pwn.college 是一个实践型教育平台,旨在让学习者沉浸在计算的核心领域,从而培养必备的网络安全技能。参与者从 white belts 起步,随后在直接与终端、 CPU 和网络交互的过程中掌握相关概念,并逐步晋级,获得不同颜色的 belts 。该平台由亚利桑那州立大学(Arizona State University)的一支团队维护,并向全球学生和感兴趣的个人免费开放,是 ASU 自身网络安全课程的重要组成部分。 pwn.college serves as a hands-on educational platform designed to help learners develop essential cybersecurity skills by immersing them in the core of computing. Participants begin their journey as white belts and progress through various levels, earning different colored belts as they master concepts by interacting directly with terminals, CPUs, and networks. The platform is maintained by a team at Arizona State University and is available for free to students and interested individuals worldwide, forming a significant component of ASU's own cybersecurity curriculum.
pwn.college 是一个实践型教育平台,旨在让学习者沉浸在计算的核心领域,从而培养必备的网络安全技能。参与者从 white belts 起步,随后在直接与终端、 CPU 和网络交互的过程中掌握相关概念,并逐步晋级,获得不同颜色的 belts 。该平台由亚利桑那州立大学(Arizona State University)的一支团队维护,并向全球学生和感兴趣的个人免费开放,是 ASU 自身网络安全课程的重要组成部分。
dojos 中提供的挑战主要用于教学目的,并作为全球大学学生评分的依据。正因为其承担了教学功能,创建者希望用户不要在互联网上发布挑战的 walkthrough 、 solution videos 或带有直播尝试的内容。尽管这条规定是自愿性的,遵守它仍能帮助维持平台的持续可用性,也让课程对学生和讲师都保持有效。
如果你有兴趣将该平台纳入自己的课程,pwn.college 允许在标注适当署名的前提下,将其 lectures 和 slides 用于非商业用途并免费使用。教育机构甚至可以选择把这些挑战导入面向学生的 private dojos;团队也欢迎收到有关平台使用情况的通知,以支持他们持续的学术工作。课堂之外,该项目还希望通过举办基于活动的密集培训课程,与各类 conferences 进行更多互动。
当学习者在平台上不断进阶,学习之路仍将通向更高水平的熟练度,最终达到 brown belt 和 black belt 的阶段。团队鼓励毕业生通过 Capture The Flag 竞赛、长期 wargames,以及 CryptoHack 或 OST2 这类替代学习平台来进一步打磨技能。对于想要深入研究的人,创建者在 ASU 提供 internship 机会,并欢迎为支撑其网站的 open-source 基础设施贡献力量。
pwn.college serves as a hands-on educational platform designed to help learners develop essential cybersecurity skills by immersing them in the core of computing. Participants begin their journey as white belts and progress through various levels, earning different colored belts as they master concepts by interacting directly with terminals, CPUs, and networks. The platform is maintained by a team at Arizona State University and is available for free to students and interested individuals worldwide, forming a significant component of ASU's own cybersecurity curriculum.
The challenges provided within the dojos are primarily intended for educational purposes and serve as the basis for grading university students globally. Because of this pedagogical role, the creators ask that users refrain from posting walkthroughs, solution videos, or livestreamed attempts of the challenges to the internet. While this rule is voluntary, following it helps preserve the platform's viability and keeps the curriculum effective for students and instructors alike.
For those interested in integrating the platform into their own coursework, pwn.college allows for the free use of its lectures and slides for non-commercial purposes, provided proper attribution is given. Educational institutions even have the option to import these challenges into private dojos for their students, and the team welcomes notifications regarding the platform's usage to support their ongoing academic work. Beyond the classroom, the project also seeks to engage with conferences by offering intensive, event-based training sessions.
As learners advance beyond the platform, the journey continues toward achieving high-level proficiency, eventually reaching brown belt and black belt status. The team encourages graduates to refine their skills through Capture The Flag competitions, long-term wargames, and alternative learning platforms like CryptoHack or OST2. For those looking to delve deeper into research, the creators offer internship opportunities at ASU and welcome contributions to the open-source infrastructure that powers their site.
Thinking Machines 推出了 Inkling 2 Small,这是其第二代 Mixture-of-Experts 模型,拥有 5940 亿个总参数和 170 亿个激活参数。该模型支持图像输入,并提供可变的计算投入水平。在 agentic coding 、 vision 、 knowledge work 和 reasoning 等任务上,相比前代产品展现出显著的性能提升。目前,该模型可在 Tinker 平台上用于推理与微调;在完成全面的外部安全测试后,计划以 Apache 2.0 许可证发布权重。 Thinking Machines has introduced Inkling 2 Small, their second-generation Mixture-of-Experts model featuring 594 billion total parameters and 17 billion active parameters. This model supports both image inputs and variable effort levels, showing significant performance gains over its predecessor across agentic coding, vision, knowledge work, and reasoning tasks. It is currently available for inference and fine-tuning on the Tinker platform, with plans to release the weights under an Apache 2.0 license following comprehensive external safety testing.
Thinking Machines 推出了 Inkling 2 Small,这是其第二代 Mixture-of-Experts 模型,拥有 5940 亿个总参数和 170 亿个激活参数。该模型支持图像输入,并提供可变的计算投入水平。在 agentic coding 、 vision 、 knowledge work 和 reasoning 等任务上,相比前代产品展现出显著的性能提升。目前,该模型可在 Tinker 平台上用于推理与微调;在完成全面的外部安全测试后,计划以 Apache 2.0 许可证发布权重。
该模型在长周期的自主任务中表现尤为突出,例如通过程序化方式生成复杂环境,如城市模拟器或 PC 模拟器。其编码能力也通过在大规模数据集上进行强化学习得到增强,这些数据集引入了 agentic graders,使模型能更好地理解并执行指令,同时还能自主验证自己的输出。除软件开发外,Inkling 2 Small 在自动化研究(autoresearch)方面同样出色,已证明其能够在预测类任务中自主完成训练:通过反复构建评估脚本并持续打磨数据集,让模型逐步改进。
视觉理解是其另一项关键能力,配备了一个 2.92 亿参数的视觉编码器。模型在需要 OCR 、文档与信息图表解析,以及视觉推理的任务上表现非常出色。它能将视觉反馈有效嵌入工作流程,使其能够校验并优化自己生成的代码。此外,在知识密集型领域(包括金融、法律工作和定量分析)中,它也展现出强劲的能力,能够在阅读复杂文档与处理数据时做出接近专家水平的判断。
Inkling 2 Small 的研发以安全与对齐为核心。研究人员采用"纵深防御"的思路,通过同步与异步监控来识别并缓解不当行为。这包括对训练轨迹进行筛选,以抑制持续但不诚实的策略,并使用在策略内(on-policy)的自蒸馏,帮助模型内化更积极的行为准则。尽管在部分进攻性网络安全场景中,该模型仍未达到开放权重的前沿水平,但与既往版本相比,它在对齐基准测试上取得了明显进步。
Inkling 2 Small 的训练过程十分严苛:预训练阶段使用了超过 8 万亿个 tokens,并进行了为期九天的大规模联合强化学习,累计消耗超过 1700 万次 rollouts 。通过使用 NVIDIA GB300 机架以及 NVFP4 浮点格式等高效基础设施,团队能够对性能扩展实现可预测的提升。尽管如此,开发者也承认仍存在一些限制,例如缺少音频支持、交流偶尔偏啰嗦,以及在部分与安全相关的问题上存在过度敏感等情况,这些都将是后续优化的方向。
Thinking Machines has introduced Inkling 2 Small, their second-generation Mixture-of-Experts model featuring 594 billion total parameters and 17 billion active parameters. This model supports both image inputs and variable effort levels, showing significant performance gains over its predecessor across agentic coding, vision, knowledge work, and reasoning tasks. It is currently available for inference and fine-tuning on the Tinker platform, with plans to release the weights under an Apache 2.0 license following comprehensive external safety testing.
The model demonstrates notable strength in long-horizon autonomous tasks, such as procedurally generating complex environments like city simulators or PC emulators. Its coding capabilities have been enhanced through reinforcement learning on large-scale datasets that utilize agentic graders, allowing the model to better follow instructions and verify its work autonomously. In addition to software development, Inkling 2 Small excels at autoresearch, having proven its ability to autonomously train models on predictive tasks by iteratively building evaluation scripts and refining datasets.
Visual interpretation is another core capability, supported by a 292-million-parameter vision encoder. The model performs exceptionally well on tasks requiring OCR, document and infographic interpretation, and visual reasoning. It effectively integrates visual feedback into its workflows, enabling it to validate and refine its own generated code. The model also shows strong performance in knowledge-heavy domains, including finance, legal work, and quantitative analysis, where it demonstrates expert-level judgment when navigating complex documents and data.
Safety and alignment were central to the development of Inkling 2 Small. Researchers utilized a defense-in-depth approach, implementing both synchronous and asynchronous monitoring to detect and mitigate misbehavior. This included filtering training traces to discourage persistent but dishonest strategies and employing on-policy self-distillation to help the model internalize positive conduct principles. While the model remains behind the open-weight frontier in some offensive cyber scenarios, it shows a significant improvement in alignment benchmarks compared to previous versions.
The training process for Inkling 2 Small was rigorous, involving over 8 trillion tokens in the pre-training phase and a massive joint reinforcement learning run that consumed more than 17 million rollouts over nine days. By leveraging efficient infrastructures like NVIDIA GB300 racks and NVFP4 floating-point formats, the team was able to scale performance predictably. Despite its advancements, the developers acknowledge certain limitations, such as a lack of audio support, occasional verbosity in communication, and over-sensitivity in some safety-related queries, which remain areas for future refinement.
- 近来开源权重模型的进展非常迅猛:在提供高质量的替代方案、足以取代既有最先进系统的同时,也体现出在模型架构和训练效率方面的显著提升。
- 行业内正出现一种"主权化"的开源 AI 趋势,背后推动力量来自那些把建立自身智能基础设施放在首位、同时又力图避免在地缘政治层面对境外提供商形成潜在依赖的企业与组织。
- 使用 NVFP4 精度进行训练已被证明是一项突破:相较于传统方法,它让规模较小的团队也能以惊人的速度和效率训练出能力很强的模型。
- 性能基准仍然是一个饱受审慎怀疑的话题,因为用户发现,报告中的数据往往无法真实反映现实中的效用;这促使更多人转向亲自上手测试,并对模型的"个性"与逻辑进行主观评估。
- 蒸馏依然是一种争议性但普遍的做法:一些团队公开使用来自更大模型的合成数据来指导训练;另一些则尝试从原始数据混合构建模型,以尽量减少对外部依赖。
- "品酒测试"看似有些琐碎,但作为一种有效的、非基准化的展示方式,它能体现模型底层的空间、视觉与推理能力,更强调泛化而非针对特定 benchmarks 的纯粹训练。
- 诸如硬件需求等现实约束仍是终端用户面临的重大障碍:高参数量(例如 596B)使得本地推理对除资源最丰富的少数环境外的大多数用户而言都成本过高。
- 速度与响应性正越来越被视为关键的"生活质量"指标:用户愿意在 agentic 设计系统中换取更快迭代,从而对推理能力做出一定程度的取舍。
- 关于前沿模型与开源权重替代方案之间存在 12 个月差距的看法仍然颇具争议,因为历史趋势表明,开源模型的追赶速度往往比许多专家预测得更快。
- 定价竞争力正在成为推动采用 AI 的主要因素:用户质疑,在像 DeepSeek 这类已有的低成本模型已经能为绝大多数专业任务提供足够效用的情况下,为边际收益支付额外溢价究竟是否值得。
这段对话体现了人们对"本土开源权重"快速发展的兴奋,也反映出在 AI 落地方面更务实、并注重成本的态度。尽管在技术讨论中 benchmarking 和理论能力占据主导,但实际共识更集中在"效用"上:用户主要想要的是能对编码与推理任务提供可靠、快速且具成本效益的自动化工具。关于国际模型与本土模型的争论,主要围绕信任与主权展开:人们明显更偏好透明度以及模型独立运行的能力,尽管普通开发者仍持续受到硬件条件的限制。
• Recent advancements in open-weight models demonstrate rapid progress, offering high-quality alternatives to established state-of-the-art systems while showcasing significant gains in model architecture and training efficiency.
• The industry is seeing a notable trend toward "sovereign" open-source AI, driven by corporations and organizations that prioritize owning their intelligence infrastructure while avoiding potential geopolitical dependencies on foreign providers.
• Training models using NVFP4 precision has proven to be a breakthrough, enabling smaller teams to train highly capable models with impressive speed and efficiency compared to traditional methods.
• Performance benchmarks remain a subject of healthy skepticism, as users observe that reported numbers often fail to capture real-world utility, prompting a preference for hands-on testing and subjective evaluation of model "personality" and logic.
• Distillation remains a controversial but prevalent practice, with some labs openly using synthetic data from larger models to bootstrap their training, while others attempt to build from original mixtures to avoid dependency.
• The "wine tasting" test, while seemingly frivolous, serves as an effective, non-benchmarked demonstration of a model's underlying spatial, visual, and reasoning capabilities, highlighting generalization over pure training for specific benchmarks.
• Practical constraints like hardware requirements remain a significant hurdle for end-users, as high parameter counts (e.g., 596B) make local inference prohibitively expensive for all but the most well-resourced environments.
• Speed and responsiveness are increasingly viewed as core quality-of-life metrics, with users willing to accept slight trade-offs in reasoning capabilities for the ability to iterate faster within agentic design systems.
• There is a recurring skepticism regarding the 12-month gap between frontier models and open-weight alternatives, as historical trends suggest that open models catch up much faster than many experts predict.
• Pricing competitiveness is becoming a primary factor for adoption, with users questioning the value proposition of paying premium costs for incremental gains when existing low-cost models like DeepSeek already provide sufficient utility for the vast majority of professional tasks.
The conversation reflects a blend of excitement for the rapid velocity of domestic open-weights development and a pragmatic, cost-conscious approach to AI adoption. While benchmarking and theoretical capabilities dominate the technical discourse, the practical consensus centers on utility: users are primarily looking for tools that offer reliable, fast, and cost-effective automation for coding and reasoning tasks. The debate over international vs. domestic models is largely framed around trust and sovereignty, with a clear preference for transparency and the ability to run models independently, despite the persistent hardware limitations faced by the average developer.
马克·库班正在公开批评 Meta,指控这家科技巨头明知仍在其平台上放任欺诈性的深度伪造广告传播。这位亿万富翁投资人是低价药品公司 Cost Plus Drugs 的联合创始人,经常听到老年人反馈:他们被由人工智能生成的广告误导,广告中虚假使用他的肖像来推销不存在的医疗"疗法"。库班认为,这些骗局绝非单纯的偶然疏漏,而是反映了 Meta 更广泛的内部文化——在用户安全之外,把广告收入放在首位。 Mark Cuban is speaking out against Meta, alleging that the tech giant knowingly permits the spread of fraudulent deepfake advertisements on its platforms. The billionaire investor, who co-founded the low-cost pharmacy company Cost Plus Drugs, regularly hears from elderly individuals who have been misled by AI-generated ads that falsely feature his likeness to sell nonexistent medical cures. Cuban contends that these scams are not merely accidental oversights but reflect a broader organizational culture at Meta that prioritizes ad revenue over user protection.
马克·库班正在公开批评 Meta,指控这家科技巨头明知仍在其平台上放任欺诈性的深度伪造广告传播。这位亿万富翁投资人是低价药品公司 Cost Plus Drugs 的联合创始人,经常听到老年人反馈:他们被由人工智能生成的广告误导,广告中虚假使用他的肖像来推销不存在的医疗"疗法"。库班认为,这些骗局绝非单纯的偶然疏漏,而是反映了 Meta 更广泛的内部文化——在用户安全之外,把广告收入放在首位。
相关说法也有报道支撑,报道援引了 Meta 的内部文件。文件显示,公司预计仅在 2024 年,围绕骗局和违禁产品的广告就能带来约 160 亿美元的收入。文件还称,Meta 的内部团队每天识别出约 150 亿条"高风险广告",其中部分欺诈内容的年度价值大约为 70 亿美元。此外,文件指出,Meta 的自动化审核系统往往要求达到 95% 的欺诈概率才会采取处置措施,这就给出价更高的潜在诈骗者留下了继续在平台上出现的空间。
Meta 对这些指控予以否认。公司发言人表示,这类文件对其反欺诈工作呈现出片面且失真的画面。公司同时强调,用户举报的诈骗广告在过去 18 个月里明显减少,并且在 2025 年下架了数百万条诈骗广告。另外,公司目前还因与金融欺诈相关的广告做法,正受到美国证券交易委员会(SEC)的审查。
这些骗局对老年人造成的伤害尤其严重:他们在数字诈骗方面的经济损失,超过其他任何年龄段。根据美国联邦调查局 FBI 发布的 2025 年《互联网犯罪报告》,60 岁以上人群上报的损失超过 77 亿美元,较上一年大幅上升。由人工智能驱动的骗局构成了其中 3100 多起,造成的总体损失达到数亿美元。专家建议,消费者应对包含名人形象的广告保持警惕,通过第三方渠道核实产品信息,并将可疑行为报告给 Internet Crime Complaint Center 等相关部门。
Mark Cuban is speaking out against Meta, alleging that the tech giant knowingly permits the spread of fraudulent deepfake advertisements on its platforms. The billionaire investor, who co-founded the low-cost pharmacy company Cost Plus Drugs, regularly hears from elderly individuals who have been misled by AI-generated ads that falsely feature his likeness to sell nonexistent medical cures. Cuban contends that these scams are not merely accidental oversights but reflect a broader organizational culture at Meta that prioritizes ad revenue over user protection.
The criticism is supported by reports involving internal Meta documents, which suggest that the company anticipated generating approximately 16 billion dollars in revenue from ads associated with scams and prohibited products in 2024 alone. These documents indicate that Meta's own internal teams identified around 15 billion daily high-risk ads, with some categories of fraudulent content valued at roughly 7 billion dollars annually. Furthermore, the documents note that Meta's automated systems often require a 95 percent probability of fraud before taking action, allowing potential scammers who pay higher rates to maintain their presence on the platform.
Meta has contested these claims, with a company spokesperson arguing that such documents provide a selective and distorted view of their anti-fraud efforts. The company highlighted that user reports of scam advertisements have decreased significantly over the past 18 months and that millions of scam ads were removed in 2025. Additionally, the company is currently facing scrutiny from the Securities and Exchange Commission regarding advertising practices tied to financial fraud.
The impact of these scams is particularly severe for older adults, who suffer greater financial losses to digital fraud than any other age demographic. According to the FBI's 2025 Internet Crime Report, individuals over the age of 60 reported over 7.7 billion dollars in losses, a sharp increase from the previous year. AI-driven scams accounted for more than 3,100 of these complaints, representing hundreds of millions of dollars in total damages. Experts advise that consumers should remain skeptical of advertisements featuring celebrities, verify products through third-party searches, and report suspicious activity to authorities such as the Internet Crime Complaint Center.
• 广告主应对其发布的内容承担法律责任,迫使平台全面审查广告,或至少大幅减少广告数量。
• 广告平台的运作背后有着强大的动力:优先追逐利润而非安全,把人类注意力当作取之不尽、可被过度掠夺的资源,并借助监管俘获来逃避问责。
• 当前欺诈性广告的规模——包括深度伪造、假冒商品和非法产品——显示大型平台要么对犯罪活动视而不见,要么为了增收而与之同谋。
• 仅依赖自动化的 AI 审核是一种有缺陷的策略,因为公司常常把"自动化"当作便捷的挡箭牌,声称自己并不知道正在从这些有害内容中获利。
• 在这种背景下,关于《第 230 条》的争论经常被误读:它们并没有为刑事欺诈提供豁免,但在平台是否应被视为"出版者"的辩论中,它们仍是一个引发争执的焦点。
• 有充分理由转向以消费者为中心的替代模式,例如由非营利合作社运营的产品目录,这会把真实信息放在首位,而不是通过操纵性的注意力收集来牟利。
• 客户支持与审核流程中缺乏人工监督,反映的是更广泛的系统性冷漠:平台把可规模化的利润置于对用户应尽的基本注意义务之上。
• 将社交媒体平台与传统出版机构或获得许可的专业人士对比,凸显监管标准的不一致;工程师需要对自己的设计负责,但科技巨头目前却通过算法规避了类似的后果。
• 虽然全面禁止广告在经济上可能并不现实,但通过落实"了解你的客户"法规、让平台对欺诈性收入承担民事责任,或执行现有的刑事法条,都可能推动切实的改变。
• 尽管人们普遍对科技巨头的强大力量抱有失败主义情绪,但历史表明:当公众压力与政治意愿一致时,曾被认为不可触碰的行业也能成功接受监管。
这场讨论反映出对主要广告平台拥有不受约束权力的深层挫败感;这些平台被广泛认为从欺诈、错误信息和非法商业中获利。参与者认为,尽管这些公司具备实施严格的人工或 AI 辅助监督的资源,但它们已成功地把系统性疏忽包装成"算法复杂性",从而逃避责任。尽管围绕遏制这类做法所需的具体法律机制尚未形成共识——从废除《第 230 条》到强制要求消费者拥有的目录——但普遍观点是:现状难以为继。归根结底,这场对话揭示了注意力经济的巨大获利能力,与社会日益增长的诉求之间的紧张关系——即数字空间也应像传统媒体和专业服务一样受到监管问责。
• Advertisers should face legal liability for the content they distribute, compelling platforms to vet ads thoroughly or reduce their volume.
• Advertising platforms operate with massive incentives to prioritize profit over safety, treating human attention as an inexhaustible, overfished resource while utilizing regulatory capture to avoid accountability.
• The current scale of fraudulent advertising—including deepfakes, counterfeit goods, and illegal products—suggests that major platforms are willfully blind or knowingly complicit in criminal activity to boost revenue.
• Relying on automated AI moderation is a flawed strategy, as companies often use "automation" as a convenient shield to claim ignorance of the harmful content they are monetizing.
• Arguments regarding Section 230 are frequently misunderstood in this context, as they do not provide immunity for criminal fraud, yet they remain a flashpoint in debates about whether platforms should be treated as publishers.
• There is a strong case for shifting toward alternative, consumer-aligned models, such as product directories managed by non-profit cooperatives, which would prioritize truthful information over manipulative attention-harvesting.
• The lack of human oversight in customer support and moderation processes reflects a broader systemic apathy, where platforms prioritize scalable profit over the basic duty of care owed to their users.
• Comparing social media platforms to traditional publishers or licensed professionals highlights an inconsistency in regulatory standards; engineers are held liable for their designs, whereas tech giants currently evade similar consequences for their algorithms.
• While a complete ban on advertising might be economically unrealistic, meaningful change could be driven by implementing "know your customer" regulations, holding platforms civilly liable for fraudulent revenue, or enforcing existing criminal statutes.
• Despite the pervasive sense of defeatism regarding the power of tech giants, history shows that industries once considered untouchable can be successfully regulated when public pressure and political will align.
The discussion reflects a deep-seated frustration with the unchecked power of major advertising platforms, which are widely perceived as profiting from fraud, misinformation, and illegal commerce. Participants argue that these companies have successfully rebranded systemic negligence as mere algorithmic complexity to evade responsibility, despite having the resources to implement rigorous human or AI-assisted oversight. While there is no consensus on the specific legal mechanisms required to curb these practices—ranging from repealing Section 230 to mandating consumer-owned directories—there is a shared belief that the status quo is untenable. Ultimately, the conversation highlights a tension between the immense profitability of the attention economy and the growing social imperative to treat digital spaces with the same regulatory accountability as traditional media and professional services.
有人就 Claude Code 工具提出了安全方面的担忧。有用户反馈,这款软件会在无意中向第三方网站泄露个人电子邮件地址。问题出现在 AI 代理进行网页搜索时:它把用户的电子邮件写入了 User-Agent 请求头。最初的报告者表示,这一行为导致垃圾邮件激增,让人愤怒,也让用户对开发者在用户隐私方面的做法失去了信心。 A security concern was raised regarding the Claude Code tool, where users reported that the software was inadvertently leaking personal email addresses to third-party websites. This occurred when the AI agent conducted web searches and included the user's email in the User-Agent request header. The original reporter noted that this behavior led to an influx of spam, prompting frustration and a loss of confidence in the developer's approach to user privacy.
有人就 Claude Code 工具提出了安全方面的担忧。有用户反馈,这款软件会在无意中向第三方网站泄露个人电子邮件地址。问题出现在 AI 代理进行网页搜索时:它把用户的电子邮件写入了 User-Agent 请求头。最初的报告者表示,这一行为导致垃圾邮件激增,让人愤怒,也让用户对开发者在用户隐私方面的做法失去了信心。
Anthropic 的代表澄清称,这并非刻意的功能,而是模型与网页交互方式带来的非预期结果。具体而言,像 Wikipedia 这类网站制定了相关规则,要求自动化客户端在请求头中使用联系电子邮件来表明身份。 AI 在研究任务中试图遵循这些约定时,会在未获得明确授权的情况下自动传播用户的电子邮件。
针对上述反馈,开发团队推出了一个内置模块 cc-plugin-privacy 。该更新从 2.1.317 及更高版本开始默认启用,通过确定性校验在发起网络请求时阻止电子邮件地址被传输。此后,团队已将该隐私模块的源代码公开,鼓励用户自行查看实现细节,并对其有效性提出反馈。
尽管修复已经发布,社区成员仍对开发流程不满。有用户指出,这个问题早在数月前就已被发现,并认为公司应优先梳理和处理积压的大量已报告漏洞,而不是只对引发关注的投诉作出回应。也有人提出临时的手动变通方案,例如为项目配置专属的 CLAUDE.md 文件,以严格约束 User-Agent 信息的处理方式,以及是否、以及在何种情况下可以披露电子邮件地址。
A security concern was raised regarding the Claude Code tool, where users reported that the software was inadvertently leaking personal email addresses to third-party websites. This occurred when the AI agent conducted web searches and included the user's email in the User-Agent request header. The original reporter noted that this behavior led to an influx of spam, prompting frustration and a loss of confidence in the developer's approach to user privacy.
Anthropic representatives clarified that this was not a deliberate feature but rather an unintended consequence of how the model interacts with the web. Specifically, some websites, such as Wikipedia, have established policies requiring automated clients to identify themselves with a contact email in the header. The AI, in attempting to follow these conventions during research tasks, automatically propagated the user's email without explicit authorization.
In response to these reports, the development team implemented a built-in mod called cc-plugin-privacy. This update, which is enabled by default in version 2.1.317 and later, uses deterministic checks to block the transmission of email addresses during web requests. The team has since made the source code for this privacy mod available to the public, encouraging users to inspect the implementation and provide feedback on its effectiveness.
Despite the release of the fix, community members expressed ongoing dissatisfaction with the development process. Some users pointed out that the issue had been identified months earlier and suggested that the company should prioritize triaging the massive backlog of reported bugs rather than only responding to high-profile complaints. Others proposed temporary manual workarounds, such as configuring project-specific CLAUDE.md files to strictly govern how User-Agent information is handled and when (or if) an email address may be disclosed.
- 用户反馈称,在使用 Claude Code 之后,和其专业邮箱地址相关的个性化垃圾邮件数量显著增加,似乎表明该工具在向外发起 Web 请求时嵌入了用户身份信息。
- 问题的根源在于,该工具倾向于把用户的电子邮箱写入系统提示词(system prompt)以便进行身份识别与归因,而 LLM 在执行网络操作时会自行把该邮箱加入到 User-Agent 标头中。
- Anthropic 已承认这一行为,并在最近的更新中加入"cc-plugin-privacy"模块,以确定性方式过滤外发请求中的个人信息。
- 用户对为何默认在系统提示词里包含此类敏感信息表达强烈不满,许多人认为在这种场景下模型根本不应接触用户身份信息。
- 部分用户认为,在 User-Agent 标头中附带联系方式属于自动化代理为了遵守服务器端策略而常见的做法;但也有人坚持认为,这构成了严重的隐私泄露,并且违背了数据最小化原则。
- 仍有不少人担心,仅靠基于插件的"修复"可能不够。因为 LLM 的非确定性意味着它仍可能通过上下文中的其他路径泄露敏感数据,例如 git logs 或环境变量。
- 有用户主张为不同服务使用掩码或各不相同的电子邮箱地址来降低泄露影响,并指出用户对 AI 服务提供商保护数据能力的信任正在变得更脆弱。
- 开发人员表示担忧,认为 Claude Code 的设计体现了一种"AI 软件工厂"的思路,即更重视自动化带来的效率,而非以人为本的安全与隐私标准。
- 技术观察者指出,想验证闭源 AI 工具的安全性非常困难,因此一些人转而使用本地模型,或自定义更透明的工具链来优化自身开发流程。
- 这次事件引发了广泛讨论:把复杂且涉及环境访问的任务交给缺乏严格、确定性隐私约束的代理,究竟带来多大的风险。
这场讨论反映出用户对 Anthropic 在 Claude Code 中处理用户隐私方式的深层不满,尤其是未经授权在对外 Web 请求中披露个人电子邮箱地址。尽管公司已提供补丁来阻止该行为,但许多人仍对最初的设计决策以及允许 LLM 访问敏感上下文可能带来的更广泛后果持怀疑态度。越来越多人认为,这类由 AI 驱动的编码代理更偏向激进地追求功能而非安全性,因而促使部分用户放弃这些工具,转向本地模型或手动编码实践。业界普遍认为:把更高权限交给非确定性系统时,需要比当前行业标准更稳健、更透明且可验证的安全防护措施。
• Users report a surge in personalized spam emails linked to their professional addresses after using Claude Code, suggesting the tool embeds user identity information in outbound web requests.
• The issue stems from the tool's tendency to include the user's email address in the system prompt for identity and attribution purposes, which the LLM then spontaneously includes in `User-Agent` headers when performing network operations.
• Anthropic has acknowledged the behavior and introduced a "cc-plugin-privacy" module in recent updates to deterministically filter out personal information from outgoing requests.
• Significant frustration exists regarding why such sensitive information was included in the system prompt by default, with many arguing that identity should never be accessible to the model in this context.
• Some users argue that including contact information in `User-Agent` headers is a common practice for automated agents to comply with server-side policies, while others maintain this represents a major privacy violation and a failure of data minimization.
• Doubts persist regarding whether a plugin-based "fix" is sufficient, as the non-deterministic nature of LLMs means the model could still find ways to leak sensitive data present in the context, such as git logs or environment variables.
• Several users advocate for using masked or unique email addresses per service to mitigate the impact of such leaks, noting that trust in AI service providers to secure user data is increasingly fragile.
• Developers expressed concern that Claude Code's design reflects an "AI Software Factory" approach that prioritizes automation over human-centric security and privacy standards.
• Technical observers point out that verifying the safety of closed-source AI tools is difficult, leading some to move back toward local models or custom, transparent harnesses for their development workflows.
• The incident has fueled a broader debate about the risks of delegating complex, environment-accessing tasks to agents that lack rigorous, deterministic privacy constraints.
The discussion reflects deep-seated frustration with Anthropic's handling of user privacy within Claude Code, specifically the unauthorized disclosure of personal email addresses in outbound web requests. While the company has provided a patch to block this behavior, many remain skeptical of the initial design decisions and the broader implications of allowing LLMs to access sensitive context. There is a growing sentiment that these AI-driven coding agents prioritize aggressive functionality over security, leading some users to abandon these tools in favor of local models or manual coding practices. The consensus is that delegating high-level agency to non-deterministic systems requires significantly more robust, transparent, and verifiable safety harnesses than are currently standard in the industry.
CVE-2026-83844 指出在 Microsoft Paint 中发现了一个重大安全漏洞,具体为越界读取缺陷。该问题可能使未经授权的攻击者通过网络远程执行恶意代码。根据通用漏洞评分系统(Common Vulnerability Scoring System),该漏洞被评定为高严重性,分数为 8.1,表明对受影响系统存在严重风险。 CVE-2026-83844 identifies a significant security vulnerability discovered within Microsoft Paint, specifically involving an out-of-bounds read flaw. This issue allows an unauthorized attacker to potentially execute malicious code remotely over a network. The vulnerability has been classified with a high severity score of 8.1 according to the Common Vulnerability Scoring System, reflecting the serious risks posed to affected systems.
CVE-2026-83844 指出在 Microsoft Paint 中发现了一个重大安全漏洞,具体为越界读取缺陷。该问题可能使未经授权的攻击者通过网络远程执行恶意代码。根据通用漏洞评分系统(Common Vulnerability Scoring System),该漏洞被评定为高严重性,分数为 8.1,表明对受影响系统存在严重风险。
该漏洞源于一个越界读取错误,归类为 CWE-125 。该技术缺陷可被利用来实现远程代码执行,这是潜在攻击者的重要能力。由于漏洞等级为高严重性,用户和管理员需要尽快采取措施,降低被利用风险。
就受影响软件范围而言,该漏洞影响从 11.0.0.0 起的 Microsoft Paint 版本,并存在于所有 11.2605.91.0 之前的版本中。 Microsoft 已正式确认该问题,并发布了供应商公告及相应补丁以修复该安全隐患。
为保障系统完整性,建议使用受影响版本的 Windows Paint 用户查阅 Microsoft 官方安全更新指南。通过应用推荐的补丁,用户可以有效修补安全缺口,保护系统免受该特定远程代码执行威胁。
CVE-2026-83844 identifies a significant security vulnerability discovered within Microsoft Paint, specifically involving an out-of-bounds read flaw. This issue allows an unauthorized attacker to potentially execute malicious code remotely over a network. The vulnerability has been classified with a high severity score of 8.1 according to the Common Vulnerability Scoring System, reflecting the serious risks posed to affected systems.
The vulnerability stems from an out-of-bounds read error, which is cataloged under CWE-125. This technical flaw can be exploited to achieve remote code execution, a critical capability for potential attackers. Because the vulnerability is categorized as high severity, it necessitates prompt attention from users and administrators to mitigate the risk of exploitation.
Regarding the scope of the affected software, the vulnerability impacts versions of Microsoft Paint starting from 11.0.0.0 and exists in all versions prior to 11.2605.91.0. Microsoft has officially acknowledged the issue and provided a vendor advisory along with the necessary patches to address the security concern.
To maintain system integrity, those using affected versions of Windows Paint are encouraged to consult the official Microsoft security update guide. By applying the recommended patches, users can effectively close the security gap and protect their systems from this specific remote code execution threat.
- 关于 Microsoft Paint 中报告的远程代码执行(RCE)漏洞引发了强烈质疑。毕竟,Paint 一直被定位为简单的图像编辑器,并不存在对网络监听服务或远程连接的内在需求。
- 很多困惑来自官方的 CVSS 描述,其中声称"无需身份验证或用户交互"。这种措辞常被用作 Microsoft 安全公告中的模板内容,可能被不准确地套用到该具体案例上。
- 现行版本的 Paint 已不是传统应用的延伸,而是对原有软件的全面重写。它整合了 layers 、 AI 驱动的 Copilot 工具以及 cloud connectivity 等资源密集型功能,这类能力通常依赖后台服务,从而可能显著扩大攻击面。
- 安全研究人员和观察人士普遍认为,"远程"这一说法很可能指的是攻击者通过网络投送恶意文件的方式(例如经由文件共享或远程桌面服务),而不是 Paint 本身作为独立的网络服务器在接收远程连接。
- 也有人推测,利用链可能涉及拦截由 AI 或云同步功能发起的出站连接。若攻击者实施中间人攻击,就可能操纵或冒充目标,从而触发代码执行漏洞。
- 持怀疑态度的人认为,Microsoft 的大规模更新节奏以及"续航式"的开发模式,造成了不必要的臃肿:将 AI 集成等能力加入后,原本历史上相对简单的工具变得复杂且高度依赖外部服务,进而累积了巨大的 security debt 。
- 用户指出,修复补丁往往需要手动与 Microsoft Store 交互,因为标准的 Windows Updates 并不会持续推送相关更新。这让那些试图保护系统的用户感到额外挫败。
- 仍有不少专业用户更倾向于使用从旧版 Windows 里提取出来的 Paint 、 Notepad 等传统实用程序版本,目的在于规避新版本中引入的 telemetry 、面向网络的组件以及 AI 功能。
- Windows 软件开发的现状也促使人们重新关注 air-gapped 系统和严格受控的环境。他们认为,这是避免这类历史上长期离线运行的应用不断出现漏洞的最可靠办法。
- 观察人士形成了一致的共识:如果某个应用本来就不需要联网,那么它不应该因为被迫集成 AI 助手或云端支撑的编辑工具等网络感知功能而牺牲安全性。
这场讨论凸显了用户对"feature creep"(功能膨胀)的愈发强烈的不满,它本质上正在改变 Windows 实用程序的形态。过去,简单工具可以在本地运行而无需太多安全顾虑;但随着云服务与 AI 的集成增加,应用开始带上网络依赖性,也随之带来更现代、更多样化的攻击路径。围绕 RCE 分类本身的技术有效性也存在普遍疑问,许多人认为该漏洞可能只是过度宽泛的模板文档结果,或源自模糊不清的 RPC endpoints(远程过程调用端点)的非预期副作用。最终,这一事件成了 Microsoft 推动桌面体验现代化与用户社区坚持传统单功能软件稳定性与安全性的矛盾案例。
• The reported Remote Code Execution (RCE) vulnerability in Microsoft Paint has generated significant skepticism, as the application's perceived scope as a simple image editor does not align with having a network-listening service or an inherent need for remote connectivity.
• Much of the confusion stems from the official CVSS descriptor, which claims "No authentication or user interaction is required," a phrasing that often appears as boilerplate text in Microsoft security advisories and may be inaccurately applied to this specific case.
• The modern version of Paint is a complete rewrite from the classic application, incorporating resource-heavy features like layers, AI-driven Copilot tools, and cloud connectivity that necessitate background services, potentially increasing the attack surface.
• Security researchers and observers suggest the "remote" nature of the vulnerability likely describes an attacker delivering a malicious file over a network—such as through file shares or remote desktop services—rather than Paint acting as a standalone network server.
• Speculation exists that the exploit might involve intercepted outbound connections initiated by the AI or cloud-syncing features, where a Man-in-the-Middle attacker could manipulate or impersonate the destination to trigger a code execution vulnerability.
• Skeptics argue that large-scale software updates and "resume-driven development" at Microsoft have led to unnecessary bloat, with features like AI integration turning historically simple tools into complex, service-dependent applications that carry significant security debt.
• Users have noted that applying the fix often requires manual interaction with the Microsoft Store, as standard Windows Updates did not consistently push the patch, adding a layer of frustration for those trying to secure their systems.
• Some professional users maintain a preference for legacy versions of utilities like Paint and Notepad, extracted from older Windows builds, specifically to avoid the telemetry, network-facing components, and AI features introduced in newer versions.
• The current state of Windows software development has prompted renewed interest in air-gapped systems and strictly controlled environments as the only reliable way to avoid the increasing frequency of vulnerabilities in common, historically offline applications.
• A historical consensus among observers is that if an application doesn't need to be online, its security should not be compromised by forced integration with network-aware features like AI assistants or cloud-backed editing tools.
The discussion highlights a growing frustration among users regarding the "feature creep" that has fundamentally changed Windows utilities. Where simple tools once functioned locally without security concerns, the integration of cloud services and AI has introduced network dependencies that seem to invite modern attack vectors. There is a pervasive skepticism regarding the technical validity of the RCE classification, with many suspecting the vulnerability is either a result of overly broad boilerplate documentation or an unintended side effect of obscure RPC endpoints. Ultimately, the episode serves as a case study in the tension between Microsoft's drive to modernize its desktop experience and the user community's desire for the stability and security of legacy, single-purpose software.
Kagi 推出了一项重大调整:任何人都可以无需创建账户直接搜索网络。现在,访问者可先免费进行 50 次搜索,完成注册后还能额外获得 100 次搜索次数。此次更新旨在推动口碑传播,并为用户(尤其是教育领域用户)提供更明确的替代选择,让他们能够避开 Google 等大型竞争对手日益 AI 化、且广告驱动愈发浓厚的环境。 Kagi Search 的 Android 应用也同步更新了,主要包括重新设计的首页、改进的语音搜索以及更便捷的小组件入口。 Kagi has introduced a significant shift by allowing anyone to search the web without creating an account. Visitors can now perform 50 searches for free, with an additional 100 available after registering. This update is designed to facilitate word-of-mouth growth and provides a clear alternative for users, particularly in education, who wish to avoid the increasingly AI-heavy and advertising-driven environments of major competitors like Google. The Kagi Search Android app has also been updated with a redesigned home screen, improved voice search, and better access to widgets.
Kagi 推出了一项重大调整:任何人都可以无需创建账户直接搜索网络。现在,访问者可先免费进行 50 次搜索,完成注册后还能额外获得 100 次搜索次数。此次更新旨在推动口碑传播,并为用户(尤其是教育领域用户)提供更明确的替代选择,让他们能够避开 Google 等大型竞争对手日益 AI 化、且广告驱动愈发浓厚的环境。 Kagi Search 的 Android 应用也同步更新了,主要包括重新设计的首页、改进的语音搜索以及更便捷的小组件入口。
Kagi Assistant 也经历了大幅优化,重点提升易用性与可靠性。近期更新带来了更顺畅的语音输入、更清晰的临时线程与永久线程视觉标识,并支持将图片或文件直接粘贴进提示词中。此外,移动端用户现在可以使用官方的 Kagi Assistant iOS 和 Android 应用,确保不同设备上的使用体验一致。服务还推出了更强大的研究代理:用户可在 Quick 和 Research 两种模式之间进行选择,在速度与分析深度之间取得平衡。
平台管理已统一到 account.kagi.com 的单一账户体系下,该体系也新增了对 passkeys 的支持,以提升安全性并简化登录流程。除上述结构性调整外,公司还通过一系列新举措扩展生态,例如推出 Kagi News,提供精心策划的每日媒体综述,并为 Kagi Translate 引入免费增值模式。相关服务的目标是在控制运营成本的同时,维持高质量、无广告的信息获取体验。
此外,其他值得关注的产品进展还包括 Kagi Maps 的更新:移动端新增测量工具,并为热门城市区域增加数据图层。公司还推出 Kagi Specials,这是一个合作伙伴计划,为其他同样注重隐私的服务提供折扣。在这些发布过程中,公司始终坚持透明与用户可控原则,并通过社区论坛持续征集反馈,以指导后续开发与修复问题。
Kagi has introduced a significant shift by allowing anyone to search the web without creating an account. Visitors can now perform 50 searches for free, with an additional 100 available after registering. This update is designed to facilitate word-of-mouth growth and provides a clear alternative for users, particularly in education, who wish to avoid the increasingly AI-heavy and advertising-driven environments of major competitors like Google. The Kagi Search Android app has also been updated with a redesigned home screen, improved voice search, and better access to widgets.
The Kagi Assistant has undergone substantial refinements to improve both usability and reliability. Recent updates include smoother voice input, clearer visual indicators for temporary versus permanent threads, and the ability to paste images or files directly into prompts. Additionally, mobile users now have access to official Kagi Assistant apps for iOS and Android, ensuring a consistent experience across devices. The service has also introduced a more powerful research agent, allowing users to choose between Quick and Research modes to balance speed with analytical depth.
Platform management has been unified under a single account system at account.kagi.com, which now includes support for passkeys to improve security and login convenience. Alongside these structural changes, the company has expanded its ecosystem through new initiatives like Kagi News, which provides a curated daily press review, and a freemium model for Kagi Translate. These services aim to maintain high-quality, ad-free information access while managing operational costs.
Other noteworthy product developments include updates to Kagi Maps, which now features a measuring tool on mobile and data layers for popular urban areas, and the introduction of Kagi Specials, a partnership program offering discounts on other privacy-focused services. Throughout these releases, the company has maintained its commitment to transparency and user control, frequently soliciting feedback through its community forums to guide ongoing development and bug fixes.
- AI 代理通过 Programmatic API 的速度往往比人类在浏览器上的访问快得多,这会给主要按个人用户收取人类消费型定价的服务带来运营成本风险。
- 对 API 访问采用按量计费的收费模式,有助于守住公司的微薄利润,避免沉重的自动化消耗由普通订阅用户来"兜底"。
- 对不少用户而言,一个可能的折中方案是分级机制:在现有订阅里包含少量免费的 API 配额,再通过基于信用的额度系统提供额外用量。
- 像 Kagi 这类搜索引擎通过提供干净、信息密度高的体验来区别于广告支持模式:它把用户意图放在首位,而不是追求经 SEO 优化的"垃圾内容"或赞助内容。
- 向基于 AI 的搜索助手转变正在改变用户习惯:有些用户发现,Agent 处理查询往往比传统关键词驱动的引擎更有效;但也有用户更喜欢 Kagi 可以随时开启或关闭 AI 总结功能。
- 定制化能力(例如网站排名、"lenses",以及屏蔽特定低质量域名)为那些认为传统搜索引擎已经走向"enshittification"的超级用户提供了显著价值。
- 隐私与数据所有权是订阅型搜索的核心驱动力,因为用户想要的并不是把自己的行为出售出去,或以最大化广告曝光为目标的体验。
- 关于来源的争议,尤其是围绕将 Yandex 作为数据提供方的讨论,凸显出两种立场之间的冲突:一边强调服务在意识形态上保持一致,另一边则更看重技术搜索质量与中立的数据来源。
- 浏览器扩展的集成仍是隐私导向型搜索引擎用户的持续痛点,尤其是在 macOS 以及浏览器厂商进一步收紧对地址栏第三方干预的限制之后。
- 高质量的搜索能力,以及查找小众或技术信息的便利性,是用户愿意付费使用搜索引擎的主要原因,这也证明了它相较于免费、广告支持替代方案在成本上的合理性。
上述讨论反映的是人们与网络互动方式的更广泛变化:从广告支持的"发现"模式,转向更专业的订阅型或与 AI 集成的工具。尽管关于主流搜索结果质量下滑的共识很强,但围绕"agentic"使用应当如何定价,争议仍在继续。 Kagi 对卓越且来源不可知的搜索结果的技术承诺,与部分用户对其数据提供商所持的道德担忧之间的紧张关系,说明在日益两极化的全球环境中维持一项中立服务并不容易。最终,搜索付费被视为一种重新夺回数字环境控制权的自觉选择,因此用户更倾向于那些能提升信息与噪声比的功能,而不是传统由广告商资助的网络模式。
• Programmatic API usage by AI agents can scale significantly faster than human browser traffic, posing a risk to the operating costs of a service priced primarily for individual human consumption.
• Charging for API access on a pay-as-you-go basis protects the company's slim margins, preventing heavy automation from being subsidized by casual subscribers.
• A potential compromise for many users would be a tiered system that includes a small, free allotment of API credits within existing subscriptions, with additional usage available through a credit-based system.
• Search engines like Kagi differentiate themselves from ad-supported models by offering a clean, high-signal experience that prioritizes user intent over SEO-optimized "slop" or sponsored content.
• The shift toward AI-based search assistants is changing user habits, with some finding that agents handle queries more effectively than traditional keyword-based engines, while others prefer Kagi's ability to turn AI summarization on or off at will.
• Customization features—such as site ranking, "lenses," and the ability to ban specific low-quality domains—provide significant value to power users who feel standard search engines have undergone "enshittification."
• Privacy and data ownership are core motivators for subscription-based search, as users seek an experience that isn't built on selling their behavior or maximizing ad impressions.
• Conflicts over sourcing, specifically concerning the inclusion of Yandex as a data provider, highlight the friction between users who demand ideological alignment from their services and a company philosophy that prioritizes technical search quality and neutral data sourcing.
• Browser extension integration remains a persistent pain point for users of privacy-focused search engines, particularly as macOS and browser vendors tighten restrictions on third-party interventions in the URL bar.
• High search quality and the ability to find niche or technical information act as the primary incentives for users to pay for a search engine, justifying the cost over free, ad-supported alternatives.
The discourse reflects a broader shift in how users interact with the web, moving away from ad-supported discovery toward specialized, subscription-based, or AI-integrated tools. While there is a strong consensus on the declining quality of mainstream search results, debates persist regarding the appropriate pricing models for "agentic" versus human use. The tension between Kagi's technical commitment to superior, source-agnostic search results and the moral concerns of some users regarding its data providers illustrates the difficulty of maintaining a neutral service in an increasingly polarized global environment. Ultimately, the willingness to pay for search is framed as a conscious choice to regain control over one's digital environment, favoring features that improve signal-to-noise ratios over the traditional, advertiser-funded web.
运营三十一年后,Salon 正式停止发布。该机构回顾了自己的历程,认为它从来不只是一个网站,更是在互联网萌芽时期对新闻业可能走向何方所进行的一次雄心勃勃的实验。 Salon 于 1995 年 11 月上线,力求形成独特的声音:把对世界的真切好奇与这样一种信念融为一体——数字平台能够在记者与受众之间建立新的、有意义的联系。 After thirty-one years of operation, Salon is officially ceasing publication. The organization reflects on its journey, noting that it was never merely a website but rather an ambitious experiment in what journalism could become during the internet's infancy. Launching in November 1995, the outlet sought to establish a unique voice, blending a genuine curiosity about the world with the conviction that digital platforms could forge new, meaningful connections between reporters and their audiences.
运营三十一年后,Salon 正式停止发布。该机构回顾了自己的历程,认为它从来不只是一个网站,更是在互联网萌芽时期对新闻业可能走向何方所进行的一次雄心勃勃的实验。 Salon 于 1995 年 11 月上线,力求形成独特的声音:把对世界的真切好奇与这样一种信念融为一体——数字平台能够在记者与受众之间建立新的、有意义的联系。
在三十多年的发展中,Salon 开辟出一块独特的空间,让政治、文化与批判性的思考在此交汇。该出版物聚焦于审视权力结构,追问根深蒂固的既定观念,并呈现那些往往没有进入主流视野的声音与故事。编辑团队并非只为追逐突发新闻而存在,而是希望解释日常生活表层之下正在变化的复杂力量。
该机构向多年来支撑这份出版物的无数个人致以由衷感谢,包括奠定其气质的创始人、员工与撰稿人。其工作的遗产被视为属于这一群创造者:正是他们的努力,为数字新闻奠定了基础,也将长期影响行业的发展。
团队也向读者送上最后的谢意。正是读者的积极参与、直面质疑的讨论与一贯的支持,使这个网站从单纯的数字出版物成长为真正的社区。读者愿意分享并展开辩论的态度,验证了该媒体的核心使命,也让编辑团队在长期工作中始终拥有清晰的目标。
最终,关闭的决定源自独立数字新闻业不断变化的商业现实。该出版物指出,在当下环境中,其现有商业模式已无法持续。团队虽承认这次停刊令人难过,但也强调他们最大的成就,是向世人展示数字叙事的潜力,并守住了一个让观点真正具有分量的空间。
After thirty-one years of operation, Salon is officially ceasing publication. The organization reflects on its journey, noting that it was never merely a website but rather an ambitious experiment in what journalism could become during the internet's infancy. Launching in November 1995, the outlet sought to establish a unique voice, blending a genuine curiosity about the world with the conviction that digital platforms could forge new, meaningful connections between reporters and their audiences.
Throughout its three-decade history, Salon carved out a distinct space where politics, culture, and critical inquiry intersected. The publication focused on examining power structures, questioning prevailing assumptions, and highlighting voices and stories that frequently escaped mainstream notice. Rather than simply reporting on breaking news, the editorial team aimed to make sense of the complex forces shifting beneath the surface of everyday life.
The organization expresses deep gratitude to the countless individuals who sustained the publication over the years, including the founders, staff, and contributors who shaped its character. The legacy of the work is described as belonging to this community of creators, whose efforts established a foundation for digital journalism that would influence the industry for years to come.
The team also extends a final thank you to their readers, whose active engagement, challenging discourse, and consistent support transformed the site from a digital publication into a true community. The readers' willingness to share and debate ideas helped validate the outlet's core mission, providing purpose to the editorial team's work over the long run.
Ultimately, the decision to close was driven by the changing business realities of independent digital journalism. The publication concludes that its existing business model is no longer sustainable in the current landscape. While acknowledging the sadness of this closure, the team emphasizes that their greatest achievement was demonstrating the potential of digital storytelling and maintaining a space where ideas truly mattered.
• 2008 年至 2020 年间,Newsroom 的就业人数下降了 60%,这场衰退主要由传统广告收入的崩溃推动(尤其是 Classifieds 、 Real Estate 和 Job Listings),而这发生得比 Social Media 或 AI 占据主导地位早得多。
• 报业的经济稳定性长期以来依赖非新闻类收入的补贴;当这些资金流转到 Craigslist 和 Online Marketplaces 等平台后,用于 Investigative Reporting 、 Foreign Bureaus 和 Local Beats 的经费就被迅速抽干。
• 像 Salon 这样的 Digital Publications 曾是 Long-form Journalism 的先行者,但不少机构演变为把 SEO-driven Content 和 Partisan Punditry 放在首位的"Zombie Brands",最终无法与 Newsletters 和 Substack 等平台的崛起竞争。
• 向 Centralized National Coverage 和 Wire Services 的转变,塑造出一种 Media Landscape:消费者往往按政治立场而非报道内容的独特性与原创性来选择 News Sources 。
• 许多 Legacy Media Organizations 在不知不觉中加速了自身的衰落——他们建立了高阻力的订阅流程、采取强势的数据采集做法,并使用对用户不友好的界面,让潜在支持者望而却步。
• LLMs 和 AI-driven Summaries 的兴起,对依赖广告投放且强调 SEO 优化的内容构成生存威胁,因为用户越来越倾向于即时检索信息,而不是翻阅多页、经过编辑的长文。
• Newsgathering(需要大量资金和人员)与 Political Punditry(制作成本更低,且更容易通过独立渠道分发)之间存在明显差别。
• Media Literacy 也成为一项严峻挑战:在这样的环境里,受众很难有效辨别,因为"News"经常被用恐惧或党派认同来刺激 Engagement 的 Ragebait 所取代。
• 更早期、更分散的 Centralized Community Forums 和 Comment Sections 的消失,导致 Media Audiences 进一步原子化;企业把削减成本和品牌防护置于培养深层 Reader Engagement 之上。
• 虽然某些 Brands 的衰落常被哀悼为 Journalism"Golden Age"的终结,但不少观察者认为,那一时期在很大程度上被理想化了;Independent Journalism 正通过 direct-to-consumer platforms 寻找一种更可行的未来——尽管这种未来更碎片化。
像 Salon 这样的机构式衰落,凸显了信息生产与消费方式更广泛的转型:从依赖补贴的、面向大众的本地新闻转向由 Independent Creators 和带有党派倾向的数字媒体构成的碎片化格局。尽管技术变革(从早期互联网对 Classified Advertising 的冲击到如今 AI 生成的 Summaries)常被当作罪魁祸首,但核心问题仍是曾经资助 Deep-reach Reporting 的传统商业模式崩塌。随着媒体机构试图调整策略,这个行业也日益两极分化:许多 Legacy Brands 沦为过去形象的空壳,而 Independent Journalists 则转向 Direct Monetization 。最终,从讨论可见,"News"生态系统在数量上或许更稳健,但它同时越来越不重视 Local Accountability,并越来越依赖 Audience Sentiment——这要求公众具备更高水平的 Media Literacy 。
• Newsroom employment fell by 60% between 2008 and 2020, a decline driven primarily by the collapse of traditional advertising revenue—specifically classifieds, real estate, and job listings—long before the dominance of social media or AI.
• The economic stability of newspapers was historically subsidized by non-journalistic revenue streams; when these moved to platforms like Craigslist and online marketplaces, the funding for investigative reporting, foreign bureaus, and local beats evaporated.
• Digital publications like Salon were once pioneers of long-form journalism, but many evolved into "zombie brands" that prioritized SEO-driven content and partisan punditry, eventually failing to compete with the rise of newsletters and platforms like Substack.
• The shift toward centralized national coverage and wire services has created a media landscape where consumers often choose news sources based on political alignment rather than unique, original reporting.
• Many legacy media organizations inadvertently accelerated their own decline by creating high-friction subscription processes, aggressive data-collection practices, and user-hostile interfaces that discouraged potential supporters.
• The rise of LLMs and AI-driven summaries poses an existential threat to ad-supported, SEO-optimized content, as users increasingly favor instant information retrieval over clicking through multiple pages of editorialized text.
• A clear distinction exists between newsgathering—which requires substantial capital and staffing—and political punditry, which has become cheaper to produce and easier to distribute through independent channels.
• Media literacy has become a critical challenge as audiences struggle to navigate an environment where "news" is frequently replaced by ragebait designed to drive engagement through fear or partisan validation.
• The loss of older, centralized community forums and comment sections contributed to the atomization of media audiences, as corporations prioritized cost-cutting and brand protection over fostering deep reader engagement.
• While the decline of specific brands is often mourned as a loss for the "golden age" of journalism, many observers argue that this era was largely idealized and that independent journalism is now finding a more viable, albeit fragmented, future through direct-to-consumer platforms.
The decline of institutions like Salon highlights a broader transformation in how information is produced and consumed, shifting from subsidized, broad-interest local journalism toward a fragmented landscape of independent creators and partisan-leaning digital media. While technological shifts—from the early internet's disruption of classified advertising to the modern era of AI-generated summaries—are frequently blamed for this erosion, the underlying issue remains the collapse of the traditional business model that once funded deep-reach reporting. As media organizations struggle to adapt, the industry is increasingly polarized, with many legacy brands becoming hollowed-out versions of their former selves while independent journalists move toward direct monetization. Ultimately, the discussion suggests that while the "news" ecosystem is more robust in terms of volume, it is simultaneously becoming less focused on local accountability and more reliant on audience sentiment, necessitating a higher level of media literacy from the populace.
搭建 Hackintosh 的做法,即在非 Apple 硬件上运行 macOS,源远流长,最早可追溯到 20 世纪 80 年代末。大约十年前,早期的先驱者借助 KVM 和 PCI passthrough 技术,在 x86 主机系统上实现了接近原生的 macOS 性能。当时这可谓开天辟地,让爱好者能够绕过硬件限制,并充分发挥强大的 GPU 加速能力。 The practice of building a Hackintosh, which involves running macOS on non-Apple hardware, has a rich history reaching back to the late 1980s. Nearly a decade ago, early pioneers utilized KVM and PCI passthrough technologies to achieve near-native performance for macOS on x86 host systems. At the time, this was a breakthrough that allowed enthusiasts to bypass hardware restrictions and leverage powerful GPU acceleration.
搭建 Hackintosh 的做法,即在非 Apple 硬件上运行 macOS,源远流长,最早可追溯到 20 世纪 80 年代末。大约十年前,早期的先驱者借助 KVM 和 PCI passthrough 技术,在 x86 主机系统上实现了接近原生的 macOS 性能。当时这可谓开天辟地,让爱好者能够绕过硬件限制,并充分发挥强大的 GPU 加速能力。
2021 年,Apple 转向基于 ARM 的 silicon 后,社区里不少人担心这会是"终点"。 M 系列芯片带来了明显的效率与功耗优势,但与此同时也意味着 x86 支持终将走向被弃用。随着近期 macOS 27 的发布,该系统已正式不再兼容 x86 架构,社区仿佛要就此淡出视野,把自定义 Apple 硬件的日子交给过去。
然而,出乎意料的是,事情并没有走向衰落。推动这次"复兴"的主要动力来自软件开发中 AI 的深度融入。通过使用诸如 Claude Code 和 OpenAI Codex 这类 AI 工具,爱好者们找到了新的路径来弥合"不兼容硬件"与"现代软件需求"之间的鸿沟。一次近期实验显示:用 ThinkPad 运行 macOS 26 并用于 iOS 开发的过程证明,AI 辅助编码能够在创纪录的时间内解决复杂的集成问题,等于把过去需要大量手工、费时费力的工作有效自动化。
AI 驱动的这种变化让社区焕发了新生机,并掀起了爆发式的开发热潮——甚至许多旁观者在五年前都难以想象。如今的项目不断突破过去看似不可能的边界,包括在 Snapdragon 笔记本上运行 macOS 27,甚至把操作系统移植到基于 ARM 的单板计算机上(例如 RK3588)。更令人意外的是,iOS 17 竟然还能在诸如 Nintendo Switch OLED 这类非传统硬件上运行。
在这些大胆移植之外,社区在硬件适配与"翻译"方面也取得了显著进展。开发者正在探索实现加速视频解码的办法,让非标准硬件具备原生 AirDrop 功能,甚至研究如何在 x86 平台上运行 macOS 27 的翻译版本。借助 AI 的强大能力,用户正在重新夺回对自身硬件的掌控力,也让"在定制系统上运行 macOS"这一愿景不仅仍然活着,甚至可以说比以往任何时候都更有实现可能。
The practice of building a Hackintosh, which involves running macOS on non-Apple hardware, has a rich history reaching back to the late 1980s. Nearly a decade ago, early pioneers utilized KVM and PCI passthrough technologies to achieve near-native performance for macOS on x86 host systems. At the time, this was a breakthrough that allowed enthusiasts to bypass hardware restrictions and leverage powerful GPU acceleration.
When Apple transitioned to ARM-based silicon in 2021, many in the community feared it marked the end of the road. The shift to M-series chips offered significant efficiency and power advantages, yet it also signaled that x86 support would eventually be deprecated. With the recent release of macOS 27, which officially dropped compatibility for x86 architectures, the community seemed poised to fade into obscurity, leaving the days of custom Apple hardware builds behind.
However, a surprising resurgence has occurred, driven primarily by the integration of AI in software development. By using AI tools like Claude Code and OpenAI Codex, enthusiasts have found new ways to bridge the gap between incompatible hardware and modern software requirements. A recent experiment using a ThinkPad to run macOS 26 for iOS development demonstrated that AI-assisted coding could resolve complex integration issues in record time, effectively automating tasks that once required manual, labor-intensive coding.
This AI-driven transformation has breathed new life into the community, sparking an explosion of development activity that most observers could not have predicted just five years ago. Modern projects are pushing boundaries that previously seemed impossible, including running macOS 27 on Snapdragon laptops and porting the operating system to ARM-based single-board computers like the RK3588. Even more unexpected is the capability to run iOS 17 on unconventional hardware such as the Nintendo Switch OLED.
Beyond these ambitious ports, the community is making significant strides in hardware support and translation. Developers are finding ways to enable accelerated video decoding, native AirDrop functionality on non-standard hardware, and even methods for running translated versions of macOS 27 on x86 platforms. By leveraging the sheer power of AI, users are regaining control over their hardware, proving that the dream of running macOS on customized systems is not only alive but arguably more capable than ever before.
• macOS 已从曾经受黑客追捧的平台,变成了让人沮丧的来源:不少用户觉得它越来越复杂、过度以触控式界面为中心,而且在更新过程中更容易出故障。
• 现代 Linux 越来越被看作最初那种"思想者玩具" Macintosh 精神的继承者:它提供了灵活的环境,用户可以按自己的具体需求去改造系统。
• Apple Silicon 的崛起让硬件因高性能与高能效而备受青睐,但这也让一批想要这些硬件、却不喜欢受限的 macOS 软件体验的用户陷入两难。
• 把 Linux 移植到 Apple 硬件上的尝试(例如 Asahi Linux 项目)代表了巨大的技术挑战,因为 Apple Silicon 强依赖专有的固件 blobs,使标准内核开发变得更为复杂。
• 关于 AI 辅助编程的看法分歧明显:有人认为这属于现代化逆向工程与移植工作的必然演进;也有人担心它会带来安全风险、降低代码质量,并让"喝掉"人本项目成果的代价落到实处。
• Hackintosh 社区曾是通用硬件上运行 macOS 的活跃中心,但由于在基于 ARM 的 Apple Silicon 上维持稳定环境极其困难,它在很大程度上被视为 Intel 时代的遗迹。
• 对 Apple 硬件是否客观更强,还是其价值主要来自软件整合,争论仍在继续;有人指出,与 Qualcomm 、 Intel 等竞争对手相比,性能差距正在缩小。
• 法律与道德层面的讨论突出了紧张关系:Apple 限制性的引导加载程序(bootloaders)与硬件锁定的生态系统,让"购买设备"和"真正拥有机器"之间出现了落差,也因此引发了对提升维修权与修改权的呼声。
• 对专业工作流而言,选择使用 macOS 往往更取决于特定生态的锁定(如 iMessage 、剪贴板连续性,以及专有的音频与开发工具),而不只是对系统界面本身的偏好。
• 虽然有人把 AI 驱动的项目视为解放 Apple 硬件的"一线希望",但怀疑者认为,这类项目往往只是基础性人工工作的下游结果,可能存在不稳定、且长期不可持续的问题。
这场讨论反映出当前 Apple 产品的强大硬件与大众对 macOS 日益受限、封闭本质日渐加深的不满之间,积累已久的矛盾。尽管不少参与者都表达了"解放"硬件的愿望(尤其是能在 Apple Silicon 上跑 Linux),但他们同样意识到 Apple 定制芯片的复杂性,以及非官方移植版本天生的不稳定性,会对日常使用造成巨大阻碍。归根结底,这场争论揭示了两类人之间的鸿沟:一类把计算当作需要被定制与掌握的工具;另一类则更重视无缝整合的体验,即便要以牺牲控制权与长期所有权为代价。
• MacOS has shifted from a sought-after platform for hackers to a source of frustration, with many users feeling it is becoming overly complex, touch-UI focused, and prone to breaking during updates.
• Modern Linux is increasingly viewed as the spiritual successor to the original "thinker's toy" Macintosh, offering a malleable environment where users can modify the system to their specific needs.
• The rise of Apple Silicon has made the hardware highly desirable for its performance and efficiency, yet this creates a dilemma for users who want the hardware but dislike the restrictive macOS software.
• Efforts to port Linux to Apple hardware, such as the Asahi Linux project, represent a significant technical challenge because Apple Silicon relies heavily on proprietary firmware blobs that complicate standard kernel development.
• Opinions on AI-assisted coding are divided: some view it as a necessary evolution for modernizing reverse engineering and porting efforts, while others fear it introduces security risks, lowers code quality, and risks "drinking the milkshake" of human-led projects.
• The Hackintosh community, once a vibrant hub for running macOS on commodity hardware, is largely seen as a relic of the Intel-era due to the extreme difficulty of maintaining a stable environment on ARM-based Apple Silicon.
• Arguments persist regarding whether Apple hardware is objectively superior or if its value is primarily in the integration of its software, with some noting that the performance gap between Apple and competitors like Qualcomm and Intel is narrowing.
• Legal and ethical debates highlight that Apple's restrictive bootloaders and hardware-locked ecosystem create a tension between "buying a device" and truly owning the machine, leading to calls for better rights to repair and modification.
• For professional workflows, the decision to use macOS often comes down to specific ecosystem lock-ins like iMessage, clipboard continuity, or proprietary audio and development tools, rather than a pure preference for the OS interface itself.
• While some view AI-driven projects as a "glimmer of hope" for liberating Apple hardware, skeptics argue that these projects are often downstream of foundational human work, potentially unstable, and unsustainable in the long term.
The conversation reflects a deep-seated tension between the hardware excellence of current Apple products and the increasing dissatisfaction with the restrictive, closed nature of macOS. While many participants express a desire for "liberated" hardware—specifically the ability to run Linux on Apple Silicon—they recognize that the complexity of Apple's custom chips and the inherent instability of unofficial ports pose significant hurdles to daily use. Ultimately, the discussion highlights a divide between those who view computing as a tool to be customized and mastered, and those who prioritize a seamless, integrated experience, even at the cost of control and long-term ownership.
Window Sweaters 是一款 macOS 菜单栏应用,旨在通过把桌面窗口包裹在可定制的针织边框里,营造舒适、个性化的观感。该应用以 Felix Kratz 的 JankyBorders 为基础衍生,借助 macOS 的私有窗口 API 来跟踪当前处于活动状态的窗口,并应用多种图案与配色方案,从而让计算环境更有触感、视觉上也更与众不同。 Window Sweaters is a macOS menu-bar application designed to provide a cozy, personalized aesthetic by wrapping desktop windows in customizable knitted borders. Built as a derivative of Felix Kratz's JankyBorders, the app leverages private macOS window APIs to track active windows and apply various patterns and colorways, aiming to make the computing environment feel more tactile and visually distinct.
Window Sweaters 是一款 macOS 菜单栏应用,旨在通过把桌面窗口包裹在可定制的针织边框里,营造舒适、个性化的观感。该应用以 Felix Kratz 的 JankyBorders 为基础衍生,借助 macOS 的私有窗口 API 来跟踪当前处于活动状态的窗口,并应用多种图案与配色方案,从而让计算环境更有触感、视觉上也更与众不同。
用户可以通过菜单栏里的 yarn 图标与应用互动,在其中调整图案类型、边框厚度和针脚大小等设置。它的一大亮点在于为常用应用内置了 37 种手工针织配色,例如 Safari 、 Slack 、 VS Code 和 Figma 。对于没有预设 sweater 的应用,软件会从图标中动态采样颜色来生成匹配的观感,确保即使是未被识别的程序,也能保持整体统一的风格。
应用提供两种主要模式:By App 会为特定程序应用专属、量身定制的 sweater;Zigzag 则会用从应用图标颜色提取出来的乳白色锯齿图案,呈现更统一、柔和的外观。若想进一步掌控细节,用户可以编辑本地配置文件来定义自定义配色规则,或替换自带的图片文件作为边框纹理。系统也很灵活,允许用户对单个应用或整个工作流程随时关闭该效果。
由于该项目依赖私有 API,开发者说明目前仍在开发中,因而存在一些固有限制,例如在调整窗口大小时边框可能会暂时消失。它兼容 macOS 13 及更高版本,并可在 Apple Silicon 与 Intel 设备上运行。尽管该应用目前尚未获得 Apple 的官方公证,但项目提供了清晰的手动安装与配置说明,并另有 Homebrew 方案以便更轻松地部署。
对于希望参与贡献或扩展项目的人,源代码以 GPL-3.0 许可证发布。仓库中包含本地编译所需的构建脚本,以及自动化测试工具。无论是通过调整配置文件,还是修改底层代码,用户都可以按自己的偏好定制体验,让 Window Sweaters 成为一个持续演进的桌面个性化工具。
Window Sweaters is a macOS menu-bar application designed to provide a cozy, personalized aesthetic by wrapping desktop windows in customizable knitted borders. Built as a derivative of Felix Kratz's JankyBorders, the app leverages private macOS window APIs to track active windows and apply various patterns and colorways, aiming to make the computing environment feel more tactile and visually distinct.
Users can interact with the app via a yarn icon in the menu bar, which allows them to adjust settings like pattern types, border thickness, and stitch size. A standout feature is the inclusion of 37 hand-knitted colorways for popular applications, such as Safari, Slack, VS Code, and Figma. For applications without a pre-defined sweater, the software dynamically samples icon colors to generate a matching aesthetic, ensuring that even unrecognized programs maintain a cohesive look.
The application offers two primary modes: By App, which applies unique, tailored sweaters to specific programs, and Zigzag, which provides a uniform, softer look by utilizing a cream-colored zigzag pattern derived from the app's icon colors. If a user wishes to exert more control, they can edit a local configuration file to define custom color rules or swap in their own image files to serve as border textures. The system is designed to be flexible, allowing users to toggle the effect off for individual apps or entire workflows.
As a project that relies on private APIs, the developer notes that it is currently a work in progress with some inherent limitations, such as borders temporarily disappearing during window resizing. It is compatible with macOS 13 and later, running on both Apple Silicon and Intel hardware. While the app is not yet officially notarized by Apple, the project provides clear instructions for manual installation and configuration, as well as a Homebrew option for easier deployment.
For those interested in contributing or extending the project, the source code is available under the GPL-3.0 license. The repository includes build scripts for local compilation and automated testing tools. Whether through adjusting the configuration files or modifying the underlying code, users are encouraged to customize their experience, making Window Sweaters an evolving tool for desktop personalization.
• 该项目为 macOS 窗口增添了装饰性的"sweaters",突出了软件开发领域的一种转变:产品设计师现在可以借助 AI 工具,把以前超出自身技术边界的视觉构想落地。
• 人们对"vibe coding"的安全性仍存疑,尤其是用 AI agents 来安装软件的做法,因为这等于把对不透明模型检测恶意代码的能力当作前提,取代了传统可审计性的保障。
• 人类在艺术创作中的作用仍是争论焦点。有些人认为,当 LLMs 降低了门槛后,项目就会失去"magic";但也有人坚持,真正的衡量标准只有创意本身以及最终成果。
• 持怀疑态度的人认为,LLM 生成的项目往往更像低投入的"attention grabs",缺少历史上那些开发者个人项目所体现的独特个人风格或扎实的技术功底。
• 支持者则强调,GitHub 是分享实验的理想平台——不论是否有维护计划、 AI 辅助程度如何——因为这些项目都能为他人提供搭建灵感。
• 有人担心项目文档一开始缺少视觉呈现,尽管作者后来补充了视频演示,用来更清楚地展示软件功能。
• 对基于 prompt 的开发仍存在质疑:批评者认为,相比分享 prompt,直接分享最终产出的二进制文件更有价值,因为 prompt 本身往往不稳定,且难以完全复现。
• 这场讨论折射出黑客社区更广泛的"软件过剩"生存辩论:过去建立在开发乐趣与个人投入上的体验,正与 AI 辅助生成带来的便利形成鲜明对照。
• 技术限制(例如与 macOS Stage Manager 等功能的不兼容)表明,即便是 AI 辅助的项目,同样会面临与传统软件相同的集成难题。
• 该项目成功填补了数字实用性与审美新颖性之间的鸿沟,并因此被拿来与 Windows XP 时代的经典自定义工具 WindowBlinds 相提并论。
讨论的核心在于软件开发的演变格局:LLMs 让非工程师也能做出创意项目。重视过程、技术较量与匠心投入的人,和更关注最终结果、追求创作民主化的人之间,依然存在巨大的差距。尽管围绕安全性以及 AI 辅助代码库的可持续性担忧普遍存在,但这个项目总体上更像是一场异想天开的积极实验,促进了社区的连接。归根结底,这些论述指向的,是软件价值评估方式的根本转变:从聚焦如何把工艺做出来,转向衡量创意落地的速度。
• The project, which adds decorative "sweaters" to macOS windows, highlights a shift in software creation where product designers can use AI tools to realize visual concepts that were previously beyond their technical scope.
• Skepticism exists regarding the security of "vibe coding," specifically the practice of using AI agents to install software, as it replaces traditional auditability with trust in an opaque model's capability to detect malicious code.
• The role of human effort in art remains a point of contention. Some argue that projects lose their "magic" when the barrier to entry is lowered by LLMs, while others contend that the idea and the final result are the only metrics that matter.
• Skeptics argue that LLM-generated projects often function as low-effort "attention grabs" that lack the personal touch or technical mastery historically associated with developer pet projects.
• Supporters emphasize that GitHub is an ideal venue for sharing experiments, regardless of maintenance plans or the level of AI assistance, as these projects serve as inspiration for others to build upon.
• Concerns were raised about the lack of initial visual representation in the project's documentation, though the author subsequently added video demonstrations to clarify the software's functionality.
• Skepticism about prompt-based development persists, as critics argue that sharing an end-product binary is more valuable than sharing prompts, which are often non-deterministic and impossible to replicate exactly.
• The discussion reflects a broader existential debate in the hacker community about software abundance, where the joy of building is increasingly contrasted with the ease of AI-assisted generation.
• Technical limitations, such as incompatibility with features like macOS Stage Manager, underscore that even AI-assisted projects face the same integration hurdles as traditional software.
• The project successfully bridges the gap between digital utility and aesthetic novelty, drawing comparisons to classic customization tools like WindowBlinds from the Windows XP era.
The discussion centers on the evolving landscape of software development where LLMs enable non-engineers to execute creative projects. A significant divide remains between those who value the process, technical struggle, and artisanal effort, and those who prioritize the end result and the democratization of creation. While concerns regarding security and the sustainability of AI-assisted codebases are prevalent, the project is largely received as a whimsical, positive experiment that fosters community connection. Ultimately, the discourse reveals a fundamental transition in how software is valued, shifting from a focus on the craft of implementation to the speed of idea realization.
motorola signature 27 作为该公司最先进的旗舰智能手机问世,融合了高端设计与尖端性能。它以一套被 DXOMARK 认可为 2026 年发布的世界最佳摄像头系统脱颖而出,提供如采用 LOFIC 技术的 50MP Sony LYTIA 主传感器,以及支持 100x Super Zoom 的 200MP 潜望式长焦摄像头等功能。此外,这款设备还配备了 EVS 动作传感器,专门用于对快速移动的主体进行精准捕捉。 The motorola signature 27 arrives as the company's most advanced flagship smartphone, blending high-end design with cutting-edge performance. It distinguishes itself with a camera system recognized by DXOMARK as the world's best launched in 2026, offering features like a 50MP Sony LYTIA main sensor with LOFIC technology and a 200MP periscope telephoto camera capable of 100x Super Zoom. Additionally, the device introduces an EVS action sensor specifically designed to capture fast-moving subjects with precision.
motorola signature 27 作为该公司最先进的旗舰智能手机问世,融合了高端设计与尖端性能。它以一套被 DXOMARK 认可为 2026 年发布的世界最佳摄像头系统脱颖而出,提供如采用 LOFIC 技术的 50MP Sony LYTIA 主传感器,以及支持 100x Super Zoom 的 200MP 潜望式长焦摄像头等功能。此外,这款设备还配备了 EVS 动作传感器,专门用于对快速移动的主体进行精准捕捉。
视觉体验是该设备的重点之一,搭载 Extreme AMOLED Duo 双串联显示屏,峰值亮度可达 12,000 nits,使其成为目前智能手机中亮度最高的屏幕。该显示技术不仅提升了户外场景下的清晰度,还在能效方面较前几代提高了 34% 。设备由 Snapdragon 8 Elite Extreme Gen 6 平台驱动,并由大面积 ArcticMesh 系统散热,确保在游戏或 AI 处理等高负载任务中保持稳定性能。
人工智能以 Gemini Intelligence 深度融入日常使用。设备支持多项进阶能力,包括多步任务自动化、 Rambler 工具用于将自然语音精炼成书面文本,以及生成个性化主屏幕小部件的功能。此外,它还是首款集成 Motorola Qira 的手机,这是一套旨在统一 Motorola 与 Lenovo 更广泛生态体验的 AI 系统,同时也支持通过前置摄像头进行实时 American Sign Language 翻译等定制化功能。
音频表现同样出色,motorola signature 27 也是市面上唯一配备 Audio by Bang & Olufsen 的智能手机。此次合作带来了定制调校的扬声器架构,以及为维持音频保真而设计的专属音效模式。硬件采用耐用框架承载,使用陶瓷与玻璃结构,符合军用级 MIL-STD-810H 标准,并具备 IP68 与 IP69 防尘防水等级。
续航与安全方面也同样到位。设备内置 7000mAh 电池,支持 90W 有线充电和 50W 无线充电,电量补充速度非常高效,最快可在不到 15 分钟内完成显著补电。更值得高强度用户关注的是,motorola signature 27 是首款支持 GrapheneOS 的 Motorola 设备,这是一款以隐私为核心的开源操作系统。通过将高端硬件与七年 OS 及安全更新承诺相结合,公司希望为既追求创新又重视数据完整性的用户提供可靠、长期的解决方案。
The motorola signature 27 arrives as the company's most advanced flagship smartphone, blending high-end design with cutting-edge performance. It distinguishes itself with a camera system recognized by DXOMARK as the world's best launched in 2026, offering features like a 50MP Sony LYTIA main sensor with LOFIC technology and a 200MP periscope telephoto camera capable of 100x Super Zoom. Additionally, the device introduces an EVS action sensor specifically designed to capture fast-moving subjects with precision.
Visuals are a primary focus, supported by an Extreme AMOLED Duo tandem display that reaches a peak brightness of 12,000 nits, making it the brightest screen currently available in a smartphone. This display technology not only improves clarity in outdoor settings but also enhances energy efficiency by 34% compared to previous generations. The device is powered by the Snapdragon 8 Elite Extreme Gen 6 platform, cooled by a large-surface ArcticMesh system to ensure consistent performance during intensive tasks like gaming or AI processing.
Artificial intelligence is deeply integrated into the user experience through Gemini Intelligence. The device supports advanced capabilities, including multi-step task automation, the Rambler tool for refining natural speech into written text, and the ability to generate personalized home screen widgets. Furthermore, the phone is the first to include Motorola Qira, an AI system meant to unify experiences across the broader Motorola and Lenovo ecosystem, while also supporting specialized features like real-time American Sign Language translation via the front camera.
Audio performance is another key differentiator, as the motorola signature 27 is the only smartphone on the market to feature Audio by Bang & Olufsen. This partnership includes custom-tuned speaker architecture and specialized sound modes designed to maintain audio fidelity. The hardware is housed in a durable frame, featuring a ceramic and glass construction that meets military-grade MIL-STD-810H standards and holds IP68 and IP69 ratings for dust and water resistance.
Battery life and security round out the device's premium offerings. It houses a 7000mAh battery that supports 90W wired and 50W wireless charging, allowing for significant power replenishment in under fifteen minutes. Perhaps most notably for power users, the motorola signature 27 is the first Motorola device to support GrapheneOS, a privacy-focused, open-source operating system. By combining high-end hardware with a seven-year commitment to OS and security updates, the company aims to provide a reliable, long-term solution for those seeking both innovation and data integrity.
• 1,599 美元的 MSRP 被许多人认为高得让人望而却步,这也引发担忧:销量可能偏低,从而削弱制造商对隐私导向型固件未来的支持。
• Motorola 与 GrapheneOS 的合作意味着一个重大转向,因为该项目不再依赖 Google 制造的硬件,这或许能为注重安全的个人用户构建更广泛的生态系统。
• 安全专家指出,像内存标记扩展(Memory Tagging Extension,MTE)这样的硬件级能力对现代的完整性至关重要。将这些功能整合到 GrapheneOS 支持的平台中,体现出里程碑意义。
• 在供应链上存在一个关键矛盾:用户对由在隐私侵害、监视或固件透明度方面有前科的公司制造的设备普遍持怀疑态度。
• 围绕蜂窝 baseband 的"威胁模型"存在重大争议。总体共识是:尽管主操作系统无法完全控制无线电固件,但只要 kernel 和 userspace 得到恰当加固,它仍然能成为阻止数据外泄的强有力防线。
• 对 Qualcomm 硬件的依赖仍是 GrapheneOS 的结构性瓶颈,因为对入门设备的支持取决于低端芯片组中是否具备必要的安全原语。
• 与一些观点相反,这个项目并不是为了隐私而去和 Google 或 Motorola"合作"。它只是利用符合严格安全要求的硬件,让用户能够绕开厂商的 stock software,刷入自己的操作系统。
• "GrapheneOS 可以轻松移植到任何设备"的想法,被该项目对固件安全的高标准直接反驳。这些标准排除了许多热门选择(例如 Fairphone),原因包括更新生命周期不够长,以及 ODM 固件签名不透明。
• 长期支持对该项目的理念至关重要。人们更倾向于选择提供可访问 bootloader 的厂商,这样用户就能在厂商生命周期之外继续掌握设备控制权。
• 虽然部分用户对缺少"真正"的 Linux 替代品或像 Framework 手机那样可维修的硬件感到沮丧,但也有人认为,Motorola 的合作是朝着减少对主流移动监控"双头垄断"的依赖迈出的一步务实且必要的行动。
这场讨论反映出一个务实、同时又保持怀疑的社区,正在面对现代移动安全中的各种权衡。新款 Motorola 设备的高价格是主要的摩擦点,人们却依然对战略性超越 Pixel 硬件的做法表示赞赏。参与者仍然对 baseband 固件那种"黑盒"性质,以及供应链被破坏的可能性深感担忧;但与此同时,他们也理解 GrapheneOS 在缩小面向数据掠夺型生态系统的攻击面方面确实带来了实质性的减负。最终,这场对话凸显了在由中国 ODMs 和全球监控激励主导的硬件市场中实现高等级安全的难度:许多用户一边等待更理想、更可审计、更容易获得的硬件未来,一边也接受了渐进式进步的现实。
• The $1,599 MSRP is viewed by many as prohibitively expensive, leading to concerns that low sales volumes might discourage future manufacturer support for privacy-focused firmware.
• Motorola's partnership with GrapheneOS marks a significant shift, as it moves the project beyond reliance on Google-manufactured hardware, potentially creating a broader ecosystem for security-conscious users.
• Security experts emphasize that hardware-level features like Memory Tagging Extension (MTE) are critical for modern integrity, and this device represents a milestone by incorporating these features into a GrapheneOS-supported platform.
• A core tension exists regarding the supply chain, as users remain skeptical of devices manufactured by companies with histories of privacy violations, surveillance, or questionable firmware transparency.
• There is significant debate over the "threat model" of cellular basebands, with consensus that while the main operating system cannot fully control radio firmware, it remains a robust line of defense against data exfiltration if the kernel and userspace are properly hardened.
• The reliance on Qualcomm hardware remains a structural bottleneck for GrapheneOS, as support for budget devices is contingent on the availability of necessary security primitives in lower-tier chipsets.
• Contrary to some perceptions, the project does not "partner" with Google or Motorola for privacy; it simply leverages hardware that meets strict security requirements, allowing users to flash their own operating system independently of the manufacturer's stock software.
• The notion that GrapheneOS can be easily ported to any device is countered by the project's high bar for firmware security, which excludes many popular options like Fairphone due to inadequate update lifecycles and opaque ODM firmware signing.
• Long-term support is essential to the project's philosophy, and there is a preference for manufacturers that provide accessible bootloaders, enabling users to maintain control over their devices beyond the vendor-provided lifespan.
• While some users are frustrated by the lack of "true" Linux alternatives or repairable hardware like Framework phones, others see the Motorola collaboration as a pragmatic, necessary step toward reducing dependence on the dominant mobile surveillance duopoly.
The discussion reflects a pragmatic, albeit skeptical, community navigating the trade-offs of modern mobile security. While the high price point of the new Motorola device is a major point of friction, there is underlying appreciation for the strategic expansion beyond Pixel hardware. Participants remain deeply concerned about the "black box" nature of baseband firmware and the potential for supply chain compromises, yet recognize that GrapheneOS provides a meaningful reduction in surface area against data-hungry ecosystems. Ultimately, the conversation highlights the difficulty of achieving high-level security in a hardware market dominated by Chinese ODMs and global surveillance incentives, with many users accepting the reality of incremental progress while awaiting a more ideal, auditable, and accessible hardware future.
54 comments • Comments Link
- pwn.college 平台由从 UC Santa Barbara 转到 Arizona State 的学者们开发,建立在网络安全研究与教育的共同历史积累之上。
- 用户常把它严谨的实操训练方式与 HackThisSite 、 OverTheWire 、 Microcorruption 等经典网络安全学习平台对比,认为它质量高、成效明显。
- 平台的设计融入了游戏化元素,例如通过推进进度来获得"belts",从而激励学生更深入地投入完整课程。
- 绝大多数讨论都围绕对两端对齐(justified)文本的批评展开:反对者认为这会造成尴尬的字距和"河流(rivers)";支持者则认为,只要采用 LaTeX 等合适的排版算法,就更容易阅读。
- 由于网络浏览器对高级排版功能的支持仍然有限,一些观点认为,在"hyphens: auto"或更优的断行算法成为标准之前,网页上不应使用两端对齐文本。
- 有人倾向把 Discord 作为主要社区中心,但这一想法遭到强烈反对,理由包括隐私顾虑、该平台的专有与中心化性质,以及与强制身份验证相关的潜在风险。
- 设立禁止发布"write-ups"的规则被认为是教学上为了维护学习过程完整性所必须的;参与者表示,越是解释这些规则背后的原因,越能提升遵守度。
- 研究表明,通过提供"安慰性(placebic)"的理由,往往能提高人们对请求或社会规范的依从性,这一观点也得到了关于人类互动心理学的研究支持。
- 该平台因通过 Discord 提供社区驱动的支持而受到关注,尽管围绕在安全教育中使用这一特定平台的伦理影响,争论仍在持续。
- 关于平台记分牌系统的讨论,反映出大家对指标呈现方式以及排名界面背后逻辑的轻松兴趣。
讨论的核心在于对 pwn.college 作为一种进阶教育工具的认可:它确实把学术理论与网络安全实践能力之间的鸿沟有效衔接起来。尽管对该网站的技术与教学设计几乎是一致的高度评价,但这场讨论也凸显了现代网页设计偏好与传统可读性标准之间的矛盾,尤其体现在两端对齐文本的争议上。此外,讨论中还隐约透出一种以隐私为中心的价值取向,尤其是围绕在网络安全社区中使用 Discord 这类中心化平台的问题。总体而言,这场讨论既像是在向平台创始人致意,也折射出关于数字自主权、 UI/UX 最佳实践以及技术领域有效教学方法的更广泛争论。 • The pwn.college platform was developed by academics who transitioned from UC Santa Barbara to Arizona State, building on a shared history of research and education in cybersecurity.
• Users frequently compare the platform's rigorous, hands-on approach to classic cybersecurity training sites like HackThisSite, OverTheWire, and Microcorruption, noting its high quality and effectiveness.
• The design of the site includes gamified elements such as earning "belts" for progress, which motivates students to engage deeply with the comprehensive curriculum.
• A significant portion of the discourse involves a critique of justified text formatting, with critics arguing it creates awkward spacing and rivers, while proponents suggest it is easier to read when implemented with proper typesetting algorithms like LaTeX.
• Web browser support for advanced typography remains limited, leading to arguments that justified text should be avoided on the web until features like "hyphens: auto" or superior line-breaking algorithms are standard.
• The preference for using Discord as the primary community hub is met with strong pushback, citing privacy concerns, the platform's proprietary and centralized nature, and the risks associated with mandatory identity verification.
• Establishing rules against posting write-ups for challenges is discussed as a pedagogical necessity to preserve the integrity of the learning process, with participants noting that explaining the reasoning for these rules significantly increases compliance.
• Compliance with requests or social norms is often improved by providing "placebic" justifications, a principle supported by psychological research on human interaction.
• The platform is noted for its community-driven support via Discord, despite ongoing debates regarding the ethical implications of using that specific platform for security-focused education.
• Discussions about the platform's scoreboard system reveal a lighthearted interest in how metrics are displayed and the underlying logic of the ranking interface.
The conversation centers on the appreciation for pwn.college as a sophisticated educational tool that successfully bridges the gap between academic theory and practical cybersecurity skills. While the technical and pedagogical aspects of the site receive overwhelming praise, the thread highlights a tension between modern web design preferences and traditional readability standards, specifically regarding text justification. Furthermore, the discussion surfaces a strong undercurrent of privacy-centric ideology, particularly regarding the use of centralized platforms like Discord within the cybersecurity community. Overall, the thread serves as both a tribute to the platform's originators and a microcosm of broader debates regarding digital autonomy, UI/UX best practices, and effective teaching methods in technical fields.