DIGEST · 2025-12-17

OrangeBot.AI Digest — 2025-12-17

56 headlines across 8 sources, aggregated for this day.

Hacker News(15)

  1. I got hacked: My Hetzner server started mining Monero (blog.jakesaunders.dev)
  2. Why do commercial spaces sit vacant? (archive.strongtowns.org)
  3. Doublespeed hacked, revealing what its AI-generated accounts are promoting (www.404media.co)
  4. How SQLite is tested (sqlite.org)
  5. FCC chair suggests agency isn't independent, word cut from mission statement (www.axios.com)
  6. Linux Kernel Rust Code Sees Its First CVE Vulnerability (www.phoronix.com)
  7. A Safer Container Ecosystem with Docker: Free Docker Hardened Images (www.docker.com)
  8. AWS CEO says replacing junior devs with AI is 'one of the dumbest ideas' (www.finalroundai.com)
  9. Yep, Passkeys Still Have Problems (fy.blackhats.net.au)
  10. Firefox is becoming an AI browser and the internet is not at all happy about it (www.pcgamer.com)
  11. Tell HN: HN was down
  12. Gemini 3 Flash: Frontier intelligence built for speed (blog.google)
  13. Coursera to combine with Udemy (investor.coursera.com)
  14. AI's real superpower: consuming, not creating (msanroman.io)
  15. Is Mozilla trying hard to kill itself? (infosec.press)

GitHub Trending(11)

  1. C4illin / ConvertX

    💾 Self-hosted online file converter. Supports 1000+ formats ⚙️

  2. resemble-ai / chatterbox

    SoTA open-source TTS

  3. virattt / ai-hedge-fund

    An AI Hedge Fund Team

  4. simstudioai / sim

    Open-source platform to build and deploy AI agent workflows.

  5. Free-TV / IPTV

    M3U Playlist for free TV channels

  6. TapXWorld / ChinaTextbook

    所有小初高、大学PDF教材。

  7. 0xk1h0 / ChatGPT_DAN

    ChatGPT DAN, Jailbreaks prompt

  8. public-apis / public-apis

    A collective list of free APIs

  9. nicotsx / zerobyte

    Backup automation for self-hosters. Built on top of restic

  10. jellyfin / jellyfin-desktop

    Jellyfin Desktop Client

  11. NVIDIA-NeMo / Gym

    Build RL environments for LLM training

Hugging Face(15)

  1. MMGR: Multi-Modal Generative Reasoning

    Video foundation models generate visually realistic and temporally coherent content, but their reliability as world simulators depends on whether they capture physical, logical, and spatial constraints. Existing metrics such as Frechet Video Distance (FVD) emphasize perceptual quality and overlook reasoning failures, including violations of causality, physics, and global consistency. We introduce MMGR (Multi-Modal Generative Reasoning Evaluation and Benchmark), a principled evaluation framework based on five reasoning abilities: Physical, Logical, 3D Spatial, 2D Spatial, and Temporal. MMGR evaluates generative reasoning across three domains: Abstract Reasoning (ARC-AGI, Sudoku), Embodied Navigation (real-world 3D navigation and localization), and Physical Commonsense (sports and compositional interactions). MMGR applies fine-grained metrics that require holistic correctness across both video and image generation. We benchmark leading video models (Veo-3, Sora-2, Wan-2.2) and image models (Nano-banana, Nano-banana Pro, GPT-4o-image, Qwen-image), revealing strong performance gaps across domains. Models show moderate success on Physical Commonsense tasks but perform poorly on Abstract Reasoning (below 10 percent accuracy on ARC-AGI) and struggle with long-horizon spatial planning in embodied settings. Our analysis highlights key limitations in current models, including overreliance on perceptual data, weak global state consistency, and objectives that reward visual plausibility over causal correctness. MMGR offers a unified diagnostic benchmark and a path toward reasoning-aware generative world models.

  2. Video Reality Test: Can AI-Generated ASMR Videos fool VLMs and Humans?

    Recent advances in video generation have produced vivid content that are often indistinguishable from real videos, making AI-generated video detection an emerging societal challenge. Prior AIGC detection benchmarks mostly evaluate video without audio, target broad narrative domains, and focus on classification solely. Yet it remains unclear whether state-of-the-art video generation models can produce immersive, audio-paired videos that reliably deceive humans and VLMs. To this end, we introduce Video Reality Test, an ASMR-sourced video benchmark suite for testing perceptual realism under tight audio-visual coupling, featuring the following dimensions: (i) Immersive ASMR video-audio sources. Built on carefully curated real ASMR videos, the benchmark targets fine-grained action-object interactions with diversity across objects, actions, and backgrounds. (ii) Peer-Review evaluation. An adversarial creator-reviewer protocol where video generation models act as creators aiming to fool reviewers, while VLMs serve as reviewers seeking to identify fakeness. Our experimental findings show: The best creator Veo3.1-Fast even fools most VLMs: the strongest reviewer (Gemini 2.5-Pro) achieves only 56\% accuracy (random 50\%), far below that of human experts (81.25\%). Adding audio improves real-fake discrimination, yet superficial cues such as watermarks can still significantly mislead models. These findings delineate the current boundary of video generation realism and expose limitations of VLMs in perceptual fidelity and audio-visual consistency. Our code is available at https://github.com/video-reality-test/video-reality-test.

  3. WorldPlay: Towards Long-Term Geometric Consistency for Real-Time Interactive World Modeling

    This paper presents WorldPlay, a streaming video diffusion model that enables real-time, interactive world modeling with long-term geometric consistency, resolving the trade-off between speed and memory that limits current methods. WorldPlay draws power from three key innovations. 1) We use a Dual Action Representation to enable robust action control in response to the user's keyboard and mouse inputs. 2) To enforce long-term consistency, our Reconstituted Context Memory dynamically rebuilds context from past frames and uses temporal reframing to keep geometrically important but long-past frames accessible, effectively alleviating memory attenuation. 3) We also propose Context Forcing, a novel distillation method designed for memory-aware model. Aligning memory context between the teacher and student preserves the student's capacity to use long-range information, enabling real-time speeds while preventing error drift. Taken together, WorldPlay generates long-horizon streaming 720p video at 24 FPS with superior consistency, comparing favorably with existing techniques and showing strong generalization across diverse scenes. Project page and online demo can be found: https://3d-models.hunyuan.tencent.com/world/ and https://3d.hunyuan.tencent.com/sceneTo3D.

  4. Scone: Bridging Composition and Distinction in Subject-Driven Image Generation via Unified Understanding-Generation Modeling

    Subject-driven image generation has advanced from single- to multi-subject composition, while neglecting distinction, the ability to identify and generate the correct subject when inputs contain multiple candidates. This limitation restricts effectiveness in complex, realistic visual settings. We propose Scone, a unified understanding-generation method that integrates composition and distinction. Scone enables the understanding expert to act as a semantic bridge, conveying semantic information and guiding the generation expert to preserve subject identity while minimizing interference. A two-stage training scheme first learns composition, then enhances distinction through semantic alignment and attention-based masking. We also introduce SconeEval, a benchmark for evaluating both composition and distinction across diverse scenarios. Experiments demonstrate that Scone outperforms existing open-source models in composition and distinction tasks on two benchmarks. Our model, benchmark, and training data are available at: https://github.com/Ryann-Ran/Scone.

  5. RoboTracer: Mastering Spatial Trace with Reasoning in Vision-Language Models for Robotics

    Spatial tracing, as a fundamental embodied interaction ability for robots, is inherently challenging as it requires multi-step metric-grounded reasoning compounded with complex spatial referring and real-world metric measurement. However, existing methods struggle with this compositional task. To this end, we propose RoboTracer, a 3D-aware VLM that first achieves both 3D spatial referring and measuring via a universal spatial encoder and a regression-supervised decoder to enhance scale awareness during supervised fine-tuning (SFT). Moreover, RoboTracer advances multi-step metric-grounded reasoning via reinforcement fine-tuning (RFT) with metric-sensitive process rewards, supervising key intermediate perceptual cues to accurately generate spatial traces. To support SFT and RFT training, we introduce TraceSpatial, a large-scale dataset of 30M QA pairs, spanning outdoor/indoor/tabletop scenes and supporting complex reasoning processes (up to 9 steps). We further present TraceSpatial-Bench, a challenging benchmark filling the gap to evaluate spatial tracing. Experimental results show that RoboTracer surpasses baselines in spatial understanding, measuring, and referring, with an average success rate of 79.1%, and also achieves SOTA performance on TraceSpatial-Bench by a large margin, exceeding Gemini-2.5-Pro by 36% accuracy. Notably, RoboTracer can be integrated with various control policies to execute long-horizon, dynamic tasks across diverse robots (UR5, G1 humanoid) in cluttered real-world scenes.

  6. OpenDataArena: A Fair and Open Arena for Benchmarking Post-Training Dataset Value

    The rapid evolution of Large Language Models (LLMs) is predicated on the quality and diversity of post-training datasets. However, a critical dichotomy persists: while models are rigorously benchmarked, the data fueling them remains a black box--characterized by opaque composition, uncertain provenance, and a lack of systematic evaluation. This opacity hinders reproducibility and obscures the causal link between data characteristics and model behaviors. To bridge this gap, we introduce OpenDataArena (ODA), a holistic and open platform designed to benchmark the intrinsic value of post-training data. ODA establishes a comprehensive ecosystem comprising four key pillars: (i) a unified training-evaluation pipeline that ensures fair, open comparisons across diverse models (e.g., Llama, Qwen) and domains; (ii) a multi-dimensional scoring framework that profiles data quality along tens of distinct axes; (iii) an interactive data lineage explorer to visualize dataset genealogy and dissect component sources; and (iv) a fully open-source toolkit for training, evaluation, and scoring to foster data research. Extensive experiments on ODA--covering over 120 training datasets across multiple domains on 22 benchmarks, validated by more than 600 training runs and 40 million processed data points--reveal non-trivial insights. Our analysis uncovers the inherent trade-offs between data complexity and task performance, identifies redundancy in popular benchmarks through lineage tracing, and maps the genealogical relationships across datasets. We release all results, tools, and configurations to democratize access to high-quality data evaluation. Rather than merely expanding a leaderboard, ODA envisions a shift from trial-and-error data curation to a principled science of Data-Centric AI, paving the way for rigorous studies on data mixing laws and the strategic composition of foundation models.

  7. Reveal Hidden Pitfalls and Navigate Next Generation of Vector Similarity Search from Task-Centric Views

    Vector Similarity Search (VSS) in high-dimensional spaces is rapidly emerging as core functionality in next-generation database systems for numerous data-intensive services -- from embedding lookups in large language models (LLMs), to semantic information retrieval and recommendation engines. Current benchmarks, however, evaluate VSS primarily on the recall-latency trade-off against a ground truth defined solely by distance metrics, neglecting how retrieval quality ultimately impacts downstream tasks. This disconnect can mislead both academic research and industrial practice. We present Iceberg, a holistic benchmark suite for end-to-end evaluation of VSS methods in realistic application contexts. From a task-centric view, Iceberg uncovers the Information Loss Funnel, which identifies three principal sources of end-to-end performance degradation: (1) Embedding Loss during feature extraction; (2) Metric Misuse, where distances poorly reflect task relevance; (3) Data Distribution Sensitivity, highlighting index robustness across skews and modalities. For a more comprehensive assessment, Iceberg spans eight diverse datasets across key domains such as image classification, face recognition, text retrieval, and recommendation systems. Each dataset, ranging from 1M to 100M vectors, includes rich, task-specific labels and evaluation metrics, enabling assessment of retrieval algorithms within the full application pipeline rather than in isolation. Iceberg benchmarks 13 state-of-the-art VSS methods and re-ranks them based on application-level metrics, revealing substantial deviations from traditional rankings derived purely from recall-latency evaluations. Building on these insights, we define a set of task-centric meta-features and derive an interpretable decision tree to guide practitioners in selecting and tuning VSS methods for their specific workloads.

  8. Vector Prism: Animating Vector Graphics by Stratifying Semantic Structure

    Scalable Vector Graphics (SVG) are central to modern web design, and the demand to animate them continues to grow as web environments become increasingly dynamic. Yet automating the animation of vector graphics remains challenging for vision-language models (VLMs) despite recent progress in code generation and motion planning. VLMs routinely mis-handle SVGs, since visually coherent parts are often fragmented into low-level shapes that offer little guidance of which elements should move together. In this paper, we introduce a framework that recovers the semantic structure required for reliable SVG animation and reveals the missing layer that current VLM systems overlook. This is achieved through a statistical aggregation of multiple weak part predictions, allowing the system to stably infer semantics from noisy predictions. By reorganizing SVGs into semantic groups, our approach enables VLMs to produce animations with far greater coherence. Our experiments demonstrate substantial gains over existing approaches, suggesting that semantic recovery is the key step that unlocks robust SVG animation and supports more interpretable interactions between VLMs and vector graphics.

  9. ShowTable: Unlocking Creative Table Visualization with Collaborative Reflection and Refinement

    While existing generation and unified models excel at general image generation, they struggle with tasks requiring deep reasoning, planning, and precise data-to-visual mapping abilities beyond general scenarios. To push beyond the existing limitations, we introduce a new and challenging task: creative table visualization, requiring the model to generate an infographic that faithfully and aesthetically visualizes the data from a given table. To address this challenge, we propose ShowTable, a pipeline that synergizes MLLMs with diffusion models via a progressive self-correcting process. The MLLM acts as the central orchestrator for reasoning the visual plan and judging visual errors to provide refined instructions, the diffusion execute the commands from MLLM, achieving high-fidelity results. To support this task and our pipeline, we introduce three automated data construction pipelines for training different modules. Furthermore, we introduce TableVisBench, a new benchmark with 800 challenging instances across 5 evaluation dimensions, to assess performance on this task. Experiments demonstrate that our pipeline, instantiated with different models, significantly outperforms baselines, highlighting its effective multi-modal reasoning, generation, and error correction capabilities.

  10. RecGPT-V2 Technical Report

    Large language models (LLMs) have demonstrated remarkable potential in transforming recommender systems from implicit behavioral pattern matching to explicit intent reasoning. While RecGPT-V1 successfully pioneered this paradigm by integrating LLM-based reasoning into user interest mining and item tag prediction, it suffers from four fundamental limitations: (1) computational inefficiency and cognitive redundancy across multiple reasoning routes; (2) insufficient explanation diversity in fixed-template generation; (3) limited generalization under supervised learning paradigms; and (4) simplistic outcome-focused evaluation that fails to match human standards. To address these challenges, we present RecGPT-V2 with four key innovations. First, a Hierarchical Multi-Agent System restructures intent reasoning through coordinated collaboration, eliminating cognitive duplication while enabling diverse intent coverage. Combined with Hybrid Representation Inference that compresses user-behavior contexts, our framework reduces GPU consumption by 60% and improves exclusive recall from 9.39% to 10.99%. Second, a Meta-Prompting framework dynamically generates contextually adaptive prompts, improving explanation diversity by +7.3%. Third, constrained reinforcement learning mitigates multi-reward conflicts, achieving +24.1% improvement in tag prediction and +13.0% in explanation acceptance. Fourth, an Agent-as-a-Judge framework decomposes assessment into multi-step reasoning, improving human preference alignment. Online A/B tests on Taobao demonstrate significant improvements: +2.98% CTR, +3.71% IPV, +2.19% TV, and +11.46% NER. RecGPT-V2 establishes both the technical feasibility and commercial viability of deploying LLM-powered intent reasoning at scale, bridging the gap between cognitive exploration and industrial utility.

  11. MemFlow: Flowing Adaptive Memory for Consistent and Efficient Long Video Narratives

    The core challenge for streaming video generation is maintaining the content consistency in long context, which poses high requirement for the memory design. Most existing solutions maintain the memory by compressing historical frames with predefined strategies. However, different to-generate video chunks should refer to different historical cues, which is hard to satisfy with fixed strategies. In this work, we propose MemFlow to address this problem. Specifically, before generating the coming chunk, we dynamically update the memory bank by retrieving the most relevant historical frames with the text prompt of this chunk. This design enables narrative coherence even if new event happens or scenario switches in future frames. In addition, during generation, we only activate the most relevant tokens in the memory bank for each query in the attention layers, which effectively guarantees the generation efficiency. In this way, MemFlow achieves outstanding long-context consistency with negligible computation burden (7.9% speed reduction compared with the memory-free baseline) and keeps the compatibility with any streaming video generation model with KV cache.

  12. Feedforward 3D Editing via Text-Steerable Image-to-3D

    Recent progress in image-to-3D has opened up immense possibilities for design, AR/VR, and robotics. However, to use AI-generated 3D assets in real applications, a critical requirement is the capability to edit them easily. We present a feedforward method, Steer3D, to add text steerability to image-to-3D models, which enables editing of generated 3D assets with language. Our approach is inspired by ControlNet, which we adapt to image-to-3D generation to enable text steering directly in a forward pass. We build a scalable data engine for automatic data generation, and develop a two-stage training recipe based on flow-matching training and Direct Preference Optimization (DPO). Compared to competing methods, Steer3D more faithfully follows the language instruction and maintains better consistency with the original 3D asset, while being 2.4x to 28.5x faster. Steer3D demonstrates that it is possible to add a new modality (text) to steer the generation of pretrained image-to-3D generative models with 100k data. Project website: https://glab-caltech.github.io/steer3d/

  13. Differentiable Evolutionary Reinforcement Learning

    The design of effective reward functions presents a central and often arduous challenge in reinforcement learning (RL), particularly when developing autonomous agents for complex reasoning tasks. While automated reward optimization approaches exist, they typically rely on derivative-free evolutionary heuristics that treat the reward function as a black box, failing to capture the causal relationship between reward structure and task performance. To bridge this gap, we propose Differentiable Evolutionary Reinforcement Learning (DERL), a bilevel framework that enables the autonomous discovery of optimal reward signals. In DERL, a Meta-Optimizer evolves a reward function (i.e., Meta-Reward) by composing structured atomic primitives, guiding the training of an inner-loop policy. Crucially, unlike previous evolution, DERL is differentiable in its metaoptimization: it treats the inner-loop validation performance as a signal to update the Meta-Optimizer via reinforcement learning. This allows DERL to approximate the "meta-gradient" of task success, progressively learning to generate denser and more actionable feedback. We validate DERL across three distinct domains: robotic agent (ALFWorld), scientific simulation (ScienceWorld), and mathematical reasoning (GSM8k, MATH). Experimental results show that DERL achieves state-of-the-art performance on ALFWorld and ScienceWorld, significantly outperforming methods relying on heuristic rewards, especially in out-of-distribution scenarios. Analysis of the evolutionary trajectory demonstrates that DERL successfully captures the intrinsic structure of tasks, enabling selfimproving agent alignment without human intervention.

  14. Nemotron-Cascade: Scaling Cascaded Reinforcement Learning for General-Purpose Reasoning Models

    Building general-purpose reasoning models with reinforcement learning (RL) entails substantial cross-domain heterogeneity, including large variation in inference-time response lengths and verification latency. Such variability complicates the RL infrastructure, slows training, and makes training curriculum (e.g., response length extension) and hyperparameter selection challenging. In this work, we propose cascaded domain-wise reinforcement learning (Cascade RL) to develop general-purpose reasoning models, Nemotron-Cascade, capable of operating in both instruct and deep thinking modes. Departing from conventional approaches that blend heterogeneous prompts from different domains, Cascade RL orchestrates sequential, domain-wise RL, reducing engineering complexity and delivering state-of-the-art performance across a wide range of benchmarks. Notably, RLHF for alignment, when used as a pre-step, boosts the model's reasoning ability far beyond mere preference optimization, and subsequent domain-wise RLVR stages rarely degrade the benchmark performance attained in earlier domains and may even improve it (see an illustration in Figure 1). Our 14B model, after RL, outperforms its SFT teacher, DeepSeek-R1-0528, on LiveCodeBench v5/v6/Pro and achieves silver-medal performance in the 2025 International Olympiad in Informatics (IOI). We transparently share our training and data recipes.

  15. VersatileFFN: Achieving Parameter Efficiency in LLMs via Adaptive Wide-and-Deep Reuse

    The rapid scaling of Large Language Models (LLMs) has achieved remarkable performance, but it also leads to prohibitive memory costs. Existing parameter-efficient approaches such as pruning and quantization mainly compress pretrained models without enhancing architectural capacity, thereby hitting the representational ceiling of the base model. In this work, we propose VersatileFFN, a novel feed-forward network (FFN) that enables flexible reuse of parameters in both width and depth dimensions within a fixed parameter budget. Inspired by the dual-process theory of cognition, VersatileFFN comprises two adaptive pathways: a width-versatile path that generates a mixture of sub-experts from a single shared FFN, mimicking sparse expert routing without increasing parameters, and a depth-versatile path that recursively applies the same FFN to emulate deeper processing for complex tokens. A difficulty-aware gating dynamically balances the two pathways, steering "easy" tokens through the efficient width-wise route and allocating deeper iterative refinement to "hard" tokens. Crucially, both pathways reuse the same parameters, so all additional capacity comes from computation rather than memory. Experiments across diverse benchmarks and model scales demonstrate the effectiveness of the method. The code will be available at https://github.com/huawei-noah/noah-research/tree/master/VersatileFFN.

Solidot(15)

  1. 欧盟软化 2035 年内燃机汽车禁令

    欧盟放宽其原定于 2035 年实施的内燃机汽车禁令,允许少量低排放汽车继续销售。欧盟原计划到 2035 年新车的排放量必须为零,或比 2021 年的水平降低 100%。现在放宽为降低 90%,为插电混动汽车留出了空间——此类汽车配备电动机和内燃机,无需寻找充电站即可利用内燃机为电池充电。欧盟官员表示此举不会影响欧盟 27 个成员国在 2050 年实现经济碳中和的目标。

  2. 四成 fMRI 信号与实际大脑活动不一致

    功能磁共振成像(fMRI)过去三十年被广泛用于大脑研究,但根据发表在《Nature Neuroscience》上的一项研究,fMRI 信号存在大量的噪音,四成 fMRI 信号与实际大脑活动不一致。研究人员发现,40% 的案例中 fMRI 信号增强与脑活动减弱相关。在脑活动增强的区域,fMRI 信号反而减弱。研究结果表明,磁共振成像(MRI)测量的氧含量与神经元活动之间不存在普遍有效的耦合。这项发现从根本上挑战了以往对 fMRI 数据与神经元活动之间关系的解读方式。

  3. 苹果和 Google 释出紧急更新修复 0day

    苹果和 Google 最近都释出了紧急更新去修复正被利用的 0day。苹果向 iPhone、iPad 和 Mac 释出更新修复两个 WebKit bug,苹果表示漏洞可能被用于对特定目标发动复杂攻击,它没有披露细节。Google 释出 Chrome 更新修复了多个安全漏洞,其中包括正被利用 0day CVE-2025-14174,该 bug 属于越界内存访问漏洞。两家公司都没有透露细节,但看起来是相关的,Google 将 CVE-2025-14174 的发现归功于苹果的安全工程团队和 Google 的安全团队 Threat Analysis Group。目前看来该 0day 是被间谍软件利用。苹果 2025 年至今修复了 9 个 0day,Google 今年至今修复了 8 个 Chrome 0day。

  4. 多家中国火箭公司尝试复制 SpaceX 的 Starship 火箭

    蓝箭航天本月初执行了朱雀三号火箭的首飞任务,火箭发射成功但回收失败。朱雀三号的外形模仿了 SpaceX 的 Falcon 9 火箭。SpaceX 正在开发它的新一代重型火箭 Starship,因此越来越多的中国火箭初创公司也在开发外形类似 Starship 的火箭,当然不太可能第一步就开发重型火箭,它们开发的是 Starship 的缩小版本。名叫上海大航跃迁的火箭公司宣布正在开发中大型可重复使用运载火箭,使用了类似 Starship 的用两根金属筷子夹住火箭的回收技术;北京宇石空间也表示在研发甲烷燃料火箭,使用类似夹火箭回收技术,它对于模仿 SpaceX 的火箭毫不掩饰,称其技术方案与马斯克的 SpaceX 公司完全一致;北京领航星箭公司将其正在研发的火箭命名为星舰一号。这些火箭初创企业能否成功研制出缩小版 Starship 还是未知之数。

  5. 德州起诉五大 TV 制造商未经同意监视用户

    德州检察长 Ken Paxton 起诉五大制造商三星、LG、索尼、海信和 TCL,指控未经同意监视用户。新闻稿指控五大电视制造商使用 Automated Content Recognition(‘ACR’) 技术非法收集用户个人数据,称 ACR 像一个不请自来的隐形数字入侵者。这种软件能每 500 毫秒对电视屏幕进行截图,实时监控观看活动,在用户不知情或未经同意下将这些信息传输回公司。然后出售消费者信息获利,这些信息被用于跨平台投放定向广告。该技术将用户隐私和敏感信息如密码和银行信息置于风险之中。Paxton 的新闻稿还指出,海信和 TCL 总部在中国,称两家公司的中国关系引发了对消费者数据收集的严重担忧。

  6. 2025 年是有记录以来英国阳光最充足的年份

    英国气象局宣布 2025 年是自 1910 年有记录以来英国阳光最充足的一年。2025 年还有两周结束,但已记录到 1622 小时的日照时间,打破了 2003 年创下的纪录。除 2 月和 10 月外,所有月份日照时间高于平均水平。气候变化正以多种方式影响天气——气温升高、冬季更潮湿、夏季更干燥——但气候变化与日照时长之间的联系仍然不明确。英国气象局表示这一趋势的原因尚不明确。

  7. Mozilla 任命了新 CEO Anthony Enzor-DeMeo

    Mozilla 任命了新 CEO Anthony Enzor-DeMeo,接替临时 CEO Laura Chambers,后者将会继续留在董事会。新 CEO 发表博客畅谈了他的愿景:致力于成为值得信赖的软件公司。它包含三层含义:首先构建的每一款产品都必须赋予用户自主权,用户控制产品的使用方式,隐私、数据使用和 AI 必须清晰易懂,AI 必须始终是一种选项,用户可以很容易将其关闭;其次商业模式必须与信任相符;第三 Firefox 将从浏览器发展成为一个更广泛的、值得信赖的软件生态系统,Firefox 将演变为一款现代化的 AI 浏览器。鉴于目前开源社区对 AI 的立场,他的 AI 浏览器畅想引发了很多争议。

  8. 酷澎信息泄露事件嫌疑人在离职后仍有内部系统访问权限

    韩国电商巨头酷澎(coupang)多达 3370 万个用户的个人信息被泄露。该事件由酷澎中国籍前员工所为,酷澎服务器从今年 6 月 24 日至 11 月 8 日遭到入侵。泄露信息范围包括用户姓名、电邮、电话号码、地址,甚至包括住宅楼门禁密码。韩国警察厅已通过国际刑警组织向淘宝发函,要求其删除涉及“售卖韩国人账号”的相关内容。公司董事长朴大俊已引咎辞职。涉嫌泄密的中国员工曾担任公司身份验证系统软件开发者,他在一年前已经离职,但仍然秘密持有内部身份验证密钥,能不受限制的访问酷澎的用户信息。入侵利用了海外服务器,通过使用登录凭证,嫌疑人伪装成公司员工访问内部系统。

  9. 冰川消失预计将加剧

    研究人员预测,全球每年消失的冰川数量将急剧上升,到本世纪中叶达到 2000-4000 座,具体取决于相较于工业化前水平的升温程度。研究者指出,如限制变暖在 1.5℃,到 2100 年,将比变暖 2.7℃ 的场景下冰川存续数量翻倍,并防止在 4.0℃ 升温下冰川近乎完全消失的局面。全球冰川正在急速消退,这一趋势与海平面上升有关。但单个冰川的消失也蕴含着文化、精神和经济影响。冰川在一些社区中有着文化和精神含义,每年吸引数百万游客,也是下游地区的重要水源。

  10. 女性童年暴露于城市环境影响成年后行为

    天津医科大学的研究人员分析了中国人影像遗传学研究中 2950 名 18-30 岁中国女性的数据,探索在生命早期城市化生活、初潮年龄(青春期标志)和成人大脑与人格特征间的关系。通过使用卫星衍生指标衡量城市建成面积、夜间光照强度等城市化特点,他们发现,早期生活暴露于城市化程度较高,与初潮年龄更早有关;而较早的初潮年龄与内侧前额叶皮质体积缩小相关,同时在问卷测评中的宜人性和奖励依赖性也较低。他们还发现,家庭社会经济地位较高与初潮年龄较早有关,这也与较低宜人性和奖励依赖性相关。研究人员表示还需要进一步对男性个体的研究来确定城市化对男性的潜在影响。

  11. 美国的部分帕金森病与饮用水污染相关

    帕金森病的研究几十年来主要集中在遗传学,但至少在美国,越来越多的证据表明帕金森病与饮用水污染相关。流行病学家 Sam Goldman 对比了位于北卡罗来纳州 Lejeune 营和加利福尼亚州 Pendleton 营的海军陆战队员,其中 Lejeune 营的供水系统被三氯乙烯(TCE)污染约 35 年,Pendleton 营的供水系统较干净。研究发现, Lejeune 营接触过 TCE 的海军陆战队员患帕金森病的几率高 70%。最新研究表明,只有 10% 到 15% 的帕金森病能完全用遗传学来解释。过去 30 年美国帕金森病发病率翻了一番——这与遗传性疾病的特征并不相符。美国环保署于 2024 年 12 月采取行动禁用三氯乙烯 (TCE)。特朗普政府于 1 月作为取消监管行动的一部分推迟了该禁令。

  12. 微软终于淘汰过时加密算法 RC4

    微软终于准备淘汰过时且已知存在弱点的加密算法 RC4。RC4 代表 Rivist Cipher 4,由 RSA 加密算法作者之一的 Ronald Linn Rivest 在 1987 年设计。RC4 最初没有公开发表,属于商业机密,但 1994 年被泄露在 Cypherpunks 邮件列表上,安全研究人员很快演示了对 RC4 的攻击。尽管存在已知弱点,RC4 仍然被 SSL 和 TLS 等安全协议广泛使用,直到十年前才被淘汰。微软表示,到 2026 年中期,Windows Server 2008 及更高版本中 Kerberos Key Distribution Center(KDC)域控制器默认设置将禁用 RC4,仅允许使用 AES-SHA1 加密。除非管理员额外配置,否则 RC4 身份验证将不再有效。微软表示,过去十年一直在稳步推进对 RC4 算法的弃用,但这项工作并不容易。

  13. React Server 高危漏洞正被黑客组织利用

    本月初安全研究人员披露了编号为 CVE-2025-55182、危险等级 10/10 的 React Server 高危漏洞,该漏洞利用的成功率几乎能达到 100%,攻击者可以远程执行代码。在漏洞披露几个小时内,中国、伊朗、朝鲜的黑客组织以及网络犯罪组织就开始大规模利用该漏洞远程执行代码、部署后门和挖掘加密货币。亚马逊的安全团队称,中国黑客组织 Earth Lamia 和 Jackpot Panda 在利用该漏洞。Palo Alto Networks 的 Unit 42 称受害者超过 50 个。地下黑客论坛有大量关于 CVE-2025-55182 的讨论,有分享扫描工具链接、概念验证攻击代码(PoC) 以及相关工具的经验帖。

  14. Cloudflare 报告称半数网络中断事故是政府干预导致的

    Cloudflare 发布了年度报告《2025 Year in Review》。报告称全球互联网流量增长 19%;最流行的互联网服务仍然是 Gooogle、Facebook 和苹果;最流行的社交网络是 Facebook、Instagram、TikTok、Snapchat、LinkedIn,X / Twitter 排名第六;最流行的新闻服务是 Globo、ESPN、BBC、NY Times 和 CNN;SpaceX Starlink 卫星互联网流量增长 2.3 倍;52% 的 TLS 1.3 流量使用了后量子加密;AI 机器人流量最主要目的是训练;最流行的 Workers AI 模型是 @cf/meta/llama-3-8b-instruct;Workers AI 最流行的任务是文本生成;AI 机器人占了 HTTP 请求的 4.2%,Google 机器人占 4.5%,非 AI 机器人占 47.9%,人类占 43.5%;移动流量 iOS 占 35% Android 占 65%;21% 的流量使用 HTTP/3,HTTP/2 占 50%;主流网站有 37% 使用 Google Analytics;Go 是最流行的 API 客户端语言;Google 搜索引擎桌面份额占 79.5%,总份额占 89.5%,百度占总搜索份额的 1.4%;在桌面浏览器市场,Chrome 占 67.9%,Edge 14.4%,Firefox 6.7%,Safari 6.2%,Opera 2.2%;在包括移动和桌面的浏览器市场,Chrome 占 66.2%,Safari 15.4%,Edge 7.4%,Firefox 3.7%,Samsung Internet 2.3%;2025 年共发生了 174 起重大的互联网中断事故,83 起是政府导致的,中国共发生了一起:2025 年 8 月 20 日北京时间约 00:34 至 01:48 期间,HTTPS 访问短暂受限。

  15. 俄罗斯封禁 Roblox 引发儿童和民众抗议

    本月初俄罗斯宣布屏蔽苹果 FaceTime 和游戏平台 Roblox,声称 FaceTime 被用于犯罪活动,而 Roblox 则被指控传播极端主义材料和 LGBT 宣传。然而对儿童游戏平台 Roblox 的封禁在俄罗斯引发了罕见的抗议,尤其是来自儿童的投诉。普京的新闻秘书 Dmitry Peskov 证实克里姆林宫收到了大量儿童对禁令的投诉。亲克里姆林宫的 Yekaterina Mizulina 透露收到了 6.3 万封 8-16 岁儿童的投诉信件,半数儿童表示由于禁令考虑离开俄罗斯。Roblox 在 2023 年是俄罗斯下载量最高的游戏,它在儿童中间非常受欢迎,约四成玩家是 13 岁或以下的儿童。上周日数十名民众在西伯利亚城市 Tomsk 举行了罕见的游行示威,抗议当局对 Roblox 的封禁。