从 13 条内容中筛选出 3 条重要资讯。
科技新闻
1. Hugging Face 发布 Megatron-LM MoE 训练手册 ⭐️ 8.0/10
2. OpenSSH 发布 10.6p2 修复长密码认证绕过 ⭐️ 8.0/10
3. 单张 RTX 5080 跑 Qwen3.8 Flash-Next：Basalt 与 llama.cpp 的自测对比 ⭐️ 7.0/10
科技新闻
Hugging Face 发布了面向 Mixture-of-Experts（MoE）训练的 Megatron-LM 手册，作者 Nouamane 表示，目标读者是已经训练过稠密模型、准备转向 MoE 的工程师和研究者。第 2 章给出 Megatron-LM 操作路径：测试硬件、构建镜像、训练稠密基线，再在单节点上训练首个 MoE 并与基线对比；第 3 章拆解路由器、路由、负载均衡、专家、块布局、训练和系统，逐项提供 Megatron-LM 代码、观察点、建议及前沿 MoE 的选择；第 4 章覆盖 serving 和 RL。作者同时公开了 55 张图的画廊、脚本，以及集中在一个 Megatron-LM 配置块中的全部推荐 flag，并称经验来自 CSCS Alps 集群约 80 万 GH200 GPU 小时；这是教育性资源，不是新模型发布或独立基准结果。
reddit · r/MachineLearning · /u/Norlax_42 · 11月5日 19:13
「背景」 MoE 通过路由器把每个 token 只发送给部分专家，从而在扩大参数规模时避免按同等比例增加每 token 的计算量；Megatron-LM 则是用于大规模模型训练的框架。对已经熟悉稠密模型训练的读者，这份手册把上述概念落到 Megatron-LM 的具体配置、代码路径和运行步骤上。
「实际影响」 准备从稠密模型迁移到 MoE 的团队可以按第 2 章的路径搭起单节点基线，并直接取用公开脚本和推荐 flag；第 3、4 章无需 GPU 即可阅读，便于在没有算力时先评估架构与 serving/RL 方案。由于推荐配置集中在 Megatron-LM，使用其他训练栈的团队需要自行映射这些参数。
标签: #mixture-of-experts, #megatron-lm, #model-training, #hugging-face, #technical-deep-dive
OpenSSH 于 11 月 5 日发布 10.6p2，紧急修复一个可用 257 至 1024 字节长密码绕过 SSH 认证的漏洞。该漏洞影响 Alpine Linux：攻击者可借此登录没有密码的密钥账户，但前提是能访问服务器网络并知道有效账户名。Alpine 已为 3.16 以后版本提供修复包；无法立即升级的运维人员可将 PasswordAuthentication 设为 no，以关闭密码登录作为临时缓解。目前尚无该漏洞遭利用的报告。
telegram · zaihuapd · 11月5日 16:44
「背景」 该问题与 Alpine 的默认认证栈有关：其 openssh-server 默认不使用 PAM（管理员也可能显式设置 UsePAM no），因此会进入受影响的口令校验路径；相关报道还称该缺陷波及 Alpine 及其他基于 musl 的 Linux 系统。[tool-1-2][tool-1-3] Alpine 的安全公告强调，升级 openssh 包后必须重启 sshd，正在运行的守护进程不会随软件包升级自动替换。[tool-1-1]
「升级后必须重启 sshd」 对运行受影响 OpenSSH 的 Alpine 主机而言，仅升级 openssh-server 软件包并不会替换正在运行的守护进程，必须重启 sshd 才能关闭漏洞；无法立即升级的服务器应设置 PasswordAuthentication no 并重启 sshd，同时可检查日志中是否存在异常登录。
参考链接
标签: #OpenSSH, #security vulnerability, #Alpine Linux, #authentication bypass, #patching
一位 Reddit 用户发布了单张 RTX 5080 16GB 加 64GB DDR5-7200 内存的本地推理配置指南：以 Basalt 为推理引擎，搭配 Unsloth 新上传（11 月 4 日）的 UD-IQ3_XXS（Dynamic v3.1）量化和 eddoursul 的 Lamina MTP drafter 来运行 Qwen3.8 Flash-Next。作者称，在同一模型文件、同一台机器上，Basalt 的解码速度约为 llama.cpp 的 3.5 倍，启用投机解码后约 5 倍，prompt 读取约 7 倍；在一次包含 151 个请求、上下文最高 202K 的 opencode agent 编码会话中，平均解码 195.6 tok/s（最好 263 tok/s、最差 156 tok/s），prefill 约 5700 tok/s。这些数字均为作者自述，未经独立验证。该量化文件体积与 16GB 显卡常用的 GSQ-RCO IQ3_S 相同，但 wikitext 困惑度从 3.382 降至 3.247，接近 BF16 的 3.273，代价是解码速度下降 1%–3.5%；Lamina 把每轮草稿接受率从 83.1% 提升到 85.8%。作者给出了带 setup 脚本的分支，要求 RTX 显卡、CUDA 13、64GB 内存和约 180GB 空闲磁盘，并需下载约 90GB 文件、逐文件校验 SHA-256。
reddit · r/LocalLLaMA · /u/yehyakar · 11月5日 16:23
「背景」 Basalt 是面向 Qwen3.8-Flash-Next 这一混合专家（MoE）模型的本地推理引擎，目前要求使用 NVIDIA Blackwell（sm_120）显卡，并可在 Linux 或 Windows 上运行，这解释了指南为何以 RTX 5080 为平台。其投机解码由模型自带的 MTP 层生成草稿，再由主模型验证每个 token；Lamina 则是在该草稿层上继续训练的替代 drafter。
「复现门槛与适用边界」 想在单张 16GB 显卡上复现这套配置的读者，实际门槛是 CUDA 13、64GB 内存和约 180GB 空闲磁盘，安装脚本本身还要下载约 90GB 权重；已经存有 GSQ-RCO IQ3_S 的用户可以用 SHARD4_FROM= 复用那块 28.8GB 的 n-gram 分片，免去重复下载。需要注意的是，文中“约为 llama.cpp 的 3.5 倍（无投机）/5 倍（带投机）、提示词读取快约 7 倍”都是作者在同一台机器上的自测数据，所用引擎是上游 v0.2.1 加上若干尚未合并的 PR 的分支，因此复现时应把该分支、UD-IQ3_XXS 量化与 Lamina drafter 视为一套整体，不宜把加速比直接外推到其他模型、量化或硬件。
参考链接
标签: #local LLM inference, #quantization, #speculative decoding, #llama.cpp, #performance benchmarking
From 13 items, 3 important content pieces were selected
Technology News
1. Hugging Face releases MoE training handbook with Megatron-LM runbook and code walkthroughs ⭐️ 8.0/10
2. OpenSSH 10.6p2 Fixes Long-Password SSH Authentication Bypass on Alpine ⭐️ 8.0/10
3. Qwen3.8 Flash-Next on one RTX 5080: guide claims ~5x llama.cpp decode ⭐️ 7.0/10
Technology News
Hugging Face has published a Mixture-of-Experts training handbook aimed at engineers who have trained a dense model and want to train an MoE next. Chapter 2 is a Megatron-LM runbook that walks through testing the hardware, building the image, training a dense baseline, and then training a first MoE on a single node measured against that baseline; Chapter 3 dissects the MoE layer (router, routing, load balancing, experts, block layout, training, systems), pairing Megatron-LM code with what to watch, the authors' recommendation, and what frontier MoEs chose, while Chapter 4 follows the model into serving and RL. Chapters 3 and 4 are stated to need no GPU. The authors say the lessons come from roughly 800k GH200 GPU-hours allocated to MoE training on the Alps cluster at CSCS, and they released the handbook alongside a gallery of 55 figures, the training scripts, and every recommended flag collected in a single Megatron-LM block. The post distinguishes results from the authors' own runs, claims about frontier models cited to their paper, config or code, and toy simulations labelled as such.
reddit · r/MachineLearning · /u/Norlax_42 · Nov 5, 19:13
「Background」 Mixture-of-Experts models replace a dense feed-forward block with a router that sends each token to a subset of expert sub-networks, so total parameters grow much faster than the compute used per token; Megatron-LM is the training framework the handbook's runbook and code references are built around. Much of the difficulty sits in choices that have no single default — routing scheme, load balancing, expert and block layout, and the parallelism settings needed to fit them — which is what the handbook addresses setting by setting.
「Impact」 For teams already training dense models in Megatron-LM, the runbook gives a concrete sequence — hardware check, image build, dense baseline, then a single-node MoE compared against it — to follow before committing to a multi-node run, and the consolidated flag block gives a starting configuration to compare against. Readers should treat the recommendations as the authors' guidance drawn from their own CSCS runs rather than an independent benchmark, and the single-node comparison is only a first check of whether the MoE setup is working.
Tags: #mixture-of-experts, #megatron-lm, #model-training, #hugging-face, #technical-deep-dive
OpenSSH released version 10.6p2 on November 5 as an emergency fix for an authentication bypass that lets passwords of 257 to 1,024 bytes bypass SSH authentication on Alpine Linux. On affected Alpine systems, an attacker with network access to the server and a valid account name could log in to accounts that use key-based authentication without a password. Alpine has published fixed packages for releases after 3.16, and administrators who cannot upgrade immediately can set `PasswordAuthentication no` to disable password logins. No exploitation has been reported.
telegram · zaihuapd · Nov 5, 16:44
「Background」 OpenSSH's sshd handles SSH logins, and Alpine's openssh-server package is configured without PAM by default, so PAM is not part of its password-authentication path (tool-1-2). The flaw also affects other musl-based systems; OpenSSH 10.6p2 contains the upstream fix, while Alpine's advisory notes that sshd must be restarted because upgrading the package alone leaves the running daemon unchanged (tool-1-1, tool-1-3).
「Restart sshd after upgrading」 Alpine operators cannot treat a package upgrade as sufficient: the advisory states that upgrading openssh-server alone does not replace the running daemon, so sshd must be restarted for the fix to take effect. Those who cannot update immediately can instead set `PasswordAuthentication no` in the sshd configuration and restart, and FossLinux recommends checking /var/log/messages for unexplained logins before considering a host safe.
References
Tags: #OpenSSH, #security vulnerability, #Alpine Linux, #authentication bypass, #patching
A Reddit guide reports that running Qwen3.8 Flash-Next on a single 16GB RTX 5080 with the Basalt engine reaches about 3.5x llama.cpp's decode speed without speculative drafting and roughly 5x with it, plus about 7x faster prompt reads on the same model file and machine. In a recorded opencode agent session (151 requests, contexts up to 202K tokens), the author measured 195.6 tok/s average decode, 263 tok/s best and 156 tok/s worst, with about 5,700 tok/s prefill. The setup combines the Unsloth UD-IQ3_XXS quant (Dynamic v3.1, uploaded Nov 4), which the author says matches the size of GSQ-RCO IQ3_S but improves wikitext perplexity from 3.382 to 3.247 at a 1–3.5% decode-speed cost, and the Lamina MTP drafter, which raised accepted drafts per drafted token from 83.1% to 85.8% on a replayed session. All figures are self-reported from one machine and have not been independently verified; the author's branch requires an RTX card, CUDA 13, 64GB RAM, roughly 180GB free disk, and about a 90GB download.
reddit · r/LocalLLaMA · /u/yehyakar · Nov 5, 16:23
「What Basalt is」 Basalt, the engine this guide is built around, is a local inference engine written specifically for the Qwen3.8-Flash-Next mixture-of-experts model and targeting Linux and Windows on NVIDIA Blackwell GPUs (sm_120). The project is in the process of generalizing from a single-model engine to a multi-model one, with Qwen3.8-Flash-Next and DeepSeek-V4.1-Flash sharing serving, benchmark, and quality code.
「Reproducibility and setup requirements」 Developers with a 16GB RTX card can only reproduce these numbers through the author's flashnext-5080-setup branch of Basalt (upstream v0.2.1 plus unmerged PRs), which requires CUDA 13, 64GB of system RAM, and roughly 180GB of free disk; anyone who already downloaded the GSQ-RCO IQ3_S file can reuse its 28.8GB n-gram shard to avoid part of the ~90GB download. Because the 3.5x/5x decode and ~7x prefill gains are self-reported from a single machine and a non-upstream build, teams should rerun the recorded-session replay on their own hardware before planning around them.
References
Tags: #local LLM inference, #quantization, #speculative decoding, #llama.cpp, #performance benchmarking