Umthombo ovulekile usube yisisekelo sokuthuthukiswa kwesofthiwe yesimanje. Cishe zonke izinhlelo zokusebenza namuhla zithembele kuwebhu eyinkimbinkimbi yemitapo yolwazi yangaphandle, izinhlaka, amamodeli, namathuluzi okwakha. Leli qiniso lodwa selivele lethula okubalulekile software supply chain security izinselele. Ngesikhathi esifanayo, ubuhlakani bokwenziwa bungene isoftware yokuthuthukisa impilo njenge-accelerator enamandla, ekhiqiza ikhodi, ephakamisa ukuncika, elungisa ngokuzenzakalelayo, futhi ethonya ngisho nokwakheka kwezakhiwocisions. Ngokubambisana, umthombo ovulekile kanye ne-AI kushintshe indlela isofthiwe eyakhiwe ngayo, kanye, ngokungenakugwenywa, nendlela ehlaselwa ngayo. Ukuhlangana kokuphepha kwe-AI, i-AI kanye nokuphepha kwesofthiwe, kanye software supply chain security akuseyona inkolelo-mbono. Manje sekungomunye wemithombo emikhulu yengozi yokuhlinzekwa kwesofthiwe ebhekene nezinhlangano zobunjiniyela.
Lelo qiniso lasungula i-SafeDev Talk yethu yakamuva: Umthombo Ovulekile, i-AI kanye Nobuso Obusha Bokuhlasela: Ikhodi Ehlomile, Ukuzivikela Okuhlakaniphile, equkethe abaholi bezokuphepha abavela ku-Red Hat, TikTok, kanye ne-Xygeni. Ingxoxo igxile kulokho amaqembu ezokuphepha kanye nobunjiniyela asevele ebhekene nakho ezindaweni zokukhiqiza, ikakhulukazi mayelana nokuhlaselwa kwe-open source supply chain, amaphakheji e-open source anonya, kanye nokungezwani okukhula phakathi kwesivinini kanye nokulawula ekuthuthukisweni kwesofthiwe eqhutshwa yi-AI. Okuvele kwaba isithombe esicacile: indawo yokuhlasela ikhula ngokushesha kunokuba amamodeli okuphepha endabuko angaqhubeka, futhi i-AI isebenza kokubili njengesiphindaphindi samandla kanye nokuhlolwa kokucindezeleka kokuqagela kwesikhathi eside ekuphepheni kwe-AI kanye software supply chain security.
Uma le ncazelo izwakala ingakhululekile ngendlela inhlangano yakho eyakha ngayo isofthiwe njengamanje, lokho akuyona into eyenzeka ngengozi. Amaqembu amaningi aqaphela kuphela ukuthi ukwethembana kushintshe kangakanani kwaba okuzenzakalelayo ngemva kokuthi okuthile kuphukile.
Ukuphepha kwe-AI kanye Software Supply Chain Security Ingabe Manje Sesiyinkinga Efanayo?
Isihloko esiphindaphindayo kuyo yonke ingxoxo kwakuwukuthi ukuphepha kwe-AI akusakwazi ukubhekwa njengomkhakha ohlukile ku- software supply chain securityIzinhlelo ze-AI azisebenzi zodwa; zakhiwe, zaqeqeshwa, zasetshenziswa, futhi zahlanganiswa ngendlela efanayo pipelineama-s, ukuncika, kanye nama-registry asevele ebhekene nokuhlaselwa kwe-open source supply chain.
Ekuthuthukisweni kwesofthiwe eqhutshwa yi-AI, amamodeli aphakamisa ikhodi, akhiqize izilungiso, futhi akhethe ukuncika ngokuzenzakalelayo.cisama-ion athinta ngqo ukuphathwa kokuthembela komthombo ovulekile, ngokuvamile ngaphandle kwenhloso yomuntu ecacile. Ngenxa yalokho, ingozi yokuncika ayisaqhutshwa kuphela ukukhetha konjiniyela; ibunjwa kakhulu ukuziphatha kwe-AI.
Lokhu kuhlangana kusho ukuthi ukwehluleka ku-AI kanye nokuphepha kwesofthiwe kuvame ukubonakala njengezehlakalo zendabuko zochungechunge lokuhlinzekwa: ukuncika okuphazamisekile, izinto zokwakha ezingcolisiwe, noma ukusengozini CI/CD izinqubo. Amathuluzi angase abe masha, kodwa ingozi yochungechunge lokuhlinzekwa kwesofthiwe ingokoqobo kakhulu futhi kunzima ukuyicabanga.
Uma amamodeli akho osongo esahlukanisa "ingozi ye-AI" "nengozi yochungechunge lokuhlinzekwa," kungakuhle ukuphinda uhlole ukuthi lowo mngcele ukhona kuphi ngempela emisebenzini yakho yokwakha nokusabalalisa.
Ukuhlaselwa Kwe-Open Source Supply Chain Ngesivinini Somshini
Ukuhlaselwa kwe-open source supply chain akukusha, kodwa i-AI ishintsha ezomnotho zabo. Abahlaseli abadingi amasu amasha; badinga ubukhulu. I-AI ivumela ukuhlaziywa okusheshayo kwe-ecosystem, ukutholakala okuzenzakalelayo kokuxhomekeka okubuthakathaka, kanye nokuphindaphinda okusheshayo kwemithwalo yokuhlaselwa.
Ngokombono wokuhlasela, lokhu kuthuthukiswa kwezimboni kokuhlola kukhulisa kakhulu izinga lempumelelo lokuhlasela okubandakanya amaphakheji omthombo ovulekile ononya. Izingxenye ebezingeke zibonwe ngaphambilini manje zingatholakala, zihlaziywe, futhi zisetshenziswe ngokushesha, ngokuvamile ngaphambi kokuba abavikeli baqaphele ukuthi ziyasetshenziswa.
Yingakho software supply chain security Awukwazi ukuthembela ezimpawini ezibambezelekile zodwa. Ukubhaliswa, izeluleko, kanye nokudalulwa kwangemva kweqiniso kusebenza ngokwezikhathi zabantu, kuyilapho abahlaseli beqhubeka nokusebenza ngesivinini somshini. Iwindi lokudalulwa elivelayo linomthelela oqondile ekwandeni kwengozi yokunikezwa kwesoftware.
Uma isignali yakho eyinhloko yokuthola ithi “irejista isuse iphakheji,” usuvele usebenza ngaphansi komugqa wesikhathi womhlaseli.
Ufuna Ukuzicwilisa Ngokujulile Ekuhlaselweni Kwe-Open Source Software Supply Chain?
Ingozi Yokuthembela Ekuthuthukisweni Kwesofthiwe Eqhutshwa Yi-AI
Enye yezingozi ezicacile okuxoxwe ngazo ngesikhathi se-SafeDev Talk kwakuwubungozi bokuthembela, ikakhulukazi ezindaweni ezithembele kakhulu ekuthuthukisweni kwesofthiwe eqhutshwa yi-AI. Abasizi bokubhala amakhodi be-AI balungiselelwe ukuze kube lula futhi kusheshe, hhayi ukuze kuncishiswe indawo yokuhlasela.
Empeleni, lokhu kuholela ekwethulweni kokuthembela okunamandla. Imitapo yolwazi emisha iyengezwa esikhundleni sokusebenzisa kabusha ukusebenza okukhona, ukuncika okuguquguqukayo yandisa buthule, futhi uthole umthombo ovulekile ukuphathwa kokuncika iba yinto esabelayo kunokuba ibe ngamabomu. Ngokuhamba kwesikhathi, amaqembu alahlekelwa ikhono lokucabanga ngalokho akwenzayo ngempela.
Lokhu akuyona nje inkinga yokuhlanzeka. Ukuthembela ngakunye okusha kwethula ingozi eyengeziwe yochungechunge lokuhlinzekwa kwesofthiwe, izinkolelo ezintsha zokuthembana, kanye namathuba amasha okuhlaselwa kochungechunge lokuhlinzekwa kwemithombo evulekile.cisama-ion azenzekela futhi abuyekezwe ngokunganaki, ingozi yokuncika iba yinto ehlelekile kunokuba ibe ngengozi.
Uma igrafu yakho yokuthembela ikhula ngokushesha kunekhono leqembu lakho lokuyichaza, lokhu akuyona inkinga yokusebenzisa amathuluzi; kuyinkinga yokuthembela.
Abasizi Bokubhala Amakhodi be-AI, Ezokuphepha, kanye Nokubhidlika Kokubuyekezwa
Enye indlela yokwehluleka okuxoxwe ngayo kwaba ukuwohloka kokubuyekezwa kontanga lapho kukhona ikhodi ekhiqizwe yi-AI. Abasizi bokubhala amakhodi be-AI, ukuphepha akukhona nje ukujova ngokushesha noma ukusetshenziswa kabi kwemodeli; kumayelana nokuthi ingakanani i-logic engakabuyekezwa efika ezinhlelweni zokukhiqiza.
Izinguquko ezikhiqizwe yi-AI zivame ukuba zikhulu, ziqondakale, futhi kunzima ukuzibuyekeza ngaphansi kwengcindezi yesikhathi. Ngenxa yalokho, ukubuyekezwa kontanga kuba okungajulile noma okungokomfanekiso. Lokhu kuwa okuthule kususa enye yezilawuli ezisebenza kahle kakhulu ku software supply chain security.
Inkinga akuyona ukunganaki konjiniyela. Kuwukungahleleki kahle komsebenzi. Lapho isivinini sivuzwa futhi ukungqubuzana kujeziswa, izilawuli zokuphepha ze-AI kanye nesofthiwe ezincike ekunakweni kwabantu ziyancipha ngokungenakugwenywa. Abahlaseli akudingeki badlule ekubuyekezweni uma ukubuyekezwa kungasasebenzi njengesithiyo.
Amaqembu amaningi acabanga ukuthi ukubuyekezwa kusasebenza ngoba inqubo ikhona. Bambalwa ababuza ukuthi ngabe kusasebenza njengokulawula okunenjongo.
Amaphakheji Omthombo Ovulekile Ononya kanye Nenganekwane Yokuthandwa
Inkolelo evamile ekuphathweni kokuthembela emthonjeni ovulekile ukuthi amaphrojekthi athandwayo aphephile. Eqinisweni, ukuthandwa kuvame ukwandisa ukuvezwa. Imitapo yolwazi esetshenziswa kabanzi iyizinhloso zenani eliphezulu ukuhlaselwa kochungechunge lokunikezwa kwempahla oluvulekile, ngobacisngoba ukuvumelana kuveza umthelela omkhulu ongezansi.
Amaphrojekthi amaningi athandwayo agcinwa amaqembu amancane noma abantu abangabodwa. Ngisho noma kutholwa izinkinga, amaphakheji omthombo ovulekile ononya avame ukuhlala etholakala amahora noma izinsuku ngaphambi kokususwa. Phakathi naleso sikhathi, izinhlangano ziyaqhubeka nokuzigwinya ngokwakha okuzenzakalelayo.
Lokhu kubambezeleka kuqinisa isidingo sokuthatha isinyathelo ngokushesha software supply chain security Izilawuli. Ukuthembela ekuthandweni, idumela, noma isenzo sokubhalisa kuphela akwanele uma ubhekene nengozi yesimanje yochungechunge lokuhlinzekwa kwesofthiwe.
“Ukusetshenziswa kabanzi” akufani nokuthi “ukuvikelwa ngenkuthalo,” futhi ukuphatha kanjalo kungenye yemibono eyiphutha kakhulu yochungechunge lokuhlinzekwa kwempahla.
Imvelaphi Emigqeni Yokunikezwa Kwesofthiwe kanye Nokuphepha Kwe-AI
Kuyo yonke ingxoxo, isidingo sokuvela kwezinhlelo zokuhlinzeka ngesofthiwe sivele ngokuphindaphindiwe. Ezindaweni ezisizwa yi-AI, ukuchazwa kuyafiphala. Ikhodi ingadalwa imodeli, iguqulwe ngumuntu, ihlanganiswe ngokuzenzakalelayo, futhi isetshenziswe ngaphandle kokuziphendulela okucacile.
Ngaphandle kobufakazi obuqinisekisiwe, izinhlangano ziphoqeleka ukwethemba izinto zobuciko ngokungaqondile. Ukuphepha kwe-AI kudinga ukushintshela ekuthembekeni kuye ekuqinisekisweni: izinto zobuciko ezisayiniwe, build attestations, kanye nemvelaphi elandelekayo. Nakuba imvelaphi ingavimbeli ukuziphatha okunonya ngokuqondile, kunciphisa kakhulu ukungaqondakali futhi kunciphisa ukukwazi komhlaseli ukuhamba.
Lokhu kusebenza ngokulinganayo kumamodeli, idatha, kanye nekhodi. Ekuthuthukisweni kwesofthiwe eqhutshwa yi-AI, ukuvela kuyimfuneko eyisisekelo kokubili ukuphepha kwe-AI kanye nesofthiwe.
SBOM kanye nokuphepha kwe-AI kwesimanje Pipelines
Indima SBOM futhi ukuphepha kwe-AI kwakungenye indaba engacacile. SBOMs inikeza ukubonakala kumagrafu okuncika, kodwa ukubonakala kukodwa akwanele. Ezindaweni ezigcwele i-AI, SBOMs kumele zithuthuke ukuze zibambe hhayi nje kuphela imitapo yolwazi, kodwa namamodeli, izinyathelo zokwakha, kanye nohlelo oluzenzakalelayocisions.
Uma ihlanganiswe ne- ukuhlaziywa kokuziphatha kanye nemvelaphi, SBOM kanye nokuphepha kwe-AI kuba amathuluzi anamandla okunciphisa ingozi yochungechunge lokuhlinzekwa kwesofthiwe. Zivumela izinhlangano ukuthi zithole izinguquko ezingalindelekile, zicabange ngomthelela, futhi ziphendule ngempumelelo kakhulu ekuhlaselweni kochungechunge lokuhlinzekwa kwemithombo evulekile.
CI/CD Pipeline Security Ngaphansi Kokucindezela Okuzenzakalelayo
Ekugcineni, CI/CD pipeline security kwavela njengendiza yokulawula ebalulekile. Pipelinezenza izenzo eziphakanyisiwe noma eziqalwe izinhlelo ze-AI. Uma lezo pipelineNjengoba zintula ukulawula okuqinile kobunikazi, ukuqinisekiswa kwezinto ezenziwe ngezinto, kanye nokuqiniswa kwenqubomgomo, ziba izindawo ezifanele zokungena zabahlaseli.
Ayenele CI/CD pipeline security ivumela amaphakheji omthombo ovulekile anobungozi ukuthi angathinti izinhlelo zokukhiqiza kuphela kodwa futhi nezindawo zonjiniyela futhi akhe ingqalasizinda. Njengoba ukwenza ngokuzenzakalelayo kukhula, pipelinekumele ziphathwe njengezimpahla ezinenani eliphezulu ngaphakathi software supply chain security izinhlelo.
Bukela i-SafeDev Talk
Ukuze uzwe kabanzi ngazo zonke lezi ziqondiso ngqo ezivela kochwepheshe ababumba lo mkhakha, bukela konke Ingxoxo ye-SafeDev: Umthombo Ovulekile, i-AI kanye Nobuso Obusha Bokuhlasela: Ikhodi Ehlomile, Ukuzivikela Okuhlakaniphile, feat URoman Zhukov (Isigqoko Esibomvu), ULeon Johnson (TikTok), Futhi U-Luis Rodríguez Berzosa (Xygeni).
Imiphumela Esebenzayo Yokuphepha Kwe-AI kanye Software Supply Chain Security
Imiphumela esebenzayo yalezi zinguquko idlulela ngale kwamathuluzi. Izinhlangano kumele ziqaphele ukuthi ukuphepha kwe-AI, i-AI kanye nokuphepha kwesofthiwe, kanye software supply chain security manje sezixhumene kakhulu.cisama-ion ayebhekwa njengengozi ephansi, izibuyekezo zokuxhomekeka, ukukhiqizwa kwekhodi, kanye nokwenza izinto ngokuzenzakalela manje anengozi ebalulekile yochungechunge lokuhlinzekwa kwesofthiwe, ikakhulukazi uma lawocisama-ion enziwa ngokungaqondile ngamathuluzi kunokuba enziwe ngokusobala ngabantu.
Ngesikhathi se-SafeDev Talk, leli phuzu lafingqwa kafushane. Njengoba esinye isikhulumi sasho, lapho izinhlelo ze-AI zihlanganyela ekuthuthukisweni kwesofthiwe, amaqembu okuphepha awasagcini nje ngokuvikela ikhodi; avikela i-decisama-ion. Ukuzenzakalela akususi umthwalo wemfanelo; kuyawusabalalisa kabusha.
Empeleni, lokhu kusho ukubuyisela inhloso lapho kulula khona. Ukuphathwa kokuthembela komthombo ovulekile kumele kubhekele ukuziphatha okuqhutshwa yi-AI kunokuthatha izinqumo zabantu. Ingozi yokuthembela ayisakwazi ukubhekwa njengokuhlolwa ngezikhathi ezithile.cise. CI/CD pipeline security kumele kuphoqelelwe ukuqinisekiswa, hhayi ukucabanga ukuthi kukhona okufakwayo okungenangozi. Futhi imvelaphi yezinhlelo zokuhlinzeka ngesofthiwe kumele isuke ekufisweni iye ekusekelweni.
Okunye ukuqonda okuvela engxoxweni ukuthi isivinini ngokwaso asisathathi hlangothi. Ukwehluleka okuningi kochungechunge lokuhlinzeka ngempahla akuveli enhlekeleleni eyodwacisi-ion, kodwa kusukela ezinqumweni eziningi ezincane ezizenzakalelayo okungekho muntu owazivuma ngokucacile. Lokhu kungaphambicisKusobala ukuthi kungani amamodeli endabuko okuthembela ehluleka ngaphansi kokuthuthukiswa kwesofthiwe eqhutshwa yi-AI.
Akukho kulokhu okusho ukulahla umthombo ovulekile noma i-AI. Ngokuphambene nalokho, kuyayiqaphela indima yabo ebalulekile kubunjiniyela besimanje. Kodwa ngaphandle kokushintsha kwemibono yezokuphepha, izinhlangano zibeka engcupheni yokuvumela ukuthi okuzenzakalelayo kuchaze ukwethenjwa ngokuzenzakalelayo.
Ukuphetha…
Indlela ewusizo yokucabanga ngalolu shintsho ukuthi software supply chain security akusekho mayelana nokuvikela izinto zobuciko kuphela. Kumayelana nokuvikela decisizindlela ze-ionEzweni elisizwa yi-AI, imibuzo ebaluleke kakhulu yokuphepha akuyona nje kuphela ukuthi “Ingabe lesi sici sisengozini?” kodwa nokuthi “Kungani lokhu kwethulwe, ngubani noma yini, futhi ngaphansi kwaziphi imikhawulo?” Izinhlangano ezizivumelanisa nalolu hlaka ngeke ziqede ubungozi, kodwa ngeke zimangele kangako ngakho.
