May 2023 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Trouble Accessing .nz Sites, Anybody?
by Lawrence D'Oliveiro 30 May '23

30 May '23

Seems some people have had trouble accessing various .nz sites since last night, and into this morning <https://www.nzherald.co.nz/business/banking-apps-some-websites-down-as-inte…>. The explanation at the end seems to indicate that InternetNZ is rolling out DNS security, and caching inconsistencies on ISPs’ servers are leading to hiccups for users. Hopefully this will be resolved soon as the outdated DNS entries get flushed.

2 1

Microsoft Releases Azure Linux
by Lawrence D'Oliveiro 26 May '23

26 May '23

Microsoft has announced a commercially-supported product it calls “Azure Linux” <https://devclass.com/2023/05/25/azure-linux-released-at-build-where-microso…>. This is essentially the same code as its custom “CBL-Mariner” distro that it runs internally on its Azure servers. While this is RPM-based (the same package manager used in Red Hat), it is not a fork of Red Hat, but is built specially from the ground up. Project lead Jim Perrin explains why: “The reason we chose not to fork a different distro … Microsoft has kind of a history with Linux. … I think the Balmer quote is from 2001, but a lot of the sentiment still lingers even today. Part of the reason we did not choose to start with a distribution and then fork it for our needs is we didn’t want to be seen as doing the embrace and extend thing again, we didn’t want to wake any of that up, we figured, build it from scratch, we can tailor it to our needs … we’re scratching an itch we had and offering the solution back to the community.” The “Ballmer quote” being the infamous phrase “Linux is a cancer” that then-CEO Steve Ballmer uttered back in 2001. Yes, nice to see some past sins are still kept in mind, at least in some corners of Microsoft ...

1 0

Fast Restart For Java Apps
by Lawrence D'Oliveiro 23 May '23

23 May '23

Java continues to be popular for server-side apps. But one problem is that starting a Java app can be slow. So if you have some Java code that performs a service on demand, runs for a short while and then shuts down again, that hurts performance. Enter “CRaC”, or “Coordinated Restore at Checkpoint” <https://devclass.com/2023/05/22/azul-makes-openjdk-with-fast-start-crac-gen…>, from a company called Azul, which seems to centre its entire business around OpenJDK <https://www.azul.com/about/>. This system lets the app dump its state to disk in a form that allows for quick resumption. This state cannot include things like open files/network connections, so the app itself needs to implement handlers to close these before the dump and reopen them after the restore, saving enough state as part of the dump to allow this to happen with minimal impact on the rest of the application. Interestingly, this system is built on another piece of software called “CRIU” or “Checkpoint/Restore In Userspace” <https://criu.org/Main_Page>, which is Linux-only. As Azul’s CTO says: “We submitted CRaC to OpenJDK as an idea for a project … and they’ve included it as one of the many project they have. The reason it isn’t in the mainstream yet, and I’m not even sure it will make it into the mainstream, is that we rely on the CRIU technology underneath on Linux, and there isn’t an equivalent that we’re aware of on Windows or on Mac. So you lose that cross-platform functionality … ” But as the article says, that may not such a big showstopper any more: Java applications are often developed on Windows or Mac, but most often deployed to Linux, suggesting that the lack of cross-platform support is not a deal-breaker for everyone.

1 0

Fibre Connection -- Separating Modem & Router Functions
by Lawrence D'Oliveiro 16 May '23

16 May '23

Most people probably have their internet connection provided through a single box. There are two separate functions going on: * “Modem” (layer 2) -- handling the low-level signalling with whatever is at the other end of the wire (whether copper or glass); * “Router” (layer 3) -- routing TCP/IP packets between your house LAN and your ISP, which provides the connection between there and the rest of the Internet. At one point I was running a cheap little Conexant AccessRunner USB box (bought from Dick Smith) on my ADSL connection; while this could also perform both functions in one, I found a version of the firmware that implemented only the modem function. Plugging this into a Linux box caused it to appear like an additional network interface (the drivers are already in the standard kernel). I could then control this via the “ppp” package <https://ppp.samba.org/>, using its PPP-over-ATM plugin to implement the correct low-level signalling (just VPI/VCI selection, really). I could then exploit the full power of the Linux network stack on that box to manage the connection to the rest of my house LAN. Anyway, as my own house gets wired up for fibre (soon...), I was curious as to whether something equivalent could be done for a fibre connection. And the information I’ve found so far (e.g. <https://www.geekzone.co.nz/forums.asp?forumid=81&topicid=274586>) indicates it might actually be simpler than this. The “ONT” (“Optical Network Terminator”) box that gets installed in your house has phone ports and Ethernet ports on it, and it appears that (once you have your ISP connection up and running) the Ethernet connection behaves just like a regular LAN connection, with a DHCP server (and ISP’s router) listening on the other end. So instead of an Internet router at your end, you can plug a regular PC directly into that port, pick up an allocated address, and have it immediately connected to the Internet. In short, there is nothing fibre-specific about the Internet router that the ISP provides to you at all. However, there might be issues with VLAN-tagging of the Ethernet frames, and this is not standardized between ISPs. (By the way, I see several folks claiming there is no “modem” in a fibre connection. Of course there is.) Not sure whether I’ll try this right away. Might be safest to do things the ISP-provided way, at least to begin with.

4 8

Unkillable UEFI Malware Bypassing Secure Boot Enabled By Unpatchable Windows Flaw
by Peter Reutemann 12 May '23

12 May '23

'Researchers have announced a major cybersecurity find -- the world's first-known instance of real-world malware that can hijack a computer's boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows. From a report: Dubbed BlackLotus, the malware is what's known as a UEFI bootkit. These sophisticated pieces of malware hijack the UEFI -- short for Unified Extensible Firmware Interface -- the low-level and complex chain of firmware responsible for booting up virtually every modern computer. As the mechanism that bridges a PC's device firmware with its operating system, the UEFI is an OS in its own right. It's located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch. Because the UEFI is the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. These traits make the UEFI the perfect place to run malware. When successful, UEFI bootkits disable OS security mechanisms and ensure that a computer remains infected with stealthy malware that runs at the kernel mode or user mode, even after the operating system is reinstalled or a hard drive is replaced. As appealing as it is to threat actors to install nearly invisible and unremovable malware that has kernel-level access, there are a few formidable hurdles standing in their way. One is the requirement that they first hack the device and gain administrator system rights, either by exploiting one or more vulnerabilities in the OS or apps or by tricking a user into installing trojanized software. Only after this high bar is cleared can the threat actor attempt an installation of the bootkit. The second thing standing in the way of UEFI attacks is UEFI Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of software used during startup is trusted by a computer's manufacturer. Secure Boot is designed to create a chain of trust that will prevent attackers from replacing the intended bootup firmware with malicious firmware. If a single firmware link in that chain isn't recognized, Secure Boot will prevent the device from starting.' -- source: https://it.slashdot.org/story/23/03/06/1854200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenOffice: The One FOSS Project That Deserves To Die, But Won’t
by Lawrence D'Oliveiro 06 May '23

06 May '23

The ever-dependable Brodie Robertson has a look at the ongoing (!) development history of OpenOffice here <https://www.youtube.com/watch?v=xdpMxmFvGBA>. Those of us on FOSS platforms moved to LibreOffice years ago. But among some sectors (my guess is, predominantly Microsoft Windows users?), OpenOffice still has the dominant name recognition. And just to add to the fun, the project actually continues putting out updates! Though these are just minor ones -- I don’t think there have been any major functional changes in the better part of a decade. The source code commit history also continues to bubble over, though a lot of the patches are tiny, almost trivial things, like fixing typos and making random-looking changes to whitespace.

1 0