December 2022 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Microsoft’s File-Tainting System ’Tain’t Working
by Lawrence D'Oliveiro 15 Mar '23

15 Mar '23

Microsoft has a clever-sounding system for trying to protect Windows users from downloading malicious files: it’s called “Mark-Of-The-Web”. What it means is that any file downloaded from an untrusted source is supposed to have a special flag set in its NTFS metadata indicating that the file is not to be trusted. So any attempt by the user to perform sensitive operations on that file (e.g. execute macros from it, run it as an executable) is supposed to trigger appropriate system warnings. If the file is a .zip archive, then this mark is supposed to be propagated to all files extracted from that archive. However, it turns out this mechanism can be bypassed (surprise, surprise) <https://www.theregister.com/2022/11/01/microsoft_motw_malware_flaw/>. How can this happen? The flaw lies in the mechanism used to tell Windows to trust downloaded files, by attaching an “Authenticode” signature to them. Files without such signatures are of course untrusted and will trigger the appropriate warnings. However, by attaching an invalid signature of a particular form, you can trigger an error response from the signature-checking process that is actually interpreted as “this file is OK” <https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html>. What do you call it when an attempt to add mechanisms to make a system more secure actually increases the attack surface on that system? By the way, the referenced Twitter thread discussing this vulnerability <https://twitter.com/GossiTheDog/status/1579895038523609088> seems to be saying that no Mark-Of-The-Web propagation is done for files extracted from .iso disc images. And that Microsoft uses this form for distributing its own software (Visio was mentioned) precisely to avoid the hassle of going through vetting by third-party antimalware tools.

1 1

Emacs: Comparing Two Regions From Two Files
by Lawrence D'Oliveiro 28 Feb '23

28 Feb '23

So I was compiling some useful database-related routines that I have used in various places (with MySQL and SQLite so far) over the years into a set of common modules, so that I could easily find the latest and best-tested versions of them for future projects. Then I came to a routine with two versions of a few dozen lines each, and I was trying to figure out a way of doing a diff on them without writing them out to temporary files. I have an Emacs command called “make-command-buffer”, which I can use for example to create a buffer for entering and executing shell commands, and collecting their output. It was easy enough to copy and paste both routines into the buffer, but now how do I put them both into one diff command? There is a shell feature called “here-docs”, which lets you include the standard-input data for a command directly following the command: «cmd» <<«marker» ... data ... «marker» where the «marker» is some word that does not occur in the data. But I want to have two of these, like this: diff -u <<EOD1 <<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2 You can do something like that in Perl, but it doesn’t work in the shell. Hunting around on line reminded me why: because you can only have one standard input. But in the Bash man page, there is a syntax for redirecting arbitary file descriptors, letting you have any number of heredocs. So, combining this with the ability to give a command a file name that corresponds to an already-open file descriptor, I finally got this to work: diff -u /dev/fd/8 /dev/fd/9 8<<EOD1 9<<EOD2 ... version 1 ... EOD1 ... version 2 ... EOD2

1 1

Ellen Ullman: “The Dumbing Down Of Programming”
by Lawrence D'Oliveiro 24 Dec '22

24 Dec '22

Found this two-part article from Salon magazine of 1998 <https://www.salon.com/1998/05/12/feature_321/>, <https://www.salon.com/1998/05/13/feature_320/>. Choice quotes: My intention had been to buy an upgrade to Windows NT Server, which was a completely sensible thing for me to be doing. ... But somehow I left the store carrying a box of Linux from a company called Slackware. ... In six clicks of a wizard, the Microsoft C++ AppWizard steps me through the creation of an application skeleton. ... Of course, I could look at the code that the Wizard has generated. ... But everything in the environment urges me not to. ... In this programming world, the writing of my code has moved away from being the central task to become a set of appendages to the entire Microsoft system structure. I'm a scrivener here, a filler-in of forms, a setter of properties. ... I once worked on a project in which a software product originally written for UNIX was being redesigned and implemented on Windows NT. Most of the programming team consisted of programmers who had great facility with Windows, Microsoft Visual C++ and the Foundation Classes. In no time at all, it seemed, they had generated many screenfuls of windows and toolbars and dialogs, all with connections to networks and data sources, thousands and thousands of lines of code. But when the inevitable difficulties of debugging came, they seemed at sea. In the face of the usual weird and unexplainable outcomes, they stood a bit agog. It was left to the UNIX-trained programmers to fix things. ... In an ideal world, I would not have to choose between the extreme polarities of dialog box and source code. My dream system interface would allow me to start hesitantly, unschooled. Then, as I used the facility that distinguishes me from the machine -- the still-mysterious capacity to learn, the ability to do something the second time in a way quite different from the first -- I could descend a level to a smarter, quicker kind of "talk." I would want the interface to scale with me, to follow me as my interest deepened or waned.

2 2

Visual Effects Society 2021 Studio Platform Report
by Lawrence D'Oliveiro 23 Dec '22

23 Dec '22

Came across this interesting survey report <https://drive.google.com/file/d/15b-4GMTSEE9tyqeQdBfy_LZnxQIdp38Y/view> (Google Drive link to a downloadable PDF file), linked from this opinion piece <https://arstechnica.com/gadgets/2022/12/it-might-be-time-for-apple-to-throw…>. The report was released early this year from the Visual Effects Society Technology Committee, and looks at how companies working in the VFX industry are using different computing platforms. Interesting fact: three-fifths of the workstations at these companies run Linux, and this share looks to increase in the future. There is a mix of distros, but the largest share are running CentOS. This seems to be dictated by the vendors of the proprietary apps, who will only support certain distros and not others. And of course this leads to worries like where do they go after the end of CentOS. By the way, the “VFX Reference Platform” is a set of baseline technical specs which gets updated every year <https://vfxplatform.com/>, hence designations like “CY2021”. Some interesting comments are recorded in the report: Windows continues to be seen as “working out of the box”, yet the comments describe many ongoing headaches with managing Windows systems, including technical limitations like “character limits, limitations of Active Directory management”. Sometimes it looks like the users can be part of the problem: All our artists refuse to work with Linux and we chose to keep on Windows for their comfort. But sometimes it's hard to manage. (Not a peep about the famous brand loyalty of Mac users?) Seems like there is a definite long-term preference for greater Linux adoption, with pleas like Support for Enterprise Software (Video and Chat Platforms) on Linux. Support for realtime tech (NVIDIA, Epic) on Linux. and We could have only Linux if it was not for Adobe After Effects and a couple of other Adobe Creative Cloud Apps.

1 0

Microsoft discovers Windows/Linux botnet used in DDoS attacks
by Peter Reutemann 16 Dec '22

16 Dec '22

'Microsoft researchers have discovered a hybrid Windows-Linux botnet that uses a highly efficient technique to take down Minecraft servers and performs distributed denial-of-service attacks on other platforms. Dubbed MCCrash, the botnet infects Windows machines and devices running various distributions of Linux for use in DDoS attacks. Among the commands the botnet software accepts is one called ATTACK_MCCRASH. This command populates the user name in a Minecraft server login page with ${env:random payload of specific size:-a}. The string exhausts the resources of the server and makes it crash. “The usage of the env variable triggers the use of Log4j 2 library, which causes abnormal consumption of system resources (not related to Log4Shell vulnerability), demonstrating a specific and highly efficient DDoS method,” Microsoft researchers wrote. “A wide range of Minecraft server versions can be affected.”' -- source: https://arstechnica.com/information-technology/2022/12/microsoft-discovers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next month
by Peter Reutemann 15 Dec '22

15 Dec '22

Hi everyone Our AGM (Annual General Meeting) is scheduled for next month on January 23rd with the following agenda: • President's Report • Treasurer's Report • Election of 2023 Committee • Retirement of WLUG servers • General business • Consumption of pizza (if not online) Details: https://www.meetup.com/waikatolinuxusersgroup/events/290343641/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0