He aha te Dosfuscation? He aha me aro atu ai ngā kaiwhakawhanake
Anei tētahi tirohanga tere mō te tūraru: whakaarohia te arotake i tētahi PR e āhua ana he whakahoutanga iti noa iho. I roto i te huna, i tāpirihia e tētahi kaituku he tuhinga āwhina kāore e kino. Engari i te hanumi, ka rere i te wā o te CI pipeline ā, ka tīmata i tētahi porowhita e pau puku ana te mahara katoa, ka pakaru te hanganga.
Ko te Dosfuscation he momo whakaeke ā-roto whakakore-o-ratonga (DoS) e huna ana mā te whakamahi i ngā tikanga whakapōrearea waehere. Ka whakakotahi i ngā arorau kua hangaia hei wawahi i te whakatinanatanga, pērā i ngā koropiko mutunga kore, i te pupuhi mahara rānei, me ngā rautaki e huna ana i tōna whanonga tūturu, e uaua ai te kite i te wā o ngā arotake, o ngā arotake rānei. Ehara tēnei i te pānga o waho; kei roto kē i tō waehere, e tatari ana kia pakaru tō hanganga, tō oma whakaputa rānei.
He aha te take? Kāore i rite ki ngā momo whakaeke whakakore ratonga tuku iho e whakakī ana i ō tūmau ki te waka, ka huna te dosfuscation i te tirohanga whānui, ka paahitia te arotake waehere, te arotake mōkihi rānei. He poma arorau kua tunua ki roto i tō pipeline.
Tauira tuturu: An mōkihi npm Kei roto he porowhita mutunga kore huna. Ka pai te haere i ngā tāutanga, engari ka mau te mahara i roto i te whakaputanga tae noa ki te hinganga o tō taupānga. E whakaatu ana tēnei me pēhea te huri o te dosfuscation, e whakakahangia ana e ngā tikanga obfuscation, hei momo huna o ngā momo whakaeke whakakore ratonga tino kino.
Te DoS Noa me te Dosfuscation: Ngā Rerekētanga Tuturu o te Mōrearea
Ko te Dosfuscation he momo whakaeke whakakore-ratonga. He rerekē tēnei i ngā momo whakaeke whakakore-ratonga tuku iho mā te whakahaere ā-roto mā te waehere huna, ehara i te waka whatunga.
Whakaarohia tēnei: Ka whakaaetia e koe tētahi PR i roto i a GitHub. Ka paahitia ngā whakamātautau, ka tīmata te hanga, kātahi ka iri tō kaiwhakahaere. Kei te whakatika koe i tētahi mahi GitHub Actions e kore e angitu, ā, ka mutu te wā. Nā te kawenga i whakararuhia i roto i tētahi whakawhirinakitanga iti i whakauru mai he porowhita mutunga kore i roto tonu i te tuhinga i muri i te tāutanga.
Ina whakaaro ngā kaiwhakawhanake mō te whakakorenga ratonga, ka whakaarohia e rātou he āhuatanga o waho-roto, pērā i te ope tono kino e patu ana i tētahi API, e pau ana rānei te whānui o te whatunga karetao i ngā whatunga. Koinei ngā momo whakaeke whakakorenga ratonga matarohia, ā, kua rite te nuinga o tātou mō ēnei. Kei a tātou ngā WAF, kei te whakamahi i te here tere, ā, kei te hanga i tētahi hanganga tauine ka taea te tango i te pānga.
Heoi, kāore te Dosfuscation e puta mai i waho. Ka honoa tika ki roto i tō pūtake waehere. Ka huna i roto i ngā whakawhirinakitanga, ka uru puku mā roto i te CI. pipelines, ā, e tatari ana kia oti te whakahaere kia pakaru ai ngā mea. Kāore he nui o te whakatikatika pareārai, te DDoS whakaiti ka aukati i te mea kāore e haere mā te whatunga; kua tae kē ki te kāinga.
Nā tēnei ka waiho te dosfuscation hei momo huna o te whakakorenga ratonga. Kāore e whakaatu i a ia anō me te haruru whatunga. Ka whakamatea e ia mai i roto, i te wā hanga, i te wā whakahaere, i te wā rānei e pāngia ai tētahi peka arorau motuhake. Ā, nā te mea kua tanumia ki roto i te waehere mā te whakamahi i ngā tikanga whakapouri matatau, e kore e kitea e koe mēnā kāore koe e rapu hohonu ana.
Koinei te take Ngā tīma DevSecOps me whakaaro ki tua atu i ngā pareparenga ā-rohe. He mea nui anō hoki te haumarutanga o te paparanga tono. Ki te mea ko tō arotahi anake ko te aukati i te haere mai o ngā raraunga kino, ka ngaro i a koe te kawenga e noho ana i roto i tō repo.
Te Whakamahinga a ngā Kaiwhakaeke i te Whakapōrearea hei Huna i te Arorau DoS i roto i te Waehere
Tērā pea ka kite koe i tēnei mahi ina tīmata te roa o te mahi rerenga mahi i te mea i whakaarohia, i te mea kino atu rānei, kāore e oti. Ko tētahi tauira ko te whakahaere a te tīma i ngā whakamātautau i roto i te ipu Docker mā Nga Mahi a GitHubI tāpirihia he āwhina whakamātautau JavaScript iti mā roto i tētahi kōwae tuatoru. I hunaia hei huna i tētahi porowhita tohatoha mahara mutunga kore i kore ai e aro te tukanga pūnga.
He maha ngā wā ka ngaro ngā kawenga DoS kua whakapōreareatia i roto i ngā rerengamahi CI, kāore e kitea. Hei tauira, he GitHub Actions pipeline tērā pea ka whakahaere i tētahi tuhinga āhua kino, ka whakamutua te mahi nā te mea he koropiko mutunga kore kua whakauruhia.
Hei whakamana i tēnei, anei te āhua o tētahi kawenga dosfuscated i roto i te waehere o ia rā.
Tauira JavaScript: Porowhita Mutunga Kore Huna
Ka whakakīia te mahara e tēnei mō ake tonu atu mā te whakamahi i ngā arorau huna, ā, ka mutu ka pakaru te taupānga.
Tauira Python: Poaka CPU Kua Whakapōturitia
Ka oma tonu tēnei porowhita whakawaehere-base64, ka whakakī i te mahara me te kore e ahua whakapae i te tirohanga tuatahi.
Te Wāhi e Huna ai ngā Uta: He Horopaki Whakakore i te Ao Tūturu
He maha ngā wā ka huna ngā kawenga kua whakakōpiritia i roto i ngā kete tuatoru, i ngā kete tuwhera-pūtake rānei, i roto i te tirohanga whānui. pull requests, ngā tuhinga ā-roto rānei ka whakamahia anō me te kore tirotiro. Ka whakawhirinaki ngā kaiwhakaeke ki te tere whanaketanga me te aunoatanga hei mawhiti atu i roto i ngā poma arorau kāore i te kitea, e whakauru ana i roto i tō pipeline.
Mā te horopaki o te ao tūturu ka taea te whakaatu i te āhua o tēnei:
Kei te whakamahi koe i a GitHub Actions hei whakahaere i tō rerengamahi CI. Tō .github/ngā reremahi/hanga.yml ka tāuta i ngā whakawhirinakitanga kaupapa. Ko tētahi o aua mea he mōkihi npm whakawhiti, ehara i te mea nāu i tāuta tika, engari hei whakawhirinakitanga o tētahi whakawhirinakitanga. E kī ana ia ka āwhina i tētahi mea ngāwari, pērā i te whakahaere aho.
Engari kei roto i te kete, e huna ana mā te whakamahi i ngā tikanga whakapōrearea, he poma arorau. Tērā pea he porowhita tohatoha mahara mutunga kore e whakaohohia ana i te wā o te i muri i te tāutanga he tuhinga, he kawemai wā-oma rānei i roto i ō whakamātautau. Ka noho moe tonu tae noa ki te whakatinanatanga, kāore he whakatūpato, kāore he haki arotake.
Kātahi ka pakaru tō CI runner. Ka piki ake te CPU me te mahara. Ka pau te wā mahi. Ka rahua tō hanga, tō whakatinanatanga rānei.
Ehara tēnei i te whakaaro noa iho. Kua kitea kētia ngā āhuatanga pēnei i te ao tūroa. E whakaatu ana ēnei i te whakamahinga a te dosfuscation i te whakawhirinaki ki tō mekameka taputapu, mā te whakamahi i ngā rerengamahi aunoa, ngā hanumi tere, me ngā whakawhirinakitanga ā-kore.
Kei hea te nuinga o te wā e huna ai ēnei utanga?
- Ngā mōkihi tuatoru: inā koa mai i npm, PyPI, Maven rānei.
- Ngā PR pūtake tuwhera: me ngā ariā huna e huna ana hei whakahōunga āwhina.
- Ngā tuhinga ā-roto: ngā wāhanga poto i whakamahia anōtia, kāore he whakamana tika, he arotake tika rānei.
Ka whakamahia e ngā kaiwhakaeke te whakapōrearea hei whakaroa i te kitenga, ka whakawhirinaki ki ngā arotake waehere papaku me ngā whakahōu whakawhirinakitanga aunoa hei mahi i te toenga.
Me pēhea te kite i te Dosfuscation i roto i tō waehere me ngā whakawhirinakitanga
Whakamahia te Tātari Pūmau hei Kimi i te Arorau Tauhou
Whakamahia nga taputapu e:
- Kitea ngā tikanga whakapōrearea pērā i te rere whakahaere kua whakararuraruhia, te hanga anō rānei i ngā aho.
- Tohua he arorau uaua rawa mō ngā kōwae māmā noa iho.
- Whakamāramahia ngā tauira mahi, ngā tauira hōtuhi rānei e rite ana ki ngā momo whakaeke whakakāhore ratonga.
Matawai i ngā Whakawhirinakitanga me te Nui Atu i te Tirotiro Putanga anake
Kaua e mutu te tirotiro i ngā tau putanga:
- Tirohia te waehere tuturu.
- Whakaritea te arotake i ngā whakahoutanga o ngā kete hou.
- Rapua ngā aho kua whakakōnaetia, ngā arorau huna, ngā tohu Dosfuscation rānei.
Arotake ā-ringa i te whakapae Pull Requests
Kia mataara mo:
- Ngā huringa tino uaua i roto i ngā whakahōutanga māmā.
- He arorau pōuri, kāore rānei e taea te pānui i roto i te waehere hou.
- Ngā PR e whakauru ana i ngā tikanga whakapoauau e mōhiotia ana.
Ka puta te pōhēhē ina whakaaro te katoa "he iti noa iho te panonitanga."
Me pēhea te ārai i te pāngia e te mate pāwera CI/CD
I roto i ngā taiao CI pērā i a GitHub Actions, GitLab CI, CircleCI rānei, ko te ārai ko te whakatū i ngā mana whakahaere e kitea ai, e ārai ai hoki i ngā kawenga kua huna i te wā wawe. Hei tauira, whakamanahia ngā arotake PR mō ngā rerengamahi katoa kei roto ngā tuhinga anga, tāuta rānei hooks, me te aroturuki .yml pipeline ngā whirihoranga mō ngā mahi a te hunga tuatoru kāore anō kia manatokohia.
CI/CD he papa tākaro whakararuraru. Anei me pēhea te raka:
- Tāpirihia ngā matawai tūmau ki ia PR me te hanga.
- Whakamahia noa ngā mōkihi mai i ngā puna pono, kua manatokohia.
- Aroturukihia te whakamahinga rauemi hanga; ko ngā pīka he tohu pea nō te arorau huna.
- Tātaitia ia whakawhirinakitanga ki tētahi kua tohua SBOM.
- Āraia te whakamahinga o ngā tikanga huna noa me te kore he take kua tuhia.
Kāore he "tāuta me te tumanako" i muri iho. Ko te tikanga o te ārai he whai guardrails kua whakauruhia ki roto i tō rerenga mahi. Mā te hopu wawe i te dosfuscation ka ārai i ngā momo whakaeke whakakāhore ratonga tino whakararuraru.
Te Tūranga o Xygeni: Te Hopu i te Dosfuscation i mua i te Hanganga
Xygeni Mā te whakauru i ngā mōhiohio haumarutanga puta noa i tō pūnaha ka āwhina i ngā tīma DevSecOps ki te whakamutu i te mahi kino i mua i te wā e kore ai e mahi. tukanga whanaketangaHe tohunga ki te kimi i ngā tikanga huna me te whakatinana i ngā kaupapa here e hangai ana ki guardrails e ārai ana i ngā whakaekenga huna o te whakakore-o-ratonga kei tae atu ki te mahi whakaputa.
I roto i ngā Arotakenga PR
Ka matawai a Xygeni i ngā rerekētanga waehere hei tautuhi i ngā tohu o te whakapoauau pēnei i:
- Tuhinga o mua eval ngā tikanga whakahaere hihiri rite rānei.
- He aho Base64, he aho whakakōnae-ono rānei hei huna i ngā arorau.
- Te rere o te mana whakahaere whakapae, pērā i ngā koropiko tauhou, i te peka arorau uaua rānei.
Ka whakaohohia e ēnei tauira ngā whakatūpato wā-tūturu i te wā pull request ngā arotake, ahakoa he waehere tuatahi, he waehere tuatoru rānei, hei āwhina i ngā kaiarotake haumarutanga ki te hopu wawe i te hapa.
I te wā o te Tātaritanga Whakawhirinakitanga
Ehara i te mea ko ngā raraunga raraunga mōkihi anake ka tātarihia e Xygeni, engari ko te pūtake tūturu o ngā whakawhirinakitanga hou, kua whakahoutia rānei. Ka kitea e ia ngā arorau kua huna i roto i ngā mahi āwhina, i ngā tuhinga whai muri rānei i te tāutanga, ka tohu i ngā mōkihi mōrearea nui ahakoa he āhua tika i te tirohanga tuatahi.
I te Wā Hanga i roto i CI/CD Pipelines
Ka aroturukihia e Xygeni ngā mahi CI mō ngā whanonga rerekē. Mēnā ka pau ohorere te CPU, te mahara rānei i tētahi hanganga, ka whai a Xygeni i te pikinga ki tētahi waehere, ki ētahi mōkihi rānei kua whakaurua mai. Ka hono aunoa i te whanonga wā-oma ki ngā kitenga tūmau hei hopu i ngā kawenga DoS huna i mua i te whakararuraru i te tukunga.
Hei Papa Whakatinana Kaupapahere
Ka taea e koe te whirihora i a Xygeni hei aukati i ngā tauira mōrearea, pēnei i:
- Te aukati i ngā whakawhirinakitanga kei roto ko te waehere kua whakamāorihia ki te base64, eval
- Me whakaae ā-ringa mō ngā tuhinga katoa i muri i te tāutanga
- Te whakatinana i ngā ture kore-manawanui mō te rere o te mana whakahaere pōuriuri i roto i ngā mahi PR, CI rānei
Ki a Xygeni, ka kaha ake te haumarutanga. Mā tēnei ka kitea ngā tīma, ka whakatūpato wawe, ka whakatinanahia hoki ngā kaupapa here ki ngā momo tikanga huna e whakawhirinakihia ana e te dosfuscation. Mā te whakauru i a Xygeni ki ia wāhanga, ngā PR, ngā matawai whakawhirinakitanga, me te wā whakahaere CI, ka hopukina e koe te riri i mua i te noho hei mate i muri i te matenga.
Nō reira, ka hurihia tō waehere e te Dosfuscation ki a koe
Ehara te Dosfuscation i te mōrearea ariā noa iho; he whakaeke tūturu e tipu haere ana, e huri ana i tō tukanga whanaketanga hei patu. Ka tupu pai i roto i ngā āputa i waenga i ngā tukunga tere, ngā tāutanga aunoa, me ngā mekameka whakawhirinakitanga uaua rawa ki te arotake ā-ringa. Ehara tēnei i te take haumarutanga anake; he wero hangarau pūmanawa. Ka karohia e ngā kawenga whakakore-o-ratonga kua whakapōreareatia ngā parepare tuku iho mā te whakauru tika i a rātou ki roto i te waehere, ki ngā wāhi kāore e taea e ngā parepare ahi me ngā tātari waka te toro atu.
Mō ngā kaiwhakawhanake, he māmā noa te kaupapa matua: Ki te tuhi waehere koe, whakaaetia pull requests, whakahaere rānei CI/CD pipelines, ko koe te rārangi mua. Ehara i te mea ko te waehere ma anake ngā hanganga haumaru; me kitea, me tirotirohia, me tiakina hoki e ngā kaupapa here i ia taahiraa o te pipeline.
Neke atu i ngā rārangi arowhai. Whakauruhia te kimi i ngā mea huna ki roto i tō rerenga mahi. Kia mataara ki ngā aho base64, ki ngā arorau rerekē, ki ngā pikinga ohorere rānei i roto i te whakamahinga rauemi CI. Kaua e whakamana noa aha tāuta e koe, engari he aha tana mahi. hamani pipeline ngā whirihoranga pēnei i te waehere whakaputa. Aunoatia ngā mea guardrailsTohua te mea he āhua rerekē, ahakoa "e mahi ana".
Nā te mea kāore te whakamāoritanga e hamama. E tatari ana. Ā, ki te kore koe e rapu ana, ka ngaro atu.
