{"id":110893,"date":"2023-10-17T09:10:18","date_gmt":"2023-10-17T07:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej"},"modified":"2023-10-17T09:10:18","modified_gmt":"2023-10-17T07:10:19","slug":"oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","title":{"rendered":"Vler\u00ebsimi i problemeve me mb\u00ebshtetje t\u00eb projekteve t\u00eb hapura dhe p\u00ebrdorimin e var\u00ebsive t\u00eb vjetra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Sonatype, e specializuar n\u00eb mbrojtjen nga sulmet q\u00eb manipulojn\u00eb me z\u00ebvend\u00ebsimin e komponenteve dhe var\u00ebsive t\u00eb softuerit (supply chain), publikoi rezultatet e nj\u00eb studimi (PDF, 62 fq.) mbi problemet me var\u00ebsit\u00eb dhe mb\u00ebshtetje n\u00eb projektet e hapura n\u00eb gjuh\u00ebt Java, JavaScript, Python dhe .NET, t\u00eb paraqitura n\u00eb depozitat Maven Central, NPM, PyPl dhe Nuget. Gjat\u00eb nj\u00eb viti \u00ebsht\u00eb v\u00ebrejtur nj\u00eb rritje mesatare prej 29% t\u00eb numrit t\u00eb projekteve n\u00eb ekosistemet e hapura t\u00eb monitoruara. Numri i shkarkimeve t\u00eb pacak\u00ebve nga depozitat e shqyrtuara n\u00eb vitin 2023 u rrit me 33%, nd\u00ebrsa p\u00ebr krahasim numri i shkarkimeve u rrit me 73% n\u00eb vitin 2021. <\/p>\n
Aktiviteti keqdash\u00ebs n\u00eb repozitor\u00eb ka p\u00ebsuar nj\u00eb rritje t\u00eb konsiderueshme \u2014 q\u00eb nga fillimi i vitit jan\u00eb identifikuar 245 mij\u00eb paketa keqdash\u00ebse dhe numri i sulmeve t\u00eb regjistruara, t\u00eb fokusuar n\u00eb z\u00ebvend\u00ebsimin e var\u00ebsive, \u00ebsht\u00eb dyfishuar.
<\/center> <\/p>\n
Shum\u00eb projekte vazhdojn\u00eb t\u00eb p\u00ebrdorin versione t\u00eb prekshme, p\u00ebr shembull, 23% e shkarkimeve t\u00eb paket\u00ebs Java Log4j ende p\u00ebrb\u00ebjn\u00eb versione me vulnerabilitete kritike, t\u00eb adresuara n\u00eb vitin 2021. N\u00eb depozit\u00ebn Maven Central, rreth 12% e t\u00eb gjitha shkarkimeve p\u00ebrfshijn\u00eb komponente q\u00eb kan\u00eb vulnerabilitete t\u00eb njohura. Mesatarisht p\u00ebr t\u00eb gjitha depozitat, pjesa e shkarkimeve t\u00eb versioneve t\u00eb vjetra t\u00eb pacak\u00ebve, q\u00eb p\u00ebrkasin n\u00eb kategori t\u00eb rrezikshme (p\u00ebr shembull, me vulnerabilitete t\u00eb paadresuara) arrin n\u00eb 20% (n\u00eb 80% t\u00eb rasteve shkarkohet versione e azhurnuar). N\u00eb 96% t\u00eb rasteve, shkarkimet e komponenteve me vulnerabilitete mund t\u00eb ishin shmangur duke zgjedhur versione ku problemi tashm\u00eb ishte adresuar. <\/p>\n
Nj\u00eb problem i r\u00ebnd\u00ebsish\u00ebm p\u00ebr ruajtjen e siguris\u00eb \u00ebsht\u00eb gjithashtu mir\u00ebmbajtja cil\u00ebsore e projekteve. N\u00eb ekosistemat p\u00ebr gjuh\u00ebt Java dhe JavaScript ka shum\u00eb v\u00ebshtir\u00ebsi n\u00eb k\u00ebt\u00eb drejtim \u2014 n\u00eb vitin e kaluar, p\u00ebr \u00e7do projekt t\u00eb pest\u00eb (18.6%) t\u00eb paraqitur n\u00eb Maven Central dhe NPM, q\u00eb trajtohej vitin e kaluar, \u00ebsht\u00eb nd\u00ebrprer\u00eb mir\u00ebmbajtja. Nga 1.176 milion projektesh t\u00eb analizuar, t\u00eb pranish\u00ebm n\u00eb repozitor\u00ebt Maven, NPM, PyPl dhe Nuget, vet\u00ebm 11% (118 mij\u00eb) vazhdojn\u00eb t\u00eb mir\u00ebmbahen aktivisht. <\/p>\n
Gjat\u00eb hulumtimit u zhvillua gjithashtu nj\u00eb anketim me 621 zhvillues profesional\u00eb nga kompani t\u00eb ndryshme. 67% e t\u00eb anketuarve mendojn\u00eb se aplikacionet e tyre nuk p\u00ebrdorin biblioteka t\u00eb cenueshme, 10% p\u00ebrballen me incidente sigurie gjat\u00eb 12 muajve t\u00eb fundit, p\u00ebr shkak t\u00eb cenueshm\u00ebrive n\u00eb software t\u00eb hapur, nd\u00ebrsa 20% kan\u00eb v\u00ebshtir\u00ebsi t\u00eb japin p\u00ebrgjigje. 28% e kompanive identifikojn\u00eb pranin\u00eb e komponent\u00ebve t\u00eb cenuesh\u00ebm brenda 1 dite pas zbulimit t\u00eb informacionit mbi cenueshm\u00ebrin\u00eb, 39% \u2014 nga 1 deri n\u00eb 7 dit\u00eb, nd\u00ebrsa 29% \u2014 m\u00eb shum\u00eb se nj\u00eb jav\u00eb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Vler\u00ebsimi](\"\/wp-content\/uploads\/2023\/10\/51959a6d676e0ad5ee98884567dd49ec.png\")
<\/center> <\/p>\n