{"id":104623,"date":"2022-07-10T09:36:38","date_gmt":"2022-07-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa"},"modified":"2022-07-10T09:36:38","modified_gmt":"2022-07-10T07:36:38","slug":"vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","title":{"rendered":"Kaksifaktori autentimise rakendamine PyPI-s p\u00f5hjustas populaarse paketi eemaldamise","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python-pakettide PyPI arendajad avaldasid plaani, et teha kaksifaktori autentimine kohustuslik kriitilistele pakettidele. Kriitilise paketi m\u00e4\u00e4ratlemine p\u00f5hineb allalaadimiste arvul ja muudatus rakendatakse projektide hooldajate ja omanike kontodele, mis on seotud 1% enim allalaaditud paketist viimase 6 kuu jooksul. Arvestades, et hetkel sisaldab PyPI hoidlasse \u00fcle 350 000 paketi, rakendatakse kaksifaktori autentimine ligikaudu 3500 paketile. Konto kuuluvuse kontrollimiseks on loodud spetsiaalne leht. Kohustusliku kaksifaktori autentimise t\u00e4pne kuup\u00e4ev ei ole veel m\u00e4\u00e4ratud, eeldatakse, et see juhtub j\u00e4rgmiste kuude jooksul. <\/p>\n

Erinevalt RubyGems, NPM ja GitHubi kahefaktorilisest autentimisest, rakendatakse PyPI-s algselt skeemi, mis soovitab kasutada riistvara tokenit koos juurdep\u00e4\u00e4suv\u00f5tmetega. Soovitatud tokenite ja WebAuthni protokolli kasutamise p\u00f5hjuseks on k\u00f5rgem turvataseme v\u00f5rreldes \u00fchekordsete paroolide genereerimisega (TOTP kasutamise v\u00f5imalus tokenite asemel tuleb saadaval valikuna). <\/p>\n

\u0422\u043e\u043a\u0435\u043d\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e — \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441\u043f\u043e\u043d\u0441\u043e\u0440\u043e\u043c \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u0438 \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 4000 \u043a\u043b\u044e\u0447\u0435\u0439 Titan. \u041a\u0430\u0436\u0434\u044b\u0439 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u0430\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0443 \u043d\u0430 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0441 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c USB-C \u0438\u043b\u0438 USB-A. \u0412\u0442\u043e\u0440\u043e\u0439 \u0442\u043e\u043a\u0435\u043d \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043d\u0430 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u043b\u043e\u043c\u043a\u0438 \u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u0440\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0438\u0441\u043a \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e \u0438 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. <\/p>\n

Kahjuks saab \u017eetone saata ainult Austriasse, Belgiasse, Kanadasse, Prantsusmaale, Saksamaale, Itaaliasse, Jaapanisse, Hispaaniasse, \u0160veitsi, \u00dchendkuningriiki ja Ameerika \u00dchendriikidesse. Teistest riikidest p\u00e4rit saatjad saavad ise osta FIDO U2F spetsifikatsiooniga \u00fchilduvaid \u017eetone, n\u00e4iteks sobivad Yubikey ja Thetis \u017eetoonid. Alternatiivina on v\u00f5imalus kasutada \u017eetoni asemel ka \u00fchekordsete paroolide autentimisrakendusi, mis toetavad TOTP protokolli, n\u00e4iteks Authy, Google Authenticator ja FreeOTP. <\/p>\n

Algatus ei m\u00f6\u00f6dunud ilma intsidentideta. Atomicwrites'i paketi autor, millel on kuus miljonit allalaadimist kuus ja 38 miljonit kuue kuu jooksul, ei soovinud kahefaasilisele autentimisele \u00fcle minna ning p\u00fc\u00fcdis oma paketi kriitiliselt olulisest nimekirjast eemaldamiseks allalaadimise arvu nullida. Nullimiseks kustutas ta k\u00f5igepealt paketi ja seej\u00e4rel laadis \u00fcles uue versiooni. Ootati, et selline manipulatsioon ainult nullib arvu, kuid arendaja \u00fcllatuseks eemaldati repole ka k\u00f5ik vanad versioonid, mis t\u00f5i kaasa probleeme raamatukogust s\u00f5ltuvates projektides, mida m\u00f5ned arendajad v\u00f5rdsustasid NPM-i paketi left-pad kustutamisest tingitud intsidendiga. <\/p>\n

Probleem s\u00fcvenes sellega, et p\u00e4rast kustutamist ei suutnud atomicwrites autor vanu versioone laadida, mis \u00f5nnestus taastada alles j\u00e4rgmisel p\u00e4eval p\u00e4rast PyPI administraatorite sekkumist. P\u00e4rast juhtunut otsustas paketi autor l\u00f5petada atomicwrites arendamise ja klassifitseerida paketi nagu aegunud. P\u00f5hjuseks toodi, et ta arendab projekti hobina oma vabal ajal ning t\u00e4iendavate n\u00f5udmiste ilmumine, mis muudavad t\u00f6\u00f6 keerulisemaks, ei \u00f5igusta aega, mida kulutatakse sellise populaarsuse tasemega tasuta paketi hooldamisele. Atomicwrites autor v\u00e4idab, et eelistaks lihtsalt koodi kirjutada l\u00f5buks, ning mure lisakaitsete p\u00e4rast pahatahtlike r\u00fcnnakute eest peaks olema tasustatud, kui keegi selle eest maksab. <\/p>\n

Teek atomicwrites sisaldab umbes 200 koodirida ja pakub funktsioone failide aatomkirjutamiseks. Asenduseks v\u00f5ib kasutada standardk\u00f5nesid os.replace ja os.rename (operatsioon seisneb ajutise nimega faili kirjutamises ja sihtfailiks \u00fcmbernimetamises p\u00e4rast valmimist).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104623","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kahefaktorilise autentimise rakendamine PyPI-s viis populaarse paketi kustutamiseni | ProHoster","description":"Python pakettide PyPI hoidla arendajad on avalikustanud plaani minna \u00fcle kohustuslikule kahefaktorilisele autentimisele projektide, mis kuuluvad kriitiliselt oluliste kategooriasse. Olulisust m\u00e4\u00e4ratakse allalaadimiste arvu j\u00e4rgi ja muudatus toimub 1% projektidest, mis on kuue kuu jooksul olnud k\u00f5ige rohkem allalaaditud, hoidjate ja omanike kontode jaoks. Arvestades, et praegu sisaldab PyPI hoidla rohkem kui","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 PyPI \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0443 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-10T07:36:38+00:00","article:modified_time":"2022-07-10T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-10 07:37:55","updated":"2022-10-08 17:25:29"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104623\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}