{"id":70931,"date":"2020-02-22T15:38:01","date_gmt":"2020-02-22T12:38:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti"},"modified":"2020-03-03T16:11:00","modified_gmt":"2020-03-03T13:11:00","slug":"rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","title":{"rendered":"Ranking of Libraries Requiring Special Security Checks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>The fund established by the Linux Foundation <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=39635\">Core Infrastructure Initiative<\/a><\/noindex>, through which leading corporations united their efforts to support open projects involved in key areas of the computer industry, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.linuxfoundation.org\/press-release\/2020\/02\/the-linux-foundation-and-harvards-lab-for-innovation-science-release-census-for-open-source-software-security\/\">conducted<\/a><\/noindex> the second study under the <noindex><a rel=\"nofollow\" href=\"https:\/\/www.coreinfrastructure.org\/programs\/census-program-ii\/\">Census<\/a><\/noindex>, aimed at identifying open projects in need of priority security audits.  <\/p>\n<p>The second study focuses on analyzing commonly used open code implicitly utilized in various corporate projects as dependencies loaded from external repositories. Vulnerabilities and compromises of third-party component developers involved in applications (supply chain) can nullify all efforts to enhance the security of the core product. As a result of the study, it was <noindex><a rel=\"nofollow\" href=\"https:\/\/www.coreinfrastructure.org\/wp-content\/uploads\/sites\/6\/2020\/02\/census_ii_vulnerabilities_in_the_core.pdf\">determined<\/a><\/noindex> 10 of the most commonly used packages in JavaScript and Java, whose security and maintenance activity require special attention.<\/p>\n<p>JavaScript libraries from the npm repository:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/caolan\/async\">async<\/a><\/noindex> (196,000 lines of code, 11 authors, 7 committers, 11 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/isaacs\/inherits\">inherits<\/a><\/noindex> (3,800 lines of code, 3 authors, 1 committer, 3 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/juliangruber\/isarray\">isarray<\/a><\/noindex> (317 lines of code, 3 authors, 3 committers, 4 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/jonschlinkert\/kind-of\">kind-of<\/a><\/noindex> (2,000 lines of code, 11 authors, 11 committers, 3 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/lodash\/lodash\">lodash<\/a><\/noindex> (42,000 lines of code, 28 authors, 2 committers, 30 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/substack\/minimist\">minimist<\/a><\/noindex> (1,200 lines of code, 14 authors, 6 committers, 38 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/addaleax\/natives\">natives<\/a><\/noindex> (3,000 lines of code, 2 authors, 1 committer, no open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/ljharb\/qs\">qs<\/a><\/noindex> (5,400 lines of code, 5 authors, 2 committers, 41 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/nodejs\/readable-stream\">readable-stream<\/a><\/noindex> (28,000 lines of code, 10 authors, 3 committers, 21 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/nodejs\/string_decoder\">string_decoder<\/a><\/noindex> (4,200 lines of code, 4 authors, 3 committers, 2 open issues).\n<\/ul>\n<p>Java libraries from Maven repositories:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/FasterXML\/jackson-core\">jackson-core<\/a><\/noindex> (74,000 lines of code, 7 authors, 6 committers, 40 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/FasterXML\/jackson-databind\">jackson-databind<\/a><\/noindex> (74,000 lines of code, 23 authors, 2 committers, 363 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/google\/guava.git\">guava.git<\/a><\/noindex>, Google libraries for Java (1,000,000 lines of code, 83 authors, 3 committers, 620 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-codec\">commons-codec<\/a><\/noindex> (51,000 lines of code, 3 authors, 3 committers, 29 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-io\">commons-io<\/a><\/noindex>  (73,000 lines of code, 10 authors, 6 committers, 148 open issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/httpcomponents-client\">httpcomponents-client<\/a><\/noindex>  (121 thousand lines of code, 16 authors, 8 committers, 47 unresolved issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/httpcomponents-core\">httpcomponents-core<\/a><\/noindex> (131 thousand lines of code, 15 authors, 4 committers, 7 unresolved issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/qos-ch\/logback\">logback<\/a><\/noindex> (154 thousand lines of code, 1 author, 2 committers, 799 unresolved issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-lang\">commons-lang<\/a><\/noindex> (168 thousand lines of code, 28 authors, 17 committers, 163 unresolved issues);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/qos-ch\/slf4j\">slf4j<\/a><\/noindex> (38 thousand lines of code, 4 authors, 4 committers, 189 unresolved issues);\n<\/ul>\n<p>The report also addresses issues related to standardizing the naming scheme for external components, securing developer accounts, and maintaining legacy versions after significant new releases are made. Additionally, the Linux Foundation has published  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.linuxfoundation.org\/wp-content\/uploads\/2020\/02\/improving_trust_security_in_oss_projects.pdf\">a document<\/a><\/noindex> with practical recommendations for organizing a secure development process for open projects. <\/p>\n<p>The document discusses role distribution within the project, creating teams responsible for security, defining security policies, monitoring the privileges of project participants, proper use of Git for fixing vulnerabilities to prevent leaks before patch publication, defining response processes for security issue reports, implementing security testing systems, applying code review procedures, and considering security-related criteria during release formation.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52415\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u0443\u0441\u0438\u043b\u0438\u044f \u0432 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438, \u043f\u0440\u043e\u0432\u0451\u043b \u0432\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Census, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043d\u0443\u0436\u0434\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u043e\u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u043c \u0430\u0443\u0434\u0438\u0442\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0412\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0430\u043d\u0430\u043b\u0438\u0437 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043e\u0434\u0430, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-70931","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0439\u0442\u0438\u043d\u0433 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043e\u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-22T12:38:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:11:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Library Safety Check Ranking | ProHoster","description":"The Core Infrastructure Initiative fund established by the Linux Foundation, within which leading.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0439\u0442\u0438\u043d\u0433 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043e\u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T12:38:01+00:00","article:modified_time":"2020-03-03T13:11:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70931","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:11:24","updated":"2022-10-03 02:59:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/70931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=70931"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/70931\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=70931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=70931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=70931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}