{"id":70931,"date":"2020-02-22T15:38:01","date_gmt":"2020-02-22T12:38:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti"},"modified":"2020-03-03T16:11:00","modified_gmt":"2020-03-03T13:11:00","slug":"rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","title":{"rendered":"Classifica delle librerie che richiedono un controllo di sicurezza particolare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Il fondo creato dall'organizzazione Linux Foundation <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=39635\">Core Infrastructure Initiative<\/a><\/noindex>, nell'ambito del quale importanti aziende hanno unito i propri sforzi per garantire il supporto ai progetti open source coinvolti in aree chiave dell'industria informatica, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.linuxfoundation.org\/press-release\/2020\/02\/the-linux-foundation-and-harvards-lab-for-innovation-science-release-census-for-open-source-software-security\/\">ha condotto<\/a><\/noindex> un secondo studio nell'ambito del programma <noindex><a rel=\"nofollow\" href=\"https:\/\/www.coreinfrastructure.org\/programs\/census-program-ii\/\">Census<\/a><\/noindex>, volto a identificare i progetti open source che necessitano di un'urgente verifica della sicurezza.  <\/p>\n<p>Il secondo studio \u00e8 focalizzato sull'analisi del codice open source condiviso, utilizzato implicitamente in vari progetti aziendali sotto forma di dipendenze scaricate da repository esterni. Le vulnerabilit\u00e0 e la compromissione dei sviluppatori di componenti di terze parti coinvolti nel funzionamento delle applicazioni (supply chain) possono annullare tutti gli sforzi per migliorare la sicurezza del prodotto principale. Come risultato dello studio, \u00e8 stato <noindex><a rel=\"nofollow\" href=\"https:\/\/www.coreinfrastructure.org\/wp-content\/uploads\/sites\/6\/2020\/02\/census_ii_vulnerabilities_in_the_core.pdf\">determinado<\/a><\/noindex> 10 dei pacchetti pi\u00f9 comunemente utilizzati in JavaScript e Java, la cui sicurezza e attivit\u00e0 di manutenzione richiedono particolare attenzione.<\/p>\n<p>Librerie JavaScript dal repository npm:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/caolan\/async\">async<\/a><\/noindex> (196 mila righe di codice, 11 autori, 7 committenti, 11 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/isaacs\/inherits\">inherits<\/a><\/noindex> (3.8 mila righe di codice, 3 autori, 1 committente, 3 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/juliangruber\/isarray\">isarray<\/a><\/noindex> (317 righe di codice, 3 autori, 3 committenti, 4 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/jonschlinkert\/kind-of\">kind-of<\/a><\/noindex> (2 mila righe di codice, 11 autori, 11 committenti, 3 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/lodash\/lodash\">lodash<\/a><\/noindex> (42 mila righe di codice, 28 autori, 2 committenti, 30 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/substack\/minimist\">minimist<\/a><\/noindex> (1.2 mila righe di codice, 14 autori, 6 committenti, 38 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/addaleax\/natives\">natives<\/a><\/noindex> (3 mila righe di codice, 2 autori, 1 committente, nessun problema aperto);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/ljharb\/qs\">qs<\/a><\/noindex> (5.4 mila righe di codice, 5 autori, 2 committenti, 41 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/nodejs\/readable-stream\">readable-stream<\/a><\/noindex> (28 mila righe di codice, 10 autori, 3 committenti, 21 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/nodejs\/string_decoder\">string_decoder<\/a><\/noindex> (4.2 mila righe di codice, 4 autori, 3 committenti, 2 problemi aperti).\n<\/ul>\n<p>Librerie Java dai repository Maven:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/FasterXML\/jackson-core\">jackson-core<\/a><\/noindex> (74 mila righe di codice, 7 autori, 6 committenti, 40 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/FasterXML\/jackson-databind\">jackson-databind<\/a><\/noindex> (74 mila righe di codice, 23 autori, 2 committenti, 363 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/google\/guava.git\">guava.git<\/a><\/noindex>, librerie Google per Java (1 milione di righe di codice, 83 autori, 3 committenti, 620 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-codec\">commons-codec<\/a><\/noindex> (51 mila righe di codice, 3 autori, 3 committenti, 29 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-io\">commons-io<\/a><\/noindex>  (73 mila righe di codice, 10 autori, 6 committenti, 148 problemi aperti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/httpcomponents-client\">httpcomponents-client<\/a><\/noindex>  (121.000 righe di codice, 16 autori, 8 committers, 47 problemi non risolti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/httpcomponents-core\">httpcomponents-core<\/a><\/noindex> (131.000 righe di codice, 15 autori, 4 committers, 7 problemi non risolti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/qos-ch\/logback\">logback<\/a><\/noindex> (154.000 righe di codice, 1 autore, 2 committers, 799 problemi non risolti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/apache\/commons-lang\">commons-lang<\/a><\/noindex> (168.000 righe di codice, 28 autori, 17 committers, 163 problemi non risolti);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"http:\/\/github.com\/qos-ch\/slf4j\">slf4j<\/a><\/noindex> (38.000 righe di codice, 4 autori, 4 committers, 189 problemi non risolti);\n<\/ul>\n<p>Il rapporto esamina anche questioni di standardizzazione dello schema di denominazione dei componenti esterni, sicurezza degli account degli sviluppatori e mantenimento delle versioni obsolete dopo il rilascio di nuove versioni significative. Inoltre, l'organizzazione Linux Foundation ha pubblicato  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.linuxfoundation.org\/wp-content\/uploads\/2020\/02\/improving_trust_security_in_oss_projects.pdf\">documento<\/a><\/noindex> raccomandazioni pratiche per organizzare un processo di sviluppo sicuro per progetti open source. <\/p>\n<p>Il documento affronta questioni relative alla distribuzione dei ruoli nel progetto, alla creazione di team responsabili della sicurezza, alla definizione delle politiche di sicurezza, al monitoraggio delle autorizzazioni dei partecipanti al progetto, all'uso corretto di Git nella correzione delle vulnerabilit\u00e0 per evitare perdite prima della pubblicazione della correzione, alla definizione dei processi di risposta ai report di problemi di sicurezza, all'implementazione di sistemi di testing della sicurezza, all'applicazione di procedure di revisione del codice e alla considerazione dei criteri di sicurezza nella formazione delle versioni.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52415\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u0443\u0441\u0438\u043b\u0438\u044f \u0432 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438, \u043f\u0440\u043e\u0432\u0451\u043b \u0432\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Census, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043d\u0443\u0436\u0434\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u043e\u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u043c \u0430\u0443\u0434\u0438\u0442\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0412\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0430\u043d\u0430\u043b\u0438\u0437 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043e\u0434\u0430, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-70931","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0439\u0442\u0438\u043d\u0433 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043e\u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-22T12:38:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:11:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Classifica delle librerie che necessitano di particolare controllo della sicurezza | ProHoster","description":"Il fondo Core Infrastructure Initiative, istituito dall'organizzazione Linux Foundation, ha portato a","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0439\u0442\u0438\u043d\u0433 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043e\u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u0444\u043e\u043d\u0434 Core Infrastructure Initiative, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0435\u0434\u0443\u0449\u0438\u0435.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/rejting-bibliotek-trebuyushhih-osoboj-proverki-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-22T12:38:01+00:00","article:modified_time":"2020-03-03T13:11:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"70931","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:11:24","updated":"2022-10-03 02:59:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/70931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=70931"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/70931\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=70931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=70931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=70931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}