Sekuyizinyanga eziningana manje, besixoxe ezincwadini ezahlukahlukene ngezinkinga zokuphepha ezivele ku-GitHub kanye nezinyathelo ababehlele ukuzihlanganisa epulatifomu ukuze balwe kangcono nezikhala zokuphepha ezazisetshenziswa abaphangi ukuze bafinyelele ezindaweni zokugcina amaphrojekthi.
Futhi manje , i-GitHub imemezele ukuthi izodinga bonke abasebenzisi abafaka ikhodi epulatifomu ukuthi bavumele uhlobo olulodwa noma ngaphezulu lokuqinisekiswa kwezinto ezimbili (2FA).
“I-GitHub isesimweni esiyingqayizivele lapha, ngenxa nje yokuthi iningi lemiphakathi evulekile yemithombo kanye nabadali bahlala ku-GitHub.com, singenza umthelela omuhle kakhulu ekuvikelekeni kwesimiso sezinto eziphilayo emhlabeni wonke ngokuphakamisa izinga lenhlanzeko yolwazi. ,” kusho uMike Hanley, oyisikhulu sezokuphepha kwaGitHub (CSO). “Sikholwa ukuthi lena ngenye yezinzuzo ezinhle kakhulu ze-ecosystem-wide esingazinikeza, futhi sizibophezele ekuqinisekiseni ukuthi noma yiziphi izinselele noma izithiyo ziyanqotshwa ukuze siqinisekise ukutholwa okuphumelelayo. »
I-GitHub imemezele ukuthi bonke abasebenzisi abalayisha ikhodi kusayithi bazodinga ukunika amandla uhlobo olulodwa noma ngaphezulu lokuqinisekiswa kwezinto ezimbili (2FA) ekupheleni kuka-2023 ukuze baqhubeke nokusebenzisa inkundla.
Inqubomgomo entsha yamenyezelwa kubhulogi yi-Chief Security Officer (CSO) ye-GitHub, uMike Hanley, owagqamisa indima yesikhulumi esiphethwe yi-Microsoft ekuvikeleni ubuqotho benqubo yokuthuthukiswa kwesofthiwe ezinsongweni ezidalwe abenzi bobubi abalawula ama-akhawunti onjiniyela.
Impela, ulwazi lomsebenzisi lomthuthukisi nalo luyacatshangelwa, futhi uMike Hanley ugcizelela ukuthi le mfuneko ngeke ikulimaze:
“I-GitHub izibophezele ekuqinisekiseni ukuthi ukuvikeleka kwe-akhawunti okuqinile akungeni ngaphandle kokuhlangenwe nakho okuhle konjiniyela, futhi umgomo wethu wokuphela konyaka ka-2023 usinika ithuba lokulungiselela lokho. Njengoba izindinganiso zishintsha, sizoqhubeka sihlola izindlela ezintsha zokuqinisekisa ngokuphephile abasebenzisi, okuhlanganisa ukufakazela ubuqiniso obungenaphasiwedi. Onjiniyela emhlabeni jikelele bangabheka phambili ekuqinisekiseni okwengeziwe nezinketho zokutholwa kwe-akhawunti, kanye
Nakuba ukuqinisekiswa kwezinto eziningi kunikeza isivikelo esengeziwe esibalulekile kuma-akhawunti aku-inthanethi, ucwaningo lwangaphakathi lwe-GitHub lubonisa ukuthi yi-16,5% kuphela yabasebenzisi abasebenzayo (cishe oyedwa kwabayisithupha) okwamanje abavumela izinyathelo zokuphepha ezithuthukisiwe kuma-akhawunti abo, inani eliphansi ngokumangazayo uma kubhekwa ukuthi ipulatifomu, kusukela kubasebenzisi bayo, kufanele iqaphele izingozi zokuvikelwa kwephasiwedi kuphela.
Ngokuqondisa laba basebenzisi ezingeni eliphansi kakhulu lokuvikela ama-akhawunti, i-GitHub inethemba lokuqinisa ukuphepha okuphelele komphakathi wokuthuthukisa isofthiwe wonkana.
“NgoNovemba 2021, i-GitHub yazibophezela ekutshalweni kwezimali okusha ekuvikelekeni kwe-akhawunti ye-npm kulandela ukutholwa kwamaphakheji e-npm ngenxa yokonakala kwama-akhawunti kanjiniyela ngaphandle kokuvulwa kwe-2FA. Siyaqhubeka nokwenza ngcono ukuphepha kwe-akhawunti ye-npm futhi sizibophezele ekuvikeleni ama-akhawunti kanjiniyela nge-GitHub.
“Iningi lokwephulwa kwezokuphepha akuwona umkhiqizo wokuhlaselwa kosuku oluyi-zero, kodwa kunalokho kufaka ukuhlaselwa kwezindleko eziphansi njengobunjiniyela bezenhlalo, ukweba imininingwane egcwele noma ukuvuza, nezinye izindlela ezinikeza abahlaseli inhlobonhlobo yokufinyelela kuma-akhawunti ezisulu kanye nezinsiza. basebenzisa. babe nokufinyelela. Ama-akhawunti onakalisiwe angasetshenziswa ukuze kwebe ikhodi eyimfihlo noma enze izinguquko ezinonya kuleyo khodi. Lokhu akuvezi nje kuphela abantu nezinhlangano ezihlotshaniswa nama-akhawunti onakalisiwe, kodwa futhi bonke abasebenzisi bekhodi ethintekile. Ngenxa yalokho, amandla okuba nomthelela ongezansi kuhlelo olubanzi lwe-ecosystem yesofthiwe nochungechunge lokuhlinzeka likhulu.
Ukuhlolwa okwenziwe kakade ngengxenye encane yabasebenzisi beplatifomu ye-GitHub kubeke isibonelo sokudinga ukusetshenziswa kwe-2FA neqembu elincane labasebenzisi beplatifomu, ngemuva kokuyihlola nababhali bemitapo yolwazi edumile ye-JavaScript esatshalaliswa ngesofthiwe yokuphatha iphakheji ye-npm.
Njengoba amaphakheji e-npm asetshenziswa kakhulu angalandwa izikhathi eziyizigidi ngeviki, ayimpokophelo ekhangayo kakhulu yabasebenzisi bohlelo olungayilungele ikhompuyutha. Kwezinye izimo, izigebengu ze-inthanethi zidicilele phansi ama-akhawunti abanikeli be-npm futhi bawasebenzise ukuze bakhulule izibuyekezo zesofthiwe ezazifakwe abantshontshi bamagama-mfihlo kanye nabasebenza nge-cryptominers.
Iphendula, i-GitHub yenze ukuqinisekiswa kwezinto ezimbili kube yisibopho kubanakekeli bamaphakheji aphezulu angu-100 npm kusukela ngo-February 2022. Inkampani ihlela ukunweba izimfuneko ezifanayo kubanikeli bamaphakheji aphezulu angu-500 ekupheleni kukaMeyi.
Ngokuvamile, lokhu kusho ukubeka isikhathi esinqunyiwe eside sokwenza i-2FA ibe yisizinda esibalulekile kulo lonke kanye nokuklama ukugeleza okuhlukahlukene kokungenisa abasebenzisi ukuze basebenzise isikhathi eside ngaphambi kosuku lokugcina luka-2024, kusho uHanley.
Ukuvikela isofthiwe yomthombo ovulekile kusalokhu kuwukukhathazeka okuphuthumayo kwemboni yesofthiwe, ikakhulukazi ngemva kokuba sengozini ye-log4j yangonyaka odlule. Kodwa nakuba inqubomgomo entsha ye-GitHub izonciphisa ezinye izinsongo, izinselele zesistimu zisekhona: Amaphrojekthi amaningi wesofthiwe yomthombo ovulekile asagcinwa amavolontiya angakhokhelwa, futhi ukuvala igebe lezimali kubonakala njengenkinga enkulu embonini yezobuchwepheshe iyonke.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe ngalokhu , ungathola imininingwane kusixhumanisi esilandelayo.