Популярность имеет свои минусы. Чем популярней язык программирования, тем выше его распространённость, а значит найдутся те кто поспешит воспользоваться этим.
С ростом популярности Python всё больше на PyPi появляется вредоносных пакетов. Трояны, стиллеры и доставщики более опасных вредоносов.
Команда PyPi постоянно мониторит подобные случаи но и их возможности достигли предела. В результате сервис временно закрывает возможность заливки новых пакетов и регистрации юзеров.
PyPI new user and new project registrations temporarily suspended
Возможно одной из причин большого наплыва вредоносов является резко возросшая доступность их создания. Сегодня любой, даже не программист, может попросить у ChatGPT написать необходимый код и все инструкции для атаки.
Основной тип атаки - рассчёт на опечатку в названии пакета. Если невнимательный программист случайно установит pilow или djangoo, считай что вредонос уже в системе.
Чтобы избежать подобных факапов я рекомендую:
▫️ Всегда работайте в виртуальном окружении, неизвестные проекты устанавливайте внутри контейнеров.
▫️ Используйте файл requirements.txt вместо ручной установки пакетов
▫️ Очень внимательно пишите названия пакетов, а после написания проверьте еще раз. Сверьте с названием из документации.
▫️ После успешных тестов всегда фиксируйте версию пакета. Бывали случаи когда опасный код добавляли в новые версии. К тому же и без этой опасности не рекомендуется ставить по умолчанию последнюю версию.
▫️ Используйте вспомогательные инструменты для проверки безопасности, например https://pyup.io/safety или https://github.com/PyCQA/bandit. Они помогут не только найти опасный код в чужих пакетах, но и ваш код проверит на уязвимости.
Будем надеяться что PyPi переосмыслит методы борьбы с вредоносами, например внедрит ИИ для проверки как симметричный шаг.
#offtop
#rust#consensus_protocol#cryptocurrency#rust#wasm
Kaspa's Rust implementation boosts speed and security, allowing faster transactions (up to 10 blocks per second) while maintaining decentralization. The recent Crescendo upgrade enhances performance, and the code is open for collaboration, offering a reliable, efficient system for users to transact quickly and securely.
https://github.com/kaspanet/rusty-kaspa
#javascript#cheerp#cheerpx#cpp#lwip#repl#tailscale#vm#wasm#webassembly#webvm#xterm_js
WebVM lets you run a full Linux system directly in your web browser without needing a server. It uses a special engine called CheerpX to safely run unmodified Linux programs by converting x86 code to WebAssembly. You get a real Debian Linux environment with many tools, and it supports networking through Tailscale VPN, so your browser VM can connect securely to the internet. You can also customize and deploy your own WebVM easily using GitHub, making it great for development, testing, or learning Linux without installing anything. This means you can have a powerful, private Linux machine anytime, anywhere, just in your browser[1][2][3].
https://github.com/leaningtech/webvm
#kotlin#android#awt#compose#declarative_ui#desktop#gui#ios#javascript#kotlin#multiplatform#reactive#swing#ui#wasm#web#webassembly
Compose Multiplatform is a Kotlin-based framework by JetBrains that lets you build user interfaces for multiple platforms—iOS, Android, desktop (Windows, macOS, Linux), and web—using mostly shared code. It is based on Jetpack Compose for Android, so you can use similar APIs across platforms, speeding up development and ensuring consistent UI design. iOS support is in beta, web is in alpha, and desktop and Android are stable. You can also access native features like camera or maps easily. This helps you save time, reduce bugs, and create apps that work well everywhere with less effort.
https://github.com/JetBrains/compose-multiplatform
#typescript#3d#browser_based#cad#geometry#occ#occt#opencascade#three#threejs#wasm#webassembly#webcad
Chili3D is a free, open-source 3D CAD application that you can use directly in your web browser. It allows you to create and edit 3D models without needing to install any software on your computer. You can make basic shapes like boxes and spheres, draw 2D sketches, and perform advanced operations like combining shapes. It also includes tools for precise alignment and measurement. This makes it easy for anyone to design and edit 3D models online, which is helpful for both beginners and experienced users.
https://github.com/xiangechen/chili3d
#cplusplus#artificial_intelligence#cloud#cloud_native#cncf#container#docker#edge_computing#ewasm#hacktoberfest#hacktoberfest2023#kubernetes#rust_lang#serverless#wasm#webassembly
WasmEdge is a fast, lightweight, and secure WebAssembly runtime that lets you run programs safely on your devices, servers, or the cloud. It supports many programming languages like C++, Rust, and JavaScript, and can run AI models, microservices, and smart contracts efficiently. WasmEdge offers strong security by isolating programs, making it great for extending software safely. It works well on edge devices, smart devices, and cloud environments, and supports easy integration with tools like Kubernetes and Docker. Using WasmEdge helps you run powerful applications faster, safer, and more flexibly on various platforms[1][2][3][4][5].
https://github.com/WasmEdge/WasmEdge
#rust#ai#ai_ocr#attention_mechanism#gnn#gnn_model#gnns#graph#graph_neural_networks#llm_inference#low_latency#mincut#neo4j#ocr#onnx#rust#vector#wasm
RuVector is a free, open-source vector database that gets smarter with every query. Unlike static databases, it learns from usage via GNN layers, runs LLMs locally with no cloud costs, supports graph queries like Neo4j, scales freely across nodes, and deploys as a single self-booting file (125ms startup). Run with `npx ruvector`. You benefit from faster, more accurate AI search that improves automatically, zero operating costs, full offline/privacy control, and easy scaling—perfect for RAG, agents, or edge apps without vendor lock-in.
https://github.com/ruvnet/ruvector
#cplusplus#avx#avx_512#avx_instructions#avx2#avx512#intrinsics#neon#simd#simd_instructions#simd_intrinsics#simd_library#simd_parallelism#simd_programming#sse42#wasm
Highway is a C++ library that helps make software run faster and use less energy. It does this by using SIMD (Single Instruction, Multiple Data) instructions, which let the CPU perform the same operation on many pieces of data at once. This can make programs up to 10 times faster and reduce energy use by up to five times. Highway works on many different types of computers and is easy to use, making it a good choice for developers who want to improve their software's performance.
https://github.com/google/highway