Why We Chose CycloneDX over SPDX | Dark Hacker News