Tristan 和 Levent Alpoge 发布了三项重要成果，证明了 incompressible porous media equation 、 Boussinesq equations 和 3D incompressible Euler equations 出现 finite-time blowup 的例子。研究通过引入 smooth forcing 实现，所用策略继承并发展了 Diego Córdoba 与 Luis Martínez-Zoroa 最初提出的核心思想。作者们强调，这是一项纯粹的个人合作，独立于他们各自的机构，并在很大程度上依赖多种大型语言模型（包括 Claude 、 Codex 和 Astra）来推进 Córdoba-Martínez-Zoroa program 的完成。

借助 AI 完成这些证明的过程漫长且充满挑战。大部分时间进展缓慢，直到八月中旬出现突破，最终又用 Lean proof assistant 对结果进行了验证。尽管在数学上取得了成功，作者对在巨大压力下发布的预印本的呈现质量表示遗憾。他们认为，这项工作的真正意义在于展现了人在压缩时间内与 AI 协同开展高水平数学研究的可能性——这一点值得学界就培训、署名和人类注意力在科研中的价值等问题进行深入而冷静的讨论。

关于与 OpenAI 的接触，叙述出现了令人不安的转折。据传一款内部 OpenAI 模型也解决了一个重大悬而未决的问题——尤其是 Navier-Stokes 的 forced blowup——Tristan 因此与包括 Sebastien Bubeck 在内的 OpenAI 代表进行了交流。对话中透露，OpenAI 有一个完整团队在攻关，投入了大量算力，而且该内部模型的成果并非像最初所暗示的那样仅靠极少的人为干预。此外，该模型成功的时间点似乎与外界流传的关于作者自身进展的消息相吻合。

讨论中有人建议作者将 Euler 的结果与 OpenAI 关于 Navier-Stokes 证明的公告同时发布，甚至提出因 Levent 在 Anthropic 工作而将其从作者名单中移除。作者拒绝这些提议后，局势变得紧张，并出现可能影响他们职业声誉的暗示性言辞。

作者强调他们并未指控任何具体的不当行为，因为他们并未见过 OpenAI 的证明，也不清楚自己的数据是否被使用。公开此事的目的是维护历史记录的准确性，防止错误叙述流布。研究人员希望将讨论重心重新拉回到数学本身，以及这些工具对更广泛学术界可能带来的变革性影响。 Tristan and Levent Alpoge have released three significant mathematical results concerning finite-time blowup for the incompressible porous media equation, the Boussinesq equations, and the 3D incompressible Euler equations. These findings were achieved using smooth forcing, a strategy building upon foundational ideas originally proposed by Diego Córdoba and Luis Martínez-Zoroa. The researchers highlight that this work was a purely personal collaboration, independent of their respective institutional affiliations, and relied heavily on the use of various large language models, including Claude, Codex, and Astra, to push the Córdoba-Martínez-Zoroa program to completion.

The process of utilizing AI for these proofs was lengthy and challenging. Progress remained slow for much of the year until a breakthrough occurred in mid-August, leading to the verification of the results via the Lean proof assistant. Despite the mathematical success, the authors express regret regarding the presentation quality of their preprints, which were produced under significant pressure. They emphasize that the true significance of this endeavor lies in the capability for humans and AI models to collaborate on high-level mathematical research in a compressed timeframe, a development that warrants a deep, unhurried discussion within the scientific community regarding the future of training, credit, and the value of human attention in research.

The narrative takes a troubling turn regarding interactions with OpenAI. Following rumors that an internal OpenAI model had also solved a major open problem—specifically, forced blowup for Navier-Stokes—Tristan engaged in discussions with representatives from the company, including Sebastien Bubeck. During these conversations, it was revealed that an entire team at OpenAI had been working on the problem, that significant compute resources were deployed, and that the internal model's effort was not the result of minimal human input as initially suggested. Furthermore, the timing of the model's success appeared to coincide with the circulation of news regarding the authors' own progress.

During these discussions, proposals were made to the authors, including suggestions that they post their Euler results alongside an OpenAI announcement of the Navier-Stokes proof, and that Levent be removed from authorship due to his employment at Anthropic. When these offers were declined, the situation grew contentious, with implications made regarding the authors' professional reputations.

The authors maintain that they are not accusing anyone of specific wrongdoing, as they have not seen OpenAI's proof and do not know if their own data was utilized. The purpose of coming forward is to ensure that the historical record remains accurate and to prevent false narratives from taking hold. Ultimately, the researchers express a desire to shift the conversation back toward the mathematics and the transformative potential of these tools for the wider academic community.

Albanese Government 已提交名为 Digital Duty of Care 的草案，标志着对网络环境进行监管的重要一步。该举措拟通过为数字服务提供商设定强制性的最低平台标准，把确保用户获得更安全体验的责任转移给服务提供商。提案的核心是 My Feed, My Way 倡议，赋予 Australians 对社交媒体算法的控制权。

根据该计划，社交媒体平台须告知用户可选择的默认信息流偏好。用户可以选择接受个性化算法推荐的信息流，也可以选择退出，仅查看自己主动关注的创作者和朋友发布的内容。此举通过限制自动推荐的影响，赋予用户更大的在线体验自主权。

立法适用范围不仅限于社交媒体，还涵盖在线游戏、各类应用程序以及 AI 聊天机器人。数字服务提供商在法律上须保护 18 岁以下用户，防止采用已知会产生负面影响的设计机制，例如令人上瘾的功能或损害自尊的元素。平台还必须采取防护措施，阻止未成年人接触有害内容，包括宣扬饮食失调的材料、色情内容、带有敌意的基于性别的观念，以及美化危险行为或自残的内容。

为确保问责，法律草案授权 eSafety Commissioner 负责监管合规并执行新标准。这包括发布针对有害应用或网站的移除通知，并简化处理网络欺凌和成人网络虐待的既有流程。平台需详尽记录其风险缓解策略，并确保这些保护措施在实施后持续有效。

未能遵守新标准将面临严厉后果，最高罚款可达 1.092 亿美元。政府正与行业组织、公民社会团体及数字平台进行定向磋商，以完善这些措施。通过该倡议，Albanese Government 希望建立一个强有力的框架，要求数字产品达到基本安全标准，并将其与对汽车或食品等实体商品的保护相提并论。该立法预计将在今年晚些时候提交 Parliament 。 The Albanese Government has introduced draft legislation for a Digital Duty of Care, marking a significant step toward regulating online environments. This initiative aims to shift the responsibility onto digital service providers to ensure safer experiences for users by setting mandatory minimum standards for their platforms. A centerpiece of this proposal is the My Feed, My Way initiative, which empowers Australians to take control of their social media algorithms.

Under the proposed My Feed, My Way scheme, social media platforms will be required to notify users of their right to choose their default feed preferences. Users will have the option to opt in to a feed curated by personalized algorithms or, alternatively, opt out to view only the content posted by the creators and friends they actively choose to follow. This move is designed to grant users greater agency over their online experience by limiting the influence of automated recommendations.

The legislation extends its reach beyond social media to encompass online games, various apps, and AI chatbots. Digital service providers will be legally required to protect users under 18 from design features known to negatively impact behavior, such as addictive functions or elements that undermine self-esteem. Furthermore, these platforms must implement safeguards to prevent minors from accessing harmful content, including material promoting eating disorders, pornography, hostile gender-based ideas, or content that glorifies dangerous acts and self-harm.

To ensure accountability, the draft laws empower the eSafety Commissioner to manage compliance and enforce new standards. This includes the authority to issue removal notices for harmful apps or websites and to streamline existing processes for addressing cyber-bullying and adult cyber abuse. Platforms will be expected to thoroughly document their risk mitigation strategies and ensure these protections remain effective over time.

Failure to adhere to these new standards carries significant consequences, with potential penalties reaching as high as 109.2 million dollars. The government is currently engaging in targeted consultation with industry bodies, civil society organizations, and digital platforms to refine these measures. With this initiative, the Albanese Government intends to establish a robust framework that mandates basic safety standards for digital products, drawing a comparison between the protections currently afforded to physical goods like cars or food. The legislation is expected to be introduced to Parliament later this year.

Mistral AI 在 D 轮融资中获得了 30 亿欧元，这是该公司三年前成立以来，欧洲科技公司规模最大的一笔股权融资。本轮由 Samsung Electronics 领投，Scaleup Europe Fund 和现有投资者 PSG Equity 参投，投后估值超过 210 亿欧元。所募资金将用于加强前沿研究、扩充计算能力，并加速在其已进入的 20 个国家的商业与国际化扩展。

公司正将自己定位为主权 AI 转型的领军者，以满足政府和大型企业在不放弃对基础设施或数据控制权的前提下使用人工智能的需求。随着组织不再仅仅追求最强大的模型，而更关注避免长期依赖与供应商锁定，它们越来越重视自主可控。 Mistral 强调自己是唯一提供全栈解决方案的厂商，涵盖开放权重模型、私有计算能力和可投入生产的工具，从而保障用户的独立性与灵活性。

Mistral 的价值主张核心是主权 AI 层，优先把控四个关键维度：将数据留在组织边界内、确保模型可定制且可控、维持可预测且私有的计算环境、以及提供全面可审计的系统。该架构旨在使机构能够在复杂且关乎任务的环境中（如制造业和重工业）集成最先进的 AI，而不会将敏感的机构知识或工作流程暴露给外部方。

本轮融资得到了来自欧洲、亚洲和北美的多元化战略与金融投资者财团的有力支持。吸引 Samsung Electronics 和 ASML 等行业巨头参与，表明 Mistral 的技术特别契合高级工程与工业应用的需求。这类机构级背书也体现出市场对其提供可行主权替代方案的广泛信心，确保客户在数字智能上保持决策权。 Mistral AI has reached a significant milestone by securing 3 billion euros in a Series D funding round, marking the largest equity fundraising event for a European technology firm since the company's inception three years ago. This round, led by Samsung Electronics and joined by the Scaleup Europe Fund and existing investor PSG Equity, brings the company's post-money valuation to over 21 billion euros. The capital infusion is intended to bolster the company's frontier research, expand its compute capacity, and accelerate its commercial and international growth across the 20 countries where it currently operates.

The company is positioning itself as a leader in the shift toward sovereign AI, addressing a growing demand among governments and large enterprises to utilize artificial intelligence without sacrificing control over their infrastructure or data. As organizations move past the initial phase of simply seeking the most powerful model, they are increasingly focused on avoiding the long-term dependencies and vendor lock-in associated with traditional AI deployments. Mistral emphasizes its role as the only provider offering a full-stack solution, which includes open-weight models, private compute capacity, and production-ready tools that allow for independence and flexibility.

Central to Mistral's value proposition is the concept of a sovereign AI layer, which prioritizes four key dimensions of control: keeping data within organizational boundaries, ensuring models remain customizable and controllable, maintaining predictable and private compute, and providing fully auditable systems. This architecture is designed to allow institutions to integrate state-of-the-art AI into complex, mission-critical environments, such as those in manufacturing and heavy industry, without exposing sensitive institutional knowledge or workflows to external parties.

The funding round reflects a strong endorsement from a diverse syndicate of strategic and financial investors spanning Europe, Asia, and North America. By attracting backing from industry giants like Samsung Electronics and ASML, Mistral is signaling that its technology is uniquely suited for the requirements of advanced engineering and industrial applications. This institutional support highlights a broad confidence in the company's mission to provide a viable, sovereign alternative to the dominant AI frameworks, ensuring that customers retain agency over their digital intelligence.

最近发布的 GLM 5.3-flash 是一款开源权重的大型语言模型，能在消费级硬件上快速且低成本运行，这打开了一个关键的脆弱性窗口。因为该模型可以被修改以移除安全防护，任何在硬件上有少量投入的人现在都能部署一个强大且无约束的工具，用来实施复杂的网络攻击。这使风险从理论上的可能性变成了迫在眉睫的现实威胁，恶意活动可以被大规模自动化。

危险在于模型的可及性与其在网络安全任务上出色性能的叠加。基准测试显示，GLM 5.3-flash 在识别并利用现实世界漏洞方面表现优异，几乎把先进的自动化黑客能力交到了任何人手中。尽管 Project Glasswing 和 Daybreak 等项目正尝试用前沿模型修补安全缺陷，但核心难题仍是如何在分散且常为遗留系统的基础设施中迅速部署这些补丁。

事态需要紧急应对，因为攻击者的推进速度已快于防御方。政府和监管机构应将重心从仅仅发现漏洞转向强制并激励补丁的实际部署。政策应优先支持基于风险的定期渗透测试，并对关键基础设施——例如电网、金融系统和电信——实施更严格的安全标准。单靠对模型或硬件的禁令很可能无效且适得其反，因为技术无可避免地会扩散。

企业和开源基金会应把这视为利用前沿 AI 强化防御、全面改造安全态势的良机。这需要超越手工安全流程，采用结构化提示、自动化测试和形式化验证来加速修补周期。应赋能内部安全工程团队，优先进行漏洞的筛选与补丁部署，确保在漏洞被自动化代理利用前得到修复。

最后，组织需建立健全内部控制，例如沙箱隔离、限定权限的凭证和纵深防御，以防自有防御代理成为事故源。逐步放弃内存不安全的语言、全面清点依赖项并演练快速的事件恢复，都是必要步骤。即便对当前威胁持怀疑态度的人，也应看到这些措施代表了网络安全必须尽快实现的进步，应在机会窗口关闭前付诸行动。 The recent release of GLM 5.3-flash, an open-weight large language model that is both fast and cheap to run on consumer hardware, has created a critical window of vulnerability. Because the model can be modified to remove safety safeguards, anyone with a modest investment in hardware can now deploy a powerful, unconstrained tool capable of performing sophisticated cyberattacks. This capability moves the needle from theoretical risk to an imminent, real-world threat where malicious activities can be automated at scale.

The danger lies in the combination of the model's accessibility and its high performance in cybersecurity tasks. Benchmarks indicate that GLM 5.3-flash is highly proficient at identifying and exploiting real-world vulnerabilities, effectively putting the power of advanced, automated hacking into the hands of virtually anyone. While existing initiatives like Project Glasswing and Daybreak have been working to patch security flaws using frontier models, the core challenge remains the slow and difficult process of deploying those fixes across fragmented, often legacy, infrastructure.

Urgency is required to address this landscape, as attackers are currently advancing faster than defenders. Governments and regulatory bodies should shift their focus toward mandating and incentivizing the actual deployment of patches, rather than just the identification of vulnerabilities. Policy should prioritize frequent, risk-based penetration testing and enforce stricter security standards for critical infrastructure, such as power grids, financial systems, and telecommunications. Relying on bans for models or hardware is likely to be ineffective and counterproductive, as the technology will inevitably proliferate regardless of such measures.

Companies and open source foundations must treat this as a prime opportunity to overhaul their security posture by leveraging frontier AI as a defensive tool. This involves moving beyond manual security practices and utilizing structured prompts, automated testing, and formal verification to accelerate the patching cycle. Internal security engineering teams should be empowered to prioritize the triage and deployment of fixes, ensuring that vulnerabilities are addressed before they can be exploited by automated agents.

Finally, organizations need to implement robust internal controls, such as sandboxing, scoped credentials, and defense-in-depth, to prevent their own defensive agents from becoming vectors for incident creation. Moving away from memory-unsafe languages, maintaining thorough inventories of dependencies, and practicing rapid incident recovery are essential steps. Even for those skeptical of the immediate threat level, these measures represent a long-overdue advancement in collective cybersecurity that must be acted upon before the window of opportunity closes.

自 2024 年初 Google 调整政策以来，独立维基托管项目遇到了重大障碍。该政策事实上把许多新建独立网站置于所谓的"Google Jail"状态：除站点主页外，几乎所有新域名下的页面都无法出现在搜索结果中。对于高度依赖搜索流量的项目而言，影响十分严重。

这种限制自 2024 年 3 月以来，似乎影响了近 90% 在新域名上启动的维基。该现象不同于普通的重复内容问题，无论内容是原创，还是从 Fandom 等平台迁移过来，都同样会被屏蔽。即便维基的主页能击败竞争对手取得较好排名，搜索引擎仍然不展示其子页面。这种"悬置"状态可能持续数月甚至接近一年，虽然在站点活跃度高或围绕维基主题发生重大新闻时，情况有时会缓和。

技术证据表明，Google 可能为打击低质量 SEO 做法，对新域名施加了较为严厉的过滤规则。有趣的是，当项目作为已有信誉的域名的子域名托管时，这个问题就消失了——即使流量不高，子域名也能避免困扰独立域名的索引封锁。这种差异迫使托管方重新考虑将社区从大型维基平台迁出的策略。

面对现状，托管组织在可见性与品牌独立性之间权衡。一个可行的做法是将新项目以子域名形式部署在已有基础设施上，以维持搜索引擎的信任，尽管这会带来品牌识别方面的问题。虽然这不是长久之计，但能作为可行的权宜之策，确保用户可访问这些维基。

最终目标仍是等到网站在搜索引擎中获得足够权威和信任后，再迁回独立根域名。组织者希望通过重定向策略和正式的地址变更工具，保留在子域名期间积累的搜索排名。与此同时，社区仍在寻求对此现象的更多澄清，以更好地评估这类搜索引擎政策对独立网络长期影响。 Independent wiki hosting initiatives have recently encountered a significant hurdle following a policy shift by Google in early 2024. This change has effectively relegated many new, independent websites to a state often referred to as Google Jail. For these projects, which often rely on search traffic for the vast majority of their visitors, the impact is severe. Specifically, Google has been preventing almost all pages on brand-new domains from appearing in search results, with the notable exception of the site's main page.

This restrictive behavior appears to affect nearly 90 percent of wikis launched on new domains since March 2024. The phenomenon is distinct from standard duplicate content issues, as it persists regardless of whether the content is original or migrated from existing platforms like Fandom. Even when a wiki's main page successfully outranks its competition, the search engine still refuses to display sub-pages. This state of limbo can last for months, or even up to a year, though it sometimes dissipates during periods of significant site activity or major updates related to the wiki's subject matter.

The technical evidence suggests that Google implemented this measure to combat low-quality SEO practices by applying heavy-handed filters to new domains. Interestingly, this problem vanishes when a project is hosted as a subdomain of an already established, reputable domain. Even without high traffic, these subdomains avoid the indexing blockade that plagues fresh, standalone web addresses. This discrepancy has forced hosting providers to rethink their strategy for migrating communities away from large wiki farms.

Moving forward, hosting organizers are weighing a difficult set of compromises to ensure their wikis remain visible. One approach involves launching projects as subdomains of established infrastructure to maintain search engine trust, despite the branding issues this presents for the individual projects. While this is not an ideal permanent solution, it provides a functional workaround that keeps the wikis accessible to their user base.

The ultimate goal remains to eventually migrate these wikis to their own dedicated root domains once they have gained enough authority and trust with search engines. Organizers hope that by using redirection strategies and formal address change tools, they can preserve the search ranking accumulated during the time spent on subdomains. In the meantime, the search for more clarity on this phenomenon continues, as the community seeks to better understand the long-term implications of these search engine policies on the independent web.

Jellyfin 12.0 是该媒体服务器的一个重要里程碑，结束了将版本号维持在 10.x 的旧做法。这反映出项目把重大架构改动（比如此前启动的大规模数据库重构）视为主版本发布。升级到 12.0 带来了显著的性能提升，尤其是在处理大型播放列表和收藏集时。通过将每个条目重构为独立行而非单一的大列表，服务器在请求处理、编辑和计数方面更高效，从而有效解决了过去大型媒体库容易卡顿的问题。

在升级前，务必先对数据和配置做完整的手动备份。首次启动时会执行大规模的数据库迁移，要求当前版本至少为 10.10.7 。迁移过程中会进行强制的媒体库扫描，因需要验证现有文件并清理遗留数据，扫描时间可能比平时更长。此外，用户名现已不区分大小写，迁移前必须解决可能的账户冲突；第三方插件也需先移除并更新，因为底层框架发生了重大变化。

12.0 对书籍和漫画的支持进行了长期期待的重构。原本依赖 Bookshelf 插件的大部分功能已被直接集成到服务器中，包括从 OPF 和 ComicInfo 文件原生读取元数据、为多种归档自动生成海报，以及改进有声书和电子书的管理。 Web 客户端的阅读界面也大幅更新，导航更统一，对多种文件类型支持更好，使平台在数字阅读方面更具竞争力。

用户体验也有所变化：Modern 布局现在为 Web 和桌面端的默认界面，带来更精致统一的视觉风格。新界面基于使用 CSS 变量的共享基础主题，简化了自定义主题的制作。搜索和推荐系统变得更灵活，管理员可按媒体库配置推荐来源，系统也允许插件扩展搜索功能，逐步摆脱硬编码限制。

底层方面也有大量改进：升级到 FFmpeg 8.1 、为多种 GPU 架构优化了转码性能，并通过 SubtitleEdit 改善了字幕处理。安全性依然是重点，修复了多项文件访问漏洞和跨站脚本风险。虽然内部 TLS/SSL 的弃用已被推迟，开发者仍然强调使用反向代理以提升安全性。需要注意的是，API 存在若干破坏性变更，客户端和插件需更新以适配新的 .NET 10 目标和更新后的 OpenAPI 规范。 Jellyfin 12.0 marks a major milestone for the media server, shifting away from the old versioning scheme that kept the release number at 10.x. This change reflects the project's shift toward treating significant architectural updates, like the massive database overhaul initiated in previous versions, as major releases. The transition to 12.0 brings substantial performance improvements, particularly in how the system handles large playlists and collections. By restructuring these data points so that individual items are managed as distinct rows rather than monolithic lists, the server can now process requests, edits, and counts with much greater efficiency, effectively resolving freezing issues that plagued large libraries in the past.

Before jumping into the new version, users must prioritize performing a full manual backup of their data and configuration. The upgrade process involves an extensive database migration that occurs on the first boot, which requires users to be on at least version 10.10.7 before attempting the update. The migration will perform a mandatory library scan, which may take longer than usual as it validates existing files and cleans up legacy data. Furthermore, users should be aware that usernames are now case-insensitive, meaning account collisions must be resolved before the migration, and third-party plugins must be removed and updated, as the underlying framework has changed significantly.

A standout improvement in 12.0 is the long-awaited overhaul of support for books and comics. Much of the functionality formerly restricted to the Bookshelf plugin has been integrated directly into the server. This includes native metadata reading from OPF and ComicInfo files, automatic poster generation for various archives, and improved organization for audiobooks and e-books. The web client has also received a major update to its reading interface, featuring unified navigation and improved support for various file types, effectively making the platform a much more robust option for digital readers.

The user experience has seen a shift as well, with the Modern layout now set as the default for web and desktop users. This interface update brings a more polished, cohesive aesthetic, utilizing a shared base theme built on CSS variables that simplifies the creation of custom themes. Beyond the visuals, the search and recommendation systems have become more flexible. Administrators can now configure recommendation sources on a per-library basis, and the system now allows plugins to extend the search functionality, moving away from hard-coded solutions.

Finally, the release is packed with significant under-the-hood enhancements, including an upgrade to FFmpeg 8.1, better transcoding performance for various GPU architectures, and improved subtitle handling via SubtitleEdit. Security also remains a top priority, with numerous patches addressing file access vulnerabilities and cross-site scripting risks. While the deprecation of internal TLS/SSL support has been postponed, the developers continue to emphasize the importance of using a reverse proxy for security. Developers should note that the API has seen several breaking changes, necessitating updates for clients and plugins to align with the new .NET 10 target and the updated OpenAPI specifications.

RSA 密码学的安全性建立在对大半素数（semiprime numbers）进行因式分解的数学难度之上。虽然现代网络在很大程度上已迁移到至少 2048-bit 的 RSA，但公钥基础设施（Public Key Infrastructure）早期缺乏严格标准。在 1990 年代中后期，由于当时普遍存在的加密出口限制（encryption export restrictions），像 Netscape Navigator 和 Internet Explorer 这样的浏览器内置的根证书使用了 512-bit 的密钥，这些密钥现在可以在现代消费级硬件上轻易被分解。

为了验证这一漏洞，可以恢复这些过时证书颁发机构（certificate authorities）的私钥。通过检索旧版浏览器安装程序的存档，可以提取出曾被默认信任的原始根证书。借助像 CADO-NFS 这样的工具，在普通台式机处理器上，这些 512-bit 密钥大约可以在一到两天内被分解。这个过程直观地显示了密码学标准进步的速度：当年作为网络安全基石的密钥如今在计算上已经不堪一击。

除了因式分解的理论演示外，实际测试这些密钥需要专门环境。现代 TLS 实现不再支持 90 年代后期使用的过时协议，因此要复活这些密钥，需要自定义服务器实现（server implementations），以便与像 Netscape 4.51 这样的旧软件通信。搭建这样的服务器可以签发在老浏览器看来有效的证书，从而揭示长期废弃的安全基础设施所带来的风险。

归根结底，这些发现提醒我们早期数字安全的脆弱性。虽然 E-Certify 和早期的 VeriSign 根证书早已从信任存储（trust stores）中移除，但这些密钥的存在及其易于因式分解的事实说明了行业为何转向更大密钥长度并主动弃用旧标准。尽管如今它们更多是一种有趣的技术好奇心，但它们凸显了在计算能力不断提升的情况下，保持安全标准更新的重要性。 The security of RSA cryptography is rooted in the mathematical difficulty of factoring large semiprime numbers. While the modern web has largely migrated to at least 2048-bit RSA, the early days of Public Key Infrastructure were characterized by a lack of rigorous standards. During the mid-to-late 1990s, when encryption export restrictions were prevalent, browsers like Netscape Navigator and Internet Explorer shipped with root certificates that utilized 512-bit keys, which are now easily factorable on modern consumer hardware.

To explore this vulnerability, it is possible to recover the private keys of these outdated certificate authorities. By utilizing archives of old browser installers, one can extract the original root certificates that were once trusted by default. Using tools like CADO-NFS on a standard desktop processor, these 512-bit keys can be factored in approximately one to two days. This process effectively demonstrates how rapidly cryptographic standards have evolved, as keys that were once foundational to early web security are now computationally trivial to compromise.

Beyond the theoretical exercise of factoring, testing these keys requires a specialized environment. Modern TLS stacks do not support the obsolete protocols used in the late 90s, so reviving these keys requires custom server implementations that can communicate with vintage software like Netscape 4.51. By constructing such a server, it is possible to issue certificates that appear valid to old browsers, illustrating the risks associated with long-deprecated security infrastructure.

Ultimately, these findings serve as a reminder of the fragility of early digital security. While the E-Certify and early VeriSign roots have long been removed from trust stores, the existence of these keys and their ease of factorization highlight why the industry has moved toward much larger key sizes and proactive deprecation. While they represent a fun technical curiosity today, they underscore the critical importance of keeping security standards current against the inevitable advance of computing power.

TALA，即 Terrastruct's AutoLayout Algorithm，现已在 MPL-2.0 许可证下开源。该新型布局引擎专为软件架构图设计，采用正交布局，旨在模仿白板绘图的直观结构，而不是基于 DAG 的算法那种刚性单向流线。通过将成熟的图形绘制研究与自创技术相结合，TALA 在对称性、流向、聚类和中位数距离等方面进行优化，以提升图形的美观与可读性。

该算法具有很强的灵活性，允许用户自定义或锁定节点的位置和大小。这个功能对 agentic 场景特别有用：在这些场景中，AI 模型可能能在二维空间里给出坐标，却难以完成复杂的连线路由工作。 TALA 也支持混合模式，用户可以固定部分元素，由引擎自动处理其余布局，从而在创意控制与计算效率之间取得平衡。

但在将 TALA 纳入工作流时也要权衡利弊。算法带有一定随机性，会使用多个种子来选出得分最佳的布局。虽然在输入一致时结果是可复现的，但对图表进行微小修改（例如新增一个节点）可能会引起视觉结构的大幅重排。此外，TALA 并不适合长而流动的 DAG，对于非常大的图表，其性能随规模呈非线性增长，速度可能比 Dagre 或 ELK 等方案慢。

要开始使用该引擎，开发者只需在 D2 version 0.9.0 中将 layout 标志设为 tala 。想要立即试验的用户可以在基于浏览器的 D2 playground 中体验完全客户端运行的测试环境。此次发布是一次协作成果，Gavin Nishizawa 和 Júlio César Batista 等开发者做出了重要贡献，团队期待社区在 TALA 公开后继续完善和改进它。 TALA, which stands for Terrastruct's AutoLayout Algorithm, is now open-source under the MPL-2.0 license. This novel layout engine is specifically engineered for software architecture diagrams, prioritizing an orthogonal design that mimics the intuitive structure of whiteboard drawings rather than the more rigid, unidirectional flow typical of DAG-based algorithms. By blending established graph-drawing research with original techniques, TALA optimizes for aesthetic clarity through considerations like symmetry, flow, clustering, and median distance.

The algorithm offers unique flexibility, allowing users to customize or lock node positions and sizes. This feature is particularly powerful for agentic use cases, where an AI model might be capable of defining coordinates in 2D space but struggles with the complex, manual task of routing connections. TALA also supports a hybrid approach, where some elements are fixed in place by the user while the engine automatically handles the remaining layout, providing a balance between creative control and computational efficiency.

However, users should be aware of certain trade-offs when integrating TALA into their workflow. The algorithm incorporates a degree of randomness, using multiple seeds to determine the best layout score. While this ensures consistency given identical inputs, small changes to the diagram, such as adding a single node, can lead to a significant reorganization of the visual structure. Additionally, TALA is not optimized for long, flowing DAGs, and for very large diagrams, its performance scales nonlinearly, making it slower than other options like Dagre or ELK.

To start using the new engine, developers can find it bundled into D2 version 0.9.0 by simply specifying the layout flag as tala. For those interested in immediate experimentation, the browser-based D2 playground offers a fully client-side environment to test the algorithm. The release is a collaborative effort, with significant contributions from developers like Gavin Nishizawa and Júlio César Batista, and the team looks forward to seeing how the community will further refine and improve TALA now that it is publicly available.

该仓库提供了一个用于教学与研究的 Stuxnet 蠕虫重构项目。通过对 2010 年发现的原始二进制文件进行逆向工程，项目旨在帮助安全研究人员与学生理解这一复杂威胁的工作原理。作者强调，本代码仅供学术分析和防御性研究使用，严禁用于任何恶意目的。

Stuxnet 专门针对 Siemens Step 7 软件以及 S7-300 和 S7-400 型可编程逻辑控制器（PLC）。其成功依赖于复杂的多阶段攻击流程，传播途径包括 USB 移动存储、网络共享和点对点机制。一旦确认目标环境存在，恶意程序会利用高级 rootkit 技术隐藏自身（包括恶意文件、进程和注册表项），在隐蔽运行的同时干预工业控制流程。

重构代码的技术架构展示了明确的执行流程：先进行环境侦察以确认目标 Siemens 软件的存在，随后拦截工程软件与控制器之间的通信，将恶意代码注入关键的运行模块。被注入的逻辑会篡改电机频率，最终使离心机转子达到足以造成机械故障的转速。项目结构对应这些阶段，详细列出各具体组件，例如初始投放程序（dropper）、权限提升利用模块以及用于隐蔽的内核模式驱动程序。

仓库为有兴趣研究该架构的人提供了构建说明，并细分了诸如 S7 hook 库和文件系统 rootkit 等模块。文档建议在隔离的虚拟环境中进行调试和监控，以保障安全。通过剖析诸如频率篡改逻辑等组件，研究人员可以开发更强的防御手段，例如 YARA 规则或针对性的网络检测签名，从而保护关键基础设施免受类似威胁。

总体而言，此次重构为安全社区保存并传承了这段恶意软件的技术史，补充并建立在 Symantec 、 Kaspersky 和 ESET 等组织此前发布的威胁情报之上。尽管 Stuxnet 的最初作者仍未明朗，该项目旨在服务于未来的防御性教育。我们鼓励用户遵守法律与道德规范，将代码作为加固系统的工具，而非仿制危害的范本。 This repository provides an educational and research-oriented reconstruction of the Stuxnet worm, a piece of malware famously recognized as the first cyber-weapon designed to inflict physical damage on industrial control systems. By reverse-engineering original binaries discovered in 2010, the project aims to help security researchers and students understand the mechanics of this complex threat. The authors emphasize that this code is intended strictly for academic analysis and defensive research, strictly prohibiting any use for malicious activities.

Stuxnet was specifically engineered to target Siemens Step 7 software and S7-300 or S7-400 programmable logic controllers. Its operational success relied on a sophisticated multi-stage approach, including propagation through USB drives, network shares, and peer-to-peer mechanisms. Once it identified a target environment, the malware utilized advanced rootkit capabilities to hide its presence, including malicious files, processes, and registry keys, allowing it to operate covertly while manipulating industrial processes.

The technical architecture of the reconstructed code highlights a precise execution flow, beginning with environment reconnaissance to verify the presence of targeted Siemens software. Upon finding a match, the malware intercepts communication between the engineering software and the controllers, injecting malicious code into critical operational blocks. This injection alters motor frequencies, ultimately driving centrifuge rotors to speeds that cause mechanical failure. The project structure mirrors these stages, detailing the specific components involved, such as the initial dropper, privilege escalation exploits, and the kernel-mode drivers used for stealth.

For those interested in exploring this architecture, the repository provides build instructions and a breakdown of modules like the S7 hook libraries and the file system rootkits. The provided documentation suggests that this material is best utilized in isolated, virtual environments to allow for safe debugging and monitoring. By dissecting components like the frequency-tampering logic, researchers can develop more robust defensive measures, such as YARA rules or specialized network signatures, to protect critical infrastructure from similar threats.

Ultimately, this reconstruction serves as a resource for the security community, building upon the foundational threat intelligence previously published by organizations like Symantec, Kaspersky, and ESET. While the original creators of Stuxnet remain unknown, this project preserves the technical history of the malware for future defensive education. Users are encouraged to maintain compliance with legal and ethical standards, treating the code as a tool to strengthen systems rather than a template for harm.

Broadcom 已悄然撤下对 VMware Virtual Disk Development Kit（VDDK）的公开访问，这给试图将工作负载从 vSphere 迁出的组织带来了重大障碍。 VDDK 是许多行业标准工具（包括 Microsoft Azure Migrate 、 Red Hat 的 Migration Toolkit for Virtualization 和 Nutanix Move）用来完成数据传输和平台迁移的关键库。 Broadcom 限制这些文件的获取，实际上让许多 VMware 客户的退出方案变得更加复杂。

这些下载页面是在没有任何正式公告或替代方案提示的情况下被移除的。尝试访问原先链接的用户现在会遇到 404 错误，且有报告称 Broadcom 的支持明确告知客户该套件不再对公众开放，并将用户引导至其授权的备份与恢复合作伙伴，这表明 VMware 相关技术正被更严格地管控和限制访问。

主要厂商已开始调整应对策略，Microsoft 和 Red Hat 等公司已更新技术文档以反映这一变化。 Microsoft 建议在无法获取 VDDK 时采用基于代理的迁移方案；Red Hat 则表示由于该库为专有软件，他们无法自行托管或重新分发。这些调整说明这并非网站临时故障，而是一次影响广泛迁移流程的有意政策性变动。

不过，部分平台不受此限制影响。例如，Proxmox 内置的导入工具并不依赖 VDDK，用户仍可在不获取外部 VMware 库的情况下迁移 VMDK 。然而，对那些严重依赖 VDDK 的第三方工具用户来说，迁移流程已明显变得更繁琐。组织现在需要直接从 Broadcom 获取授权（可能需要加入特定技术计划），或寻找完全不同且可能更复杂的迁移方案。 Broadcom has quietly removed public access to the VMware Virtual Disk Development Kit, commonly known as the VDDK, creating a significant new hurdle for organizations attempting to migrate their workloads away from the vSphere platform. The VDDK is a critical library used by numerous industry-standard tools, including Microsoft Azure Migrate, Red Hat's Migration Toolkit for Virtualization, and Nutanix Move, to facilitate data transfers and platform transitions. By restricting access to these files, Broadcom has effectively complicated the exit strategy for many VMware customers.

The removal of these download pages has occurred without a formal announcement or a clear replacement path. Users attempting to access previously available links now encounter 404 errors, and reports indicate that Broadcom support has explicitly informed customers that the kit is no longer available for general use. Instead, support representatives have directed users toward authorized backup and recovery partners, further signaling a shift toward a more restricted, gatekept environment for VMware-related technologies.

Major vendors are already reacting to the fallout, with companies like Microsoft and Red Hat updating their technical documentation to reflect the lack of public availability. Microsoft now advises administrators to shift to agent-based migration methods when the VDDK is inaccessible, while Red Hat has acknowledged that because the library is proprietary, they cannot host or redistribute it themselves. These updates confirm that the change is not a temporary website glitch but a deliberate structural adjustment that impacts widespread migration workflows.

Despite the disruption, some platforms remain unaffected by this specific restriction. For instance, the import utility built into Proxmox does not rely on the VDDK to move VMware workloads, allowing users to continue migrating VMDKs without needing to source external VMware libraries. However, for those heavily reliant on third-party utilities that depend on the VDDK, the migration process has become significantly more cumbersome. Organizations are now faced with needing to secure direct authorization from Broadcom, which may involve membership in specific technology programs, or finding entirely different, potentially more complex, migration strategies.