Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
📰 NEWS | Campesino Movements Demand Venezuelan Gov’t Step In to Protect Activists from ‘Criminalization’ Attacks
Venezuelan campesino movements have denounced the arrest of Lilibeth Rangel in Zulia and the detention of 28 rural producers in Barinas as part of a broader pattern of criminalization.
The Small Farmers Movement (MPA) is urging government institutions to intervene and address judicial delays and alleged landowner interference in security operations. Campesino families from La Rubiera and La Fortuna estates have been demanding land titles under the 2001 Land Law for years.
🔗 Read the full report here: https://venezuelanalysis.com/news/campesino-movements-demand-venezuelan-govt-step-in-to-protect-activists-from-criminalization-attacks/
#Peasants#Campesinos
On September 21, Venezuelan campesino leader Iraidez Andrade was killed by masked hitmen in Barinas state.
He had been a prominent voice in the Las Mercedes land struggle and was working with local communities to secure land for campesino families. Rural organizations have called for justice and an end to impunity for the ongoing violence against campesino leaders.
Full report here 👉🏼https://shorturl.at/dzgzG
#Peasants#Campesinos
📹 VIDEO | Rice Producers Protest Agribusiness Pressure in Venezuela
Rice producers across Venezuela are taking to the streets ahead of the upcoming harvest, warning that prices offered by agroindustrial firms could leave many farmers unable to cover production costs.
Campesino groups say large conglomerates are using their control over silos, imports, and distribution to push prices down, while limited access to credit keeps farmers dependent on company financing.
After talks with producers, Agriculture Minister Julio León Heredia announced a provisional price. But campesino organizations warn they were barely represented in negotiations.
Click here to read our full report 👉🏾https://venezuelanalysis.com/news/venezuela-rice-producers-denounce-agribusiness-pressure-demand-govt-support-for-fair-prices/
#Agriculture#Peasants#Campesinos
📰 NEWS | Venezuela: Rice Producers Denounce Agribusiness Pressure, Demand Gov’t Support for Fair Prices
Venezuelan rice producers have staged demonstrations in Barinas, Cojedes, Guárico and Portuguesa, demanding state action to secure fair prices for their crops.
According to producer representative Víctor Martínez, agribusiness firms are offering $0.32–0.38 per kilo ahead of harvest, compared to $0.50–0.55 last year. Producers have set a $0.70 per kilo target in negotiations, citing rising input costs and lack of credit access.
Growers also report financing agreements in which companies provide inputs and collect up to 60% of the crop as payment. Campesino organizations are considering a rally in Caracas. Government officials have not yet commented.
Read the full report here 👉🏾https://venezuelanalysis.com/news/venezuela-rice-producers-denounce-agribusiness-pressure-demand-govt-support-for-fair-prices/
#Agriculture#Peasants#Campesinos
📰 NEWS | Venezuela: Turkish Investors to Take Over State-Owned Sugar Mills Under ‘Strategic Alliances’
Venezuela has signed agreements with Turkish investors to manage three state-owned sugar mills — Central Venezuela (Zulia state), Santa Clara (Yaracuy state), and Ezequiel Zamora (Barinas state) — as part of new 'strategic alliances,' Agriculture Minister Julio León announced.
Authorities have not disclosed further details. Previous experiences with similar alliances in the countryside have raised concerns among campesinos regarding transparency and impacts on small-scale producers.
🔗 Read the full report here: https://shorturl.at/pwPmt
#Peasants#Campesinos#PrivateSector#Sugar
🖊 COLUMN | Venezuela, Popular Power and Coffee
Jessica Dos Santos' latest column showcases how 18 communes in Sanare, Venezuela, launched the “Enriquito Colmenárez” coffee-roasting plant after receiving it from the Agriculture Ministry.
The grassroots initiative supports campesinos with subsidies, training, and direct diesel access, while preparing to export robusta beans to the US and Russia. The plant will also host a soil lab through a partnership with the United Nations Food and Agriculture Organization (FAO).
🔗 Read the full VA column here: https://shorturl.at/EAU4t
#Coffee#Peasants#Campesinos#PopularPower#TalesofResistance