Dhowr maalmood ka hors Google ayaa daaha ka rogtay hindisaha isha furan ee sugan (SOS), maxaa siiyaan gunno shaqada la xiriirta xoojinta software -ka il furan ee muhiimka ah oo malaayiin doolar loo qoondeeyay lacag -bixinnadii ugu horreysay, laakiin haddii hindisaha loo aqoonsado inuu guulaystay, maal -gelinta mashruucu wuu sii socon doonaa.
Codsiyada gunnada waxaa loo aqbalaa oo keliya isbeddellada la aqbalay mashaariicda oo leh heer aad u culus ugu yaraan 0.6 marka loo eego OpenSSF Score Score ama lagu daray liiska mashaariicda u baahan kontaroolada amniga gaarka ah.
Dabeecadda isbeddelada la soo jeediyay waa inay la xiriirtaa hagaajinta amniga meelaha sida xoojinta ilaalinta kaabayaasha kaabayaasha (tusaale ahaan, isdhexgalka joogtada ah iyo hababka qaybinta), hirgelinta nidaamyada xaqiijinta saxiixyada dhijitaalka ah ee qaybaha alaabada software, kordhinta badeecadda heerka (dib -u -eegista, ilaalinta laanta, Imtixaanka Fuzzing, ka -hortagga weerarada ku -tiirsanaanta).
Sanadkii la soo dhaafay, waxaan samaynay dhowr maalgashi si aan u xoojino amniga mashaariicda isha furan ee muhiimka ah, waxaanan dhowaan ku dhawaaqnay $ 10 bilyan oo ay naga go'an tahay difaaca internetka ahmiyadaha iyo caawinta hagaajinta dayacanka.
Marka laga hadlayo qadarka gunooyinka, kuwaas ayaa loo soo saari doonaa sida soo socota:
- $ 10,000 ama ka badan - Si loo soo bandhigo horumarin waqti dheer, muhiim ah, muhiim ah, oo kakan oo ka ilaalinaysa baylahda daran ee koodhka mashruuca furan ama kaabayaasha.
- $ 5000- $ 10000 - hagaajinta dhibka dhexe ee saamaynta togan ku leh nabadgelyada.
- $ 1000- $ 5000 loogu talagalay hagaajinta dhibka dhexdhexaadka ah si loo kordhiyo amniga.
- $ 505 - hagaajinta amniga yar.
Maanta, waxaan ku faraxsanahay inaan ku dhawaaqno kafaala -qaadkayaga barnaamijka tijaabada ah ee Secure Open Source (SOS) oo uu hoggaaminayo Linux Foundation. Barnaamijkani wuxuu dhaqaale ahaan ku abaalmariyaa horumariyaasha hagaajinta amniga mashaariicda muhiimka ah ee il furan oo aan dhammaanteen ku tiirsannahay. Waxaan ku bilaabaynaa $ 1 milyan oo maalgelin ah waxaanan qorshaynaynaa inaan balaarino gaadhitaanka barnaamijka oo ku salaysan jawaab celinta bulshada.
Dhinaca kale OSTIF (Sanduuqa Horumarinta Teknolojiyadda Furan ee Furan), oo loo abuuray in lagu xoojiyo amniga mashaariicda isha furan, waxay ku dhawaaqday iskaashi ay la samaysay Google, kaas oo muujiyay rabitaankeeda ah inay maalgeliso hubinta amniga madaxa bannaan ee 8 mashruuc il furan.
Lacagihii laga helay Google, waxaa la go'aamiyay in la hubiyo Git, maktabadda Lodash JavaScript, qaab-dhismeedka PHP Laravel, qaabka Slf4j Java, maktabadaha Jackson JSON (Jackson-core iyo Jackson-databind) iyo qaybaha Apache Http (Httpcomponents- core iyo Httpcomponents).
Taageerada Google ayaa u oggolaan doonta OSTIF inay bilawdo Barnaamijka Hanti-dhowrka Maareynta (MAP), kaas oo ballaarin doona dib-u-eegistayada qoto-dheer ee amniga mashaariic badan oo muhiim u ah hab-nololeedka il furan.
Markii hore, iyadoo la adeegsanayo lacagihii la helay iyadoo ka dhalatay ururinta tabarucaadka, sanduuqa OSTIF waxay hore u baadhay OpenSSL, VeraCrypt, OpenVPN, Monero, mashaariicda aan xadidnayn DNS iyo QRL.
Si gooni ah, beeshu waxay hore u soo diyaarisay qalab loogu talagalay hubinta qaab -dhismeedka Symfony PHP. Haddii ay dhacdo maalgelin dheeri ah oo loogu talagalay hanti -dhowrka, mashaariicda Systemd, Electron, Rails, Drupal, Joomla, WebPack, Reprepro, Ceph, React Native, Salt, Respible, Angular, Gatsby iyo Guava ayaa sidoo kale la qorsheeyay.
Tani waxay calaamad u tahay guusha weyn ee soo jiidashada deeq -bixiyeyaasha shirkadaha waaweyn si ay u taageeraan tusaalaha OSTIF ee lagu hagaajinayo softiweerka furan iyada oo loo marayo dib -u -eegista amniga iyo xisaabinta koodhka isha.
Xulashada waxaa loo sameeyay si ku dhisan qiimeyn ku saabsan saameynta amniga ee mashruuca ku jira hab -nololeedka il furan iyo faa'iidada ka iman karta bulshada iyada oo la kordhinayo amniga mashaariicda la tixgelinayo. Qiyaastii 100 oo mashruuc oo GitHub ah, ayaa la xisaabiyey isuduwaha iyadoo la tixgelinayo arrimo ay ka mid yihiin caannimada isticmaalka sida ku -tiirsanaanta, dalabka kaabayaasha dhaqaalaha, tirada horumariyeyaasha, waxqabadka horumarka, tirada farriimaha khaldan ee xiran iyo kuwa aan xirnayn, tirada ururada taageera mashruuca, soo noqnoqoshada cusboonaysiinta, taariikhda aqoonsiga nuglaanta, iwm.
Fuentes: https://ostif.org/, https://security.googleblog.com/