git locally. Or to gitlab. I worked in a place that didn't care if us-east-1 died, so did their customers. :-(

I use KDE Neon basically Ubuntu lts + latest plasma/KDE