Ubuthakathaka bokuphepha kusofthiwe yomthombo ovulekile ngezinye izikhathi abubonakali iminyaka engaphezu kwemine. Lokhu kungenye yezinto ezibalulekile ezitholwe embikweni wakamuva we-State of the Octoverse ovela kwipulatifomu yokusingatha nokuphatha ukuthuthukiswa kwesofthiwe i-GitHub.
Kodwa-ke, lesi sitatimende asilona iqiniso ngokuphelele, ngoba, ngokusekelwe ekuthuthukisweni kwezobuchwepheshe kanye neqiniso lokuthi eminyakeni yamuva nje izinkampani eziningi ezinkulu kanye nabathuthukisi bajoyine inhlangano yesofthiwe yomthombo ovulekile, lokhu kuye kwavumela intuthuko esheshayo ngokuya ngentuthuko, ukudalwa kwamathuluzi okuhlola, kanye ikakhulukazi ukutholwa kobuthakathaka.
Nakuba kusese ngokoqobo, ukungabi nemali eyanele (okuholela ekunciphiseni izinsizakusebenza zabantu) kuvame ukuba yisithiyo ekusesheni nasekutholakaleni kwalezi zimo ezibuthakathaka.
Isibonelo, i-Heartbleed iyinkinga yesofthiwe ekhona kulabhulali ye-OpenSSL cryptography kusukela ngoMashi 2012. Ivumela umhlaseli ukuthi afunde inkumbulo yeseva noma iklayenti ukuze athole idatha esetshenziswe ngesikhathi sokuxhumana kwe-Transport Layer Security (TLS). Iphutha, elithinta izinsizakalo eziningi ze-inthanethi, alitholakalanga kwaze kwaba nguMashi 2014 futhi lenziwa umphakathi ngo-Ephreli 2014. Lokhu kushiye iwindi leminyaka emibili yokuthi abaphangi bahlasele izinkulungwane zamaseva.
Kuthiwa ubungozi bugcine buse-OpenSSL repository ngephutha kulandela isiphakamiso esivela kunjiniyela ozinikele sokulungisa amaphutha nokuthuthukisa izici.
Lezi zinhlobo zamaphutha (ezethulwe ngephutha) zibangela u-83% walawo atholakale kumaphrojekthi omthombo ovulekile abanjwe ku-GitHub. Kodwa-ke, umbiko wakamuva we-State of the Octoverse uthi u-17% ubuthakathaka obulethwa ngamabomu ngabantu besithathu abanonya.
Lezi izibalo okufanele zengezwe ngombiko wakamuva weRisksense ogcizelela ukuthi amaphutha ku-software yomthombo ovulekile akhula njalo. Amaphrojekthi we-IT aya ngokuya ngokuya ngomthombo ovulekile, ochaza intshisekelo ekhulayo yabaduni emkhakheni.
Ukuba sengozini kungadala umonakalo emsebenzini wakho futhi kudale nezinkinga ezinkulu zokuphepha. Kodwa-ke, ukukhubazeka okuningi kubangelwa izimbungulu, hhayi ukuhlaselwa okunonya.
Ngokuthembela kumthombo ovulekile lapho ungakwazi, ithimba lakho liyazuza kukho konke ukulungiswa okutholwe kwalungiswa ngumphakathi. Isikhathi sokulungisa siyinto ebalulekile kuwo wonke amaqembu we-DevOps
Imodeli yokuxhaswa ngemali ye-open-source sphere ingenye yezinto ezingase zichaze ukuthi kungani ubuthakathaka besofthiwe buvame ukungatholakali ngezikhathi ezibucayi. I-Core Infrastructure Initiative (CII) ingenye yamaphrojekthi ambalwa axhasa futhi asekela amaphrojekthi esofthiwe yamahhala nevulekile abalulekile ekusebenzeni kwe-inthanethi nezinye izinhlelo ezinkulu zolwazi.
Iningi lamaphrojekthi ku-GitHub asuselwa kwisoftware yomthombo ovulekile. Lokhu kuhlaziywa kufaka phakathi amakhosombe womphakathi avulekile anomnikelo okungenani owodwa ngenyanga ngayinye phakathi kuka-10.1.2019 no-30.09.2020.
Lesi sakamuva kube yisihloko sesimemezelo kulandela ukuba sengozini kwe-OpenSSL okubucayi okusetshenziswe izigidi zamawebhusayithi. Inkinga: I-CII incike eminikelweni evela kubadlali abasungulwe kahle emhlabeni wesoftware ephathelene. I-Facebook, i-VMWare, iMicrosoft, iComcast, ne-Oracle (ukusho nje lezi zinkampani) zixhasa iLinux Foundation, ngakho-ke amaphrojekthi afana neCentral Infrastructure Initiative (CII).
Lokhu kubanikeza izihlalo emabhodini ahlukahlukene okwenza izinqumo ngakho-ke abanye balawula ngokwenzeka enkundleni yemithombo evulekile. UBryan Lunduke, owayeyilungu leBhodi elivulekile le-OpenSUSE, uxoxa kabanzi ngalesi simo.
Umphumela osheshayo ukuthi amaphrojekthi omthombo ovulekile azuza ngokuxhaswa ngezimali yilawo asekelwe kakhulu kuwo ingqalasizinda yawo.
Okokugcina, uma unesithakazelo sokufunda kabanzi ngalokhu , ungabheka iwebhusayithi elandelayo lapho ungathola khona imibiko ehlanganisiwe.