[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6z3h4nqojn7c":3},{"slug":4,"category":5,"publishedAt":6,"titleZh":7,"titleEn":8,"summaryZh":9,"summaryEn":10,"models":11,"hardwares":15,"bodyZh":16,"bodyEn":17,"sourceName":18,"sourceUrl":19,"updatedAt":20},"strata-v0-1-38-released","NEWS","2026-10-05T04:00:00.000Z","Strata v0.1.38 发布：DNS rebinding 安全修复 + 128K prompt 提速 6.4%","Strata v0.1.38 released: DNS rebinding security fix + 6.4% 128K prompt speedup","Strata 10 月 3 日发布 v0.1.38：默认仅接受 localhost\u002FLAN 主机、防 DNS rebinding 攻击；128K 上下文 IQ2_XS prompt 处理性能提升 6.4%。","Strata v0.1.38 (Oct 3) ships a DNS-rebinding mitigation (default API binds to localhost\u002FLAN) and a 6.4% 128K-context IQ2_XS prompt speedup.",[12],{"id":13,"name":14},11,"Qwen3.8-Flash-Next",[],"### 是什么\n\n10 月 3 日，开源推理引擎 [Strata](https:\u002F\u002Fgithub.com\u002FNiko1221\u002FStrata) 发布 **v0.1.38**，包含两项重要更新：\n\n- **安全修复**：未显式配置 API key 时，HTTP 服务**仅接受 localhost 与 LAN 主机请求**，关闭外部攻击面；针对 DNS rebinding 攻击做了防护\n- **性能提升**：128K 上下文 IQ2_XS 量化下 prompt 处理速度提升约 6.4%\n\n### 为什么这次发布值得注意\n\nDNS rebinding 是本地 AI 服务被外部网页攻击的常见途径——攻击者通过恶意网页把受害者浏览器的同源策略绕过，进而访问 `http:\u002F\u002Flocalhost:8080\u002Fv1\u002Fchat` 一类接口。Strata 0.1.38 把默认绑定收窄到 localhost\u002FLAN，是这次最重要的改动。\n\n### 影响范围\n\n- 用户在公网\u002F容器\u002F虚拟机里跑 Strata 时，需要显式配置 API key 才能对外暴露\n- 128K 上下文是 Strata 的核心卖点之一，6.4% prompt 提速对长文档摘要、RAG 检索后处理这类场景直接收益\n\n### 本地部署角度\n\n如果只在单机或家庭网络内用 Strata，本次升级**零迁移成本**（默认设置已足够安全）；但升级后首次启动会看到一条\"API bind to 127.0.0.1\"日志，确认即可。","### What it is\n\nOn October 3, the open-source inference engine [Strata](https:\u002F\u002Fgithub.com\u002FNiko1221\u002FStrata) shipped **v0.1.38** with two notable changes:\n\n- **Security fix**: when no API key is explicitly configured, the HTTP server now **only accepts localhost and LAN hosts**, closing the external attack surface; DNS-rebinding attacks are mitigated.\n- **Performance**: ~6.4% prompt-processing speedup at 128K-context IQ2_XS quantization.\n\n### Why this release matters\n\nDNS rebinding is the canonical attack vector against local AI services — a malicious page can bypass the browser's same-origin policy and hit `http:\u002F\u002Flocalhost:8080\u002Fv1\u002Fchat`. Strata 0.1.38 narrowing the default bind to localhost\u002FLAN is the most important change in this release.\n\n### Impact\n\n- Users running Strata on public-facing hosts, containers or VMs must now set an explicit API key to expose the service externally\n- 128K-context prompt handling is one of Strata's marquee features; 6.4% speedup directly benefits long-doc summarization and post-RAG processing\n\n### Local deployment angle\n\nIf you only run Strata on a workstation or home LAN, this upgrade is **zero-migration** — the new defaults are already secure; just confirm the \"API bind to 127.0.0.1\" log line on first start.","Strata GitHub Releases + LinuxCompatible.org","https:\u002F\u002Fwww.linuxcompatible.org\u002Fstory\u002Fstrata-v0138-runs-a-125billionmodel-llm-on-any-gaming-pc","2026-10-05T02:23:19.745Z"]