{"id":112715,"date":"2024-01-05T21:10:15","date_gmt":"2024-01-05T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah"},"modified":"2024-01-05T21:10:15","modified_gmt":"2024-01-05T19:10:15","slug":"problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","title":{"rendered":"Problemet p\u00ebr shkak t\u00eb raporteve mbi vulnerabilitetet t\u00eb p\u00ebrgatitura nga mjetet e AI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniel Stenberg, autori i mjetit p\u00ebr d\u00ebrgimin dhe marrjen e t\u00eb dh\u00ebnave n\u00eb rrjet, curl, shprehu kritika ndaj p\u00ebrdorimit t\u00eb mjeteve AI p\u00ebr krijimin e raporteve mbi vulnerabilitetet. K\u00ebto raporte p\u00ebrfshijn\u00eb detaje t\u00eb holl\u00ebsishme, jan\u00eb shkruar n\u00eb nj\u00eb gjuh\u00eb normale dhe duken cil\u00ebsore, por n\u00ebse nuk analizohen me kujdes, ato thjesht mund t\u00eb \u00e7orientojn\u00eb, duke z\u00ebvend\u00ebsuar problemet reale me p\u00ebrmbajtje q\u00eb duket cil\u00ebsore por \u00ebsht\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb e padobishme. <\/p>\n

Projektin Curl ofron shp\u00ebrblime p\u00ebr zbule t\u00eb vulnerabiliteteve t\u00eb reja dhe deri tani ka marr\u00eb 415 raporte p\u00ebr probleme t\u00eb mundshme, prej t\u00eb cilave vet\u00ebm 64 jan\u00eb konfirmuar si vulnerabilitete dhe 77 si gabime jo t\u00eb lidhura me sigurin\u00eb. K\u00ebshtu, 66% e t\u00eb gjitha raporteve nuk p\u00ebrmbanin ndonj\u00eb informacion t\u00eb dobish\u00ebm dhe vet\u00ebm ia kan\u00eb marr\u00eb koh\u00ebn zhvilluesve, q\u00eb mund t\u00eb ishte shpenzuar p\u00ebr di\u00e7ka m\u00eb t\u00eb dobishme. <\/p>\n

Zhvilluesit jan\u00eb t\u00eb detyruar t\u00eb shpenzojn\u00eb shum\u00eb koh\u00eb kot duke analizuar raporte t\u00eb pavlera dhe duke verifikuar informacionin aty disa her\u00eb, pasi cil\u00ebsia e jashtme e paraqitjes krijon nj\u00eb besim t\u00eb m\u00ebtejsh\u00ebm n\u00eb informacion dhe krijon ndjesin\u00eb se zhvilluesi ka kuptuar di\u00e7ka keq. N\u00eb an\u00ebn tjet\u00ebr, krijimi i nj\u00eb raporti t\u00eb till\u00eb k\u00ebrkon p\u00ebrpjekje minimale nga aplikuesi, i cili nuk merr mundimin p\u00ebr t\u00eb verifikuar n\u00ebse ka nj\u00eb problem real, por thjesht kopjon pa mendim t\u00eb dh\u00ebnat e marra nga ndihm\u00ebsit AI, duke shpresuar p\u00ebr fat n\u00eb gar\u00ebn p\u00ebr t\u00eb marr\u00eb shp\u00ebrblimin. <\/p>\n

Dy shembuj t\u00eb till\u00eb t\u00eb raporteve t\u00eb pavlera jepen. Nj\u00eb dit\u00eb p\u00ebrpara shpalljes s\u00eb planifikuar t\u00eb informacionit mbi nj\u00eb vulnerabilitet t\u00eb rreziksh\u00ebm t\u00eb tetorit (CVE-2023-38545), p\u00ebrmes Hackerone u d\u00ebrgua nj\u00eb raport q\u00eb thoshte se patch-i me korrigjimin kishte dal\u00eb n\u00eb publik. N\u00eb t\u00eb v\u00ebrtet\u00eb, raporti p\u00ebrmbante nj\u00eb p\u00ebrzierje t\u00eb p\u00ebrgatitur nga ndihm\u00ebsi AI Google Bard, e mbushur me fakte rreth problemeve t\u00eb ngjashme dhe fragmente informacioni t\u00eb detajuar rreth vulnerabiliteteve t\u00eb kaluara. Si rezultat, informacioni dukej i ri dhe i aktualizuar, por n\u00eb t\u00eb v\u00ebrtet\u00eb nuk kishte lidhje me realitetin. <\/p>\n

Shembulli i dyt\u00eb p\u00ebrfshin nj\u00eb mesazh t\u00eb marr\u00eb m\u00eb 28 dhjetor p\u00ebr nj\u00eb tejkalim buffer-i n\u00eb menaxherin e WebSocket-it, d\u00ebrguar nga nj\u00eb p\u00ebrdorues q\u00eb kishte informuar tashm\u00eb projekte t\u00eb ndryshme p\u00ebr dob\u00ebsit\u00eb p\u00ebrmes Hackerone. Si metod\u00eb p\u00ebr t\u00eb rip\u00ebrs\u00ebritur problematik\u00ebn, raporti p\u00ebrmendte fjal\u00eb t\u00eb p\u00ebrgjithshme p\u00ebr d\u00ebrgimin e nj\u00eb k\u00ebrkese t\u00eb modifikuar me nj\u00eb vler\u00eb q\u00eb tejkalonte madh\u00ebsin\u00eb e buffer-it, q\u00eb p\u00ebrdorej gjat\u00eb kopjimit me ndihm\u00ebn e strcpy. N\u00eb raportin gjithashtu jepeshin shembuj p\u00ebr rregullimin (shembuj p\u00ebr z\u00ebvend\u00ebsimin e strcpy me strncpy) dhe jepte nj\u00eb lidhje p\u00ebr rreshtin e kodit \"strcpy(keyval, randstr)\", n\u00eb t\u00eb cilin sipas mendimit t\u00eb paraqit\u00ebsit kishte nj\u00eb gabim. <\/p>\n

Zhvilluesi e kontrolloi gjith\u00e7ka tri her\u00eb dhe nuk gjeti ndonj\u00eb problem, por sepse raporti ishte shkruar me siguri dhe madje p\u00ebrfshinte nj\u00eb korrigjim, kishte ndjesin\u00eb se di\u00e7ka po humbiste diku. P\u00ebrpjekja p\u00ebr t\u00eb sqaruar se si hulumtuesi mundi t\u00eb kalonte kontrollimin e madh\u00ebsis\u00eb para thirrjes s\u00eb strcpy dhe si madh\u00ebsia e tamponit keyval u b\u00eb m\u00eb e vog\u00ebl se madh\u00ebsia e t\u00eb dh\u00ebnave t\u00eb lexuara, \u00e7oi n\u00eb marrjen e shpjegimeve t\u00eb detajuara, por pa informacion shtes\u00eb, t\u00eb cilat vet\u00ebm shpjegonin arsyet e zakonshme t\u00eb ndodhjes s\u00eb mbushjes s\u00eb tamponit, t\u00eb pa lidhura me kodin specifik t\u00eb Curl. P\u00ebrgjigjet i ngjanin komunikimit me nj\u00eb ndihm\u00ebs AI dhe pas kalimit t\u00eb gjysm\u00eb dite n\u00eb p\u00ebrpjekje t\u00eb panevojshme p\u00ebr t\u00eb m\u00ebsuar si shfaqej problemi, zhvilluesi u bind p\u00ebrfundimisht se nuk kishte asnj\u00eb dob\u00ebsi n\u00eb t\u00eb v\u00ebrtet\u00eb.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043e\u0442\u0447\u0451\u0442\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u044f\u0437\u044b\u043a\u043e\u043c \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438, \u043d\u043e \u0431\u0435\u0437 \u0432\u0434\u0443\u043c\u0447\u0438\u0432\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430 \u0434\u0435\u043b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043b\u0438\u0448\u044c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0437\u0430\u0431\u043b\u0443\u0436\u0434\u0435\u043d\u0438\u0435, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0449\u0438\u043c \u043c\u0443\u0441\u043e\u0440\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c. \u041f\u0440\u043e\u0435\u043a\u0442 Curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112715","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problemet p\u00ebr shkak t\u00eb raporteve p\u00ebr dob\u00ebsit\u00eb t\u00eb p\u00ebrgatitura nga mjetet AI | ProHoster","description":"Daniel Stenberg, autori i utilitarit p\u00ebr t\u00eb marr\u00eb dhe d\u00ebrguar t\u00eb dh\u00ebna n\u00eb rrjet curl, kritikoi p\u00ebrdorimin e mjeteve AI n\u00eb hartimin e raporteve p\u00ebr dob\u00ebsit\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438\u0437-\u0437\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T19:10:15+00:00","article:modified_time":"2024-01-05T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=112715"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112715\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=112715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=112715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=112715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}