{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T02:10:04Z","timestamp":1750299004001,"version":"3.41.0"},"reference-count":16,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T00:00:00Z","timestamp":1740700800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Queue"],"published-print":{"date-parts":[[2025,2,28]]},"abstract":"<jats:p>String matching can't be that difficult. But what are we matching on? What is the intrinsic identity of a software component? Does it change when developers copy and paste the source code instead of fetching it from a package manager? Is every package-manager request fetching the same artifact from the same upstream repository mirror? Can we trust that the source code published along with the artifact is indeed what's built into the release executable? Is the tool chain kosher?<\/jats:p>","DOI":"10.1145\/3723152","type":"journal-article","created":{"date-parts":[[2025,3,26]],"date-time":"2025-03-26T22:19:23Z","timestamp":1743027563000},"page":"108-119","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["String Matching at Scale"],"prefix":"10.1145","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-3872-633X","authenticated-orcid":false,"given":"Dennis","family":"Roellke","sequence":"first","affiliation":[{"name":"Bloomberg"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,3,26]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"SCA for containers: the good, the bad, and the truth. Open Source Summit Europe","author":"Azhakesan A.","year":"2024","unstructured":"Azhakesan, A., Ombredanne, P. 2024. SCA for containers: the good, the bad, and the truth. Open Source Summit Europe; https:\/\/events.linuxfoundation.org\/archive\/2024\/open-source-summit-europe\/program\/schedule\/."},{"volume-title":"The Mythical Man-Month: Essays on Software Engineering","author":"Brooks F. P.","key":"e_1_2_1_2_1","unstructured":"Brooks Jr., F. P. 1975. The Mythical Man-Month: Essays on Software Engineering. Addison-Wesley Publishing Company."},{"key":"e_1_2_1_3_1","unstructured":"Container SBOM Clarity Project Public Report. 2024; https:\/\/nexb.com\/sca-containers\/."},{"key":"e_1_2_1_4_1","unstructured":"Conway M. E. 1967. How do committees invent?; https:\/\/www.melconway.com\/Home\/pdf\/committees.pdf."},{"key":"e_1_2_1_5_1","unstructured":"Fox B. 2024. The fall of the National Vulnerability Database. Darkreading; https:\/\/www.darkreading.com\/vulnerabilities-threats\/fall-of-national-vulnerability-database."},{"key":"e_1_2_1_6_1","unstructured":"GitBOM; https:\/\/www.iana.org\/assignments\/ uri-schemes\/prov\/gitoid."},{"key":"e_1_2_1_7_1","volume-title":"A viewpoint on software supply chain security: Are we getting lost in translation? IEEE Security & Privacy 21(6), 55?58","author":"Melara M. S.","year":"2023","unstructured":"Melara, M. S., Torres-Arias, S. 2023. A viewpoint on software supply chain security: Are we getting lost in translation? IEEE Security & Privacy 21(6), 55?58; https:\/\/dl.acm.org\/doi\/10.1109\/MSEC.2023.3316568."},{"volume-title":"National Vulnerability Database","author":"News","key":"e_1_2_1_8_1","unstructured":"NVD News. 2024. National Vulnerability Database, National Institute of Standards and Technology; https:\/\/www.nist.gov\/itl\/nvd\/nvd-news."},{"key":"e_1_2_1_9_1","unstructured":"Official Common Platform Enumeration (CPE) Dictionary. National Institute of Standards and Technology; https:\/\/nvd.nist.gov\/products\/cpe."},{"key":"e_1_2_1_10_1","unstructured":"package-url. A minimal specification and implementation of purl aka a Package \"mostly universal\" URL; https:\/\/github.com\/package-url."},{"volume-title":"Towards a hermeneutic definition of software. Humanities and Social Sciences Communications 7(71)","author":"Possati L.","key":"e_1_2_1_11_1","unstructured":"Possati, L. 2020. Towards a hermeneutic definition of software. Humanities and Social Sciences Communications 7(71). Springer Nature; https:\/\/www.nature.com\/articles\/s41599-020-00565-0."},{"key":"e_1_2_1_12_1","unstructured":"purldb is a dataset of purls; https:\/\/github.com\/aboutcode-org\/purldb-data."},{"key":"e_1_2_1_13_1","volume-title":"New recommendations to improve the NVD. OWASP","author":"Springett S.","year":"2022","unstructured":"Springett, S. 2022. New recommendations to improve the NVD. OWASP; https:\/\/owasp.org\/blog\/2022\/09\/13\/sbom-forum-recommends-improvements-to-nvd."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3315887"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1080\/00029890.1958.11989128"},{"key":"e_1_2_1_16_1","unstructured":"xkcd: a webcomic of romance sarcasm math and language; https:\/\/xkcd.com\/927\/."}],"container-title":["Queue"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3723152","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3723152","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:56:42Z","timestamp":1750298202000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3723152"}},"subtitle":["A call for interdisciplinary collaboration and better-directed resources"],"short-title":[],"issued":{"date-parts":[[2025,2,28]]},"references-count":16,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,2,28]]}},"alternative-id":["10.1145\/3723152"],"URL":"https:\/\/doi.org\/10.1145\/3723152","relation":{},"ISSN":["1542-7730","1542-7749"],"issn-type":[{"type":"print","value":"1542-7730"},{"type":"electronic","value":"1542-7749"}],"subject":[],"published":{"date-parts":[[2025,2,28]]},"assertion":[{"value":"2025-03-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}