October 2022 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 30 Nov '23

30 Nov '23

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 1

Emacs: Comparing Two Regions From Two Files
by Lawrence D'Oliveiro 28 Feb '23

28 Feb '23

So I was compiling some useful database-related routines that I have used in various places (with MySQL and SQLite so far) over the years into a set of common modules, so that I could easily find the latest and best-tested versions of them for future projects. Then I came to a routine with two versions of a few dozen lines each, and I was trying to figure out a way of doing a diff on them without writing them out to temporary files. I have an Emacs command called “make-command-buffer”, which I can use for example to create a buffer for entering and executing shell commands, and collecting their output. It was easy enough to copy and paste both routines into the buffer, but now how do I put them both into one diff command? There is a shell feature called “here-docs”, which lets you include the standard-input data for a command directly following the command: «cmd» <<«marker» ... data ... «marker» where the «marker» is some word that does not occur in the data. But I want to have two of these, like this: diff -u <<EOD1 <<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2 You can do something like that in Perl, but it doesn’t work in the shell. Hunting around on line reminded me why: because you can only have one standard input. But in the Bash man page, there is a syntax for redirecting arbitary file descriptors, letting you have any number of heredocs. So, combining this with the ability to give a command a file name that corresponds to an already-open file descriptor, I finally got this to work: diff -u /dev/fd/8 /dev/fd/9 8<<EOD1 9<<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2

1 1

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 11 Feb '23

11 Feb '23

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 1

Windows Driver-Signing Doesn’t Work
by Lawrence D'Oliveiro 14 Dec '22

14 Dec '22

Having Microsoft verify third-party drivers with a digital signature, so that Windows will block the loading of unsigned drivers, seemed like a good idea when it came in with Windows Vista. Enforcing quality control would remove a big source of crashes, as well as security loopholes. But it seems the execution falls somewhat short <https://arstechnica.com/information-technology/2022/10/no-fix-in-sight-for-…>. The system for revoking signatures for old, obsolete drivers that are discovered to have security vulnerabilities in them doesn’t seem to work very well, allowing miscreants to exploit this old code to gain control of Windows systems. This has been dubbed a “Bring Your Own Vulnerable Device/Driver” (BYOVD) attack. Microsoft’s own Vice President of “OS Security and Enterprise” continues to claim that “Windows has everything you need to block” buggy signed drivers. Yet the article’s author was unable to get the mechanism to work. And Microsoft itself appeared to have no interest in helping to fix that. It seems to me, one thing missing from the mechanism is a time limit on signature validity. By contrast, when you get SSL/TLS certs for your website, they are only valid for some fixed interval (e.g. a year for certs from traditional certificate authorities, 90 days for ones from Let’s Encrypt). This means that clients using such certificates do not need to maintain an ever-growing list of revoked ones to check against, since ones that are past their expiry date can be rejected anyway. If the cert for a Windows driver has expired, but the driver itself is still valid, Microsoft should be able to simply renew the certificate. But I guess if Microsoft’s servers are struggling just to distribute certificate revocations, having to push out renewals as well will likely just make things worse.

1 2

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

LineageOS flashing
by Peter Reutemann 01 Nov '22

01 Nov '22

Hi everyone Since I've talked about flashing LineageOS on Android phones before... In the past, I've always used TWRP (https://twrp.me/) as recovery tool on the phones. However, the tools has been lagging behind with Android 12 support and the 3.7.0 release (which in theory added Android 12 support) failed on my old Galaxy S7 (I'm using custom ROMs supplied by Ivan Meier). Unfortunately, OrangeFox Recovery, which seems a popular alternative to TWRP, didn't support my Galaxy S7. However, I found a little workaround for that dilemma: though I used TWRP to install Android 11, during the setup process I then ticked the box to also update the recovery tool with LineageOS recovery with the every subsequent update. After updating the phone to the latest Android 11, I had LineageOS recovery on there which has (working) support for Android 12 and I managed to upgrade successfully to 12. Just in case somebody runs into a similar problem... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vanilla OS: More Than Just Vanilla GNOME With Ubuntu
by Peter Reutemann 31 Oct '22

31 Oct '22

'Slashdot reader Soul_Predator writes: Vanilla OS is Ubuntu on stock GNOME, with on-demand immutability and package selection freedom. It is currently a beta project, with a stable release planned for the next month. "The first-time setup process is a breeze to experience," writes It's FOSS News, applauding how it lets uses choose and enable Flatpak/Snap/AppImage. Overall, a package manager that installs applications utilizing a container, getting the ability to choose your package managers, on-demand immutability, and vanilla GNOME make it seem like a good deal to keep an eye on... I'd say it is a project that I believe a lot of users will appreciate. You can download the ISO by joining its Discord channel for now. The ISO is not yet publicly available to all. Take a look at its documentation if you are curious. However, as per the roadmap, they plan to have a release candidate soon enough. ' -- source: https://tech.slashdot.org/story/22/10/29/1953233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching The Kids To Be Safe Online
by Lawrence D'Oliveiro 30 Oct '22

30 Oct '22

A program is being introduced into schools to give students a better appreciation for how to keep themselves safe online <https://www.stuff.co.nz/national/education/130292250/students-urged-to-be-l…>. It covers things like spotting phishing attacks, and avoiding making personal information public that you might regret later: Naenae College principal Nic Richards said while students were experts in social media, parents and teachers were aware that “the decisions made now can exist online forever.” “Experts” in putting information up and interacting with other users, not so savvy perhaps in understanding the consequences of doing so. And maybe some of what they learn will rub off on others in their family ... including their parents?

1 0