{"id":100063,"date":"2021-04-30T10:22:37","date_gmt":"2021-04-30T08:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti"},"modified":"2021-04-30T10:22:37","modified_gmt":"2021-04-30T08:22:37","slug":"github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/github-uzhestochaet-pravila-svyazannye-s-razmeshheniem-rezultatov-issledovanij-bezopasnosti","title":{"rendered":"GitHub forcon m\u00eb t\u00eb rrepta rregullat lidhur me publikimin e rezultateve t\u00eb hulumtimeve mbi sigurin\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub publikoi ndryshime n\u00eb rregullat q\u00eb p\u00ebrcaktojn\u00eb politik\u00ebn mbi publikimin e eksploit\u00ebve dhe rezultateve t\u00eb hulumtimit t\u00eb softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm, si dhe p\u00ebrputhshm\u00ebrin\u00eb me Ligjin p\u00ebr t\u00eb Drejtat e Autorit n\u00eb Epok\u00ebn Digjitale (DMCA) t\u00eb Shteteve t\u00eb Bashkuara. Ndryshimet jan\u00eb ende n\u00eb nj\u00eb gjendje t\u00eb pap\u00ebrfunduar dhe jan\u00eb t\u00eb disponueshme p\u00ebr diskutim p\u00ebr 30 dit\u00eb. <\/p>\n
N\u00eb rregullat p\u00ebr p\u00ebrputhshm\u00ebrin\u00eb me DMCA, p\u00ebrve\u00e7 ndalimit t\u00eb m\u00ebparsh\u00ebm p\u00ebr shp\u00ebrndarjen dhe sigurimin e instalimit ose dor\u00ebzimit t\u00eb softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm aktiv\u00eb dhe eksploit\u00ebve, jan\u00eb shtuar kushtet e m\u00ebposhtme: <\/p>\n
\n
Nj\u00eb ndalim i qart\u00eb p\u00ebr vendosjen n\u00eb depo t\u00eb teknologjive p\u00ebr anashkalimin e mjeteve teknike t\u00eb mbrojtjes s\u00eb t\u00eb drejtave t\u00eb autorit, duke p\u00ebrfshir\u00eb \u00e7el\u00ebsat e licenc\u00ebs, si dhe programet p\u00ebr gjenerimin e \u00e7el\u00ebsave, anashkalimin e verifikimit t\u00eb \u00e7el\u00ebsave dhe zgjatjen e periudh\u00ebs falas t\u00eb funksionimit.\n
Ngrihet nj\u00eb procedure p\u00ebrpara se t\u00eb p\u00ebrballet me nj\u00eb k\u00ebrkes\u00eb p\u00ebr heqjen e k\u00ebtij kodi. Personi q\u00eb b\u00ebn k\u00ebrkes\u00ebn p\u00ebr heqje k\u00ebrkohet t\u00eb ofroj\u00eb detaje teknike, me nj\u00eb q\u00ebllim t\u00eb deklaruar p\u00ebr ta d\u00ebrguar k\u00ebt\u00eb k\u00ebrkes\u00eb p\u00ebr ekspertiz\u00eb para bllokimit.\n
N\u00eb rast t\u00eb bllokimit t\u00eb repositorit, premtohet mund\u00ebsia p\u00ebr t\u00eb eksportuar issue dhe PR-t\u00eb, si dhe t\u00eb ofrohet sh\u00ebrbim juridik. <\/ul>\n
Ndryshimet e b\u00ebra n\u00eb rregullat q\u00eb lidhen me eksploit\u00ebt dhe malware-in, marrin n\u00eb konsiderat\u00eb kritikat e shprehura pas heqjes nga Microsoft e prototipit t\u00eb eksploitit p\u00ebr Microsoft Exchange, i cili ishte p\u00ebrdorur p\u00ebr t\u00eb kryer sulme. N\u00eb rregullat e reja b\u00ebhet nj\u00eb p\u00ebrpjekje e qart\u00eb p\u00ebr t\u00eb ndar\u00eb p\u00ebrmbajtjen q\u00eb paraqet rrezik dhe q\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer sulme aktive, nga kodi q\u00eb shoq\u00ebron hulumtimet n\u00eb fush\u00ebn e siguris\u00eb. Ndryshimet e \u0432\u043d\u0435\u0441ura: <\/p>\n
\n
\u00cbsht\u00eb e ndaluar jo vet\u00ebm t\u00eb sulmohet p\u00ebrdoruesit e GitHub duke postuar p\u00ebrmbajtje me eksploit\u00eb ose duke p\u00ebrdorur GitHub si nj\u00eb mjet shp\u00ebrndarjeje p\u00ebr eksploit\u00eb, si\u00e7 ka ndodhur m\u00eb par\u00eb, por gjithashtu t\u00eb postosh kode t\u00eb d\u00ebmshme dhe eksploit\u00eb q\u00eb ndihmojn\u00eb n\u00eb realizimin e sulmeve aktive. N\u00eb nj\u00eb kuptim t\u00eb p\u00ebrgjithsh\u00ebm, nuk ndalohet publikimi i shembujve t\u00eb eksploit\u00ebve t\u00eb p\u00ebrgatitur gjat\u00eb hulumtimeve t\u00eb siguris\u00eb dhe q\u00eb prekin dob\u00ebsi t\u00eb rregulluara tashm\u00eb, por gjith\u00e7ka varet nga interpretimi i termit \u00absulme aktive\u00bb.\n
P\u00ebr shembull, publikimi n\u00eb \u00e7do form\u00eb i teksteve burimore t\u00eb kodit JavaScript q\u00eb sulmon shfletuesin, bie n\u00ebn k\u00ebt\u00eb kriter \u2014 asgj\u00eb nuk e pengon keqb\u00ebr\u00ebsin t\u00eb ngarkoje kodin burimor n\u00eb shfletuesin e viktim\u00ebs p\u00ebrmes fetch-it, t\u00eb b\u00ebj\u00eb automatikisht patch, n\u00ebse prototipi i eksploitit \u00ebsht\u00eb publikuar n\u00eb nj\u00eb version jo-funksional, dhe ta ekzekutoj\u00eb. Po ashtu p\u00ebr \u00e7do kod tjet\u00ebr, p\u00ebr shembull n\u00eb C++, asgj\u00eb nuk e pengon ta kompiloje at\u00eb n\u00eb makin\u00ebn e sulmuar dhe ta ekzekutoj\u00eb. Kur t\u00eb zbulohet nj\u00eb repository me nj\u00eb kod t\u00eb till\u00eb, planifikohet q\u00eb t\u00eb mos fshihet, por t\u00eb mbyllet aksesin ndaj tij. <\/p>\n
I \u00ebsht\u00eb kaluar lart n\u00eb tekst seksioni q\u00eb ndalon \u00abspamin\u00bb, manipulimet, pjes\u00ebmarrjen n\u00eb tregun e manipulimeve, programet p\u00ebr shkeljen e rregullave t\u00eb ndonj\u00eb faqeje, phishing dhe p\u00ebrpjekjet p\u00ebr t\u00eb.\n
Shtohet nj\u00eb pika me shpjegimin e mund\u00ebsis\u00eb p\u00ebr t\u00eb b\u00ebr\u00eb apel n\u00eb rast mosmarr\u00ebveshjeje me bllokimin.\n
\u00cbsht\u00eb shtuar nj\u00eb k\u00ebrkes\u00eb p\u00ebr pronar\u00ebt e depozitave, n\u00eb t\u00eb cilat regjistrohet p\u00ebrmbajtje potencialisht e rrezikshme n\u00eb kuad\u00ebr t\u00eb k\u00ebrkimeve t\u00eb siguris\u00eb. Prania e till\u00eb p\u00ebrmbajtjeje duhet t\u00eb p\u00ebrmendet qart\u00eb n\u00eb fillim t\u00eb skedarit README.md, dhe n\u00eb skedarin SECURITY.md duhet t\u00eb jepen t\u00eb dh\u00ebnat kontaktuese p\u00ebr lidhje. \u00cbsht\u00eb e specifikuar se n\u00eb terma t\u00eb p\u00ebrgjithsh\u00ebm, GitHub nuk fshin eksploit\u00ebt e publikuar me k\u00ebrkime t\u00eb siguris\u00eb p\u00ebr vulnerabilitete t\u00eb zbuluara tashm\u00eb (jo 0-day), por ruan t\u00eb drejt\u00ebn t\u00eb kufizoj\u00eb aksesin n\u00ebse mendon se ndjehet rreziku i p\u00ebrdorimit t\u00eb k\u00ebtyre eksploit\u00ebve p\u00ebr sulme reale dhe pranohet ankesat n\u00eb sh\u00ebrbimin e mb\u00ebshtetjes s\u00eb GitHub p\u00ebr p\u00ebrdorimin e kodit p\u00ebr sulme. <\/ul>\n