Apple Support Community 作为一个久负盛名的讨论论坛，供用户交流故障排除经验并讨论公司的产品，现已正式走向终结。该平台目前已进入只读状态，并计划于 2026 年 11 月 20 日永久关闭。

此次关闭也意味着一项自 1998 年起便开始运转的服务正式画上句号。彼时它最初以 Apple Tech Exchange 的名称上线，经过数十年的发展，它一直是用户之间点对点技术互助的重要枢纽。尽管 Apple 感谢多年来为社区贡献专业知识的成员，但公司尚未明确说明，网站下线后这片规模庞大的历史帖子内容将如何处置。

在有关该决定的声明中，Apple 表示，此举是在对自身当前战略与客户需求进行仔细评估之后作出的。需要为设备寻求帮助的用户，将被引导前往官方 Apple Support 网站获取后续支持。目前仍不清楚平台正式关闭时，现有内容是会被存档保存，还是会被直接删除。 The Apple Support Community, a long-standing discussion forum for users to exchange troubleshooting advice and discuss company products, is officially coming to an end. The platform has already transitioned into a read-only state, and it is scheduled to be permanently shut down on November 20, 2026.

This closure marks the conclusion of a service with a history stretching back to 1998, when it originally launched as the Apple Tech Exchange. Over the decades, it served as a primary hub for peer-to-peer technical assistance. While Apple has thanked the community members who contributed their expertise over the years, the company has not clarified what will become of the vast archive of historical posts once the site is taken down.

In a statement regarding the decision, Apple indicated that the move follows a careful evaluation of its current strategy and customer needs. Users seeking assistance for their devices are being directed to utilize the official Apple Support website for future guidance. At this time, it remains unclear if the existing content will be archived or simply erased when the platform officially closes its doors.

现代智能电视变得越来越先进，但这项技术往往也引发了对消费者隐私的担忧。许多用户担心自己的设备会如何追踪他们的行为，比如通过监听家中的音频、记录屏幕上显示的内容，或将个人数据上传并与云端服务器共享。为回应这些顾虑，针对亚马逊、 Apple 、 Google 、 LG 、 Roku 、三星和 TCL 等主要电视与流媒体设备制造商，提出了 17 个直接问题，目的是超越隐私政策中常见的模糊措辞。

这些回复明确指出，数据收集通常与语音助手（Voice Assistants）和自动内容识别（Automatic Content Recognition，ACR）等特定功能相关。大多数公司表示，它们的麦克风被设计为只会在特定触发条件下启动，例如按下遥控器上的实体按钮或使用唤醒词，而不是对家庭进行持续、被动的监控。此外，各公司普遍强调，用于识别正在观看内容以提供推荐或衡量指标的 ACR 技术，不会截取屏幕内容的实际截图或录制视频。相反，它通常依赖音频指纹来识别正在播放的媒体。

尽管这些保证仍然存在，这些回复也反映出一种现实：要让核心服务正常运作，往往需要进行数据传输。虽然不少功能允许用户选择是否开启，但公司承认，如果用户想保留完整的智能体验，就无法彻底阻止数据传输。例如，Google 和 Amazon 等制造商表示，基础的设备健康遥测以及与账户相关的信息，对电视的正常运行是必需的。因此，即便用户可以调整隐私设置来减少个性化广告或特定追踪，他们也很少有机会在设备保持联网的前提下，关闭所有形式的数据交换。

各厂商的透明度差异很大：有些公司会提供详细、针对具体型号的说明，而另一些公司则对部分问题拒绝回答，或干脆没有回应。即便用户选择退出数据收集，这种退出方式也不一定完全可靠；有研究指出，由于常规运维所需的操作数据，网络流量可能仍会持续产生。调查结果表明，尽管用户如今比过去拥有更多控制权，但要真正理解智能电视的数据"足迹"，仍需要仔细查看各家公司的具体政策，并愿意逐项管理设置。 Modern smart TVs have become increasingly sophisticated, but this technology often comes with concerns about consumer privacy. Many users worry about how their devices might be tracking their behavior, whether by listening to home audio, recording what is on the screen, or sharing personal data with cloud servers. To address these concerns, a series of 17 direct questions were put to major TV and streaming device manufacturers, including Amazon, Apple, Google, LG, Roku, Samsung, and TCL, to move beyond the opaque language typically found in privacy policies.

The responses clarify that data collection is often tied to specific features like voice assistants and Automatic Content Recognition (ACR). Most companies state that their microphones are designed to activate only upon a specific trigger, such as a physical button press on a remote or a wake word, rather than engaging in continuous, passive surveillance of a home. Furthermore, companies generally maintain that ACR technology, which identifies content being viewed to provide recommendations or metrics, does not capture actual screenshots or video recordings of what is on the display. Instead, it typically uses audio fingerprinting to identify the media being played.

Despite these assurances, the responses highlight a landscape where data transmission is often required for core services to function. While many features are opt-in, companies acknowledge that users cannot entirely stop data transmission if they want to maintain full smart functionality. Some manufacturers, such as Google and Amazon, note that basic device health telemetry and account-based information are necessary for the TV to operate properly. Consequently, while users can manage privacy settings to limit personalized ads or specific tracking, they are rarely given an option to disable every form of data exchange while keeping the device connected to the internet.

Transparency varies significantly among the manufacturers, with some companies providing detailed, model-specific explanations while others declined to answer certain questions or failed to respond entirely. Even when users opt out of data collection, the methods for doing so are not always foolproof, and some research suggests that traffic might continue due to routine operational data requirements. The survey results underscore that while users have more control today than in the past, understanding the data footprint of a smart TV requires a careful review of specific company policies and a willingness to manage settings individually.

沙盒模拟器是一款交互式、超逼真的数字体验，旨在直接在桌面、平板电脑和手机的 Web 浏览器中运行。借助 WebGL2 和 JavaScript，它提供了流畅且响应迅速的环境，用户能够在其中实时操控颗粒。界面支持直接互动：用户只需用手指或鼠标光标推动沙粒，就能以更具触感的方式模拟沙子的物理行为。

除了基础互动，模拟器还加入了基于运动的控制，让真实感更进一步。用户可以倾斜设备，使沙子在屏幕上自然滑动；也可以摇晃设备，将沙粒抖散。得益于这些功能，体验仿佛扎根于物理世界：数字画布变成了会随硬件方向与移动而变化的动态沙箱。

项目提供多种审美设置，用户可以选择不同类型的沙子，如 river 、 beach 、 desert 、 volcanic 或 coral 。每种模式都呈现出独特的视觉风格，仿照自然环境中对应的纹理与色彩特征。再加上可以持续不断倾倒新沙的能力，材料来源几乎无穷，让用户能够尽情操纵或堆叠。

功能选项同样延伸到沙子下方的环境，提供 light 、 lock screen interaction 和 screen-off behavior 的可切换设置。用户还可以选择开启 sound，为沙粒的视觉运动增添一层听觉体验。通过将这些实用功能与直观的触摸及运动控制结合在一起，这款模拟器把技术性的 WebGL 演示与放松、富有创意的工具连接了起来。 The sand simulator is an interactive, hyper-realistic digital experience designed to run directly within web browsers on desktops, tablets, and phones. By leveraging WebGL2 and JavaScript, the tool provides a fluid, responsive environment where users can manipulate granular particles in real time. The interface allows for direct interaction, enabling users to push grains with their fingers or mouse cursors, simulating the physical behavior of sand in a tactile way.

Beyond simple interaction, the simulator incorporates motion-based controls to enhance the feeling of realism. Users can tilt their devices to cause the sand to slide naturally across the screen or shake the device to scatter the grains. These features make the experience feel grounded in physics, turning a digital canvas into a dynamic sandbox that reacts to the orientation and movement of the hardware.

The project offers a variety of aesthetic settings, allowing users to select different types of sand such as river, beach, desert, volcanic, or coral varieties. Each setting provides a distinct visual style, mimicking the texture and color profiles found in natural environments. This variety, paired with the ability to continuously pour fresh sand, creates an endless supply of material to manipulate or stack.

Functional options also extend to the environment under the sand, providing toggleable settings for light, lock screen interaction, and screen-off behavior. Users have the option to enable sound, adding an auditory layer to the visual movement of the grains. By integrating these utility features with intuitive touch and motion controls, the simulator bridges the gap between a technical WebGL demonstration and a relaxing, creative tool.

来自 MIT CSAIL 的最新研究引入了 weight-space programming，证明大型语言模型可以通过直接编辑其他网络的权重来完成复杂任务，而不必通过传统的基于梯度的方法进行训练，例如玩游戏或提升数学推理能力。在针对 Qwen3.5-0.8B 模型的一项实验中，Astra 仅通过修改其权重中极小的一部分，就将基础模型的数学准确率从 7.9% 提升到了 48.1% 。这种干预通过改变模型在推理过程中 residual stream 的移动方式，切实解决了常见的 thinking loops 失败问题，也就是模型陷入不断重复相同序列的困境。

Astra 的实现方式是：先在模型内部激活中找到一个特定方向（称为 loop direction），然后通过编辑权重将该方向从模型输出中减去。该过程需要定位模型矩阵中哪些特定列在促成循环行为，并对它们进行数学层面的调整。尽管 Astra 采用了持续数小时的试错来确定要改哪些权重、改多少，但很快就能看出：整个优化过程可以被表述为一个 linear program 。

通过把 loop direction 设为约束条件，并为模型在 looping tokens 和 productive tokens 上的表现设定目标，linear program 能比通过试错搜索的智能体更高效地求出所需的权重改动。借助 primal-dual hybrid gradient solver，可以在仅修改八分之一权重的情况下获得几乎相同的性能提升。此外，该方法还能使用 heuristic directions：它们无需依赖复杂的推理智能体，就能识别 loop vector，从而进一步简化流程。

对这些编辑的分析表明，这种干预本质上相当于一个 constant steering vector 。由于所选权重在大量 tokens 中都持续被激活，该编辑的效果就类似于在特定层向 residual stream 添加了一个固定偏置。尽管这种持续推动足以阻止模型循环并显著增强推理能力，但仍要求精确的推动强度：推动过弱，循环会卷土重来；推动过强，则会削弱模型的推理表现。

最终，这套 linear programming 方法不仅证明了 weight-space editing 可以被系统化并实现高效率，同时也揭示了：被纠正的行为往往源于模型激活空间里简单且可预测的模式。这项技术也为处理其他模型行为（例如 refusal 或特定风格输出）提供了新思路——通过采用类似的优化方法，识别并锁定 residual stream 中控制这些输出的关键方向。 Recent research from MIT CSAIL introduced weight-space programming, demonstrating that large language models can perform complex tasks, like playing games or improving mathematical reasoning, by directly editing the weights of other networks rather than training them via traditional gradient-based methods. In a specific experiment involving the Qwen3.5-0.8B model, the model Astra successfully improved the base model's math accuracy from 7.9% to 48.1% by modifying a tiny fraction of its weights. This intervention effectively addressed the common failure of thinking loops, where models become trapped repeating sequences, by altering how the model's residual stream moves during inference.

Astra accomplished this by finding a specific direction in the model's internal activations, labeled as the loop direction, and then editing the weights to subtract this direction from the model's output. The process involved identifying which specific columns within the model's matrices were contributing to the looping behavior and adjusting them mathematically. While Astra relied on a trial-and-error approach over several hours to determine which weights to change and by how much, it became clear that this entire optimization process could be framed as a linear program.

By defining the loop direction as a constraint and setting specific goals for the model's behavior on looping and productive tokens, a linear program can solve for the necessary weight adjustments far more efficiently than an agent searching by trial and error. Utilizing a primal-dual hybrid gradient solver, it is possible to achieve nearly identical performance improvements while changing eight times fewer weights. This approach also allows for the use of heuristic directions, which can identify the loop vector without requiring a sophisticated reasoning agent, further simplifying the process.

The investigation into these edits revealed that the intervention is essentially acting as a constant steering vector. Because the chosen weights are consistently active across many tokens, the edit functions much like adding a fixed bias to the residual stream at specific layers. While this constant push is enough to stop the model from looping and significantly improve its reasoning capabilities, it requires a precise strength setting. If the push is too weak, the loops return, and if it is too strong, the model's reasoning performance degrades.

Ultimately, while the linear programming approach proves that weight-space editing can be systematized and made highly efficient, it also highlights that the behavior being corrected often stems from simple, predictable patterns in the model's activation space. This technique opens the door to addressing other model behaviors, such as refusal or stylistic patterns, by applying similar optimization methods to identify and target the specific directions within the residual stream that govern these outputs.

在推出社会计划或政策之前，社会应先举行一场谦卑的"仪式"，承认我们深刻的无知。尽管这些举措旨在造福公众，但在教育、医疗和国际援助领域，令人意外的是，大量重大干预都未能达到预期效果。从未带来结果的学校改进补助金，到未能改变机构人口结构的多样性倡议，这些反复出现的失败说明，我们最精心的计划常常建立在并不牢靠的基础之上。

社会科学长期都在面对这一困境。 Peter Rossi 那著名的、尽管带着玩笑意味的评价"金属定律"（metallic laws of evaluation）就体现了这种担忧。他认为，大型社会项目的净影响往往为零，尤其是当项目试图从根本上改变人的行为时。尽管研究不断进步，稳定且可靠的实际成效依然难以获得。一些一次性的研究常被宣传为成功案例，但这些结论很少能在严格审查中站得住脚，于是出现一种局面：数十年的研究最终往往以令人失望的"无效结果"收场。

之所以会固执地继续推行无效干预，是因为人们存在一种心理上的控制错觉。就像人们会错误地相信自己能通过行动影响彩票这类随机结果一样，政策制定者和慈善机构也常常觉得，只要他们投入了干预，就一定会成功——仅仅因为他们抱着这样的意图。这种自信极其普遍，以至于许多项目在没有明确衡量"成功"的标准、也从未开展真正评估的情况下就照常推进，并默认良好的初衷本身就足以证明有效。

当这些项目不可避免地失灵时，人们通常会采取讨价还价、否认，或干脆彻底认命的反应。他们可能会转向自认为符合常识的做法，比如现金转移支付，却发现即便是这些手段也缺乏稳定的成功证据。还有人会使用"并非真正的苏格兰人"（no true Scotsman）式的辩护，把失败归咎于执行过程，而不是核心理念本身。不过，最具破坏性的反应是彻底认命：把解决社会问题的难度误当成不可能，从而让我们彻底放弃努力去改善世界。

最终，我们需要朝着科学成熟迈进：承认我们并不真正理解人类心智，也无法完全把握社会系统的复杂性。困在这种中间状态并不是停止前进的理由，而恰恰是拥抱更严谨的"猜测—核实"方法的理由。我们实际上还处在发现的早期阶段，类似古代学者：他们或许捕捉到了一些准确的线索，但对支撑世界的机制却存在深刻误解。与其把自己当作已经找到了终局答案，不如培养谦卑的态度，为未来的进步播下种子，并接受：真正有效的干预既需要耐心，也需要愿意从失败中吸取教训。 Before launching social programs or policies, society should adopt a ritual of humility to acknowledge our profound ignorance. While intended to serve the public good, a surprising number of major interventions in education, healthcare, and international aid fail to produce their desired effects. From school improvement grants that yielded no results to diversity initiatives that failed to shift institutional demographics, these persistent failures suggest that our best-laid plans are often built on shaky foundations.

The social sciences have long grappled with this, as evidenced by Peter Rossi's famous, albeit tongue-in-cheek, metallic laws of evaluation. Rossi argued that the net impact of large social programs is often zero, particularly when those programs seek to fundamentally change human behavior. Despite advancements in research, consistent and reliable impact remains elusive. One-off studies are frequently touted as successes, yet these findings rarely hold up under rigorous scrutiny, leading to a landscape where decades of research often culminate in disappointing null results.

This tendency to persevere with ineffective interventions is rooted in a psychological illusion of control. Just as people falsely believe they can influence random outcomes like lotteries through personal action, policymakers and philanthropists often feel their interventions will succeed simply because they intend them to. This confidence is so pervasive that many projects proceed without defining success or ever attempting a real evaluation, assuming that their good intentions are sufficient proof of efficacy.

When these programs inevitably falter, people typically react with bargaining, denial, or total resignation. They might pivot to what they view as common sense solutions, such as cash transfers, only to find that even these measures lack consistent evidence of success. Others retreat into a "no true Scotsman" defense, blaming the implementation rather than the core idea. However, the most damaging response is total resignation, where the difficulty of solving social problems is mistaken for impossibility, causing us to abandon the effort to improve our world altogether.

Ultimately, we must move toward scientific maturity by admitting that we do not fully understand the human mind or the complexities of societal systems. Being stuck in this middle state is not a reason to stop, but a reason to embrace a more rigorous "guess and check" approach. We are effectively living in the early stages of discovery, much like ancient scholars who held some accurate insights while being deeply mistaken about the underlying mechanisms of the world. Rather than assuming we have arrived at final answers, we should cultivate the humility to plant seeds for future progress, accepting that successful intervention requires both patience and the willingness to learn from failure.

这次发现源于作者在前往秘鲁旅行途中，关于历史探索的一个简单问题。受到 Hiram Bingham 寻找失落城市的启发，作者思考现代技术能如何应用于考古发现。通过与包括 Gemini 、 ChatGPT 、 Claude 和 Grok 在内的多种 AI agents 合作，作者确定 lidar 是最合适的工具。由于卫星影像常被茂密的丛林树冠遮挡，lidar 利用激光脉冲绘制植被下方的地表，从而让人能够看到肉眼难以察觉的隐藏信息。

团队随后将研究重点从秘鲁转向玛雅地区，因为那里更容易获取公开的 lidar 数据。仅用了一个晚上，48 个 AI agents 就分析了约 1,200 平方公里的丛林影像。它们像高度勤勉、条理清晰的研究人员一样逐一手动查看图像，识别金字塔、广场和平台等人造结构，同时剔除自然地貌。到第二天早上，agents 已经标记出若干看起来像是未被发现的地点：这些地点呈现出与周围环境截然不同的锐利人工棱角与清晰的建筑布局。

其中有一处地点尤为引人注目：它包括一个已被整理得较为平整的广场、一座高约 8 到 12 米的金字塔、一个抬高的庭院，以及一个可能的蓄水设施。为确认该位置是否早已登记，agents 对既有文献和考古档案进行了细致核查。确认这一异常并非既知记录后，AI agents 便向作者提供了联系 Mexico's National Institute of Anthropology and History（INAH）的必要步骤。根据他们的指导，作者撰写了正式报告，并将其翻译成西班牙语以确保表达清楚。

提交结果后，墨西哥相关部门的回复在 72 小时内到达。 INAH 证实，在所提供的坐标处没有已登记的考古遗址记录。尽管这还未达到官方实地发现的标准，但现有数据表明该地点很可能是经典时期的玛雅政务中心，或许是用于举行仪式、进行地方治理以及日常生活的枢纽。作者表示，只要 INAH 决定派遣团队到现场核实，他愿意提供协助。

回顾整个过程，作者认为自己在考古领域的"外行"身份反而带来了优势：它让自己能够用一种全新、没有包袱的方式去面对一个长期存在的问题。通过把现成的计算资源和 AI agents 与公开数据结合起来，人们就能在极短的时间内完成重要的科学工作。这一成果凸显了 AI 作为各学科催化力量的潜力，也意味着，阻碍发现的主要剩余因素只有人类的好奇心与想象力。 The discovery began with a simple question about historical exploration while traveling through Peru. Inspired by Hiram Bingham's search for lost cities, the author wondered how modern technology could be applied to archaeological discovery. Collaborating with various AI agents, including Gemini, ChatGPT, Claude, and Grok, the author identified lidar as the ideal tool. Because satellite imagery is often obstructed by dense jungle canopy, lidar, which uses laser pulses to map the ground beneath the vegetation, offered a way to see what remained hidden to the naked eye.

The team shifted their focus from Peru to the Maya region, where public lidar data is more accessible. Overnight, forty-eight AI agents analyzed approximately 1,200 square kilometers of jungle imagery. They acted as highly diligent, methodical researchers, manually inspecting images to identify man-made structures like pyramids, plazas, and platforms while filtering out natural features. By the next morning, the agents had flagged several sites that appeared to be undiscovered, displaying sharp, artificial corners and structural layouts that clearly contrasted with the surrounding landscape.

One particular site caught their attention, featuring a leveled plaza, an 8 to 12-meter-tall pyramid, a raised courtyard, and a potential water reservoir. The agents performed a thorough review of existing literature and archaeological archives to confirm that the location was not already registered. Once confident in the anomaly, the AI agents provided the author with the necessary instructions to contact Mexico's National Institute of Anthropology and History (INAH). Following their guidance, the author prepared a formal report, which was translated into Spanish to ensure clarity.

After submitting the findings, the response from the Mexican authorities arrived within 72 hours. INAH confirmed that there was no record of an archaeological site at the provided coordinates. While not yet an official field discovery, the data suggests the site was a Maya civic center from the Classic period, likely serving as a hub for ceremonies, local governance, and daily life. The author has offered to support a potential field investigation should INAH choose to send a team to verify the findings on the ground.

Reflecting on the process, the author notes that being an outsider in the field of archaeology proved to be an advantage, as it allowed for a fresh, unburdened approach to a long-standing problem. By combining readily available compute resources and AI agents with existing public data, significant scientific work can be accomplished in a remarkably short time. This achievement highlights the potential for AI to act as a catalyst across all scientific disciplines, suggesting that the only remaining limits to discovery are human curiosity and imagination.

一名研究人员发现了 NVIDIA GA100 die 上的一个电压故障注入漏洞，该漏洞可实现对 eFuses 的未授权修改。利用这一缺陷，能够把受限硬件（例如 CMP 170HX 挖矿卡）变成完全可用的 A100-80G 数据中心级 GPU 。这些解锁后的显卡甚至可能超过零售版 A100，因为该漏洞可让此前因良率管理而被禁用的所有 streaming multiprocessors 重新启用，使性能大约达到标准量产机型的 1.2 倍。

该漏洞的关键在于 NVIDIA 如何进行产品分层。 GA100 die 主要使用两类保险丝：标准物理 eFuses 以及所谓的 fuseless fuses 。物理保险丝是永久性的，而 fuseless fuses 更像一种脚本式机制，用于告知硬件哪些功能需要启用或关闭。研究人员通过搭建自定义的电压故障注入方案，绕过安全校验，并把新的配置写入 fuseless fuse 区域。这样就相当于推翻了把高性能 die 限制成挖矿卡的约束，从而使 PCIe Gen4 、 NVLink 以及完整 framebuffer 容量等能力得以恢复。

要实现这种绕过，必须对 GPU 的电压调节器进行精确控制。研究人员设计了一种故障注入机制，用于接入 PWMVID 信号，从而在 GPU 的启动过程中操纵供电电压。通过找到"Goldilock's glitch"这一状态，安全敏感的 option words 就能在不触发防御性锁定的情况下被清除。障碍解除后，用户即可对硬件进行编程，使其忽略人为设定的限制。整个过程高度专业，通常需要进行硬件改装，包括拆除特定电阻并进行人工焊接连接，才能成功与显卡的供电系统建立接口。

这项研究带来的结果是显著的硬件能力提升。除了承载众多此类挖矿卡上本就具备的完整 80GB 内存外，用户还能够启用 Multi-Instance GPUs 与 NVDEC 等更高级功能，但前提是他们完成所需的硬件与固件调整。该研究在发表前已向 NVIDIA 的安全团队披露，然而相关技术已公开发布，目的是加深对 GA100 架构的理解，并展示那些因市场分层而本应长期处于沉睡状态的强大功能，仍可能被解锁。 A researcher has identified a voltage fault injection vulnerability on the NVIDIA GA100 die that allows for the unauthorized modification of eFuses. By exploiting this flaw, it is possible to convert restricted hardware, such as the CMP 170HX mining card, into a fully functional A100-80G datacenter-grade GPU. These unlocked cards can even outperform retail A100 units because the exploit enables all available streaming multiprocessors that were previously disabled for yield management, resulting in roughly 1.2 times the performance of standard production models.

The core of the vulnerability lies in how NVIDIA manages product segmentation. The GA100 die uses two main types of fuses: standard physical eFuses and so-called fuseless fuses. While physical fuses are permanent, fuseless fuses act as a script-like system that tells the hardware which features to enable or disable. By using a custom voltage glitching setup, the researcher was able to bypass security checks and write new configurations to the fuseless fuse region. This effectively overrides the restrictions that turn a high-performance die into a limited mining card, allowing for the restoration of features like PCIe Gen4, NVLink, and full framebuffer capacity.

Implementing this bypass requires precise control over the GPU's voltage regulator. The researcher developed a glitching mechanism that taps into the PWMVID signal to manipulate the supply voltage during the GPU's boot sequence. By finding the "Goldilock's glitch" state, the controller's security-sensitive option words can be cleared without triggering defensive locks. Once these barriers are removed, the user can program the hardware to ignore its artificial limitations. This process is highly technical and requires hardware modifications, including the removal of specific resistors and manual soldering of connections, to successfully interface with the card's power delivery system.

The end result of this research is a significant transformation in hardware capability. Beyond simply accessing the full 80GB of memory found on many of these mining cards, users can now enable advanced functionalities such as Multi-Instance GPUs and NVDEC, provided they perform the necessary hardware and firmware adjustments. While the research was disclosed to NVIDIA's security team prior to publication, the techniques have been released publicly to foster deeper understanding of the GA100 architecture and to demonstrate the potential for unlocking powerful features that would otherwise remain dormant due to market segmentation.

由于涉及 eMudhra 中间证书的安全事件，需要从包括 certifi 在内的通用 CA 捆绑包中移除 emSign 根 CA 证书。用户必须立即升级一系列软件包，并在重建容器镜像时禁用层缓存，以确保获取最新、受信任的系统证书。若不进行这些更新，系统将容易遭受"中间人攻击"，从而可能破坏与 python.org 和 pypi.org 等关键服务之间的安全连接。

受影响并已更新的软件范围很广，包括 pip 、 uv 、 certifi 的各个版本，以及 hatch 、 conda 和 virtualenv 等多种开发工具。我们敦促开发者升级到指定版本或更新版本，以降低相关风险。使用 Docker 的用户也已注意到，3.11 到 3.15 版本的官方 Python 镜像已更新，以修复这一安全漏洞。

除了更新软件包外，Python 维护者也发布了语言本身的新版本。其中包括 Python 3.15.2 、 3.14.10 、 3.13.18 、 3.12.16 和 3.11.18，它们内置会自动拒绝受损中间证书的逻辑，即便系统的 CA 捆绑包尚未完全更新，也能提供至关重要的防御层。仍在使用旧版本 Python（尤其是 3.10 及更早版本）的用户需要注意：这些版本已进入生命周期末期，不再提供这些关键的安全修复。

在技术通报之外，社区也在悼念 Tim Peters 的离世。 Guido van Rossum 透露，Peters 是 Python 历史上极为重要的人物，今年早些时候已去世。他对该语言的影响深远，从早期贡献（如混合算术支持）到长期担任导师与共同设计者的角色，都体现出他不可替代的价值。 Peters 以耐心著称，数学功底严谨，同时也善于用易懂且包容的方式解释复杂的设计挑战。

Peters 还通过他创作的 Zen of Python 留下了持久的遗产，这一作品至今仍在塑造社区的理念；他也开发了 Timsort，这种算法如今已被全球范围内的多种语言采用。同事们不仅记得他的技术天才，也记得他的谦逊和他与社区互动的独特方式——他常常用幽默与热情来化解技术分歧。他对早期 Python 开发文化的影响，以及他在 Python Software Foundation 董事会中的专注服务，为该语言走向广泛普及奠定了基础。 A security incident involving eMudhra intermediate certificates has necessitated the removal of the emSign root CA certificate from common CA bundles, including the certifi package. Users must immediately upgrade a range of software packages and rebuild container images with layer caching disabled to ensure they fetch the latest, trusted system certificates. Failure to perform these updates leaves systems vulnerable to monster-in-the-middle attacks that could compromise secure connections to critical services like python.org and pypi.org.

The list of affected and updated software is extensive, including versions of pip, uv, certifi, and various development tools like hatch, conda, and virtualenv. Developers are urged to upgrade to the specified versions or newer to mitigate these risks. For those using Docker, the official Python images for versions 3.11 through 3.15 have also been updated to address this security flaw.

In addition to updating packages, the Python maintainers have released new versions of the language itself. These releases, including Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18, contain logic that automatically rejects the compromised intermediate certificates, providing a crucial layer of defense even if a system's CA bundle has not yet been fully updated. Users operating on older versions of Python, specifically 3.10 and earlier, should be aware that these versions are end-of-life and no longer receive these vital security fixes.

Beyond the technical alerts, the community is mourning the loss of Tim Peters, a central figure in Python's history who passed away earlier this year. Guido van Rossum shared the news, highlighting Peters's immense impact on the language, from his early contributions like mixed arithmetic support to his role as a long-term mentor and co-designer. Peters was well known for his patience, his mathematical rigor, and his ability to explain complex design challenges in ways that were accessible and inclusive.

Peters left a lasting legacy through his creation of the Zen of Python, which continues to shape the community's philosophy, and the development of Timsort, an algorithm now used globally in languages beyond Python. Colleagues remember him not just for his technical genius, but for his humility and his unique approach to community interaction, where he famously used humor and warmth to resolve technical disagreements. His influence on the culture of early Python development and his dedicated service on the board of the Python Software Foundation were foundational to the language's rise to prominence.

将 SSH keys 存储在 macOS 的 Secure Enclave 中进行保护，可以提供强有力的安全保障：即便机器被入侵，也能防止私钥被提取。该方案利用一个与主处理器隔离的安全子系统，确保真实的私钥不会出现在磁盘或系统内存里。 Mac 并不保存原始密钥本身，而是保留一个引用；每次进行签名操作时，都必须通过硬件支持的身份验证来完成。借助内置的 CryptoTokenKit，用户可以在每次发起 SSH 连接时强制进行 Touch ID 验证，从而在增强安全性的同时，也能清楚地了解密钥何时被访问。

要搭建这一套流程，用户可以使用 sc_auth 命令创建一个符合 FIDO2 标准并绑定 Secure Enclave 的身份。密钥在满足相应生物识别要求的前提下生成后，会创建一个密钥句柄，作为标准 SSH 工具的接口。由于 macOS 在连接过程中不会自动识别这些非标准密钥名称，用户需要在 SSH 配置文件中手动指定这些密钥的路径。同时，还必须设置 SSH_SK_PROVIDER 环境变量，指向对应的系统库，以便 Shell 在身份验证阶段能够与 Secure Enclave 可靠通信。

这套原生实现既安全又不依赖第三方软件，但在易用性和恢复方面仍有一些取舍。最明显的不足是 Touch ID 提示的用户界面略显粗糙，观感和常见的 macOS 体验不够一致。此外，由于密钥是在硬件内部生成、且无法导出，它们与本机设备紧密绑定。丢失 Mac 就相当于丢失密钥，因此需要在服务器的 authorized_keys 文件中提前注册多个密钥，例如备用硬件令牌，或来自另一台机器的备份 Secure Enclave 密钥，以确保访问能力持续可用。

总体而言，选择基于硬件的方案，相比把密钥当作纯文本文件保存，提升非常显著。每次使用都要求生物识别验证，能消除恶意软件静默外传密钥的风险。虽然部分用户可能觉得原生界面不够精致，但底层机制依然是一个强大且内建的安全解决方案。若用户觉得原生提示过于打扰，还可以考虑 Secretive 等第三方方案：它们同样提供类似的基于硬件的架构，并能带来更顺滑的用户界面，同时保留 Secure Enclave 的核心优势。 Protecting SSH keys by storing them within the macOS Secure Enclave offers a robust security layer that prevents private keys from being extracted, even if a machine is compromised. This approach leverages a security subsystem isolated from the main processor, ensuring that the actual private key never exists on the disk or in system memory. Instead of storing a raw key, the Mac keeps a reference that requires hardware-backed authentication for every signing operation. By utilizing the built-in CryptoTokenKit, users can enforce Touch ID verification whenever an SSH connection is initiated, providing both enhanced security and transparency regarding when the key is being accessed.

To set up this system, users can utilize the sc_auth command to create a FIDO2-compliant identity linked to the Secure Enclave. Once a key is generated with the proper biometric requirements, a key handle is created to serve as the interface for standard SSH tools. Because macOS does not automatically recognize these non-standard key names during the connection process, users must explicitly define the path to these keys in their SSH configuration files. It is also necessary to set the SSH_SK_PROVIDER environment variable to point to the correct system library, allowing the shell to communicate with the Secure Enclave effectively during authentication.

While this native implementation is highly secure and requires no third-party software, it comes with certain trade-offs regarding usability and recovery. The most notable drawback is a somewhat unpolished and aesthetically unrefined user interface for the Touch ID prompts, which can feel inconsistent with the typical macOS experience. Furthermore, because the keys are generated inside the hardware and cannot be exported, they are inextricably tied to the host device. Losing the Mac means losing the key, making it essential to register multiple keys—such as a secondary hardware token or a backup Secure Enclave key from another machine—in the server's authorized_keys file to ensure continued access.

Ultimately, opting for a hardware-backed approach is a significant step up from keeping keys as plain text files. Requiring biometric verification for every use eliminates the risk of silent key exfiltration by malicious software. Although some users might find the native UI clunky, the underlying mechanism remains a powerful, built-in solution for those prioritizing security. For those who find the native prompts too intrusive, third-party alternatives like Secretive can offer a similar hardware-backed architecture with a more refined user interface, while still maintaining the core benefits of the Secure Enclave.

早在 1980 年代初期，当 8-bit PC 硬件受到极其严重的限制时，制作流畅、可玩的电子游戏是一项极其耗费精力的优化工作。作者的一位朋友当时正在开发一款图形密集的横向卷轴游戏，游戏几乎已经完成，但却深受帧率过低而无法运行的问题困扰。尽管程序员已经应用了诸如循环展开（loop unrolling）等标准优化手段，但游戏速度依然缓慢。当时的挑战在于硬件缺乏诸如 blitters 或 texture mappers 等现代特性，这要求程序员必须手动逐字节地移动数据以将图像绘制到屏幕上。

作者在研究代码后意识到，瓶颈在于负责将 background tiles 复制到 screen buffer 的那段程序。机器使用的 6809 处理器提供了一些特定且强大的寻址模式，但朴素的复制例程的周期计数依旧很高。通过进一步展开循环，并手动计算内存访问的偏移量，他们实现了 60% 的速度提升。然而，这仍不足以满足游戏的性能要求，于是作者开始寻求更非传统、近乎"疯狂"的解决方案。

在查阅 6809 微处理器手册后，作者发现处理器的 stack 指令可以被改造成用于快速数据传输。通过征用硬件 stack 寄存器，即 S 和 U，作者开发出一种方法：利用包括 DP 寄存器在内的所有可用寄存器，以单次突发（single burst）的方式把数据从 tile 中取出并推送到 screen buffer 。这种方案效率极高，但也带来了副作用——tiles 会被绘制得上下颠倒，且左右两半被交换。

为了解决这一问题，两人意识到这种"搅乱"过程其实是一个 involution 。于是他们在游戏运行前就对 tiles 做了预处理，提前把内部结构反转。这样一来，等到把被破坏的数据绘制到屏幕后，图像在到达屏幕时会被自动完美地还原。该方案带来了 70% 的速度提升，基本有效地解决了性能问题。但当他们为声音加入 hardware-clocked interrupts 时，最后一道难题出现了。由于该例程需要征用 stack pointer，如果在绘制 tile 的过程中触发中断，就会覆盖保存 reference tiles 的内存。

他们通过巧妙地交换 stack 指针来化解这次最终的技术危机，确保中断造成的任何破坏都会落到 screen buffer 上，而不是原始的 tile data 。为了避免这种短暂的屏幕异常被玩家看到，他们调整了绘制顺序：从高内存往低内存绘制。这样，任何意外的损坏都会在下一张 tile 被绘制时被覆盖，从而保证在 buffer 送往显示器之前问题不会显现出来。

回想当初，作者把这段经历视作早期计算时代所必需的创造力的证明。面对极其苛刻的硬件限制，程序员不得不反复尝试、失败并迭代，才能找到既巧妙又有时不那么正统的解决方案。这个故事也提醒人们：在这样的技术挑战中，同样能收获乐趣，并鼓励他人把自己的经验记录下来，免得这些具有专业性与历史意义的见解随着时间流逝而被遗忘。 Back in the early 1980s, when 8-bit PC hardware was incredibly limited, creating smooth, playable video games was a grueling exercise in optimization. A friend of the author was developing a graphically intensive side-scroller that was nearly complete but suffered from unplayable frame rates. Despite the programmer having already applied standard optimizations like loop unrolling, the game remained too slow. The challenge was that the hardware lacked modern features like blitters or texture mappers, requiring programmers to manually move data byte by byte to draw images onto the screen.

The author, after studying the code, realized that the bottleneck was the routine responsible for copying background tiles to the screen buffer. The 6809 processor used in the machine offered specific, powerful addressing modes, but the cycle counts for the naive copying routine remained high. By further unrolling the loops and manually calculating offsets for memory access, they achieved a 60 percent speed increase. However, this was still insufficient to meet the performance requirements of the game, leading the author to seek even more unconventional, "crazy" solutions.

After consulting a 6809 microprocessor manual, the author discovered that the processor's stack instructions could be repurposed for rapid data movement. By commandeering both the hardware stack registers, S and U, the author developed a method to pull data from a tile and push it to the screen buffer using every available register—including the DP register—to move blocks of data in a single burst. This approach was remarkably efficient, but it introduced a side effect: the process drew the tiles upside down and with their halves swapped.

To overcome this, the pair realized that the mangling process was actually an involution. By pre-processing the tiles to reverse their internal structure before the game ran, the act of drawing the corrupted data would perfectly restore the images once they reached the screen. This solution provided a 70 percent speed improvement, effectively solving the performance issues. However, a final hurdle emerged when they implemented hardware-clocked interrupts for sound. Because the routine relied on commandeering the stack pointer, an interrupt occurring during a tile draw would overwrite the memory where the reference tiles were stored.

They addressed this final technical crisis by cleverly swapping the stack pointers, ensuring that any corruption caused by an interrupt would target the screen buffer rather than the original tile data. To prevent this temporary screen glitch from being visible to the player, they altered the drawing order to proceed from high memory to low memory. This ensured that any accidental corruption would be overwritten by the next tile being drawn before the buffer was sent to the display.

Looking back, the author highlights this experience as a testament to the ingenuity required during the early era of computing. Faced with severe hardware limitations, programmers had to constantly experiment, fail, and iterate to find elegant, if sometimes unorthodox, solutions. The story serves as a reminder of the joy found in such technical struggles and an encouragement for others to document their own experiences before these specialized, historic insights are lost to time.