Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
#trending: Teenager who has autism waits an hour at Jurong East MRT Station with no train service, mum goes to his aid
"The problem was that he didn’t know what his next step should be. At the same time, he may have been hoping that the train would arrive later." Ms Lydiawati Ismail said of her son who has autism.
🚇https://tdy.sg/3NajJLe
@todayonlinesg
#trending: Father-daughter dance at competition goes viral, viewers say it made them cry or think of their own dads
They won a “special mention” medal and they were also the oldest and youngest participants in the open category, Mr Jay Sng said.
🤸♂️🧑🧒https://tdy.sg/3XkEgla
@todayonlinesg
#trending: S'pore woman's biggest culture shock living in Sweden? Many couples skip marriage even after kids
Ms Wynnette Yip said that she has been in a relationship with her Swedish partner for eight years and often faces questions from friends and family in Singapore on whether her other half was ever going to propose to her or was simply "wasting (her) time".
🇸🇪https://tdy.sg/3ZpFcHx
@todayonlinesg
#trending: 'Full-on racial harmony' — video of Chinese S'porean youths loving Tamil movie goes viral
Many netizens found it refreshing and heartwarming to see Chinese youths so thoroughly enjoying a film of a different language and culture, with users calling their reactions "cute" and "awesome".
🎬https://tdy.sg/3AQNKwP
@todayonlinesg
#trending: 'Completely drained' — British expat's tale of long hours in China's tech sector goes viral
Many social media users in China were amused to see a foreigner grappling with the demanding work culture in their country.
🇨🇳https://tdy.sg/4egs2Ry
@todayonlinesg
#trending: S'pore non-profit that staged TikTok video of man harassing woman sparks debate on when to step in to help others
TikTok users have lauded real-life passers-by who chose to intervene and help the woman, not realising that it was a staged incident. They said that it is important to look out for each other.
➡️https://tdy.sg/3Xcbx1X
@todayonlinesg
#trending: SIA flight attendant praised as 'angel' for helping passenger clean jeans using own stain remover pen
In a "friendly chat" with a cabin crew member she referred to as Aiden, Ms Paige Parker asked him "almost jokingly" if SIA had any stain removers, expecting the answer would be no.
✈️https://tdy.sg/3AxJC4T
@todayonlinesg
#trending: Is Amsterdam safer? S'porean woman's reasons for moving to the Netherlands spark debate online
Aside from her safety concerns, the weather was a major factor, as she found Singapore too hot and humid. "I can't be sweating perpetually," she wrote.
➡️https://tdy.sg/3Ti9EQf
@todayonlinesg
#trending: Japanese ramen shop ranks Singaporeans’ spice tolerance as ‘mid’; netizens agree
Out of 10 levels, Singapore and Malaysia are ranked in the middle while Indonesia is at the top with the highest spice tolerance.
➡️https://tdy.sg/4fNFrBQ
#trending: Influencer's praise of NDP crowd control leaves S'poreans grateful for reminder 'we are so blessed'
Ms Francesca Tanmizi, an Indonesian who lives in Singapore, told her 316,000 TikTok followers she was wowed by the efficiency of NDP crowd control, the speedy cleanup of rainwater and the friendliness of the personnel involved.
🇸🇬https://tdy.sg/3WByhIk
@todayonlinesg
#trending: New S'pore teen character in Marvel comic book sounds like burnt-out student, say netizens
A Redditor teased that the character's powers could be “the result of years of training by her kiasu Tiger mum under the Singapore academic system” rather than an actual superpower.
👩🎓https://tdy.sg/4dFadep
@todayonlinesg
#trending: Netizens praise Jetstar Asia's 20th anniversary song for celebrating uniquely Singaporean traits
One viewer wrote: "Please consider (Mr Van Der Ven) for NDP theme song. He writes his own music and can supply 20 different types of aunties."
➡️https://tdy.sg/3WqSn85