November 2024 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

GIMP 3.0 - a Milestone For Open-Source Image Editing
by Peter Reutemann 30 Nov '24

30 Nov '24

'The long-awaited release of the GNU Image Manipulation Program (GIMP) 3.0 is on the way, marking the first major update since version 2.10 was released in April 2018. It now features a GTK 3 user interface and GIMP 3.0 introduces significant changes to the core platform and plugins. This release also brings performance and usability improvements, as well as more compatibility with Wayland and complex input sources. GIMP 3.0 is the first release to use GTK 3, a more modern foundation than the GTK 2 base of prior releases. GTK 4 has been available for a few years now, and is on the project's radar, but the plan was always to finish the GTK 3 work first. Moving to GTK 3 brings initial Wayland compatibility and HiDPI scaling. In addition, this allows for GIMP users to take advantage of multi-touch input, bringing pinch-to-zoom gestures to the program, and offering a better experience when working with complex peripherals, such as advanced drawing tablets. These features were not previously possible due to the limitations of GTK 2. A secondary result of the transition to GTK 3 is a refreshed user interface (UI), now with support for CSS themes included. In this release, four themes are available by default, including light, dark, and gray themes, along with a high-contrast theme for users with visual impairments. Additionally, this release has transitioned to using GTK's header bar component, typically used to combine an application's toolbar and title bar into one unit. To maintain familiarity with previous releases, however, GIMP 3.0 still supports the traditional menu interface.' -- source: https://tech.slashdot.org/story/24/11/29/134239/ Cheers, Peter

1 0

Both KDE and GNOME To Offer Official Distros
by Peter Reutemann 30 Nov '24

30 Nov '24

'KDE and GNOME have decided that because they're not big and complicated enough already, they might work better if they have their own custom distributions underneath. What's the worst that could happen? A talk from this year's KDE conference, Akademy 2024, looks like it's going to become real. The talk, by KDE developer Harald Sitter, was entitled An Operating System of Our Own, and the idea sounds simple enough: Sitter proposed an official KDE Linux distribution. Now the proposal is gathering steam and a plan is coming together for an official KDE Linux -- codenamed "Project Banana."' -- source: https://tech.slashdot.org/story/24/11/29/2055220 Cheers, Peter

1 0

file browser
by Peter Reutemann 26 Nov '24

26 Nov '24

Hi there Today, I decided to finally switch my default file browser to krusader: https://krusader.org/ For a number of years, I've been using double-commander: https://doublecmd.sourceforge.io/ Mostly, I was quite happy with double-commander, as it had my preferred two-panel approach for managing files (I frequently copy files between various directories around for testing models etc). The two-panel approach was something I came to appreciate back in the DOS days when using the Norton Commander. With Double-commander I could also have an arbitrary number of tabs within a panel. The function buttons at the bottom (rename/copy/view/terminal/etc) were also quite handy when using the mouse. And, very importantly, Double-commander is available for Windows as well. However, remote access via sftp was quite slow (viewing and copying files) and that's when I had to fall back on caja, as it had a much higher throughput. Compared to caja, krusader is much faster when listing remote files. Waiting around for caja to refresh a few thousand files was taking way too long (sometimes up to 30 seconds). That's what gave me the final push to make the switch (on my development machine). Double-commander will still be my go-to tool for Windows machines. Anyway, what is your preferred file browser? Cheers, Peter

2 1

g: An Elegant Alternative for the ls Command in Linux
by Peter Reutemann 25 Nov '24

25 Nov '24

Hi everyone Just came across this post: '“g” is a free and open-source cross-platform alternative to the ls command, offering more advanced features than any other alternative, such as what “exa” can provide. The developer named this tool “g” because it’s written in Go, and “g” is simply easy to remember. It offers various ways to customize output, multiple ways to layout the output, integrated support for Git, advanced sorting mechanisms, fuzzy path matching, and hyperlink support.' -- source: https://linuxtldr.com/g-alternative-of-the-ls-command/ Looks like an interesting alternative. :-) Cheers, Peter

1 0

Red Hat is Becoming an Official Microsoft 'Windows Subsystem for Linux' Distro
by Peter Reutemann 24 Nov '24

24 Nov '24

'You can use any Linux distribution inside of the Windows Subsystem for Linux" Microsoft recently reminded Windows users, "even if it is not available in the Microsoft Store, by importing it with a tar file." But being an official distro "makes it easier for Windows Subsystem for Linux users to install and discover it with actions like wsl --list --online and wsl --install," Microsoft pointed out this week. And "We're excited to announce that Red Hat will soon be delivering a Red Hat Enterprise Linux WSL distro image in the coming months..." Thank you to the Red Hat team as their feedback has been invaluable as we built out this new architecture, and we're looking forwards to the release...! Ron Pacheco, senior director, Red Hat Enterprise Linux Ecosystem, Red Hat says: "Developers have their preferred platforms for developing applications for multiple operating systems, and WSL is an important platform for many of them. Red Hat is committed to driving greater choice and flexibility for developers, which is why we're working closely with the Microsoft team to bring Red Hat Enterprise Linux, the largest commercially available open source Linux distribution, to all WSL users." Read Pacheco's own blog post here. But in addition Microsoft is also releasing "a new way to make WSL distros," they announced this week, "with a new architecture that backs how WSL distros are packaged and installed." Up until now, you could make a WSL distro by either creating an appx package and distributing it via the Microsoft Store, or by importing a .tar file with wsl -import. We wanted to improve this by making it possible to create a WSL distro without needing to write Windows code, and for users to more easily install their distros from a file or network share which is common in enterprise scenarios... With the tar based architecture, you can start with the same .tar file (which can be an exported Linux container!) and just edit it to add details to make it a WSL distro... These options will describe key distro attributes, like the name of the distro, its icon in Windows, and its out of box experience (OOBE) which is what happens when you run WSL for the first time. You'll notice that the oobe_command option points to a file which is a Linux executable, meaning you can set up your full experience just in Linux if you wish. ' -- source: https://tech.slashdot.org/story/24/11/23/0251245 Cheers, Peter

1 0

Ubuntu Linux Impacted By Decade-Old 'needrestart' Flaw That Gives Root
by Peter Reutemann 21 Nov '24

21 Nov '24

'Five local privilege escalation (LPE) vulnerabilities in the Linux utility "needrestart" -- widely used on Ubuntu to manage service updates -- allow attackers with local access to escalate privileges to root. The flaws were discovered by Qualys in needrestart version 0.8, and fixed in version 3.8. BleepingComputer reports: Complete information about the flaws was made available in a separate text file, but a summary can be found below: - CVE-2024-48990: Needrestart executes the Python interpreter with a PYTHONPATH environment variable extracted from running processes. If a local attacker controls this variable, they can execute arbitrary code as root during Python initialization by planting a malicious shared library. - CVE-2024-48992: The Ruby interpreter used by needrestart is vulnerable when processing an attacker-controlled RUBYLIB environment variable. This allows local attackers to execute arbitrary Ruby code as root by injecting malicious libraries into the process. - CVE-2024-48991: A race condition in needrestart allows a local attacker to replace the Python interpreter binary being validated with a malicious executable. By timing the replacement carefully, they can trick needrestart into running their code as root. - CVE-2024-10224: Perl's ScanDeps module, used by needrestart, improperly handles filenames provided by the attacker. An attacker can craft filenames resembling shell commands (e.g., command|) to execute arbitrary commands as root when the file is opened. - CVE-2024-11003: Needrestart's reliance on Perl's ScanDeps module exposes it to vulnerabilities in ScanDeps itself, where insecure use of eval() functions can lead to arbitrary code execution when processing attacker-controlled input. The report notes that attackers would need to have local access to the operation system through malware or a compromised account in order to exploit these flaws. "Apart from upgrading to version 3.8 or later, which includes patches for all the identified vulnerabilities, it is recommended to modify the needrestart.conf file to disable the interpreter scanning feature, which prevents the vulnerabilities from being exploited," adds BleepingComputer.' -- source: https://it.slashdot.org/story/24/11/21/0057206 Cheers, Peter

1 0

Linux Kernel 6.12 Has Been Released
by Peter Reutemann 18 Nov '24

18 Nov '24

'Slashdot unixbhaskar writes: Linus has released a fresh Linux kernel for public consumption. Please give it a try and report any glitches to the maintainers for improvement. Also, please do not forget to express your appreciation to those tireless folks who did all the hard work for you. The blog OMG Ubuntu calls it "one of the most biggest kernel releases for a while," joking that it's a "really real-time kernel." The headline feature in Linux 6.12 is mainline support for PREEMPT_RT. This patch set dramatically improves the performance of real-time applications by making kernel processes pre-emptible — effectively enabled proper real-time computing... Meanwhile, Linus Torvalds himself contributes a new method for user-space address masking designed to claw back some of the performance lost due to Spectre-v1 mitigations. You might have heard that kernel devs have been working to add QR error codes to Linux's kernel panic BSOD screen (as a waterfall of error text is often cut off and not easily copied for ad-hoc debugging). Well, Linux 6.12 adds support for those during Direct Rendering Manager panics... A slew of new RISC-V CPU ISA extensions are supported in Linux 6.12; hybrid CPU scaling in the Intel P-State driver lands ahead of upcoming Intel Core Ultra 2000 chips; and AMD P-State driver improves AMD Boost and AMD Preferred Core features. More coverage from the blog 9to5Linux highlights a new scheduler called sched_ext, Clang support (including LTO) for nolibc, support for NVIDIA's virtual command queue implementation for SMMUv3, and "an updated cpuidle tool that now displays the residency value of cpuidle states for a clearer and more detailed view of idle state information when using cpuidle-info." Linux kernel 6.12 also introduces SWIG bindings for libcpupower to make it easier for developers to write scripts that use and extend the functionality of libcpupower, support for translating normalized error addresses reported by an AMD memory controller into system physical addresses using a UEFI mechanism called platform runtime mechanism (PRM), as well as simplified loading of microcode patches on AMD Zen and newer CPUs by using the family, model, and stepping encoded in the patch revision number... Moreover, Linux 6.12 adds support for running as a protected guest on Android as well as perf and support for a bunch of new interconnect PMUs. It also adds the final conversions to the new Intel VFM CPU model matching macros, rewrites the PCM buffer allocation handling and locking optimizations, and improves the USB audio driver... ' -- source: https://linux.slashdot.org/story/24/11/18/0142252 Cheers, Peter

1 0

mailing list alternatives
by Peter Reutemann 18 Nov '24

18 Nov '24

Hi everyone Here is a list of all the potential options for having the WLUG mailing list continue in some form after the University of Waikato will shut down their mailman instance next month: 1. TechnologyWise would support us and host it at Catalyst (Wellington) Type: unspecified (since general hosting, could be mailman?) Comment: TW ran the BOP LUG that way 2. Linux Australia (https://lists.linux.org.au/mailman/listinfo) Type: mailman (open-source) Comment: not yet contacted whether they'd be open to it 3. Don Gould Type: unspecified (has FLOSS platform, so could be mailman) 4. NZOSS Type: discourse (open-source, at community.iridescent.nz) Comment: unlikely to migrate archives 5. Outlook Groups option Type: MS Outlook (proprietary) Comment: just email distribution, probably no archives In terms of WLUG list archives... I've experimented with hypermail (https://github.com/hypermail-project/hypermail) and was able to turn the 53MB mbox file containing all our posts from the last 25 years into 183MB of HTML. That way, we can at least ensure that the old content doesn't get lost completely. I also talked to Daniel Lawson, who's hosting the old WLUG website and wiki. Though he is not keen on managing mail (bit of a nightmare nowadays according to him), he'd be willing to host the HTML version of the archives. Please reply to this post with your preferred option(s) by Saturday night (e.g., "1" or "1 3 4"). On Sunday, I will then create a final tally (hopefully). Thanks again for your suggestions! Cheers, Peter

3 4