{"id":104623,"date":"2022-07-10T09:36:38","date_gmt":"2022-07-10T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa"},"modified":"2022-07-10T09:36:38","modified_gmt":"2022-07-10T07:36:38","slug":"vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","title":{"rendered":"Implementarea autentific\u0103rii cu dou\u0103 factorii \u00een PyPI a dus la un incident de \u0219tergere a unui pachet popular","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii depozitului de pachete Python, PyPI, au publicat un plan de trecere la autentificarea cu dou\u0103 factori obligatorie pentru pachetele din categoria critic\u0103. Importan\u021ba este determinat\u0103 de num\u0103rul de desc\u0103rc\u0103ri \u0219i modificarea se va aplica conturilor men\u021binatorilor \u0219i de\u021bin\u0103torilor de proiecte asociate cu 1% din pachetele ce conduc \u00een num\u0103rul desc\u0103rc\u0103rilor \u00een ultimele 6 luni. Av\u00e2nd \u00een vedere c\u0103 \u00een prezent depozitul PyPI include mai mult de 350 de mii de pachete, autentificarea cu dou\u0103 factori va fi aplicat\u0103 pentru aproximativ 3500 de pachete. Pentru a verifica includerea contului \u00een list\u0103, a fost preg\u0103tit\u0103 o pagin\u0103 special\u0103. Data exact\u0103 a introducerii autentific\u0103rii cu dou\u0103 factori obligatorii nu a fost stabilit\u0103 \u00eenc\u0103, estim\u00e2ndu-se c\u0103 aceasta se va \u00eent\u00e2mpla \u00een urm\u0103toarele luni. <\/p>\n

Spre deosebire de trecerea la autentificarea cu dou\u0103 factori pentru proiectele RubyGems, NPM \u0219i GitHub, \u00een PyPI va fi implementat ini\u021bial un sistem care preconizeaz\u0103 utilizarea dorit\u0103 a unui token hardware cu chei de acces. Motivul pentru recomandarea utiliz\u0103rii tokenurilor \u0219i a protocolului WebAuthn este men\u021bionarea unei securit\u0103\u021bi mai ridicate \u00een compara\u021bie cu generarea de parole unice (posibilitatea de a utiliza TOTP \u00een loc de tokenuri va fi disponibil\u0103 ca op\u021biune). <\/p>\n

Tokenii vor putea fi ob\u021binu\u021bi gratuit \u2014 compania Google a sprijinit ini\u021biativa \u0219i a alocat 4000 de chei Titan pentru proiect. Fiecare persoan\u0103 \u00eenso\u021bitoare poate solicita ob\u021binerea gratuit\u0103 a dou\u0103 tokenuri cu interfa\u021ba USB-C sau USB-A. Al doilea token este trimis ca rezerv\u0103 \u00een cazul \u00een care firul principal se defecteaz\u0103 sau se pierde, pentru a minimiza riscul de a pierde accesul la repozitoriu \u0219i a scuti dezvoltatorii de necesitatea de a trece printr-o procedur\u0103 complicat\u0103 de recuperare a accesului. <\/p>\n

Din p\u0103cate, tokenurile pot fi trimise doar \u00een Austria, Belgia, Canada, Fran\u021ba, Germania, Italia, Japonia, Spania, Elve\u021bia, Regatul Unit \u0219i Statele Unite. Men\u021bin\u0103torii din alte \u021b\u0103ri pot achizi\u021biona pe cont propriu tokenuri compatibile cu specifica\u021bia FIDO U2F, de exemplu, tokenurile Yubikey \u0219i Thetis sunt potrivite. Ca alternativ\u0103, este disponibil\u0103 \u0219i op\u021biunea utiliz\u0103rii aplica\u021biilor de autentificare bazate pe parole unice, care suport\u0103 protocolul TOTP, precum Authy, Google Authenticator \u0219i FreeOTP. <\/p>\n

Ini\u021biativa nu a fost f\u0103r\u0103 incidente. Autorul pachetului Atomicwrites, care are 6 milioane de desc\u0103rc\u0103ri pe lun\u0103 \u0219i 38 de milioane \u00een ultimele 6 luni, nu a dorit s\u0103 treac\u0103 la autentificarea cu dou\u0103 factori \u0219i, pentru a-\u0219i exclude pachetul din lista celor critice, a \u00eencercat s\u0103 reseteze contorul desc\u0103rc\u0103rilor. Pentru a reseta, a \u0219ters \u00eent\u00e2i pachetul \u0219i apoi a \u00eenc\u0103rcat o nou\u0103 versiune. Se a\u0219tepta ca o astfel de manipulare s\u0103 reseteze doar contorul, dar, spre surprinderea dezvoltatorului, toate versiunile anterioare au fost \u0219terse din depozit, ceea ce a dus la probleme pentru proiectele dependente de aceast\u0103 bibliotec\u0103, pe care unii dezvoltatori le-au comparat cu incidentul rezultat din \u0219tergerea pachetului left-pad din NPM. <\/p>\n

Problema s-a agravat deoarece, dup\u0103 \u0219tergere, autorul atomicwrites nu a putut s\u0103 \u00eencarce versiunile anterioare, care au fost restaurate abia \u00een ziua urm\u0103toare dup\u0103 interven\u021bia administratorilor PyPI. Dup\u0103 cele \u00eent\u00e2mplate, autorul pachetului a decis s\u0103 opreasc\u0103 dezvoltarea atomicwrites \u0219i s\u0103-l declare \u00eenvechit. Ca motiv, acesta a men\u021bionat c\u0103 dezvolt\u0103 proiectul ca hobby \u00een timpul liber, iar apari\u021bia unor cerin\u021be suplimentare care complic\u0103 activitatea nu merit\u0103 timpul depus pentru \u00eentre\u021binerea gratuit\u0103 a unui pachet at\u00e2t de popular. Autorul atomicwrites sus\u021bine c\u0103 ar prefera pur \u0219i simplu s\u0103 scrie cod pentru distrac\u021bie, iar grija pentru protec\u021bia suplimentar\u0103 \u00eempotriva atacurilor cibernetice ar trebui s\u0103 fie preluat\u0103 de cei care pl\u0103tesc pentru asta. <\/p>\n

Biblioteca atomicwrites con\u021bine aproximativ 200 de linii de cod \u0219i ofer\u0103 func\u021bii pentru scrierea atomic\u0103 a fi\u0219ierelor. Ca alternativ\u0103, se pot utiliza apelurile standard os.replace \u0219i os.rename (opera\u021bia const\u0103 \u00een scrierea \u00eentr-un fi\u0219ier cu nume temporar \u0219i redenumirea \u00een fi\u0219ierul \u021bint\u0103 dup\u0103 finalizare).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445. \u0412\u0430\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043e \u043a \u0443\u0447\u0451\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 1% \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043b\u0438\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0437\u0430 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432. \u0421 \u0443\u0447\u0451\u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 PyPI \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104623","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Implementarea autentific\u0103rii cu dou\u0103 factori \u00een PyPI a dus la un incident cu \u0219tergerea unui pachet popular | ProHoster","description":"Dezvoltatorii depozitului de pachete Python PyPI au publicat un plan de trecere la autentificarea cu dou\u0103 factori obligatorie pentru pachetele care intr\u0103 \u00een categoria celor critice.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 PyPI \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0443 \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043b\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vnedrenie-dvuhfaktornoj-autentifikaczii-v-pypi-privelo-k-inczidentu-s-udaleniem-populyarnogo-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-10T07:36:38+00:00","article:modified_time":"2022-07-10T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104623","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-10 07:37:55","updated":"2022-10-08 17:25:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=104623"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/104623\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=104623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=104623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=104623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}