Nvidia RTX Spark runs local AI five times slower on Linux, and a fake interview cost Binance $6.3B

On Wednesday's HN front page, Nvidia's new RTX Spark laptops, sold to people who want to run big models locally, lose most of their speed on Linux the moment they are plugged in. Also: a PHP crash that AI turned into a server takeover, a coding assignment that opened Binance's wallets, and a failed vote on C++26.

Slide text

Nvidia RTX Spark runs local AI five times slower on Linux, and a fake interview cost Binance $6.3B

The RTX Spark laptops from MSI, Asus and Dell put the chip from Nvidia's DGX Spark desktop into a laptop, with up to 128 gigabytes of shared memory, and every one ships with Windows on ARM. On an MSI Prestige running Linux on wall power, GPT-OSS 120B runs at about 14 tokens a second. Windows and WSL both run it at about 65. The GPU sits near 780 megahertz instead of 2.2 gigahertz, and stays cool, so heat isn't the cause. On battery, Linux gets its speed back.

The slowdown comes from a Windows-only component, Nvidia Platform Controllers and Framework, which splits one power budget between the CPU and the GPU. Switch it off on Windows and Windows slows down the same way, from about 83 tokens a second to about 31. The firmware hands that component an encrypted table of power settings, and Linux has no key, so the fix has to come in Nvidia's Linux driver. In the thread, porphyra pointed out that Omarchy already supports the Asus and Dell models. If I bought one now, I'd run vLLM inside WSL, which keeps full speed on wall power, after raising its 14 gigabyte memory default.

PHP2Shell put sites running WordPress and Drupal at risk of leaking data and running an attacker's code. The bug behind it reached the PHP Foundation in 2024 as a plain crash, and crash reports wait. This year Calif, in an audit sponsored by OpenAI, used AI tools to turn it into remote code execution in two weeks. The patch took four engineers two months, and it shipped before attackers had the exploit. In the thread, adunsulag, who works on an open-source healthcare project, says six months of reports have been hard to keep up with, and many of them are real.

The 6.3 billion dollar Binance theft began with a job offer. In September, a Binance engineer contacted through a real job site interviewed with a fake company, and its fake CEO asked him to download a coding assignment. The repo ran during setup on his work laptop and replaced pyenv with malware. From there the attackers used an internal AI tool to reach two wallet engineers, found a container deployment token on one of their machines, and on October 29 deployed the container that took the money. The FBI ties it to North Korea's TraderTraitor crew. In the thread, gandreani argued that production deploys belong in CI, so a token like that never sits on a laptop.

On October 23, the draft of C++26 failed its final ballot among the national standards bodies, short of the two-thirds it needed. Since 1998 this step had passed quietly every time. The objection is contracts, the preconditions and postconditions on functions, which several countries say aren't ready, even though the committee voted them in by a wide margin. The way forward is a revised draft, a Technical Specification, or cancelling, which would mean staying on C++23 until C++29. Every path delays the next standard, and the committee meets on November 16.