Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
Hello everyone!
We are happy to announce that the author of this channel has successfully completed AI Governance Professional training with the International Association of Privacy Professionals.
New goal: IAPP AI Governance exam and certification in Q1 2024!
#IAPP#AIGovernance
Dear Colleagues, I am thrilled to announce that I have successfully passed the AI Governance Professional certification exam from the International Association of Privacy Professionals (AIGP/IAPP).
This comprehensive exam covered a wide range of topics, from the technological foundations of AI systems and their lifecycles to the ethical, risk management, and legal considerations surrounding the development and deployment of AI systems.
I am committed to continuing my learning in this area and sharing news and valuable resources with you.
#IAPP#AIGP
🌐📥IAPP Publishes Curated Third-Party Resources for AI Governance
The IAPP AI Governance Center released a curated collection of third-party AI governance resources, compiled by Managing Director Ashley Casovan. The list brings together tools, templates, guidelines, and repositories from trusted organizations worldwide, aimed at helping AI developers, deployers, regulators, and governance professionals navigate an increasingly fragmented information landscape.
The initiative responds to a recurring problem in the field: the volume of AI governance material is growing faster than professionals can realistically track, assess, and trust. The resource is designed to highlight relevant, practical materials without duplicating existing work, and will be updated periodically with community input.
Casovan emphasizes that effective AI governance requires a “full-sum approach,” where multiple organizations contribute complementary expertise.
#AIGovernance#AIRegulation#EthicalAI#IAPP#AIPolicy
AIGP 2025 Update: Streamlining AI Governance Certification for Real-World Impact
The IAPP has unveiled the latest version of its AIGP Body of Knowledge (BoK), effective for exams through February 2, 2025, offering a clearer, more flexible, and practical approach to AI governance certification. Simplified to four domains, the update places new emphasis on foundational principles, ensuring that certification aligns with the most relevant and influential legal frameworks worldwide.
This streamlined version is highly practical, designed to address the current responsibilities AI governance professionals encounter, not merely theoretical questions. Furthermore, Domains III and IV now separate the roles of developers and deployers, a crucial distinction reflecting how laws and standards are evolving in the field.
By balancing legal and technical insights, the new AIGP BoK solidifies its standing as the essential credential for those committed to responsible AI governance.
#AIGP#AIGovernance#LegalTech#ResponsibleAI#IAPP
IAPP Releases Comprehensive Report on AI Governance in Practice
The International Association of Privacy Professionals (IAPP) has released a new report on AI Governance in Practice, providing key insights into the evolving field of AI governance.
The report offers a foundational overview of AI, detailing its development and essential terminology. This approach allows anyone to grasp the basics and advance in the field. It includes a thorough inventory of AI risks, particularly data-centric ones, and offers practical strategies for managing them. Additionally, the report cites leading resources, including laws, regulations, and frameworks like the NIST AI RMF, providing a strong basis for deeper exploration.
Moreover, the report highlights various industry examples to contextualize theoretical concepts. For those preparing for the AI governance exam, the report aligns well with the AIGP Body of Knowledge and covers numerous topics likely to be tested.
#AI#AIGovernance#DataPrivacy#IAPP#AIGP
Navigating the Future of AI Governance: IAPP Introduces AIGP Certification
Hello, AI enthusiasts! Exciting news from the International Association of Privacy Professionals (IAPP)! They have released the Artificial Intelligence Governance Professional Body of Knowledge (BoK), a foundational document for the upcoming AIGP certification and training.
This certification presents a brand new learning opportunity for legal professionals in the AI domain:
🔹 A Path to Safe and Trustworthy AI: The BoK outlines the knowledge and skills required for AI governance professionals to guide AI implementation responsibly.
🔹 A Living Document for an Ever-Changing Landscape: In a rapidly evolving world, updates to the BoK will be reviewed every six months to ensure it remains up-to-date.
🔹 Empowering Professionals for New Responsibilities: As generative AI increasingly integrates into business operations, organizations face both excitement and concern. The BoK equips professionals from diverse backgrounds to navigate legal and ethical challenges and take a proactive approach to risk mitigation.
🔹 A Collaborative Effort: The BoK is the result of a remarkable collaboration between the IAPP and leading voices from privacy, law, ethics, academia, computer science, and more.
🔹 Elevating AI Governance Professionals: With AI initiatives becoming integral to various organizations, privacy professionals are well-positioned to take the lead. The AIGP certification empowers them to gain the necessary knowledge and expertise to excel in AI governance roles. It's a wonderful new opportunity for legal professionals to advance their expertise in the exciting field of AI!
#AIandLaw#AIRegulation#IAPP#DigitalEthics#AIinBusiness#AIcertification
📖IAPP Expands Its AI Governance Lexicon to 101 Key Terms
The International Association of Privacy Professionals (IAPP) has released an expanded version of its Key Terms for AI Governance, now including over 100 core concepts used by professionals across the AI policy and compliance space. The initial glossary, published in fall 2023, contained 61 terms; the 2025 update integrates new terminology reflecting emerging AI use cases and governance challenges identified by the IAPP community and its collaborators.
Each definition draws on authoritative sources, including legislative texts, international frameworks, and governmental reports, ensuring alignment with the evolving global AI governance landscape. By codifying shared language and meaning, the IAPP glossary functions as a reference point for practitioners seeking consistency in interpretation and application of AI governance principles across jurisdictions.
#AI#Governance#Law#Ethics#IAPP#Terminology#Compliance#AIGovernance