Ukuhlasela kwe-Typosquatting
Kubukeka sengathi zonke izinyathelo zokuphepha ku labo abebesebenza endaweni yokugcina iphakheji yePython I-PyPI (Python Package Index), Abazange basebenzise kakhulu, Njengoba nakuba bephoqa abasebenzisi ukuthi basebenzise ukuqinisekiswa kwezinto ezimbili futhi basebenzise izinyathelo zokuphepha ukuze bagweme ukwethulwa kwamaphakheji anonya ngangokunokwenzeka, basaqhubeka nokuba nenani elikhulu lezinkinga ngakho.
Futhi enye yezinkinga ezinkulu ezikhungethe i-NPM ukulayishwa okusobala kwamaphakheji anonya, okuyinkinga ebilokhu yaba nayo eminyakeni yamuva futhi engakwazi ukuyiqeda futhi isizathu sokusho lokhu ukuthi lesi simo siyafana ne-PyPi. iyahlangabezana, nakuba ngokwezinga elincane, njengoba kwenziwe imizamo yokusebenzisa izihlungi ezihlukahlukene zokuphepha, futhi ngisho nokuzama ngoba amaphakheji anonya ayaqhubeka nokuvela.
Isizathu sokubalula lokhu ukuthi Ukuvinjelwa kwesikhashana kusanda kufakwa ekubhalisweni kwabasebenzisi abasha nokudala amaphrojekthi amasha endaweni yokugcina yephakheji ye-Python PyPI ngenxa yokuhlasela okuzenzakalelayo okuqhubekayo okuholele ekulandweni okukhulu kwamaphakheji anonya. Lesi sinyathelo sithathwe ngemuva kokuthi amaphakheji angama-566 anekhodi enonya elayishiwe, alayishwa Balingisa isitayela semitapo yolwazi yePython engu-16 edumile, endaweni yokugcina izinto phakathi no-March 26 no-27.
Amagama alawa maphakheji anonya Akhiwa kusetshenziswa amasu okuthayipha, ahlanganisa ukwaba amagama afanayo kodwa anomehluko omncane kubalingiswa ngabanye. Isibonelo, amagama anjengokuthi "temsorflow" asetshenziswa esikhundleni sokuthi "tensorflow", "requyests" esikhundleni sokuthi "izicelo", "asyincio" esikhundleni se-"asyncio", phakathi kwamanye. Lokhu kuhlasela kusizakala ngabasebenzisi abaphazamisekile, abangenza amaphutha lapho besesha noma belandela izixhumanisi ezingosini nasezingxoxweni lapho abahlaseli beshiya khona imiyalelo edukisayo.
Amaphakheji anonya Asekelwe kukhodi evela kumalabhulali asemthethweni futhi afaka izinguquko ezifaka uhlelo olungayilungele ikhompyutha kusistimu. Lolu hlelo olungayilungele ikhompuyutha lusesha futhi luthumele idatha ebucayi namafayela, njengamagama ayimfihlo, okhiye bokudlula, ama-crypto wallet, amathokheni, namakhukhi esikhathi. Ikhodi engalungile ishumekwe efayeleni le-setup.py, elenziwa phakathi nokufakwa kwephakheji, futhi lapho icushiwe, ilanda izingxenye eziyingozi kuseva yangaphandle.
Lokhu kuhlasela okuzenzakalelayo kwe-typosquat kwenziwa emahoreni ambalwa ekuqhumeni okusheshayo okumbalwa, kwabona ukukhishwa kwamaphakheji angaphezu kuka-500, futhi kwaqondiswe kumaphakheji adumile we-PyPI angu-16. Nakuba impendulo esheshayo nenamandla ye-PyPI ngokuqinisekile yasiza ekwehliseni imiphumela yalokhu kuhlasela, kubalulekile ukuqaphela ukuthi akuwona wonke ama-ecosystem ashesha futhi asebenza ngempumelelo ekubhekaneni nokuhlasela okunjalo.
Ukuhlaselwa kwendawo yokugcina ye-PyPI kube kubanzi kakhulu futhi kuthinte imitapo yolwazi eminingi edumile yePython. Abahlaseli bakwazile ukulanda izinhlobo ezinonya zamaphakeji afana ne-TensorFlow, BeautifulSoup, PyGame, SimpleJson, Matplotlib, PyTorch, CustomTKInter, Selenium, Dramaturgo, Asincio kanye ne-Request. Ngaphezu kwalokho, kuhlonzwe amacala angawodwa okukhwabanisa kwemitapo yolwazi njenge-py-cord, colorama, capmonstercloudclient, pillow kanye ne-bip-utils.
Mayelana nokuhlaselwa komphakathi we-Top.gg, umhlaseli ufake ebucayini i-akhawunti ye-GitHub yomunye wonjiniyela, okwamvumela ukuthi ebe amakhukhi esiphequluli futhi enze izinguquko ezinonya.
Kufakwe amaphakheji amathathu anonya endaweni yokugcina ye-PyPI futhi izizinda ezingamanga zabhaliswa ukuze zisabalalise ukuncika kumaphakheji anonya. Nge-akhawunti entshontshiwe, kwenziwe ushintsho endaweni ye-GitHub yephrojekthi ye-Top.gg, lapho ifayela le-requirements.txt lanezelwa eliqukethe isixhumanisi se-clone enonya yephakheji ye-“colorama” esingethwe kusizinda esingamanga. Inhloso bekuwukukhohlisa onjiniyela ukuthi balande uhlobo olunonya lwephakeji, njengoba isizinda esingelona iqiniso sifana nesizinda esisemthethweni esisetshenziswa ukulanda amaphakheji ku-PyPI.
Lokhu kuhlasela kugqamisa ukubaluleka kokuvikeleka kumaphakeji enqolobane kanye nesidingo sabasebenzisi nonjiniyela ukuthi baqaphele imizamo engaba khona yokufaka engcupheni ukuvikeleka nokulanda uhlelo olungayilungele ikhompuyutha.
uma uyiNginentshisekelo yokufunda okwengeziwe ngayo, ungabheka imininingwane kufayela le- isixhumanisi esilandelayo.