围绕 PrivSec-dev 兼容性存储库中 ASN Bank 移动应用的讨论，凸显了银行安全实践与使用 GrapheneOS 等隐私优先的替代操作系统之间日益加剧的矛盾。最初，不少用户反馈体验参差不齐：有人无需 Google Play Services 也能使用该银行应用，而也有人在登录环节遇到了阻碍，主要出在连接检测和设备完整性校验等环节。

随着讨论历经数年发展，焦点逐渐从应用的基本可用性转向 iDEAL | Wero 支付系统的严格门槛。许多用户发现自己已无法继续使用这些支付服务，因为应用程序要求必须通过 Google Play Integrity API 的验证。对重视隐私、并坚持去谷歌化环境的用户而言，这无疑是一道高墙：该机制实际上会拦截不符合 Google 特定认证标准的设备。

参与讨论的人对银行依赖美国基础设施表达了明显不满，并认为这与 Wero 希望推动欧洲数字主权的目标相悖。由提交投诉的客户提供的 ASN Bank 官方回应也印证了该银行确实遵循由 Wero 倡议所设定的集体安全要求。银行表示，这些严格的完整性检查是为了符合有关防欺诈与支付安全的欧洲监管要求；同时，针对使用不受支持操作系统的用户，他们目前没有提供任何绕过方案。

这场讨论也折射出对金融行业依赖专有设备认证机制的更广泛质疑。批评者认为，依靠 Google Play Integrity 不仅是试图越过边界、阻断对关键公共基础设施的访问，还属于技术层面存在问题的做法：它忽视了更安全、开放的设备认证替代路径。受影响用户普遍认为这一现状难以长期维持，许多人呼吁对金融监管机构施加协调施压，确保银行服务对所有公民开放，不论其所使用的移动操作系统为何。 The discussion surrounding the ASN Bank mobile application on the PrivSec-dev compatibility repository highlights a growing tension between banking security practices and the use of alternative, privacy-focused operating systems like GrapheneOS. Initially, users reported mixed experiences, with some able to use the banking application without Google Play Services, while others encountered barriers during the login process, specifically relating to connectivity checks and device integrity verification.

As the conversation evolved over several years, the central issue shifted from general app functionality to the strict requirements of the iDEAL | Wero payment system. Many users found that they could no longer access these payment services because the application mandates Google Play Integrity API verification. This has created a significant hurdle for users who prioritize privacy and de-Googled environments, as the system effectively blocks devices that do not meet Google's specific certification criteria.

Participants in the discussion have expressed frustration with the bank's reliance on American infrastructure, arguing that this contradicts the stated goal of Wero, which is to foster European digital sovereignty. Official responses from ASN Bank, provided by customers who filed complaints, confirm that the bank follows the collective security requirements set by the Wero initiative. The bank maintains that these strict integrity checks are necessary to meet European regulations regarding fraud prevention and payment security, and they currently offer no workaround for users on unsupported operating systems.

The dialogue highlights a broader critique of the financial sector's reliance on proprietary attestation mechanisms. Critics argue that relying on Google Play Integrity is not only an overreach that prevents access to critical public infrastructure but also a technically flawed approach that ignores more secure, open alternatives for device attestation. There is a strong consensus among the affected users that this situation is unsustainable, with many calling for coordinated pressure on financial regulators to ensure that banking services remain accessible to all citizens, regardless of their chosen mobile operating system.

Kugelblitz 是一款 macOS 应用，旨在打造一套全面的 3D 地球仪和地图集，让用户能够借助高质量的开放地理数据（open geodata）探索地球以及其他天体。该应用让用户像飞行员一样在真实地形上进行漫游浏览，支持多种地图类型，包括影像（imagery）、道路地图（road maps）和地形图（topographic views）。这些地图并不是平铺在表面上，而是直接贴合覆盖到地形之上，并配备 3D 建筑，让体验更沉浸。

该应用完全依托可自由获取的开源地理数据运行，数据直接来自 OpenStreetMap 等发布者。用户无需账号即可访问这些信息。所有已加载的数据都会自动在本地缓存，同一网络中的 Kugelblitz 实例甚至还能共享缓存，从而提升效率。对技术细节有兴趣的用户，应用提供状态窗口（status windows），用于显示数据来源，并列出每个所用来源对应的许可证（licenses）。

除了 3D 地球仪，Kugelblitz 还提供地图集（atlas view）视图，可用五种不同的平面投影方式展示地理数据。用户可以方便地在这些视图之间切换，以更好地满足不同需求。软件还内置强大的"库"（Library）功能，支持搜索、查看并把全球地图服务（如卫星影像（satellite imagery）、高程模型（elevation models）以及更多 3D 数据）直接集成到工作区中。

性能是这款应用的重点之一：即使在 M1 Mac 等入门级硬件上也能保持顺畅。导航方式也很灵活，既支持触控板（trackpads）和鼠标（mice）等常见输入方式，也可使用 3Dconnexion SpaceMouse 等专用设备，带来更有手感、类似驾驶舱（cockpit）的飞行体验。此外，软件还支持将其 3D 环境流式传输到 Apple Vision Pro 头显，让用户能直接从 Mac 获得完全沉浸式的观看体验。

Kugelblitz 还可作为时间与天文探索工具。它能对太阳位置进行精准定位，以还原现实世界的光照与阴影效果，并提供跨越 5,000 多年的历史事件数据，例如日食（eclipses），同时也包含地震活动（seismic activity）与火山喷发（volcanic eruptions）等信息。借助内置的时间穿梭（time shuttle），用户可以观察这些事件在全球范围内如何呈现，从而使该应用既适合作为教育工具，也能作为研究人员和爱好者的精密可视化实用工具。 Kugelblitz is a macOS application designed to serve as a comprehensive 3D globe and atlas, allowing users to explore the Earth and other celestial bodies through high-quality open geodata. The app enables users to navigate real terrain as if they were pilots, utilizing various map types including imagery, road maps, and topographic views. These maps do not sit flat but are draped directly onto the terrain, featuring 3D buildings for a more immersive experience.

The application functions entirely on freely available, open-source geodata, sourced directly from publishers like OpenStreetMap. Users do not need an account to access this information. All loaded data is automatically cached locally, and Kugelblitz instances on the same network can even share this cache to improve efficiency. For those interested in technical details, the app provides status windows that display where data originates and list the relevant licenses for every source used.

Beyond the 3D globe, Kugelblitz offers an atlas view that displays geographical data in five different flat projections. Users can easily toggle between these views to suit their specific needs. The software also includes a powerful Library feature that allows users to search, view, and integrate global map services, such as satellite imagery, elevation models, and additional 3D data, directly into their workspace.

Performance is a significant focus of the application, which is optimized to remain smooth even on entry-level hardware like the M1 Mac. Navigation is versatile, supporting standard input methods like trackpads and mice, as well as specialized hardware like the 3Dconnexion SpaceMouse for a more tactile, cockpit-like flight experience. Furthermore, the software supports streaming its 3D environment to an Apple Vision Pro headset, allowing for a fully immersive viewing experience directly from the Mac.

Kugelblitz also functions as a tool for temporal and astronomical exploration. It features precise positioning of the Sun to reflect real-world light and shadows and includes data on historical events such as eclipses spanning over 5,000 years, as well as seismic activity and volcanic eruptions. By using the built-in time shuttle, users can observe how these events manifest across the globe, making the application both an educational tool and a sophisticated visual utility for researchers and enthusiasts alike.

BUI 是一个独立的 UI 库，它从 Blender 中提取了高度优化的 Widget 绘制与交互系统。通过将这些组件从 Blender 的核心代码库中解耦，该项目让开发者能够跨多种编程语言（包括 Python 、 Rust 、 JavaScript 、 C 和 C++）构建高性能、低功耗的桌面应用。它基于一个轻量级的 C 运行时（kit）运作，用来管理 Widget 树、布局、输入处理与渲染。

该库提供基于 Blender 著名交互模型的统一用户体验。核心功能包括拖动式数值微调、在输入框内对数学表达式进行求值、模糊菜单搜索以及完善的撤销支持。由于 BUI 采用模块化设计，它支持多种渲染后端：既有高效的软件光栅化器，也提供使用 Direct3D 11 或 OpenGL 3.3 的硬件加速方案。借助损伤渲染架构，BUI 只重绘发生变化的区域，从而确保空闲状态下的应用几乎不占用 CPU 资源。

开发者可以从多个入口使用该库。对 Python 用户而言，BUI 能与现有 tkinter 和 ttk 应用实现近乎无缝的兼容，无需改动代码，并支持 Qt 风格语法以及一套原生的 Blender 组件。 Rust 与 JavaScript 开发者则可使用类似 Web 的框架，这些框架支持 HTML 、 CSS 和 Tailwind，同时还可以在特定场景中集成原生的 Blender Widget 。此外，该库还提供 Dear ImGui 的后端，让开发者可以把该界面与 Blender 的主题结合使用，甚至可以用 Blender 的原生组件替换其标准 Widget 。

性能是该项目的重点：库设计为快速、内存高效，并能以极低开销处理复杂界面。它对图像与视频提供了强大的支持，包括离线程解码，以及带内存预算的缓存，用于避免性能瓶颈。作为独立方案，BUI 避免了基于浏览器运行时的臃肿，使得开发者能够创建体积紧凑、启动迅速、同时保持原生感与良好响应性的应用。

该项目持续进行维护，模块化架构也鼓励贡献与提升透明度。尽管部分功能（例如 macOS 窗口支持与 Qt 语法覆盖）仍处于实验或不完整阶段，但核心的 C 运行时以及主要语言绑定已可用并经过测试。开发者可通过官方网站获取完整文档，内容涵盖安装流程、各语言指南以及性能基准，帮助团队评估如何将 BUI 最好地集成到现有工作流中。 BUI is a standalone user interface library that extracts the highly optimized widget drawing and interaction systems from Blender. By decoupling these components from Blender's core codebase, the project allows developers to build high-performance, battery-efficient desktop applications across multiple programming languages, including Python, Rust, JavaScript, C, and C++. It operates via a lightweight C runtime, known as the kit, which manages the widget tree, layout, input handling, and rendering.

The library provides a consistent user experience based on Blender's famous interaction model. Key features include drag-to-scrub number fields, mathematical expression evaluation within inputs, fuzzy menu searching, and comprehensive undo support. Because BUI is built to be modular, it supports multiple rendering backends, including a highly efficient software rasterizer and hardware-accelerated options using Direct3D 11 or OpenGL 3.3. Through a damage-rendering architecture, BUI only redraws regions that have changed, ensuring that idle applications consume virtually no CPU resources.

Developers have several entry points to the library. For Python users, BUI offers near-perfect compatibility with existing tkinter and ttk applications without requiring code changes, alongside support for Qt-style syntax and a set of native Blender components. Rust and JavaScript developers can utilize web-like frameworks that support HTML, CSS, and Tailwind, combined with the ability to integrate native Blender widgets for specific tasks. Additionally, the library provides a backend for Dear ImGui, allowing developers to use that interface with Blender's theming or even replace its standard widgets with Blender's native counterparts.

Performance is a central focus of the project, with the library designed to be fast, memory-efficient, and capable of handling complex interfaces with minimal overhead. It includes robust support for images and video, featuring off-thread decoding and memory-budgeted caching to prevent performance bottlenecks. As a standalone solution, BUI avoids the bloat of browser-based runtimes, enabling the creation of compact, fast-starting applications that maintain native feel and responsiveness.

The project is actively maintained with a modular architecture that encourages contribution and transparency. While some features like macOS window support and Qt syntax coverage remain in experimental or partial stages, the core C runtime and primary language bindings are functional and tested. Developers can access full documentation through the official website, which covers installation, language-specific guides, and performance benchmarks to help teams determine how best to integrate BUI into their existing workflows.

Failed to crawl the webpage. (English version not available)

Linux 操作系统在 1990 年代初期的开发，标志着对传统的、等级分明的软件创建模式的一次关键性背离。尽管 AT&T 和 Microsoft 等行业巨头依赖全职且高薪的团队，并通过受限版权与专有保密机制来加以保护，Linus Torvalds 却提出了截然不同的思路。他邀请全球共同参与他的内核项目，并将其保持为任何人都能自由研究、修改和分发的开放软件，从而推动了 GNU/Linux 操作系统的诞生。如今，这类软件支撑着全球绝大多数服务器、超级计算机和智能手机，实质上对专有控制的必要性提出了挑战。

这一被称为"基于公地的同伴式生产"（commons-based peer production）的范式，此后激发了无数项目，它们更依赖自愿协作而非官僚式管理。 Wikipedia 是最典型的例子：它从公开征集编写内容的倡议发展为人类历史上规模最大、内容最完整的百科全书。类似的较小项目，比如 GuttenPlag Wiki，也同样展示了大众如何组织并完成复杂任务，例如记录 Plagiarism，而这类行动可能带来显著的现实影响，包括高级官员的辞职。

同伴式生产的核心在于四项关键支撑：运用多样化、且往往并非以金钱为核心的激励机制；实行去中心化的自我治理；以分布式方式完成任务；并建立公共公地。与依靠合同义务、预设工作计划或定价体系的市场型企业不同，这些项目在运作时不受合同约束，也不预先设定任务方案或价格结构。尽管它们可能在某些方面与市场的分散性具有相似之处，但同伴式生产否定了这样一种观点：只有金钱激励与排他性的私有产权制度，才是高效组织人类劳动的唯一可行路径。

尽管取得了成功，同伴式生产仍与商业利益之间持续存在张力。许多现代平台，例如 Reddit，在保留企业所有权的同时，嵌入了同伴式协作的部分机制。随着这些公司逐步走向公开融资或更侧重广告收入，它们往往会限制志愿者所创建数据的访问权限，从而让开放社区与商业服务之间的界限变得模糊。此类转变也常常揭示了一个现实：当同伴式生产的资源没有被严格保护为公共公地时，它们就更容易变得不稳定。

这场运动自身也面临内部挑战，包括人口结构失衡、非正式等级关系的出现，以及持续存在的骚扰与排斥问题。此外，许多成功项目最终又会遇到"需要制度化"的要求，这可能反过来导致那种官僚化结构的出现，而这正是该运动一开始试图避免的东西。尽管如此，来自同伴式生产的影响仍在不断扩展，正在塑造从众筹、共享经济到支撑生成式人工智能的训练数据等一系列领域。

最终，同伴式生产为关于工作应如何被组织的传统经济学假设提供了一种有力替代。它证明了：在没有中央权威、也没有利润动机的情况下，无偿志愿者同样能够生产出有价值且高质量的成果。面对当下诸如谣言与错误信息（Misinformation）、以及公民参与度下降等问题，这种协作模式为人们如何携手应对复杂的全球性挑战，提供了一个富有意义、并经受时间检验的框架。 The development of the Linux operating system in the early 1990s marked a pivotal departure from the traditional, hierarchical model of software creation. While industry giants like AT&T and Microsoft relied on full-time, well-paid teams protected by restrictive copyright and proprietary secrecy, Linus Torvalds introduced a radically different approach. By inviting global collaboration on his kernel project and keeping it free for anyone to study, modify, and distribute, he helped spawn the GNU/Linux operating system. Today, this software underpins a vast majority of the world's servers, supercomputers, and smartphones, effectively challenging the necessity of proprietary control.

This paradigm, known as commons-based peer production, has since inspired countless projects that rely on voluntary cooperation rather than bureaucratic management. Wikipedia stands as the most prominent example, evolving from an open call for contributions into the largest and most comprehensive encyclopedia in human history. Smaller initiatives, such as the GuttenPlag Wiki, have similarly demonstrated the power of the crowd to organize and execute complex tasks, like documenting plagiarism, which can have significant real-world consequences, including the resignation of high-level officials.

At its core, peer production thrives on four key pillars: the use of diverse, often nonmonetary incentives, decentralized self-governance, distributed task execution, and the creation of a public commons. Unlike market-based firms, these projects operate without contractual obligations, predefined work plans, or pricing structures. While they may share some similarities with the distributed nature of markets, peer production rejects the notion that financial incentives and exclusive property regimes are the only viable ways to organize human effort effectively.

Despite its success, peer production faces ongoing tensions with commercial interests. Many modern platforms, such as Reddit, have integrated elements of peer-based collaboration while maintaining corporate ownership. Over time, as these companies move toward public offerings or prioritize advertising revenue, they often restrict access to the data that volunteers created, blurring the line between open communities and commercial services. This shift frequently highlights the precarity of peer-produced resources when they are not strictly protected as a public commons.

The movement is not without its own internal challenges, including issues of demographic imbalance, the emergence of informal hierarchies, and the persistent problems of harassment and exclusion. Furthermore, successful projects often encounter the need to formalize, which can lead to the very bureaucratic structures the movement initially sought to avoid. Yet, despite these obstacles, the influence of peer production continues to expand, shaping everything from crowdfunding and the sharing economy to the training data powering generative artificial intelligence.

Ultimately, peer production serves as a powerful alternative to classical economic assumptions about how work should be organized. It proves that valuable, high-quality goods can be produced by unpaid volunteers operating without a central authority or a profit motive. As society navigates contemporary issues like misinformation and eroding civic participation, this collaborative model offers a meaningful, time-tested framework for how people can work together to address complex global challenges.

Failed to crawl the webpage. (English version not available)

pwn.college 是一个实践型教育平台，旨在让学习者沉浸在计算的核心领域，从而培养必备的网络安全技能。参与者从 white belts 起步，随后在直接与终端、 CPU 和网络交互的过程中掌握相关概念，并逐步晋级，获得不同颜色的 belts 。该平台由亚利桑那州立大学（Arizona State University）的一支团队维护，并向全球学生和感兴趣的个人免费开放，是 ASU 自身网络安全课程的重要组成部分。

dojos 中提供的挑战主要用于教学目的，并作为全球大学学生评分的依据。正因为其承担了教学功能，创建者希望用户不要在互联网上发布挑战的 walkthrough 、 solution videos 或带有直播尝试的内容。尽管这条规定是自愿性的，遵守它仍能帮助维持平台的持续可用性，也让课程对学生和讲师都保持有效。

如果你有兴趣将该平台纳入自己的课程，pwn.college 允许在标注适当署名的前提下，将其 lectures 和 slides 用于非商业用途并免费使用。教育机构甚至可以选择把这些挑战导入面向学生的 private dojos；团队也欢迎收到有关平台使用情况的通知，以支持他们持续的学术工作。课堂之外，该项目还希望通过举办基于活动的密集培训课程，与各类 conferences 进行更多互动。

当学习者在平台上不断进阶，学习之路仍将通向更高水平的熟练度，最终达到 brown belt 和 black belt 的阶段。团队鼓励毕业生通过 Capture The Flag 竞赛、长期 wargames，以及 CryptoHack 或 OST2 这类替代学习平台来进一步打磨技能。对于想要深入研究的人，创建者在 ASU 提供 internship 机会，并欢迎为支撑其网站的 open-source 基础设施贡献力量。 pwn.college serves as a hands-on educational platform designed to help learners develop essential cybersecurity skills by immersing them in the core of computing. Participants begin their journey as white belts and progress through various levels, earning different colored belts as they master concepts by interacting directly with terminals, CPUs, and networks. The platform is maintained by a team at Arizona State University and is available for free to students and interested individuals worldwide, forming a significant component of ASU's own cybersecurity curriculum.

The challenges provided within the dojos are primarily intended for educational purposes and serve as the basis for grading university students globally. Because of this pedagogical role, the creators ask that users refrain from posting walkthroughs, solution videos, or livestreamed attempts of the challenges to the internet. While this rule is voluntary, following it helps preserve the platform's viability and keeps the curriculum effective for students and instructors alike.

For those interested in integrating the platform into their own coursework, pwn.college allows for the free use of its lectures and slides for non-commercial purposes, provided proper attribution is given. Educational institutions even have the option to import these challenges into private dojos for their students, and the team welcomes notifications regarding the platform's usage to support their ongoing academic work. Beyond the classroom, the project also seeks to engage with conferences by offering intensive, event-based training sessions.

As learners advance beyond the platform, the journey continues toward achieving high-level proficiency, eventually reaching brown belt and black belt status. The team encourages graduates to refine their skills through Capture The Flag competitions, long-term wargames, and alternative learning platforms like CryptoHack or OST2. For those looking to delve deeper into research, the creators offer internship opportunities at ASU and welcome contributions to the open-source infrastructure that powers their site.

Thinking Machines 推出了 Inkling 2 Small，这是其第二代 Mixture-of-Experts 模型，拥有 5940 亿个总参数和 170 亿个激活参数。该模型支持图像输入，并提供可变的计算投入水平。在 agentic coding 、 vision 、 knowledge work 和 reasoning 等任务上，相比前代产品展现出显著的性能提升。目前，该模型可在 Tinker 平台上用于推理与微调；在完成全面的外部安全测试后，计划以 Apache 2.0 许可证发布权重。

该模型在长周期的自主任务中表现尤为突出，例如通过程序化方式生成复杂环境，如城市模拟器或 PC 模拟器。其编码能力也通过在大规模数据集上进行强化学习得到增强，这些数据集引入了 agentic graders，使模型能更好地理解并执行指令，同时还能自主验证自己的输出。除软件开发外，Inkling 2 Small 在自动化研究（autoresearch）方面同样出色，已证明其能够在预测类任务中自主完成训练：通过反复构建评估脚本并持续打磨数据集，让模型逐步改进。

视觉理解是其另一项关键能力，配备了一个 2.92 亿参数的视觉编码器。模型在需要 OCR 、文档与信息图表解析，以及视觉推理的任务上表现非常出色。它能将视觉反馈有效嵌入工作流程，使其能够校验并优化自己生成的代码。此外，在知识密集型领域（包括金融、法律工作和定量分析）中，它也展现出强劲的能力，能够在阅读复杂文档与处理数据时做出接近专家水平的判断。

Inkling 2 Small 的研发以安全与对齐为核心。研究人员采用"纵深防御"的思路，通过同步与异步监控来识别并缓解不当行为。这包括对训练轨迹进行筛选，以抑制持续但不诚实的策略，并使用在策略内（on-policy）的自蒸馏，帮助模型内化更积极的行为准则。尽管在部分进攻性网络安全场景中，该模型仍未达到开放权重的前沿水平，但与既往版本相比，它在对齐基准测试上取得了明显进步。

Inkling 2 Small 的训练过程十分严苛：预训练阶段使用了超过 8 万亿个 tokens，并进行了为期九天的大规模联合强化学习，累计消耗超过 1700 万次 rollouts 。通过使用 NVIDIA GB300 机架以及 NVFP4 浮点格式等高效基础设施，团队能够对性能扩展实现可预测的提升。尽管如此，开发者也承认仍存在一些限制，例如缺少音频支持、交流偶尔偏啰嗦，以及在部分与安全相关的问题上存在过度敏感等情况，这些都将是后续优化的方向。 Thinking Machines has introduced Inkling 2 Small, their second-generation Mixture-of-Experts model featuring 594 billion total parameters and 17 billion active parameters. This model supports both image inputs and variable effort levels, showing significant performance gains over its predecessor across agentic coding, vision, knowledge work, and reasoning tasks. It is currently available for inference and fine-tuning on the Tinker platform, with plans to release the weights under an Apache 2.0 license following comprehensive external safety testing.

The model demonstrates notable strength in long-horizon autonomous tasks, such as procedurally generating complex environments like city simulators or PC emulators. Its coding capabilities have been enhanced through reinforcement learning on large-scale datasets that utilize agentic graders, allowing the model to better follow instructions and verify its work autonomously. In addition to software development, Inkling 2 Small excels at autoresearch, having proven its ability to autonomously train models on predictive tasks by iteratively building evaluation scripts and refining datasets.

Visual interpretation is another core capability, supported by a 292-million-parameter vision encoder. The model performs exceptionally well on tasks requiring OCR, document and infographic interpretation, and visual reasoning. It effectively integrates visual feedback into its workflows, enabling it to validate and refine its own generated code. The model also shows strong performance in knowledge-heavy domains, including finance, legal work, and quantitative analysis, where it demonstrates expert-level judgment when navigating complex documents and data.

Safety and alignment were central to the development of Inkling 2 Small. Researchers utilized a defense-in-depth approach, implementing both synchronous and asynchronous monitoring to detect and mitigate misbehavior. This included filtering training traces to discourage persistent but dishonest strategies and employing on-policy self-distillation to help the model internalize positive conduct principles. While the model remains behind the open-weight frontier in some offensive cyber scenarios, it shows a significant improvement in alignment benchmarks compared to previous versions.

The training process for Inkling 2 Small was rigorous, involving over 8 trillion tokens in the pre-training phase and a massive joint reinforcement learning run that consumed more than 17 million rollouts over nine days. By leveraging efficient infrastructures like NVIDIA GB300 racks and NVFP4 floating-point formats, the team was able to scale performance predictably. Despite its advancements, the developers acknowledge certain limitations, such as a lack of audio support, occasional verbosity in communication, and over-sensitivity in some safety-related queries, which remain areas for future refinement.

马克·库班正在公开批评 Meta，指控这家科技巨头明知仍在其平台上放任欺诈性的深度伪造广告传播。这位亿万富翁投资人是低价药品公司 Cost Plus Drugs 的联合创始人，经常听到老年人反馈：他们被由人工智能生成的广告误导，广告中虚假使用他的肖像来推销不存在的医疗"疗法"。库班认为，这些骗局绝非单纯的偶然疏漏，而是反映了 Meta 更广泛的内部文化——在用户安全之外，把广告收入放在首位。

相关说法也有报道支撑，报道援引了 Meta 的内部文件。文件显示，公司预计仅在 2024 年，围绕骗局和违禁产品的广告就能带来约 160 亿美元的收入。文件还称，Meta 的内部团队每天识别出约 150 亿条"高风险广告"，其中部分欺诈内容的年度价值大约为 70 亿美元。此外，文件指出，Meta 的自动化审核系统往往要求达到 95% 的欺诈概率才会采取处置措施，这就给出价更高的潜在诈骗者留下了继续在平台上出现的空间。

Meta 对这些指控予以否认。公司发言人表示，这类文件对其反欺诈工作呈现出片面且失真的画面。公司同时强调，用户举报的诈骗广告在过去 18 个月里明显减少，并且在 2025 年下架了数百万条诈骗广告。另外，公司目前还因与金融欺诈相关的广告做法，正受到美国证券交易委员会（SEC）的审查。

这些骗局对老年人造成的伤害尤其严重：他们在数字诈骗方面的经济损失，超过其他任何年龄段。根据美国联邦调查局 FBI 发布的 2025 年《互联网犯罪报告》，60 岁以上人群上报的损失超过 77 亿美元，较上一年大幅上升。由人工智能驱动的骗局构成了其中 3100 多起，造成的总体损失达到数亿美元。专家建议，消费者应对包含名人形象的广告保持警惕，通过第三方渠道核实产品信息，并将可疑行为报告给 Internet Crime Complaint Center 等相关部门。 Mark Cuban is speaking out against Meta, alleging that the tech giant knowingly permits the spread of fraudulent deepfake advertisements on its platforms. The billionaire investor, who co-founded the low-cost pharmacy company Cost Plus Drugs, regularly hears from elderly individuals who have been misled by AI-generated ads that falsely feature his likeness to sell nonexistent medical cures. Cuban contends that these scams are not merely accidental oversights but reflect a broader organizational culture at Meta that prioritizes ad revenue over user protection.

The criticism is supported by reports involving internal Meta documents, which suggest that the company anticipated generating approximately 16 billion dollars in revenue from ads associated with scams and prohibited products in 2024 alone. These documents indicate that Meta's own internal teams identified around 15 billion daily high-risk ads, with some categories of fraudulent content valued at roughly 7 billion dollars annually. Furthermore, the documents note that Meta's automated systems often require a 95 percent probability of fraud before taking action, allowing potential scammers who pay higher rates to maintain their presence on the platform.

Meta has contested these claims, with a company spokesperson arguing that such documents provide a selective and distorted view of their anti-fraud efforts. The company highlighted that user reports of scam advertisements have decreased significantly over the past 18 months and that millions of scam ads were removed in 2025. Additionally, the company is currently facing scrutiny from the Securities and Exchange Commission regarding advertising practices tied to financial fraud.

The impact of these scams is particularly severe for older adults, who suffer greater financial losses to digital fraud than any other age demographic. According to the FBI's 2025 Internet Crime Report, individuals over the age of 60 reported over 7.7 billion dollars in losses, a sharp increase from the previous year. AI-driven scams accounted for more than 3,100 of these complaints, representing hundreds of millions of dollars in total damages. Experts advise that consumers should remain skeptical of advertisements featuring celebrities, verify products through third-party searches, and report suspicious activity to authorities such as the Internet Crime Complaint Center.

有人就 Claude Code 工具提出了安全方面的担忧。有用户反馈，这款软件会在无意中向第三方网站泄露个人电子邮件地址。问题出现在 AI 代理进行网页搜索时：它把用户的电子邮件写入了 User-Agent 请求头。最初的报告者表示，这一行为导致垃圾邮件激增，让人愤怒，也让用户对开发者在用户隐私方面的做法失去了信心。

Anthropic 的代表澄清称，这并非刻意的功能，而是模型与网页交互方式带来的非预期结果。具体而言，像 Wikipedia 这类网站制定了相关规则，要求自动化客户端在请求头中使用联系电子邮件来表明身份。 AI 在研究任务中试图遵循这些约定时，会在未获得明确授权的情况下自动传播用户的电子邮件。

针对上述反馈，开发团队推出了一个内置模块 cc-plugin-privacy 。该更新从 2.1.317 及更高版本开始默认启用，通过确定性校验在发起网络请求时阻止电子邮件地址被传输。此后，团队已将该隐私模块的源代码公开，鼓励用户自行查看实现细节，并对其有效性提出反馈。

尽管修复已经发布，社区成员仍对开发流程不满。有用户指出，这个问题早在数月前就已被发现，并认为公司应优先梳理和处理积压的大量已报告漏洞，而不是只对引发关注的投诉作出回应。也有人提出临时的手动变通方案，例如为项目配置专属的 CLAUDE.md 文件，以严格约束 User-Agent 信息的处理方式，以及是否、以及在何种情况下可以披露电子邮件地址。 A security concern was raised regarding the Claude Code tool, where users reported that the software was inadvertently leaking personal email addresses to third-party websites. This occurred when the AI agent conducted web searches and included the user's email in the User-Agent request header. The original reporter noted that this behavior led to an influx of spam, prompting frustration and a loss of confidence in the developer's approach to user privacy.

Anthropic representatives clarified that this was not a deliberate feature but rather an unintended consequence of how the model interacts with the web. Specifically, some websites, such as Wikipedia, have established policies requiring automated clients to identify themselves with a contact email in the header. The AI, in attempting to follow these conventions during research tasks, automatically propagated the user's email without explicit authorization.

In response to these reports, the development team implemented a built-in mod called cc-plugin-privacy. This update, which is enabled by default in version 2.1.317 and later, uses deterministic checks to block the transmission of email addresses during web requests. The team has since made the source code for this privacy mod available to the public, encouraging users to inspect the implementation and provide feedback on its effectiveness.

Despite the release of the fix, community members expressed ongoing dissatisfaction with the development process. Some users pointed out that the issue had been identified months earlier and suggested that the company should prioritize triaging the massive backlog of reported bugs rather than only responding to high-profile complaints. Others proposed temporary manual workarounds, such as configuring project-specific CLAUDE.md files to strictly govern how User-Agent information is handled and when (or if) an email address may be disclosed.