从 19 条内容中筛选出 6 条重要资讯。
科技新闻
1. OpenSSH 的 '*' 密码哈希认证边界情况 ⭐️ 7.0/10
2. DialFork 发布程序性幻觉基准，含三项评测任务 ⭐️ 7.0/10
3. 路透：约 60 万颗英伟达 H200 积压香港待批 ⭐️ 7.0/10
财经新闻
1. 芯片股抛售加剧，纳斯达克 100 指数跌 5% ⭐️ 8.0/10
2. 中国叫停软银 54 亿美元收购 ABB 机器人业务 ⭐️ 7.0/10
3. Switch 2 第二财季销量同比跌 41% ⭐️ 7.0/10
科技新闻
一篇安全分析文章声称，OpenSSH sshd 在特定配置下——使用 musl 编译、未走 PAM、启用密码登录，并同时存在密码哈希为 '*' 的账户和另一个设有有效密码的账户——本应禁止密码登录的账户会接受 256 到 1024 字符的任意密码。评论者将根因描述为 crypt 返回值与哈希的直接比较，以及 '*' 被当作带内特殊值使用。现有材料没有提供独立复现或上游修复说明，且讨论强调前置条件很窄，因此这更像有条件的技术披露，而非已确认的普遍漏洞。
hackernews · josemrb · 11月5日 12:19 · 社区讨论
「背景」 OpenSSH 的 sshd 在 musl 等非 PAM 环境中会把用户输入的密码与 `/etc/shadow` 中的哈希交给 libc 的 `crypt()` 比对，而 `*`、`!` 这类占位符通常表示该账户不应能用密码登录。Alpine Linux 的安全公告进一步按账户哈希形态和 `PasswordAuthentication` 配置划分受影响范围，指出使用 `!` 的锁定账户、没有 `$` 风格哈希的系统以及由 cloud-init 写入 `PasswordAuthentication no` 的云镜像属于不同情形。
「升级与重启」 在 Alpine Linux 上运行 sshd 的用户需要升级 openssh 并重启守护进程，因为仅升级软件包不会替换正在运行的守护进程。该问题被指影响 Alpine、OpenWrt、Buildroot 等 musl 系统，并已在 openssh 10.6p2 中修复。
「社区讨论」 tonnydourado 质疑文章措辞比实际严重，因为利用需要 musl、非 PAM、启用密码登录及特定账户组合等多个条件；BoppreH 则认为根因是 '*' 被用作带内特殊值，并担心类似的字符串滥用还会出现。amluto 补充说，musl 曾在 crypt_des 中规避类似失败，却未覆盖 crypt_sha 路径。
参考链接
标签: #OpenSSH, #security vulnerability, #authentication, #musl, #in-band signaling
Idiap 研究院与 Logitech 联合发布 DialFork，一个针对对话智能体“程序性幻觉”的基准：智能体的工具调用和事实陈述都正确，却偏离既定对话流程。作者称这是首个专门测量“该说什么、按什么顺序说”的基准，覆盖 12 个领域、24 项任务，通过回放并注入漂移生成超过 3.6 万段对话，并由 30 名人工标注者和一个经他们校准的 LLM 评判器检查。基准分为三个任务：定位漂移起始轮次、衡量单段对话与正确版本之间的程序距离、比较两组对话的整体分布；论文报告了初始结果，但该帖未给出具体指标。数据、代码、论文、论文预测和人工判断均已公开，三项任务在 Hugging Face 上各有排行榜。
reddit · r/MachineLearning · /u/sergbur · 11月5日 10:44
「背景」 此前对 LLM 智能体的评测主要围绕两条轴线展开：回答是否符合事实，以及工具调用是否正确。但在真实的对话流程中，大量步骤并不是工具调用，而是智能体必须说出的内容，例如提问、确认和告知结果；这类在内容与顺序上的偏离，此前没有独立的度量方式。作者（Idiap Research Institute，与 Logitech 合作）将这种偏离称为“程序性幻觉”，并据此提出第三条评测轴线；他们表示，据其所知，DialFork 是首个针对该轴线的基准。
「影响」 对构建对话智能体的团队来说，DialFork 提供了可直接用于实时护栏、模型升级后漂移监测，以及按对话流程而非仅按内容检索或聚类的评测维度；其排行榜只需提交一个 CSV 预测文件，降低了外部方法参与比较的门槛。不过这些用途是作者提出的方向，实际效果仍取决于方法在这三个任务上的表现。
标签: #LLM agents, #benchmarks, #hallucination, #conversational AI, #evaluation
路透社援引知情人士报道，约 60 万颗英伟达 H200 芯片目前积压在香港，等待运往中国大陆，原因是北京尚未批准大规模进口。近几个月只有少数中国互联网企业各获得约 1 万颗，另有少量芯片通过中间商和间接渠道流入。H200 并非英伟达最新型号，但性能仍高于国产替代品；10 月底中国大陆八卡 H200 服务器报价超过 600 万元，约为一年前的三倍。上述数量、配额与价格均来自路透社的未具名消息源，相关进口审批状态尚未获得官方确认。
telegram · zaihuapd · 11月5日 14:42
「背景」 H200 属于英伟达上一代数据中心 GPU，虽非最新型号，但性能仍高于国产替代品，这使其在中国市场仍有较强需求。对华大规模出货还须经过中方进口审批，审批未放开正是这批芯片滞留香港、仅有少量流入大陆的直接原因。
「影响」 对需要高性能算力的中国互联网与 AI 企业而言，能通过正规渠道获得的 H200 配额仍非常有限，而八卡整机报价已涨到一年前约三倍，这会直接抬高训练算力扩容的采购成本，并迫使企业在等待审批与转向国产或其他替代方案之间做取舍。
标签: #Nvidia H200, #China export controls, #AI hardware, #GPU supply chain, #semiconductor policy
财经新闻
据彭博报道，11 月 4 日美国芯片股抛售加深，纳斯达克 100 指数下跌 5%。费城半导体指数（芯片行业基准）较 6 月高点累计下跌 36%。
telegram · zaihuapd · 11月5日 15:39
「背景」 费城半导体指数追踪美国主要芯片股走势，常被当作芯片板块的风向标。此前民主党在选举中拿下国会两院，市场担心 AI 数据中心扩张会遭遇更多监管阻力。
「影响」 持有芯片股和科技基金敞口的投资者直接承受下跌，资金转向必需消费、医疗等防御板块，美国国债、日元和瑞郎走强。
参考链接
标签: #semiconductor stocks, #Nasdaq 100, #market selloff, #AI regulation, #safe-haven rotation
中国外国投资安全审查机构禁止软银以约 54 亿美元收购 ABB 机器人业务在中国实施，ABB 于 11 月 5 日确认收到通知。报道将叫停原因归于工业数据、供应链和核心技术可能外流的风险，并提到中国约占该业务 30%。
telegram · zaihuapd · 11月5日 10:44
「背景」 软银此前同意收购 ABB 机器人业务，意在推进将人工智能与机器人结合的“物理 AI”布局；中国是 ABB 最大的机器人市场，且面向中国客户的多数机器人都在当地生产。
「影响」 这将直接阻断软银通过并购扩张人工智能与机器人业务的计划，也使 ABB 机器人业务中约三成来自中国的部分无法随交易一并整合。
参考链接
标签: #China regulatory review, #cross-border M&A, #SoftBank, #ABB robotics, #foreign investment screening
Nintendo's Switch 2 quarterly sales fell 41% year over year to 2.67 million units, while revenue and net profit missed market expectations amid higher memory chip costs and price increases.
telegram · zaihuapd · 11月5日 14:12
标签: #Nintendo, #Switch 2, #earnings, #console sales, #memory chip costs
From 19 items, 6 important content pieces were selected
Technology News
1. SSHole write-up links OpenSSH '*' hash to musl crypt edge case ⭐️ 7.0/10
2. DialFork benchmark targets procedural drift in LLM agents ⭐️ 7.0/10
3. Report: 600,000 Nvidia H200 Chips Stuck in Hong Kong Awaiting China Approval ⭐️ 7.0/10
Financial News
1. Chip selloff pushes Nasdaq 100 down 5% ⭐️ 8.0/10
2. China blocks SoftBank's $5.4 billion acquisition of ABB robotics unit ⭐️ 7.0/10
3. Switch 2 第二财季销量同比跌 41% ⭐️ 7.0/10
Technology News
A security write-up describes an OpenSSH password-authentication edge case in which sshd compiled with musl, running without PAM, and allowing password logins can accept any 256–1024-character password for an account whose password hash is '*' if another account on the server has a valid password. The analysis attributes the behavior to crypt returning the '*' setting as the hashed result, making sshd's comparison succeed, and the write-up says the configuration must also meet further conditions that commenters describe as narrow. Commenters dispute the severity and note musl already contains a workaround for a related crypt path but not the SHA-crypt path named in the write-up.
hackernews · josemrb · Nov 5, 12:19 · Discussion
「Background」 OpenSSH's non-PAM password check calls the platform crypt() with the stored hash as the setting and compares the returned string against that hash. On musl, crypt() can return the literal '*' when it cannot process a setting, and since /etc/shadow also uses '*' to mark an account with no usable password, the comparison can succeed. The write-up's preconditions are an sshd linked against musl without PAM, password authentication enabled, at least one '*' account and another account with a real '$'-style hash; Alpine's advisory notes that '!'-locked accounts, systems with no '$'-style hash, and cloud-init images that write PasswordAuthentication no fall outside the affected set.
「Remediation」 Administrators running sshd on musl-based distributions such as Alpine should upgrade OpenSSH and then restart sshd; Alpine's advisory states that upgrading the package alone does not replace the running daemon, so the vulnerable process remains until restart. A linux.org.ru report says the flaw dates to 2016 and is fixed in OpenSSH 10.6p2, and it lists Alpine, OpenWrt, and Buildroot among affected musl-based systems.
「Community discussion」 Commenters challenged the write-up's framing, pointing to multiple preconditions—musl, no PAM, password logins enabled, a '*' hash account, and another account with a valid password—and suggesting the impact is narrower than the headline claim. Others argued the real problem is in-band signaling, with '*' overloaded as both a 'no password' marker and a crypt error value.
References
Tags: #OpenSSH, #security vulnerability, #authentication, #musl, #in-band signaling
Researchers at Idiap Research Institute, with Logitech, released DialFork, an open benchmark for "procedural hallucination": conversational agents that remain fluent and make correct tool calls but stop saying or doing required steps in the right order. DialFork contains over 36,000 dialogues across 24 tasks in 12 domains, built by letting agents follow workflows and then replaying them with drift-inducing instructions; the authors say annotations were checked by 30 human annotators and an LLM judge calibrated against them. It defines three evaluation tasks—detecting the turn where drift begins, measuring distance between a dialogue and its drifted versions, and comparing sets of dialogues—and provides a public Hugging Face leaderboard, GitHub code, dataset, and paper. The authors describe it as, to their knowledge, the first benchmark for this axis; the supplied excerpt does not report detailed results.
reddit · r/MachineLearning · /u/sergbur · Nov 5, 10:44
「Background」 LLM-agent evaluations have largely focused on factual accuracy and correct tool use. In conversational workflows, however, many required steps are utterances—asking a question, confirming a detail, or reporting a result—rather than tool calls. DialFork frames deviation from those steps as procedural hallucination and treats it as a separate evaluation axis.
「Impact」 Agent teams can use DialFork's three tracks to check whether a model upgrade or user simulator changes the order of conversational steps, not just whether facts or tool calls are correct, and submit predictions to the public leaderboard as a single CSV file.
Tags: #LLM agents, #benchmarks, #hallucination, #conversational AI, #evaluation
Reuters reported on November 5 that about 600,000 Nvidia H200 chips are backlogged in Hong Kong awaiting Chinese approval for large-scale import, citing unnamed sources. In recent months, a few Chinese internet companies each received about 10,000 chips, while smaller volumes entered through intermediaries and indirect channels. The H200 is not Nvidia's newest model but still outperforms domestic alternatives, and in late October eight-card H200 servers in mainland China were reportedly quoted at more than 6 million yuan, about three times the price a year earlier.
telegram · zaihuapd · Nov 5, 14:42
「Background」 The H200 is not Nvidia's newest data-center GPU, but the report says its performance remains above domestic Chinese alternatives. The chips are reported to be held in Hong Kong while awaiting Beijing's approval for mass import into mainland China, so the pile-up reflects an import-authorization bottleneck.
「Impact」 For Chinese AI firms outside the small group receiving direct allocations, procurement remains dependent on limited intermediary and indirect-channel supply rather than approved large-scale imports.
Tags: #Nvidia H200, #China export controls, #AI hardware, #GPU supply chain, #semiconductor policy
Financial News
On Nov. 4, a deepening selloff in U.S. chip stocks left the Nasdaq 100 down 5% and the Philadelphia Semiconductor Index 36% below its June high.
telegram · zaihuapd · Nov 5, 15:39
「Context」 The Nasdaq 100 tracks the 100 largest non-financial companies on the tech-heavy Nasdaq exchange, and the Philadelphia Semiconductor Index is a benchmark for U.S. chipmakers, so the gap from June shows how far chip shares have fallen from their peak. Market reports tied the decline to the Democrats' sweep of Congress, which investors read as raising the odds of tighter AI rules, and analyst Dan Ives said 40 to 100 planned AI data centers could be at risk.
「Impact」 The drop hit investors concentrated in chip and other technology shares as money moved into consumer staples, health care and safe havens; bitcoin fell 5%.
References
Tags: #semiconductor stocks, #Nasdaq 100, #market selloff, #AI regulation, #safe-haven rotation
ABB said on Nov. 5 that Chinese foreign-investment security reviewers barred SoftBank's roughly $5.4 billion acquisition of its robotics business from being implemented in China, a market that accounts for about 30% of that business.
telegram · zaihuapd · Nov 5, 10:44
「Background」 SoftBank had agreed to buy ABB’s robotics division for about $5.4 billion as part of a push into “physical AI,” the combination of artificial intelligence and robots. China is ABB’s largest robotics market, and most robots built for Chinese customers are manufactured locally.
References
Tags: #China regulatory review, #cross-border M&A, #SoftBank, #ABB robotics, #foreign investment screening
Nintendo's Switch 2 quarterly sales fell 41% year over year to 2.67 million units, while revenue and net profit missed market expectations amid higher memory chip costs and price increases.
telegram · zaihuapd · Nov 5, 14:12
Tags: #Nintendo, #Switch 2, #earnings, #console sales, #memory chip costs