这次发现源于作者在前往秘鲁旅行途中，关于历史探索的一个简单问题。受到 Hiram Bingham 寻找失落城市的启发，作者思考现代技术能如何应用于考古发现。通过与包括 Gemini 、 ChatGPT 、 Claude 和 Grok 在内的多种 AI agents 合作，作者确定 lidar 是最合适的工具。由于卫星影像常被茂密的丛林树冠遮挡，lidar 利用激光脉冲绘制植被下方的地表，从而让人能够看到肉眼难以察觉的隐藏信息。

团队随后将研究重点从秘鲁转向玛雅地区，因为那里更容易获取公开的 lidar 数据。仅用了一个晚上，48 个 AI agents 就分析了约 1,200 平方公里的丛林影像。它们像高度勤勉、条理清晰的研究人员一样逐一手动查看图像，识别金字塔、广场和平台等人造结构，同时剔除自然地貌。到第二天早上，agents 已经标记出若干看起来像是未被发现的地点：这些地点呈现出与周围环境截然不同的锐利人工棱角与清晰的建筑布局。

其中有一处地点尤为引人注目：它包括一个已被整理得较为平整的广场、一座高约 8 到 12 米的金字塔、一个抬高的庭院，以及一个可能的蓄水设施。为确认该位置是否早已登记，agents 对既有文献和考古档案进行了细致核查。确认这一异常并非既知记录后，AI agents 便向作者提供了联系 Mexico's National Institute of Anthropology and History（INAH）的必要步骤。根据他们的指导，作者撰写了正式报告，并将其翻译成西班牙语以确保表达清楚。

提交结果后，墨西哥相关部门的回复在 72 小时内到达。 INAH 证实，在所提供的坐标处没有已登记的考古遗址记录。尽管这还未达到官方实地发现的标准，但现有数据表明该地点很可能是经典时期的玛雅政务中心，或许是用于举行仪式、进行地方治理以及日常生活的枢纽。作者表示，只要 INAH 决定派遣团队到现场核实，他愿意提供协助。

回顾整个过程，作者认为自己在考古领域的"外行"身份反而带来了优势：它让自己能够用一种全新、没有包袱的方式去面对一个长期存在的问题。通过把现成的计算资源和 AI agents 与公开数据结合起来，人们就能在极短的时间内完成重要的科学工作。这一成果凸显了 AI 作为各学科催化力量的潜力，也意味着，阻碍发现的主要剩余因素只有人类的好奇心与想象力。 The discovery began with a simple question about historical exploration while traveling through Peru. Inspired by Hiram Bingham's search for lost cities, the author wondered how modern technology could be applied to archaeological discovery. Collaborating with various AI agents, including Gemini, ChatGPT, Claude, and Grok, the author identified lidar as the ideal tool. Because satellite imagery is often obstructed by dense jungle canopy, lidar, which uses laser pulses to map the ground beneath the vegetation, offered a way to see what remained hidden to the naked eye.

The team shifted their focus from Peru to the Maya region, where public lidar data is more accessible. Overnight, forty-eight AI agents analyzed approximately 1,200 square kilometers of jungle imagery. They acted as highly diligent, methodical researchers, manually inspecting images to identify man-made structures like pyramids, plazas, and platforms while filtering out natural features. By the next morning, the agents had flagged several sites that appeared to be undiscovered, displaying sharp, artificial corners and structural layouts that clearly contrasted with the surrounding landscape.

One particular site caught their attention, featuring a leveled plaza, an 8 to 12-meter-tall pyramid, a raised courtyard, and a potential water reservoir. The agents performed a thorough review of existing literature and archaeological archives to confirm that the location was not already registered. Once confident in the anomaly, the AI agents provided the author with the necessary instructions to contact Mexico's National Institute of Anthropology and History (INAH). Following their guidance, the author prepared a formal report, which was translated into Spanish to ensure clarity.

After submitting the findings, the response from the Mexican authorities arrived within 72 hours. INAH confirmed that there was no record of an archaeological site at the provided coordinates. While not yet an official field discovery, the data suggests the site was a Maya civic center from the Classic period, likely serving as a hub for ceremonies, local governance, and daily life. The author has offered to support a potential field investigation should INAH choose to send a team to verify the findings on the ground.

Reflecting on the process, the author notes that being an outsider in the field of archaeology proved to be an advantage, as it allowed for a fresh, unburdened approach to a long-standing problem. By combining readily available compute resources and AI agents with existing public data, significant scientific work can be accomplished in a remarkably short time. This achievement highlights the potential for AI to act as a catalyst across all scientific disciplines, suggesting that the only remaining limits to discovery are human curiosity and imagination.

一名研究人员发现了 NVIDIA GA100 die 上的一个电压故障注入漏洞，该漏洞可实现对 eFuses 的未授权修改。利用这一缺陷，能够把受限硬件（例如 CMP 170HX 挖矿卡）变成完全可用的 A100-80G 数据中心级 GPU 。这些解锁后的显卡甚至可能超过零售版 A100，因为该漏洞可让此前因良率管理而被禁用的所有 streaming multiprocessors 重新启用，使性能大约达到标准量产机型的 1.2 倍。

该漏洞的关键在于 NVIDIA 如何进行产品分层。 GA100 die 主要使用两类保险丝：标准物理 eFuses 以及所谓的 fuseless fuses 。物理保险丝是永久性的，而 fuseless fuses 更像一种脚本式机制，用于告知硬件哪些功能需要启用或关闭。研究人员通过搭建自定义的电压故障注入方案，绕过安全校验，并把新的配置写入 fuseless fuse 区域。这样就相当于推翻了把高性能 die 限制成挖矿卡的约束，从而使 PCIe Gen4 、 NVLink 以及完整 framebuffer 容量等能力得以恢复。

要实现这种绕过，必须对 GPU 的电压调节器进行精确控制。研究人员设计了一种故障注入机制，用于接入 PWMVID 信号，从而在 GPU 的启动过程中操纵供电电压。通过找到"Goldilock's glitch"这一状态，安全敏感的 option words 就能在不触发防御性锁定的情况下被清除。障碍解除后，用户即可对硬件进行编程，使其忽略人为设定的限制。整个过程高度专业，通常需要进行硬件改装，包括拆除特定电阻并进行人工焊接连接，才能成功与显卡的供电系统建立接口。

这项研究带来的结果是显著的硬件能力提升。除了承载众多此类挖矿卡上本就具备的完整 80GB 内存外，用户还能够启用 Multi-Instance GPUs 与 NVDEC 等更高级功能，但前提是他们完成所需的硬件与固件调整。该研究在发表前已向 NVIDIA 的安全团队披露，然而相关技术已公开发布，目的是加深对 GA100 架构的理解，并展示那些因市场分层而本应长期处于沉睡状态的强大功能，仍可能被解锁。 A researcher has identified a voltage fault injection vulnerability on the NVIDIA GA100 die that allows for the unauthorized modification of eFuses. By exploiting this flaw, it is possible to convert restricted hardware, such as the CMP 170HX mining card, into a fully functional A100-80G datacenter-grade GPU. These unlocked cards can even outperform retail A100 units because the exploit enables all available streaming multiprocessors that were previously disabled for yield management, resulting in roughly 1.2 times the performance of standard production models.

The core of the vulnerability lies in how NVIDIA manages product segmentation. The GA100 die uses two main types of fuses: standard physical eFuses and so-called fuseless fuses. While physical fuses are permanent, fuseless fuses act as a script-like system that tells the hardware which features to enable or disable. By using a custom voltage glitching setup, the researcher was able to bypass security checks and write new configurations to the fuseless fuse region. This effectively overrides the restrictions that turn a high-performance die into a limited mining card, allowing for the restoration of features like PCIe Gen4, NVLink, and full framebuffer capacity.

Implementing this bypass requires precise control over the GPU's voltage regulator. The researcher developed a glitching mechanism that taps into the PWMVID signal to manipulate the supply voltage during the GPU's boot sequence. By finding the "Goldilock's glitch" state, the controller's security-sensitive option words can be cleared without triggering defensive locks. Once these barriers are removed, the user can program the hardware to ignore its artificial limitations. This process is highly technical and requires hardware modifications, including the removal of specific resistors and manual soldering of connections, to successfully interface with the card's power delivery system.

The end result of this research is a significant transformation in hardware capability. Beyond simply accessing the full 80GB of memory found on many of these mining cards, users can now enable advanced functionalities such as Multi-Instance GPUs and NVDEC, provided they perform the necessary hardware and firmware adjustments. While the research was disclosed to NVIDIA's security team prior to publication, the techniques have been released publicly to foster deeper understanding of the GA100 architecture and to demonstrate the potential for unlocking powerful features that would otherwise remain dormant due to market segmentation.

由于涉及 eMudhra 中间证书的安全事件，需要从包括 certifi 在内的通用 CA 捆绑包中移除 emSign 根 CA 证书。用户必须立即升级一系列软件包，并在重建容器镜像时禁用层缓存，以确保获取最新、受信任的系统证书。若不进行这些更新，系统将容易遭受"中间人攻击"，从而可能破坏与 python.org 和 pypi.org 等关键服务之间的安全连接。

受影响并已更新的软件范围很广，包括 pip 、 uv 、 certifi 的各个版本，以及 hatch 、 conda 和 virtualenv 等多种开发工具。我们敦促开发者升级到指定版本或更新版本，以降低相关风险。使用 Docker 的用户也已注意到，3.11 到 3.15 版本的官方 Python 镜像已更新，以修复这一安全漏洞。

除了更新软件包外，Python 维护者也发布了语言本身的新版本。其中包括 Python 3.15.2 、 3.14.10 、 3.13.18 、 3.12.16 和 3.11.18，它们内置会自动拒绝受损中间证书的逻辑，即便系统的 CA 捆绑包尚未完全更新，也能提供至关重要的防御层。仍在使用旧版本 Python（尤其是 3.10 及更早版本）的用户需要注意：这些版本已进入生命周期末期，不再提供这些关键的安全修复。

在技术通报之外，社区也在悼念 Tim Peters 的离世。 Guido van Rossum 透露，Peters 是 Python 历史上极为重要的人物，今年早些时候已去世。他对该语言的影响深远，从早期贡献（如混合算术支持）到长期担任导师与共同设计者的角色，都体现出他不可替代的价值。 Peters 以耐心著称，数学功底严谨，同时也善于用易懂且包容的方式解释复杂的设计挑战。

Peters 还通过他创作的 Zen of Python 留下了持久的遗产，这一作品至今仍在塑造社区的理念；他也开发了 Timsort，这种算法如今已被全球范围内的多种语言采用。同事们不仅记得他的技术天才，也记得他的谦逊和他与社区互动的独特方式——他常常用幽默与热情来化解技术分歧。他对早期 Python 开发文化的影响，以及他在 Python Software Foundation 董事会中的专注服务，为该语言走向广泛普及奠定了基础。 A security incident involving eMudhra intermediate certificates has necessitated the removal of the emSign root CA certificate from common CA bundles, including the certifi package. Users must immediately upgrade a range of software packages and rebuild container images with layer caching disabled to ensure they fetch the latest, trusted system certificates. Failure to perform these updates leaves systems vulnerable to monster-in-the-middle attacks that could compromise secure connections to critical services like python.org and pypi.org.

The list of affected and updated software is extensive, including versions of pip, uv, certifi, and various development tools like hatch, conda, and virtualenv. Developers are urged to upgrade to the specified versions or newer to mitigate these risks. For those using Docker, the official Python images for versions 3.11 through 3.15 have also been updated to address this security flaw.

In addition to updating packages, the Python maintainers have released new versions of the language itself. These releases, including Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18, contain logic that automatically rejects the compromised intermediate certificates, providing a crucial layer of defense even if a system's CA bundle has not yet been fully updated. Users operating on older versions of Python, specifically 3.10 and earlier, should be aware that these versions are end-of-life and no longer receive these vital security fixes.

Beyond the technical alerts, the community is mourning the loss of Tim Peters, a central figure in Python's history who passed away earlier this year. Guido van Rossum shared the news, highlighting Peters's immense impact on the language, from his early contributions like mixed arithmetic support to his role as a long-term mentor and co-designer. Peters was well known for his patience, his mathematical rigor, and his ability to explain complex design challenges in ways that were accessible and inclusive.

Peters left a lasting legacy through his creation of the Zen of Python, which continues to shape the community's philosophy, and the development of Timsort, an algorithm now used globally in languages beyond Python. Colleagues remember him not just for his technical genius, but for his humility and his unique approach to community interaction, where he famously used humor and warmth to resolve technical disagreements. His influence on the culture of early Python development and his dedicated service on the board of the Python Software Foundation were foundational to the language's rise to prominence.

将 SSH keys 存储在 macOS 的 Secure Enclave 中进行保护，可以提供强有力的安全保障：即便机器被入侵，也能防止私钥被提取。该方案利用一个与主处理器隔离的安全子系统，确保真实的私钥不会出现在磁盘或系统内存里。 Mac 并不保存原始密钥本身，而是保留一个引用；每次进行签名操作时，都必须通过硬件支持的身份验证来完成。借助内置的 CryptoTokenKit，用户可以在每次发起 SSH 连接时强制进行 Touch ID 验证，从而在增强安全性的同时，也能清楚地了解密钥何时被访问。

要搭建这一套流程，用户可以使用 sc_auth 命令创建一个符合 FIDO2 标准并绑定 Secure Enclave 的身份。密钥在满足相应生物识别要求的前提下生成后，会创建一个密钥句柄，作为标准 SSH 工具的接口。由于 macOS 在连接过程中不会自动识别这些非标准密钥名称，用户需要在 SSH 配置文件中手动指定这些密钥的路径。同时，还必须设置 SSH_SK_PROVIDER 环境变量，指向对应的系统库，以便 Shell 在身份验证阶段能够与 Secure Enclave 可靠通信。

这套原生实现既安全又不依赖第三方软件，但在易用性和恢复方面仍有一些取舍。最明显的不足是 Touch ID 提示的用户界面略显粗糙，观感和常见的 macOS 体验不够一致。此外，由于密钥是在硬件内部生成、且无法导出，它们与本机设备紧密绑定。丢失 Mac 就相当于丢失密钥，因此需要在服务器的 authorized_keys 文件中提前注册多个密钥，例如备用硬件令牌，或来自另一台机器的备份 Secure Enclave 密钥，以确保访问能力持续可用。

总体而言，选择基于硬件的方案，相比把密钥当作纯文本文件保存，提升非常显著。每次使用都要求生物识别验证，能消除恶意软件静默外传密钥的风险。虽然部分用户可能觉得原生界面不够精致，但底层机制依然是一个强大且内建的安全解决方案。若用户觉得原生提示过于打扰，还可以考虑 Secretive 等第三方方案：它们同样提供类似的基于硬件的架构，并能带来更顺滑的用户界面，同时保留 Secure Enclave 的核心优势。 Protecting SSH keys by storing them within the macOS Secure Enclave offers a robust security layer that prevents private keys from being extracted, even if a machine is compromised. This approach leverages a security subsystem isolated from the main processor, ensuring that the actual private key never exists on the disk or in system memory. Instead of storing a raw key, the Mac keeps a reference that requires hardware-backed authentication for every signing operation. By utilizing the built-in CryptoTokenKit, users can enforce Touch ID verification whenever an SSH connection is initiated, providing both enhanced security and transparency regarding when the key is being accessed.

To set up this system, users can utilize the sc_auth command to create a FIDO2-compliant identity linked to the Secure Enclave. Once a key is generated with the proper biometric requirements, a key handle is created to serve as the interface for standard SSH tools. Because macOS does not automatically recognize these non-standard key names during the connection process, users must explicitly define the path to these keys in their SSH configuration files. It is also necessary to set the SSH_SK_PROVIDER environment variable to point to the correct system library, allowing the shell to communicate with the Secure Enclave effectively during authentication.

While this native implementation is highly secure and requires no third-party software, it comes with certain trade-offs regarding usability and recovery. The most notable drawback is a somewhat unpolished and aesthetically unrefined user interface for the Touch ID prompts, which can feel inconsistent with the typical macOS experience. Furthermore, because the keys are generated inside the hardware and cannot be exported, they are inextricably tied to the host device. Losing the Mac means losing the key, making it essential to register multiple keys—such as a secondary hardware token or a backup Secure Enclave key from another machine—in the server's authorized_keys file to ensure continued access.

Ultimately, opting for a hardware-backed approach is a significant step up from keeping keys as plain text files. Requiring biometric verification for every use eliminates the risk of silent key exfiltration by malicious software. Although some users might find the native UI clunky, the underlying mechanism remains a powerful, built-in solution for those prioritizing security. For those who find the native prompts too intrusive, third-party alternatives like Secretive can offer a similar hardware-backed architecture with a more refined user interface, while still maintaining the core benefits of the Secure Enclave.

早在 1980 年代初期，当 8-bit PC 硬件受到极其严重的限制时，制作流畅、可玩的电子游戏是一项极其耗费精力的优化工作。作者的一位朋友当时正在开发一款图形密集的横向卷轴游戏，游戏几乎已经完成，但却深受帧率过低而无法运行的问题困扰。尽管程序员已经应用了诸如循环展开（loop unrolling）等标准优化手段，但游戏速度依然缓慢。当时的挑战在于硬件缺乏诸如 blitters 或 texture mappers 等现代特性，这要求程序员必须手动逐字节地移动数据以将图像绘制到屏幕上。

作者在研究代码后意识到，瓶颈在于负责将 background tiles 复制到 screen buffer 的那段程序。机器使用的 6809 处理器提供了一些特定且强大的寻址模式，但朴素的复制例程的周期计数依旧很高。通过进一步展开循环，并手动计算内存访问的偏移量，他们实现了 60% 的速度提升。然而，这仍不足以满足游戏的性能要求，于是作者开始寻求更非传统、近乎"疯狂"的解决方案。

在查阅 6809 微处理器手册后，作者发现处理器的 stack 指令可以被改造成用于快速数据传输。通过征用硬件 stack 寄存器，即 S 和 U，作者开发出一种方法：利用包括 DP 寄存器在内的所有可用寄存器，以单次突发（single burst）的方式把数据从 tile 中取出并推送到 screen buffer 。这种方案效率极高，但也带来了副作用——tiles 会被绘制得上下颠倒，且左右两半被交换。

为了解决这一问题，两人意识到这种"搅乱"过程其实是一个 involution 。于是他们在游戏运行前就对 tiles 做了预处理，提前把内部结构反转。这样一来，等到把被破坏的数据绘制到屏幕后，图像在到达屏幕时会被自动完美地还原。该方案带来了 70% 的速度提升，基本有效地解决了性能问题。但当他们为声音加入 hardware-clocked interrupts 时，最后一道难题出现了。由于该例程需要征用 stack pointer，如果在绘制 tile 的过程中触发中断，就会覆盖保存 reference tiles 的内存。

他们通过巧妙地交换 stack 指针来化解这次最终的技术危机，确保中断造成的任何破坏都会落到 screen buffer 上，而不是原始的 tile data 。为了避免这种短暂的屏幕异常被玩家看到，他们调整了绘制顺序：从高内存往低内存绘制。这样，任何意外的损坏都会在下一张 tile 被绘制时被覆盖，从而保证在 buffer 送往显示器之前问题不会显现出来。

回想当初，作者把这段经历视作早期计算时代所必需的创造力的证明。面对极其苛刻的硬件限制，程序员不得不反复尝试、失败并迭代，才能找到既巧妙又有时不那么正统的解决方案。这个故事也提醒人们：在这样的技术挑战中，同样能收获乐趣，并鼓励他人把自己的经验记录下来，免得这些具有专业性与历史意义的见解随着时间流逝而被遗忘。 Back in the early 1980s, when 8-bit PC hardware was incredibly limited, creating smooth, playable video games was a grueling exercise in optimization. A friend of the author was developing a graphically intensive side-scroller that was nearly complete but suffered from unplayable frame rates. Despite the programmer having already applied standard optimizations like loop unrolling, the game remained too slow. The challenge was that the hardware lacked modern features like blitters or texture mappers, requiring programmers to manually move data byte by byte to draw images onto the screen.

The author, after studying the code, realized that the bottleneck was the routine responsible for copying background tiles to the screen buffer. The 6809 processor used in the machine offered specific, powerful addressing modes, but the cycle counts for the naive copying routine remained high. By further unrolling the loops and manually calculating offsets for memory access, they achieved a 60 percent speed increase. However, this was still insufficient to meet the performance requirements of the game, leading the author to seek even more unconventional, "crazy" solutions.

After consulting a 6809 microprocessor manual, the author discovered that the processor's stack instructions could be repurposed for rapid data movement. By commandeering both the hardware stack registers, S and U, the author developed a method to pull data from a tile and push it to the screen buffer using every available register—including the DP register—to move blocks of data in a single burst. This approach was remarkably efficient, but it introduced a side effect: the process drew the tiles upside down and with their halves swapped.

To overcome this, the pair realized that the mangling process was actually an involution. By pre-processing the tiles to reverse their internal structure before the game ran, the act of drawing the corrupted data would perfectly restore the images once they reached the screen. This solution provided a 70 percent speed improvement, effectively solving the performance issues. However, a final hurdle emerged when they implemented hardware-clocked interrupts for sound. Because the routine relied on commandeering the stack pointer, an interrupt occurring during a tile draw would overwrite the memory where the reference tiles were stored.

They addressed this final technical crisis by cleverly swapping the stack pointers, ensuring that any corruption caused by an interrupt would target the screen buffer rather than the original tile data. To prevent this temporary screen glitch from being visible to the player, they altered the drawing order to proceed from high memory to low memory. This ensured that any accidental corruption would be overwritten by the next tile being drawn before the buffer was sent to the display.

Looking back, the author highlights this experience as a testament to the ingenuity required during the early era of computing. Faced with severe hardware limitations, programmers had to constantly experiment, fail, and iterate to find elegant, if sometimes unorthodox, solutions. The story serves as a reminder of the joy found in such technical struggles and an encouragement for others to document their own experiences before these specialized, historic insights are lost to time.

在 Anthropic 的 Project Glasswing 启动后的七个月里，这项计划在软件安全领域真正带来的影响仍遭到质疑。尽管项目一开始就宣称能够识别数千个高严重性与关键严重性漏洞，但实际效果远没有达到预期。追踪数据显示，归因于 Anthropic 的漏洞仅占今年已发布 CVE 总量的 0.5%，而其中真正可能在实际环境中被利用的证据少之又少。

项目内部的"账本"难以继续推进，暴露出发现与修复之间的差距越来越大。自 9 月以来，Anthropic 报告的发现数量几乎增加了 12,000 项，但已确认的修复数量却基本停滞不前。此外，被标记为重复或被撤回的发现数量，明显超过了实际完成的修复数量，这也让人对项目所声称的高真阳性率产生了疑虑。

鉴于人工分诊无法有效扩展，Anthropic 近期调整了策略，推出了自动化的 OSS Scanner 。该工具把验证压力从 Anthropic 内部团队转移给开源维护者：维护者现在需要处理未经核实、由模型生成的报告。 Anthropic 也承认这些发现是在没有人工审查的情况下生成的，这引发了对低质量甚至错误提交风险的担忧。

对这套新扫描器进行的一次实际测试以 curl 项目为对象，进一步凸显了维护者的困境。在 curl 处理的 34 份报告中，超过一半被判定为无效，只有少数被确认属于低严重性问题。这种结果与 Anthropic 所宣称的高成功率形成了鲜明反差，也表明项目产出的严重性或准确性往往达不到最初承诺。

归根结底，尽管 AI 驱动的漏洞发现具备潜力，但 Project Glasswing 的相关数据反映出目前的落地效果未能兑现其宣传叙事。让开源维护者承担大量潜在误报的处理工作，不仅没有减轻负担，反而给原本希望帮助的社区增加了额外工作。随着项目主张与维护者所观察到的现实之间的偏差持续存在，这项倡议的整体有效性与必要性仍将受到持续质疑。 Seven months into Anthropic's Project Glasswing, the initiative continues to face skepticism regarding its actual impact on software security. While the project launched with ambitious claims about identifying thousands of high- and critical-severity vulnerabilities, the reality has proven to be less significant. Tracking data indicates that vulnerabilities attributable to Anthropic account for a mere 0.5% of all CVEs published this year, with an extremely small fraction showing evidence of being exploited in the wild.

The project's internal ledger has struggled to maintain momentum, revealing a growing disconnect between discovery and resolution. Since September, the number of findings reported by Anthropic has surged by nearly 12,000, yet the number of confirmed fixes has remained largely stagnant. Furthermore, the volume of findings marked as duplicates or withdrawn has significantly outpaced the number of actual fixes, casting doubt on the project's reported high true-positive rates.

Recognizing that manual triage was not scaling, Anthropic recently shifted its approach by launching an automated OSS Scanner. This tool effectively offloads the burden of validation from Anthropic's internal teams to open source maintainers, who must now process unverified, model-generated reports. Anthropic acknowledges that these findings are produced without human review, raising concerns about the potential for low-quality or incorrect submissions.

A practical test of this new scanner, involving the curl project, highlighted the challenges maintainers face. Out of 34 reports processed by curl, more than half were determined to be invalid, while only a small minority were confirmed as low-severity issues. This experience stands in stark contrast to the high success rates claimed by Anthropic and suggests that the project's output often lacks the severity or accuracy initially promised.

Ultimately, while AI-driven vulnerability discovery holds promise as a tool, the data from Project Glasswing suggests that the current execution is falling short of its marketing narrative. The reliance on open source maintainers to handle a high volume of potential false positives has created an additional workload for the very communities the project aimed to assist. As the discrepancies between the project's claims and the reality observed by maintainers persist, the overall effectiveness and necessity of the initiative remain subject to ongoing critique.

Apple 正在开发一款名为 Harbor 的新应用，旨在简化在 Mac 硬件上本地运行人工智能模型的流程。通过让用户把电脑变成私有 AI 推理服务器，该工具确保数据始终留在用户设备上，而不会被传输到云端。此举也显示出 Apple 对支持基于 Silicon 架构设备上的本地 AI 工作负载的更深承诺，包括 Mac Studio 和 Mac mini 。

Harbor 最引人注目的功能之一，是它能通过 Thunderbolt 5 将多台 Mac 电脑连接起来，从而组建一个集群。借助这种连接方式，应用可以在不同设备之间汇聚统一内存，使用户能够运行通常会超出单台机器容量的更大、更复杂的模型。同时，这种集群配置还能提升并发能力，以便同时处理多个请求。

Harbor 的用户体验设计为简洁、上手容易，几乎不需要专业的技术能力。软件会自动检测通过 Thunderbolt 5 连接的设备以组建集群，无需复杂的手动设置或命令行操作。此外，应用内置模型管理功能，用户可以直接在界面中浏览、下载并加载开源权重模型。

目前，Harbor 仍处于 Apple 旗下 Claris 品牌的私有预览阶段。虽然它还未对公众开放，但其开发进展表明，未来很可能会推出正式版本，让更多 Mac 用户更容易获得强大的私有 AI 计算能力。 Apple is developing a new application called Harbor, designed to simplify the process of running artificial intelligence models locally on Mac hardware. By enabling users to turn their computers into private AI inference servers, the tool ensures that data remains on the user's device rather than being transmitted to the cloud. This initiative signals a deeper commitment from Apple to support local AI workloads on silicon-based machines, including the Mac Studio and Mac mini.

One of the most notable features of Harbor is its ability to create a cluster by connecting multiple Mac computers over Thunderbolt 5. This connectivity allows the application to pool unified memory across devices, which effectively enables users to run larger, more complex models that would typically exceed the capacity of a single machine. Additionally, this cluster setup supports higher concurrency for handling multiple requests simultaneously.

The user experience in Harbor is intended to be streamlined and accessible, requiring minimal technical expertise. The software automatically detects Thunderbolt 5-connected devices to form a cluster without the need for complex manual configurations or command-line inputs. Furthermore, the app includes integrated model management, allowing users to browse, download, and load open-weight models directly within the interface.

Currently, Harbor is in a private preview phase under Apple's Claris brand. While it is not yet available to the general public, its development suggests a forthcoming release that will likely make powerful, private AI computing more attainable for a wider range of Mac users in the near future.

在 Terence Tao 的著作《 Six Math Essentials 》中，这位 Fields Medalist 将浩瀚的数学领域提炼为六个基本概念，它们自古至今一直是思想者们的指路明灯。通过聚焦这些核心支柱，本书为理解定量推理如何帮助我们驾驭并解读当代世界的复杂性提供了一份清晰路线图。

这六个要素中的第一个，是"数"的概念。 Tao 将其视为通往定量思维的主要入口。随后，他转向代数，把它描述为实现抽象化、从而概括各种关系的关键工具。几何并不仅仅被当作研究形状的学科来引入，而是一种用于计算与测量那些超出人类视觉边界的现象的实用方法。

为应对生活中固有的不可预测性，本书引入概率，作为一种用严谨、合乎逻辑的思维来处理不确定性的框架。与此同时，分析学提供了驾驭极端情形所必需的数学语言，无论面对的是极其宏大的尺度，还是无穷小的存在。最后，本书以动力学收束，Tao 将其呈现为理解"变化本身"的决定性数学。

这本书篇幅短小却精炼优雅，在不让人感到负担的前提下，覆盖了足够广阔的思想空间。它既是希望弄清塑造我们社会的科学与数据背后机制的读者的便捷入门，也充分体现了作者作为顶尖数学家的深厚造诣。 In his book Six Math Essentials, Fields Medalist Terence Tao distills the vast field of mathematics into six fundamental concepts that have served as guideposts for thinkers from antiquity to the modern day. By focusing on these core pillars, the book offers a roadmap for understanding how quantitative reasoning allows us to navigate and interpret the complexities of our contemporary world.

The first of these essentials is the concept of numbers, which Tao frames as the primary gateway to quantitative thinking. From there, he moves into algebra, describing it as the essential tool for abstraction that allows us to generalize relationships. Geometry is introduced not just as a study of shapes, but as a practical method for calculating and measuring phenomena that exist well beyond the limits of human vision.

To address the inherent unpredictability of life, the book explores probability as a framework for navigating uncertainty with rigorous, logical thinking. These tools are complemented by the study of analysis, which provides the mathematical language necessary to tame extremes, whether they involve the incredibly large or the infinitesimally small. Finally, the book rounds out the collection with dynamics, which Tao presents as the definitive mathematics of change itself.

Clocking in at a slim, elegant length, the book manages to cover a vast amount of intellectual ground without feeling overwhelming. It serves as an accessible entry point for those looking to understand the mechanics behind the science and data that shape our society, while also reflecting the author's deep expertise as a preeminent mathematician.

在经历了多年销量下滑并于 2016 年被 Toyota 停产后，Scion 品牌正在迎来一场意外回归。该品牌最初于 2003 年推出，瞄准年轻人群，主打价格亲民、风格古怪的车型，并在巅峰时期曾以汽车行业里最低的平均购车者年龄而闻名。如今，它以"Scion by Toyota"的身份回归，把自己重新定位为"freedom lab"，致力于通过创新设计与实验性概念来挑战传统的出行方式。

此次复兴品牌旗下的首款量产车型是 KEI-01——一款基于现有 Toyota Pixis 打造的超紧凑型多用途卡车，而 Toyota Pixis 本身又是 Daihatsu Hijet Jumbo Cab 的换标车型。 KEI-01 在 Toyota 位于 Indiana 的体系内生产，作为真正的 kei 卡车，它搭载 660cc 发动机，并配备 CVT 变速箱。由于该车获得认证并符合美国低速车辆的安全标准，其行驶范围被限制在限速 35 mph 以下的道路上，因此更适合作为农业、仓储作业以及城市配送的专用工具，而不是普通的日常通勤车。

尽管车身尺寸大约只有五英尺宽、十一英尺长，KEI-01 却被打造为真正的干活利器。它提供 600 磅的有效载荷能力，配备可灵活折叠的三向货箱，并采用四轮驱动以应对不平整路面。车内同样具备加热与空调等现代化舒适配置。不过，Toyota 计划把首批上市限定在一个面向车队运营的利基试点项目中，时间从 2027 年底开始。至于未来是否向普通消费者开放，仍取决于首批车队推广后的实测数据与用户反馈。

除了计划量产的 KEI-01 外，"Scion by Toyota"阵容还包含两款实验性概念车，用以展示品牌新的探索方向。 SxS Concept 是一款偏硬派的越野 side-by-side 车型，搭载来自 Toyota Tacoma 的 300 马力涡轮增压发动机，并特别加入了"Silent Mode"，可实现纯电动模式的全工况运行。与之相对的 BKE Concept 则是一款为户外爱好者打造的个人出行设备。它小巧的车身尺寸和扎实耐用的轮胎，旨在连接 KEI-01 的实用属性与 SxS 的高性能能力，为穿行于狭窄的非铺装越野小路提供更便携的解决方案。 After being retired by Toyota in 2016 following years of declining sales, the Scion brand is making an unexpected comeback. Originally launched in 2003 to target a younger demographic with budget-friendly, quirky vehicles, the marque famously achieved the lowest average buyer age in the automotive industry during its peak. Now returning as "Scion by Toyota," the brand is repositioning itself as a "freedom lab" dedicated to challenging conventional mobility through innovative design and experimental concepts.

The first production vehicle under this revived identity is the KEI-01, an ultra-compact utility truck based on the existing Toyota Pixis, which is itself a rebadged Daihatsu Hijet Jumbo Cab. Manufactured using Toyota's infrastructure in Indiana, the KEI-01 is a genuine kei truck featuring a 660cc engine and a CVT transmission. Because it is certified to meet American low-speed vehicle safety standards, it is restricted to roads with speed limits under 35 mph, making it a specialized tool for agriculture, warehouse operations, and urban delivery rather than a conventional daily driver.

Despite its compact size of roughly five feet wide and eleven feet long, the KEI-01 is designed as a functional workhorse. It boasts a 600-pound payload capacity, a versatile three-way fold-down cargo bed, and four-wheel drive for navigating uneven terrain. While the vehicle includes modern comforts like heat and air conditioning, Toyota plans to limit its initial release to a niche pilot program focused on fleet usage starting in late 2027. Future consumer availability remains uncertain and will depend on performance data and feedback from the initial fleet rollout.

In addition to the production-bound KEI-01, the Scion by Toyota lineup features two experimental concepts that illustrate the brand's new focus on exploration. The SxS Concept is a rugged, off-road side-by-side vehicle powered by a 300-horsepower turbocharged engine from the Toyota Tacoma, which uniquely includes a "Silent Mode" that allows for fully electric operation. Complementing this is the BKE Concept, a personal mobility device designed for outdoor enthusiasts. Its small form factor and rugged tires are intended to bridge the gap between the utilitarian nature of the KEI-01 and the high-performance capabilities of the SxS, offering a portable solution for navigating narrow, off-road paths.

Starlink 已正式推出 Mini 2，这是其便携式卫星互联网硬件的下一代产品。该版本专为需要在偏远或恶劣环境中保持可靠连接的用户打造，采用了完全重新设计的机身外壳，比上一代更薄也更耐用。机身厚度仅 23.1mm，产品定位强调便携性，宣称可以和笔记本电脑一起装进包里，面向追求高机动性的用户。

Mini 2 的一项重要升级是内置了可快速更换的电池，可实现最长约 4.5 小时的独立运行。摆脱必须连接专用外部电源的限制后，用户可在露营、徒步或靠近水域工作时实现真正不受束缚的上网。电池额定容量为 71Wh，可通过标准 60W USB-C 接口充电。若需要更长时间使用，用户既可以更换备用电池，也可以在设备仍处于充电状态时继续保持连接。

Mini 2 的机身结构也体现了其面向户外的定位，具备 IP67 防护等级。该等级可确保设备在多种环境挑战下依然可用，包括路途中遇到的雨淋、在水上遭遇的风浪，以及海滩环境中的沙尘。为便于移动场景搭建，设备还提供了实用设计，例如内置支架，以及标准 1/4-20 相机螺纹接口，便于安装到多种三脚架配置上。

在连接能力方面，Mini 2 支持 Wi‑Fi 6，覆盖范围最高可达 1,800 平方英尺。尽管内部硬件有所调整，设置流程仍然简单：用户只需将设备对准天空，约 60 秒即可完成联网。整套产品包含 Starlink Mini 2 主机、可拆卸电池、电源适配器，以及一条 3 米 USB-C 线缆。

目前，Starlink 正在邀请美国境内的部分客户进行预订。尽管初期可用范围有限，但公司计划在不久的将来扩展到更多客户和更多国家。此次发布意味着 Starlink Mini 系列的关键进化，朝着更灵活、且更自成体系的使用生态迈进，为那些希望保持移动性的用户提供在不牺牲高速卫星连接前提下的解决方案。 Starlink has officially introduced the Mini 2, the next generation of its portable satellite internet hardware. This iteration is specifically designed for users who need reliable connectivity in remote or rugged environments, featuring a completely redesigned enclosure that is both thinner and more durable than its predecessor. With a sleek profile of just 23.1mm, the device is marketed as being compact enough to fit alongside a laptop in a bag, making it a highly mobile solution for adventurers.

A major upgrade in the Mini 2 is the inclusion of a quick-swap, built-in battery that provides up to 4.5 hours of independent operation. This shift away from requiring a dedicated external power source allows for true untethered internet access, whether you are camping, hiking, or working near water. The battery itself is rated at 71 Wh and can be charged via a standard 60W USB-C connection. If longer sessions are required, users have the flexibility to swap in a spare battery or remain connected while the unit is actively charging.

The physical construction of the Mini 2 reflects its focus on outdoor use, boasting an IP67 environmental rating. This level of protection ensures that the unit remains operational through various challenges, including rain on the trail, wind on the water, or sand at the beach. The hardware includes convenient touches for mobile setups, such as a built-in kickstand and a standard 1/4-20 camera thread mount, which allows for easy installation on a variety of tripod configurations.

Connectivity performance remains a priority, with the device supporting Wi-Fi 6 and covering an area of up to 1,800 square feet. Despite the internal hardware changes, the setup process remains straightforward, requiring users to simply point the device at the sky to get online in about 60 seconds. The complete package ships with the Starlink Mini 2 unit, the detachable battery, a power supply, and a 3-meter USB-C cable.

Currently, Starlink is opening preorders by invitation for select customers within the United States. While availability is initially limited, the company plans to expand access to more customers and countries in the near future. This launch marks a significant evolution for the Starlink Mini series, moving toward a more versatile and self-contained ecosystem for users who prioritize mobility without sacrificing high-speed satellite connectivity.