June 2023 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Brave aims to curb practice of websites that port scan visitors
by Peter Reutemann 30 Jun '23

30 Jun '23

'The Brave browser will take action against websites that snoop on visitors by scanning their open Internet ports or accessing other network resources that can expose personal information. Starting in version 1.54, Brave will automatically block website port scanning, a practice that a surprisingly large number of sites were found engaging in a few years ago. According to this list compiled in 2021 by a researcher who goes by the handle G666g1e, 744 websites scanned visitors’ ports, most or all without providing notice or seeking permission in advance. eBay, Chick-fil-A, Best Buy, Kroger, and Macy's were among the offending websites.' -- source: https://arstechnica.com/security/2023/06/brave-will-soon-control-which-site… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Mode
by Peter Reutemann 30 Jun '23

30 Jun '23

'For approximately twenty years, Red Hat (now a fully owned subsidiary of IBM) has experimented with building a business model for operating system deployment and distribution that looks, feels, and acts like a proprietary one, but nonetheless complies with the GPL and other standard copyleft terms. Software rights activists, including SFC, have spent decades talking to Red Hat and its attorneys about how the Red Hat Enterprise Linux (RHEL) business model courts disaster and is actively unfriendly to community-oriented Free and Open Source Software (FOSS). These pleadings, discussions, and encouragements have, as far as we can tell, been heard and seriously listened to by key members of Red Hat's legal and OSPO departments, and even by key C-level executives, but they have ultimately been rejected and ignored — sometimes even with a “fine, then sue us for GPL violations” attitude. Activists have found this discussion frustrating, but kept the nature and tenure of these discussions as an “open secret” until now because we all had hoped that Red Hat's behavior would improve. Recent events show that the behavior has simply gotten worse, and is likely to get even worse.' -- source: https://sfconservancy.org/blog/2023/jun/23/rhel-gpl-analysis/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Potted History Of 60 Years Of Computer Networking
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

These guys, Larry Peterson and Bruce Davie, have done a whole series of open-source books all around the common theme of “A Systems Approach”. Here <https://www.theregister.com/2023/06/28/60_years_of_networking/> one of them offers a summary of the origins of the Internet, going back to the invention of packet switching and “best effort” delivery, and how that turned out to be such an important change from the traditional telephone network. He also takes the credit/blame for a long-standing myth about the Internet: I feel obligated to point out that there is no mention in this paper of the internet being designed to withstand nuclear attack. Unfortunately, I was responsible for perpetuating that misconception in an early edition of Computer Networks: A Systems Approach. Leiner et al debunk this myth and explain its origins in their paper, but it’s a remarkably persistent one. “[C]ontinue despite loss of networks or gateways” is as close as it gets. But now, cracks are starting to show in the trend toward centralization of popular Internet services. Not only is the “Fediverse” providing alternatives to Twitter and Facebook, but it is now also offering choices to those fed up with recent developments at Reddit, as well.

1 0

The ReactOS Project Suddenly Shows Signs of Life
by Peter Reutemann 29 Jun '23

29 Jun '23

'ReactOS is an open-source operating system that aims to replicate Microsoft Windows, and can already run many Windows applications without modification. ReactOS published a new (infrequent) newsletter to outline recent work. It reveals that progress has slowed down recently, but the project definitely isn't dead. The newsletter also acknowledges the team hasn't put out a new version since the end of 2021, although progress continues. Due to shifting focuses to quality releases, they are no longer on a quarterly release cadence. The date of the next release is not set yet, but according to a huge list of already-implemented changes they aim for it to be a substantial update. The last update to ReactOS was version 0.4.14, released on December 2021. While developers were previously committed to releasing updates every three months, that has since changed and updates will now be focused on quality rather than quantity. For the ReactOS team to be confident enough to release something, it needs to have less than 20 known unfixed regressions while adding new features and functions. Behind the scenes, it looks like things are spinning well. The team specifically highlighted its progress on the x64 port of ReactOS, which went from being a non-booting mess to an operating system that boots up and mostly works. It doesn't run any x86 programs since it doesn't have WoW64, but it's going well.' -- source: https://tech.slashdot.org/story/23/06/28/212238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft's GitHub Under Fire For DDoSing Crucial Open Source Project Website
by Peter Reutemann 29 Jun '23

29 Jun '23

'The servers used by the GMP project, an open source arithmetic library at the heart of GCC and other programs, slowed to a crawl earlier this month due to a large amount of network traffic originating from Microsoft servers. The Register reports: Torbjorn Granlund, principal author of GMP, raised the alarm in a note to the project's mailing list. "The GMP servers are under attack by several hundred IP addresses owned by Microsoft Corporation," he wrote. "We do not know if this is made with malice by Microsoft, if it is some sort of mistake, or if [it is one] of their cloud customers ... running the attack. The attack targets the GMP repo, with thousands of identical requests. The requests are cleverly chosen as to cause heavy system load. "We're firewalling off all of Microsoft's IP addresses as an emergency response." The following day, Mike Blacker, director of threat hunting, operations, and response at Microsoft's GitHub, had identified the culprit: a GitHub Actions Workflow that clones a Mercurial repo and has been forked more than 700 of times. "Microsoft and GitHub have investigated the issue and determined that a GitHub user updated a script within the FFmpeg-Builds project that pulled content from https://gmplib.org," explained Blacker. "This build was configured to run parallel simultaneous tests on 100 different types of computers/architectures. This activity does not appear to be nefarious. [GMP] appears to have limited infrastructure that could not sustain the limited, yet simultaneous requests." [...] As of last week, the excessive traffic was still an issue. "Our servers are fully available again, but that's the result of us adding all participating Microsoft network ranges to our firewall," the GMP project explains on its webpage. "We understand that we are far from the first project to take such measures against Github." The Register asked Granlund whether he was satisfied with Microsoft-GitHub's response, and he told us he had only heard once from Blacker. "I blocked about 40 IP ranges from accessing our web server," he explained. "A week after this started, there was still intensive traffic from the same IP addresses, perhaps 100 different Microsoft addresses all in all, belonging to about 40 ranges. The difference was that that traffic just caused minuscule load, and a log line in the firewall." "Problem solved. I cannot care less if they no longer can access gmplib.org. I find it interesting how little responsibility Github/Microsoft assume here. They seem to think that they are entitled to bash away at smaller sites." ' -- source: https://tech.slashdot.org/story/23/06/28/2045228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let’s Encrypt Outage--Did Anybody Notice?
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

Just noticed a mention in passing in this article <https://www.theregister.com/2023/06/28/microsofts_github_gmp_project/> that Let’s Encrypt was issuing bad certificates over a period of about an hour earlier this month <https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/648b3…>. An explanation of what went wrong (from a third party who does monitoring of CA (mis)behaviour as part of his job) is here <https://www.agwa.name/blog/post/last_weeks_lets_encrypt_downtime>. Seems like many of the people affected were still using their bad certificates a week after the incident. Did you have one of the bad certificates? That article mentions a new addition to the ACME auto-renewal protocols that would allow clients to resolve a glitch like this in future without any manual intervention.

1 0