Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
Pump result: Today's pump on Kucoin shocked us all with the massive volume, this was expected as we onboarded over 30,000 members in the past two weeks. However, due to unprecedented sell pressure from the #HALO team, we had expected a much larger rise in price. In fact internally we had discussed that we will be targeting around 900-1000% which we still tried to achieve with our team buying endless amounts after the first few minutes to guarantee that our members make good enough profit . Nonetheless, member's managed to profit over 150% during the signal, and with the support of our team we even managed to provide a second and third wave for extra profits which means anyone that has bought the dips during the signal had the chance to instantly make a lot of profits! We are receiving an overwhelming amount of positive messages from our community and we're happy to hear so many of you profited.
From this point on, our signals will only get stronger, and you can be confident that we will use all the power we have to keep reaching higher targets. As the majority of you are aware, our greatest pump to date generated a profit for our members of around 2000%, and now our primary focus is to see if we can repeat that sort of pump. It will be quite easy to accomplish with our existing power. It can happen once again if we don't face any sell pressure coming from the coin team itself which is something that can be hard to avoid at times, hopefully we can achieve that result once again on the next one. Stay tuned for the next pump announcement.
Pump result: Today's pump on Kucoin shocked us all with the massive volume, this was expected as we onboarded over 30,000 members in the past two weeks. However, due to unprecedented sell pressure from the #HALO team, we had expected a much larger rise in price. In fact internally we had discussed that we will be targeting around 900-1000% which we still tried to achieve with our team buying endless amounts after the first few minutes to guarantee that our members make good enough profit . Nonetheless, member's managed to profit over 150% during the signal, and with the support of our team we even managed to provide a second and third wave for extra profits which means anyone that has bought the dips during the signal had the chance to instantly make a lot of profits! We are receiving an overwhelming amount of positive messages from our community and we're happy to hear so many of you profited.
From this point on, our signals will only get stronger, and you can be confident that we will use all the power we have to keep reaching higher targets. As the majority of you are aware, our greatest pump to date generated a profit for our members of around 2000%, and now our primary focus is to see if we can repeat that sort of pump. It will be quite easy to accomplish with our existing power. It can happen once again if we don't face any sell pressure coming from the coin team itself which is something that can be hard to avoid at times, hopefully we can achieve that result once again on the next one. Stay tuned for the next pump announcement.
🌎 Sun halos, circular rainbows encircling the sun, form when sunlight passes through high-altitude ice crystals. These brilliant rings are a natural spectacle, often signaling incoming weather changes. ✨
#sun⚡#halo⚡#atmosphere⚡#optics
👉subscribe Interesting Planet