Jan\u00eb zbuluar detaje t\u00eb sulmit ndaj infrastruktur\u00ebs s\u00eb p\u00ebrdorur gjat\u00eb zhvillimit t\u00eb framework-ut t\u00eb m\u00ebsimit makinerik PyTorch, i cili b\u00ebri t\u00eb mundur nxjerrjen e \u00e7el\u00ebsave t\u00eb aksesit t\u00eb mjaftuesh\u00ebm p\u00ebr t\u00eb publikuar t\u00eb dh\u00ebna arbitrare n\u00eb depozit\u00ebn e publikimeve t\u00eb projektit n\u00eb GitHub dhe AWS, si edhe p\u00ebr t\u00eb futur kod n\u00eb deg\u00ebn kryesore t\u00eb depozit\u00ebs dhe p\u00ebr t\u00eb shtuar nj\u00eb backdoor p\u00ebrmes var\u00ebsive. Z\u00ebvend\u00ebsimi i publikimeve t\u00eb PyTorch mund t\u00eb ishte p\u00ebrdorur p\u00ebr t\u00eb kryer nj\u00eb sulm ndaj kompanive t\u00eb m\u00ebdha si Google, Meta, Boeing dhe Lockheed Martin, t\u00eb cilat p\u00ebrdorin PyTorch n\u00eb projektet e tyre. N\u00eb kuad\u00ebr t\u00eb programit Bug Bounty, kompania Meta u ka paguar studiuesve $16250 p\u00ebr informacionin mbi problemin. <\/p>\n
Thelbi i sulmit q\u00ebndron n\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb kodit t\u00eb vet n\u00eb sistemet<\/a> integrimit t\u00eb vazhdueshme, q\u00eb kryejn\u00eb rip\u00ebrt\u00ebritje dhe ekzekutimin e detyrave p\u00ebr testimin e ndryshimeve t\u00eb reja q\u00eb d\u00ebrgohen n\u00eb depo. Problemi prek projektet q\u00eb p\u00ebrdorin p\u00ebrpunuesit e jasht\u00ebm \"Self-Hosted Runner\" me GitHub Actions. Ndryshe nga p\u00ebrpunuesit tradicional\u00eb t\u00eb GitHub Actions, p\u00ebrpunuesit Self-Hosted nuk ekzekutohen n\u00eb infrastruktur\u00ebn e GitHub, por n\u00eb server\u00ebt e tyre. server\u00ebt e tyre ose n\u00eb<\/a> makina virtuale, t\u00eb mir\u00ebmbajtura nga zhvilluesit. <\/p>\n Ekzekutimi i detyrave t\u00eb nd\u00ebrtimit n\u00eb server\u00ebt e tyre lejon organizimin e ekzekutimit t\u00eb kodit, i cili mund t\u00eb realizoj\u00eb skanimin e rrjetit t\u00eb brendsh\u00ebm t\u00eb nd\u00ebrmarrjes, k\u00ebrkimin n\u00eb FS-n\u00eb lokale t\u00eb \u00e7el\u00ebsave t\u00eb enkriptimit dhe token\u00ebve t\u00eb aksesit, analizimin e variablave t\u00eb mjedisit me parametrat e referimit n\u00eb depozita t\u00eb jashtme ose sh\u00ebrbime t\u00eb cloud. N\u00eb munges\u00eb t\u00eb izolimit t\u00eb duhur t\u00eb mjedisit t\u00eb nd\u00ebrtimit, t\u00eb dh\u00ebnat e ndjeshme t\u00eb gjetura mund t\u00eb d\u00ebrgohen nga sulmuesit jasht\u00eb, p\u00ebr shembull, p\u00ebrmes thirrjeve n\u00eb API-t\u00eb e jashtme. P\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrdorimin nga projektet e \"Self-Hosted Runner\", mund t\u00eb p\u00ebrdoret mjeti Gato, q\u00eb analizon skedar\u00ebt e workflow t\u00eb hapur dhe logjet e ekzekutimit t\u00eb detyrave CI. <\/p>\n N\u00eb PyTorch dhe shum\u00eb projekte t\u00eb tjera q\u00eb p\u00ebrdorin \"Self-Hosted Runner\", ekzekutimi i detyrave t\u00eb nd\u00ebrtimit lejohet vet\u00ebm p\u00ebr zhvilluesit, ndryshimet e t\u00eb cil\u00ebve m\u00eb par\u00eb kan\u00eb kaluar nj\u00eb rishikim dhe jan\u00eb p\u00ebrfshir\u00eb n\u00eb baz\u00ebn e kodit t\u00eb projektit. Prania e statusit \"contributor\" duke p\u00ebrdorur konfigurimet e parazgjedhura n\u00eb depo ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar p\u00ebrpunuesit e GitHub Actions gjat\u00eb d\u00ebrgimin e k\u00ebrkesave pull dhe, p\u00ebr rrjedhoj\u00eb, p\u00ebr t\u00eb ekzekutuar kodin e tyre n\u00eb \u00e7do mjedis GitHub Actions Runner t\u00eb lidhur me depozita ose organizat\u00ebn q\u00eb menaxhon projektin. <\/p>\n Nd\u00ebrlidhja me statusin «contributor» u pa e leht\u00eb p\u00ebr t'u shmangur — mjafton t\u00eb d\u00ebrgohet nj\u00eb ndryshim t\u00eb par\u00ebnd\u00ebsish\u00ebm dhe t\u00eb pritet miratimi i tij n\u00eb baz\u00ebn e kodit, pas s\u00eb cil\u00ebs zhvilluesi automatikisht fitoi statusin e nj\u00eb pjes\u00ebmarr\u00ebsi aktiv, k\u00ebrkesat p\u00ebr pull jan\u00eb lejuar t\u00eb testohen n\u00eb infrastruktur\u00ebn CI pa kontroll t\u00eb ve\u00e7ant\u00eb. P\u00ebr t\u00eb fituar statusin e zhvilluesit aktiv, gjat\u00eb eksperimentit u p\u00ebrdor\u00ebn ndryshime t\u00eb par\u00ebnd\u00ebsishme estetike, lidhur me korrigjimin e gabimeve n\u00eb dokumentacion. P\u00ebr t\u00eb fituar aksesin n\u00eb depo dhe n\u00eb ruajtjen e l\u00ebshimeve t\u00eb PyTorch, gjat\u00eb sulmit me ekzekutimin e kodit n\u00eb «Self-Hosted Runner» u krye kapja e tokenit GitHub, q\u00eb u p\u00ebrdor p\u00ebr aksesin n\u00eb depo nga proceset e nd\u00ebrtimit, si dhe \u00e7el\u00ebsave AWS, t\u00eb angazhuar p\u00ebr ruajtjen e rezultateve t\u00eb nd\u00ebrtimit. <\/p>\n