From 37 items, 6 important content pieces were selected
A post on Openwall argues that Linux kernel vulnerability disclosures do not automatically give downstream distributions advance notice. According to the discussion, distributions only get a heads-up if the reporter specifically coordinates through the linux-distros mailing list. This affects distribution maintainers, vendors, and users who rely on timely patches before a vulnerability becomes public. If advance coordination does not happen, downstream projects may have less time to prepare fixes, mitigations, or advisories. The policy described in the thread places the burden on the reporter to involve linux-distros, rather than on the kernel team to automatically notify every downstream consumer. The mailing list is intended for embargoed discussions only, which limits who can see the details before public disclosure.
hackernews · ori_b · Apr 30, 16:43
Background: Coordinated vulnerability disclosure is a process where maintainers get time to fix a security issue before it is made public. The Linux kernel security documentation says the project wants security bugs reported so they can be fixed and disclosed quickly, while the linux-distros list is meant for embargoed coordination with trusted distribution security contacts. In practice, this kind of workflow is meant to balance rapid patching with giving downstream users time to prepare.
Discussion: Commenters were sharply critical of the process, with several arguing that it is irresponsible to disclose exploits before distributions ship fixes. Others said reporters should not be expected to coordinate with every downstream consumer and that the kernel project itself should handle notification better. One reply quoted Greg KH as saying advance notification is constrained by policy and legal/governmental requirements.
Tags: #Linux kernel, #vulnerability disclosure, #open source security, #patch management, #distribution maintainers
A Semgrep report says a malicious dependency themed “Shai-Hulud” was found in the PyTorch Lightning AI training library. The incident shows that even widely used ML training libraries can become a delivery point for supply-chain malware. PyTorch Lightning is used to simplify PyTorch training workflows, so a compromise in this layer can affect many downstream users and projects. The case underscores how ML teams inherit software supply-chain risk from the Python ecosystem, not just from their own code. PyTorch Lightning is a high-level interface built on top of PyTorch, which means it sits directly in the training stack that many developers rely on. In ML security terms, supply-chain attacks can target the components used to build and deploy models, making dependency review and provenance checks especially important.
hackernews · j12y · Apr 30, 16:09
Background: PyTorch Lightning is an open-source Python library that helps organize PyTorch training code and automate parts of the training process. In machine learning, supply-chain attacks refer to compromises in the tools, packages, data, or infrastructure that feed model development and deployment. Python-based ML projects often depend on many third-party packages, which increases the attack surface.
Discussion: Commenters reacted with broad concern that high-profile supply-chain attacks seem to be increasing across major packages. Several people pointed to the ML ecosystem’s heavy dependency footprint, while others argued that some bot-driven issue handling may be obscuring security signals and that reducing dependencies could help.
Tags: #supply-chain security, #malware, #PyTorch Lightning, #machine learning, #open source security
This long-form explainer breaks down how an oil refinery turns crude oil into usable products, and it drew strong Hacker News interest with 445 points and 138 comments. The article walks through the refinery chain from separation to upgrading processes, giving readers a detailed systems-level view of the plant. Refining is the step that turns raw crude into fuels and feedstocks the modern economy actually uses, so understanding the process helps explain both energy supply and refinery economics. For engineers and technically curious readers, it also clarifies why refinery operations are complex, capital-intensive, and highly optimized. The core steps highlighted by the background sources are fractional distillation, which separates crude into fractions by boiling range, and downstream conversion units such as fluid catalytic cracking, which break larger hydrocarbons into higher-value gasoline-range products. Hydrodesulfurization is also important because it removes sulfur to very low levels before later processing steps, helping protect catalysts like those used in catalytic reforming.
hackernews · chmaynard · Apr 30, 13:54
Background: Crude oil is not a single substance but a mixture of many hydrocarbons with different boiling points. Refineries first separate those components in a distillation tower, then use chemical and catalytic processes to reshape the mix into products such as gasoline, diesel, and other fuels. Some units split molecules into smaller ones, while others remove contaminants like sulfur or improve the quality of a product stream. That combination of separation, conversion, and cleanup is what makes a refinery much more than a simple distillation plant.
Discussion: Commenters responded with a mix of personal experience and technical curiosity. Several people shared first-hand refinery memories or family connections, while others pointed to SimRefinery and games like Factorio as surprisingly useful mental models for understanding refinery process flow.
Tags: #industrial engineering, #energy, #process engineering, #technical explainer
Rivian’s support article asks whether owners can disable all data collection from their vehicles, and a Hacker News thread turns that question into a broader debate about privacy controls in connected EVs. Commenters focus on how much telemetry can really be turned off and whether cellular connectivity is needed for safety updates. Connected cars increasingly rely on telematics and OTA software delivery, so privacy settings can affect not just data sharing but also recall fixes and safety improvements. The issue matters to EV owners, automakers, regulators, and security researchers because it sits at the intersection of privacy, compliance, and vehicle safety. The discussion highlights a practical tradeoff: disabling the eSIM or other connectivity may reduce telemetry, but it could also prevent over-the-air recall or safety updates. Search results note that OTA updates are now common in new cars, and a telematics control unit serves as the vehicle’s internet-connected communications hub.
hackernews · Cider9986 · Apr 30, 20:27
Background: A telematics control unit, or TCU, is the embedded module that connects a vehicle to external networks and enables connected services such as fleet features and V2X communication. In modern vehicles, manufacturers can also use OTA updates to push software changes, including some recall-related fixes, without requiring a dealership visit. That makes the question of “turning off all data collection” more complicated than simply flipping a privacy switch.
Discussion: The thread is broadly sympathetic to giving owners an opt-out, but many commenters worry that disabling connectivity could create safety and compliance problems. Several posts raise edge cases around OTA recalls, regulatory access, and even national-security risks if a manufacturer or government can reach cars remotely; one commenter also noted that physically removing the OnStar unit was once the only practical way to cut cellular connectivity on an older truck.
Tags: #privacy, #connected cars, #EVs, #cybersecurity, #over-the-air updates
The FCC held an initial vote on an NPRM in WC Docket No. 26-82, titled “Protecting Domestic Telecommunications Services from National Security Threats.” The proposal would remove covered entities such as China Mobile, China Telecom, and China Unicom from Section 214 blanket authorization and asks whether U.S. carriers should also be barred from interconnecting with them. If adopted, the rule could materially change how major Chinese telecom operators access U.S. telecom infrastructure and how traffic is exchanged with U.S. networks. It would also signal a deeper regulatory shift toward treating telecom connectivity as a national-security issue, with implications for carriers, customers, and cross-border network arrangements. This is only an NPRM, not a final rule, so the proposal still has to go through publication, public comment, FCC review, and final action, and its terms may change substantially. The FCC is also asking about revoking existing authorizations, possible wind-down periods, extending limits to affiliates, and the impact of any interconnection ban on existing agreements, costs, and transition timing.
telegram · zaihuapd · Apr 30, 17:10
Background: An NPRM, or Notice of Proposed Rulemaking, is the FCC’s formal way of asking the public to comment before it adopts or changes a rule. Section 214 of the Communications Act is part of the FCC’s carrier authorization framework, and “blanket authorization” can let carriers operate without filing a separate case for every authorization. Interconnection agreements are the contracts and technical arrangements carriers use to exchange traffic between networks.
Tags: #FCC, #telecom policy, #network regulation, #China-US relations, #national security
Financial Times and Reuters reported that Huawei internally expects its AI chip business revenue to rise by more than 60% in 2026, reaching about $12 billion. The forecast is tied to strong demand from Chinese companies seeking domestic alternatives for AI computing hardware amid continued access limits on high-performance foreign chips. The forecast signals that demand for localized AI infrastructure in China may be stronger than expected, which could accelerate Huawei’s role in the domestic semiconductor ecosystem. It also highlights how export restrictions and geopolitics are reshaping AI hardware purchasing decisions across Chinese tech firms. The report says the revenue outlook is based on existing orders already in hand, rather than a newly announced product launch. The key caveat is that this is an internal forecast reported by media, so it reflects demand expectations more than an official company guide.
telegram · zaihuapd · May 1, 03:08
Background: AI chips are specialized hardware used to perform the heavy computation behind training and running large AI models. In China, domestic AI hardware alternatives have become more important as access to some high-performance foreign chips remains constrained. That has pushed large technology companies to look for local suppliers that can support growing AI infrastructure needs.
Tags: #Huawei, #AI chips, #semiconductors, #China AI infrastructure, #geopolitics
From 37 items, 6 important content pieces were selected
Openwall 上的一篇文章指出，Linux 内核漏洞披露并不会自动提前通知下游发行版。讨论中提到，只有当报告者专门通过 linux-distros 邮件列表协调时，发行版才会提前获知。 这会影响发行版维护者、厂商以及依赖及时补丁的用户，因为漏洞公开前的准备时间可能会被压缩。若缺少提前协调，下游项目就更难在公开前准备修复、缓解措施或安全公告。 线程里描述的政策把协调责任更多放在报告者身上，而不是由内核团队自动通知所有下游消费者。linux-distros 邮件列表只用于保密期内的讨论，这也限制了公开披露前能够看到细节的人范围。
hackernews · ori_b · Apr 30, 16:43
背景: 协调漏洞披露是一种流程：维护者先获得修复安全问题的时间，然后再公开漏洞。Linux 内核安全文档表示，项目希望尽快收到安全漏洞报告，以便快速修复和披露；而 linux-distros 列表则用于与受信任的发行版安全联系人进行保密协调。实际上，这类流程旨在在快速修补和让下游用户提前准备之间取得平衡。
社区讨论: 评论区的批评很强烈，很多人认为在发行版尚未发布修复前就公开利用方式是不负责任的。也有人指出，不应要求报告者去协调所有下游消费者，而应由内核项目本身更好地处理通知工作。另有回复引用 Greg KH 的说法，称提前通知受到政策以及法律/政府要求的限制。
标签: #Linux kernel, #vulnerability disclosure, #open source security, #patch management, #distribution maintainers
Semgrep 的报告称，PyTorch Lightning 这个 AI 训练库中发现了一个带有“Shai-Hulud”主题的恶意依赖。此次事件表明，即使是广泛使用的机器学习训练库，也可能成为供应链恶意软件的传播入口。 PyTorch Lightning 用于简化 PyTorch 训练流程，因此这类层级被攻破可能影响大量下游用户和项目。此事也说明，机器学习团队承受的供应链风险不仅来自自己的代码，还来自 Python 生态中的依赖关系。 PyTorch Lightning 是建立在 PyTorch 之上的高层接口，这意味着它直接位于许多开发者依赖的训练栈中。按照机器学习安全的定义，供应链攻击可以瞄准用于构建和部署模型的各类组件，因此依赖审查和来源验证尤其重要。
hackernews · j12y · Apr 30, 16:09
背景: PyTorch Lightning 是一个开源 Python 库，用于帮助组织 PyTorch 训练代码并自动化部分训练流程。在机器学习中，供应链攻击指的是对参与模型开发和部署的工具、包、数据或基础设施进行入侵。基于 Python 的机器学习项目通常依赖大量第三方包，这会扩大攻击面。
社区讨论: 评论者普遍担心，主流软件包中的高知名度供应链攻击似乎正在增加。有人指出机器学习生态的依赖链非常庞大，也有人认为某些机器人式的问题处理可能掩盖了安全信号，并主张减少依赖数量会更有帮助。
标签: #supply-chain security, #malware, #PyTorch Lightning, #machine learning, #open source security
这篇长篇解读文章拆解了炼油厂如何把原油变成可用产品，并在 Hacker News 上获得了很高关注，拿到 445 分和 138 条评论。文章从分离到升级处理，按系统视角讲清了整套炼油流程。 炼油是把原油转化为现代经济真正使用的燃料和原料的关键环节，因此理解这一过程有助于解释能源供应和炼厂经济性。对工程师和技术爱好者来说，这也能说明为什么炼厂运行如此复杂、资本密集且高度优化。 背景资料强调的核心步骤包括分馏，也就是按沸点范围把原油分成不同馏分；以及下游转化装置，例如流化催化裂化（FCC），它会把更大的烃分子裂解成更有价值的汽油范围产品。加氢脱硫同样重要，因为它要在后续工艺前把硫降到极低水平，从而保护像催化重整这类工序中使用的催化剂。
hackernews · chmaynard · Apr 30, 13:54
背景: 原油并不是一种单一物质，而是由许多沸点不同的烃类混合而成。炼油厂首先会在分馏塔中把这些组分分开，然后再通过化学和催化工艺，把它们改造成汽油、柴油和其他燃料。有些装置负责把大分子裂解成更小的分子，有些则负责去除硫等杂质或提升产品质量。正是这种分离、转化和净化的组合，让炼油厂远远不只是一个简单的蒸馏装置。
社区讨论: 评论区里既有亲身经历，也有技术好奇心。有人分享了参观炼厂或家人在炼厂工作的经历，另一些人则提到 SimRefinery 以及 Factorio 这类游戏，认为它们对理解炼油流程意外地有帮助。
标签: #industrial engineering, #energy, #process engineering, #technical explainer
Rivian 的支持页面讨论车主是否可以关闭车辆中的全部数据收集，而 Hacker News 的讨论把它扩展成了对联网 EV 隐私控制的更广泛争论。评论者主要关心遥测到底能关掉多少，以及蜂窝连接是否也是安全更新所必需的。 联网汽车越来越依赖远程信息处理和 OTA 软件分发，因此隐私设置影响的不只是数据共享，还可能影响召回修复和安全改进。这个问题关系到 EV 车主、车企、监管者和安全研究人员，因为它同时涉及隐私、合规和行车安全。 讨论强调了一个现实权衡：关闭 eSIM 或其他联网功能可能减少遥测数据，但也可能阻止通过 OTA 推送的召回或安全更新。检索结果显示，OTA 更新已经在新车中变得很常见，而远程信息处理控制单元（TCU）正是车辆连接互联网的通信中枢。
hackernews · Cider9986 · Apr 30, 20:27
背景: 远程信息处理控制单元（TCU）是把车辆连接到外部网络的嵌入式模块，它支持车联网服务、车队管理以及 V2X 等功能。现代汽车厂商还可以通过 OTA 更新推送软件变更，包括部分与召回相关的修复，而不必让车主去经销商。也正因为如此，“关闭全部数据收集”并不只是一个简单的隐私开关问题。
社区讨论: 讨论整体上支持让车主拥有关闭选项，但很多评论者担心，关闭联网能力可能带来安全和合规问题。几条评论进一步提出了 OTA 召回、监管访问，甚至车企或政府远程控制车辆所带来的国家安全风险；还有评论提到，在一些老车型上，物理拆除 OnStar 模块曾经是切断蜂窝连接的唯一实用办法。
标签: #privacy, #connected cars, #EVs, #cybersecurity, #over-the-air updates
FCC 就 WC Docket No. 26-82 号案件、题为《保护国内电信服务免受国家安全威胁》的 NPRM 进行了初步表决。该提案拟将中国移动、中国电信、中国联通等“涵盖名单”实体排除出《通信法》第 214 条的概括授权，并征求是否应禁止美国运营商与其互联互通的意见。 如果最终通过，这项规则将实质性改变主要中资电信运营商接入美国电信基础设施以及与美国网络交换流量的方式。它也表明监管层正把电信连接更明确地视为国家安全问题，这会影响运营商、客户以及跨境网络安排。 这只是 NPRM，并不是最终规则，因此后续还要经过联邦公报发布、公众评议、FCC 审查和最终裁决，提案内容也可能发生较大变化。FCC 还在征求是否撤销现有授权、是否设置过渡期、是否将限制扩展到关联企业，以及互联互通禁令对现有协议、成本和切换时间的影响。
telegram · zaihuapd · Apr 30, 17:10
背景: NPRM 即《拟议规则制定通知》，是 FCC 在正式采纳或修改规则前征求公众意见的法定程序。 《通信法》第 214 条是 FCC 运营商授权框架的一部分，“概括授权”可以让运营商无需为每一项许可都单独提交案件。互联互通协议则是运营商之间交换网络流量所依赖的合同和技术安排。
标签: #FCC, #telecom policy, #network regulation, #China-US relations, #national security
据《金融时报》和路透社报道，华为内部预计其 AI 芯片业务在 2026 年的营收将增长超过 60%，约达 120 亿美元。该预测主要来自中国企业对本土 AI 算力硬件替代方案的强劲需求，而高性能海外芯片的获取仍然受限。 这一预测表明，中国对本土化 AI 基础设施的需求可能比外界预期更强，也可能进一步提升华为在国内半导体生态中的地位。它还说明，出口限制和地缘政治正在重塑中国科技企业的 AI 硬件采购选择。 报道指出，这一收入展望基于华为已经锁定的在手订单，而不是某款新产品发布。需要注意的是，这属于媒体披露的内部预测，更能反映需求预期，而非华为正式发布的业绩指引。
telegram · zaihuapd · May 1, 03:08
背景: AI 芯片是用于完成大模型训练和推理等高强度计算的专用硬件。由于部分高性能海外芯片的获取仍然受限，中国本土 AI 硬件替代方案的重要性正在上升。这也推动大型科技公司转向能够满足 AI 基础设施需求的本土供应商。
标签: #Huawei, #AI chips, #semiconductors, #China AI infrastructure, #geopolitics