Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
BREAKING ⚠️🚨
⛴️⛴️⛴️ After months of failed negotiations, the @gazafreedomflotilla campaign in Turkiye @mavimarmaratr started the #FreedomWatch , a non-violent direct action with hundreds of people to free our boats from Hyadarpasa port in Istambul. The demonstrators blocked the port entrance and peacefully chained themselves to the gates.
🚨 LIVE NOW: https://www.instagram.com/mavimarmaratr?igsh=emNib2ZtZHFjZTFj
🇵🇸🍉 The objective of this inspiring action is that the we can finally sail to #Gaza to take desperately needed humanitarian aid and break the genocidal siege that Israel established on Gaza since 2007.
⛴️ Our protests in Turkiye will continue until our boats are free to sail, since they have all the necessary documentation and meet all the necessary requirements to do so. Please help us share this important action to #BreakTheSiege and to create a people´s humanitarian corridor in Gaza. When governments fail, we sail! #FreedomFlotilla#WeWillSail#LetThemSail🇵🇸
After prolonged negotiations with the Dutch Port Authority, ‘Handala’ is finally docked in Rotterdam! The Freedom Flotilla Coalition had organized a place to dock with Rotterdan City Marina but for undisclosed reasons, were prevented from docking in the planned location. This delay impacted our peaceful event and demonstration to welcome ‘Handala’ where children had drawn pictures and letters of support to send to Palestinian people in Gaza.
John Turnbull, representative of Canada Boat to Gaza, said “while engaging on this mission, the Palestinians are teaching us how to resist”.
Handala will continue to challenge the complicity of European countries on a journey to break the siege of Gaza. Next stop, London!
#breakthesiege#endtheblockade#gaza#palestine#freegaza#freepalestine#weaillsail#letthemsail#handala
Robert has long fought alongside Palestinians and isn't stopping now. Having spent time in Palestine documenting horrific human rights abuses by Israeli forces, he has seen the brutality of the occupation first hand. Despite the extreme difficulty in leaving his children and partner back home in what he describes as a "grieving process", he shares how important it is to use his privilege to be a part of the collective effort to break the siege on Gaza. As we have witnessed over the course of 9 months and 76+ years prior, we cannot fathom or predict the IOF's brutality or what they are capable of if they intercept 'Handala' in international waters. So we need your help in keeping Robert as safe as possible. We need your help in demanding safe passage for all volunteers onboard our Flotillas. Please share our videos, tag your politicians and ensure that we reach Gaza safely. #endtheblockade#breakthesiege#robertmartin#freepalestine#freegaza#endtheoccupation#solidarity#wewillsail#letthemsail
Palestinians in Gaza are being forced to endure a “vicious cycle of malnutrition, infection, wounds breaking down, more infection, more malnutrition”, explains British surgeon haunted by Gaza horrors. Professor Nick Maynard has only just arrived back in the UK after lending his expertise in Gaza where he witnessed teenagers with treatable, survivable injuries, whose bodies tragically shut down due to malnutrition. We need to break the siege of Gaza. We need to ensure the borders are opened to be able to provide medical aid and food to these teenagers and their families immediately. This could not be more urgent. #BreakTheSiege#AllEyesOnRafah#EndTheBlockade#GazaBlockade#FreedomFlotilla#WeWillSail#LetThemSail#Rafah#NickMaynard
The demonstration to release our Flotilla ships currently being prevented from leaving port by the Turkish Port Authorities, continues in Istanbul. We need your help in getting international media to cover this historic protest and help put pressure on the government to release our ships, ensuring we can sail towards Gaza.
HOW TO HELP:
1. Call, email and/or demonstrate at Turkish embassies and consulates and demand that the Freedom Flotilla ships be released and allowed to deliver aid to Gaza immediately.
2. Tag mainstream accounts in this post or when you share our photos to your stories.
3. Message the social media page of the Ministry of Transport and Foreign Affairs @tcdisisleri and @uabakanligi on IG and on X
4. Share our videos using the hashtags #WeWillSail and #LetThemSail tagging @tcdisisleri and @uabakanligi
#WeWillSail#LetThemSail#TheFreedomFlotilla#FFC#Istanbul#Turkiye#Turkey#MaviMarmara