December 2024 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

Setting Application Menu Shortcut
by Lawrence D'Oliveiro 24 Dec '24

24 Dec '24

So after my last Debian Unstable upgrade, I am now running KDE Plasma 6 as my desktop. KDE Plasma, by default, brings up its application menu if you press and release what it calls the “Meta” (more commonly “Super” or “Windows”) modifier key. I have this disabled because I use Meta/Super instead of Alt as the modifier key for moving windows around; and I did that switch to avoid interfering with the use of the Alt-click function in Blender. Previously, I did this change to Meta/Super behaviour by editing a config file called ~/.config/kwinrc. But now, this has been unified with the rest of the system settings, and can be controlled through the same interface <https://www.lorenzobettini.it/2024/06/modifier-only-shortcuts-in-kde-plasma…> (excuse the ads).

1 0

Home Assistant's New Voice Assistant Answers To 'Hey Jarvis'
by Peter Reutemann 20 Dec '24

20 Dec '24

'Home Assistant (not to be confused with the Google Assistant on Google Home) has launched the Voice Preview Edition (Voice PE), its first dedicated voice assistant hardware for $59. The device offers a privacy-focused, locally controlled solution that supports over 50 languages and integrates seamlessly with the open-source smart home platform. As The Verge notes, Voice PE supports the wake words "Hey Jarvis" right out of the box. From the report: The Voice PE is a small white box, about the size of your palm, with dual microphones and an audio processor. An internal speaker lets you hear the assistant, but you can also connect a speaker to it via a 3.5 mm headphone jack for better-quality media playback. A colored LED ring on top of the Voice PE indicates when the assistant is listening. It surrounds a rotary dial and a physical button, which is used for setup and to talk to the voice assistant without using the wake word. The button can also be customized to do whatever you want (because this is Home Assistant). A physical mute switch is on the side, and the device is powered by USB-C (charger and cable not included). There's also a Grove port where you can add sensors and other accessories. For those who don't like the idea of always-listening microphones in their home from companies such as Amazon and Google, but who still want the convenience of controlling their home with their voice, the potential here is huge. But it may be a while until Voice PE is ready to replace your Echo or Nest smart speaker. [...] if you want more features, Voice PE can connect to supported AI models, such as ChatGPT or Gemini, to fully replace Assist or use it as a fallback for commands it doesn't understand. But for many smart home users, there will be plenty of value in a simple, inexpensive device that lets you turn your lights on and off, start a timer, and execute other useful commands with your voice without relying on an internet connection. ' -- source: https://yro.slashdot.org/story/24/12/19/231255 Cheers, Peter

1 0

vim and files from gvfs mounted file systems
by Peter Reutemann 19 Dec '24

19 Dec '24

Hi everyone Since upgrading to Linux Mint 22 Wilma and vim 9.1.x, I noticed an issue with vim when editing remote files (eg mounted via sftp through caja): saving the file would fail. Not ideal... Looks like there is an issue with gvfs mounted file systems: https://github.com/vim/vim/issues/5309 https://github.com/vim/vim/issues/5237#issuecomment-1366262853 Disabling the creation of backup files avoids the issue: :set backupcopy=no Or, if you want to automate it based on path, you can place the following in your .vimrc: autocmd BufRead,BufNewFile /run/user/* set backupcopy=no Cheers, Peter

1 0

TP-Link faces possible US ban as hijacked routers fuel Chinese attacks
by Peter Reutemann 19 Dec '24

19 Dec '24

'US government authorities are reportedly investigating whether to ban TP-Link wireless routers, which have been targeted in some high-profile attacks linked to the Chinese government. TP-Link, which was founded in China in 1996 and said it relocated its headquarters to the US in October this year, has racked up significant market share in US homes and businesses. US authorities are investigating whether TP-Link "poses a national-security risk and are considering banning the devices," The Wall Street Journal reported today. The WSJ notes that TP-Link is "the top choice on Amazon.com, and powers Internet communications for the Defense Department and other federal government agencies."' -- source: https://arstechnica.com/tech-policy/2024/12/report-us-considers-banning-tp-… Maybe time to flash your TP-Link router with something like OpenWRT? https://openwrt.org/toh/start Cheers, Peter

1 0

Australia Moves To Drop Some Cryptography By 2030
by Peter Reutemann 19 Dec '24

19 Dec '24

'Australia's chief cyber security agency has decided local orgs should stop using the tech that forms the current cryptographic foundation of the internet by the year 2030 -- years before other nations plan to do so -- over fears that advances in quantum computing could render it insecure. The Land Down Under's plans emerged last week when the Australian Signals Directorate (ASD) published guidance for High Assurance Cryptographic Equipment (HACE) -- devices that send and/or receive sensitive information -- that calls for disallowing the cryptographic algorithms SHA-256, RSA, ECDSA and ECDH, among others, by the end of this decade. Bill Buchanan, professor in the School of Computing at Edinburgh Napier University, wrote a blog post in which he expressed shock that the ASD aims to move so quickly. "Basically, these four methods are used for virtually every web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent," he wrote. "The removal of SHA-256 definitely goes against current recommendations."' -- source: https://it.slashdot.org/story/24/12/18/173242 Cheers, Peter

1 0

Xfce 4.20 Desktop Environment Released with Experimental Wayland Support
by Peter Reutemann 17 Dec '24

17 Dec '24

'Two years after the release of Xfce 4.18, Xfce 4.20 is here as another major update to this light and fast desktop environment for GNU/Linux distributions. Xfce 4.20 is packed with lots of new features and improvements like experimental support for Wayland with support for the Labwc and Wayfire compositors, improved support for HiDPI displays, and libxfce4windowing as a new abstraction library to present windowing concepts in a windowing-system-independent manner. Wayland sessions of Xfce can be started with the startxfce4 --wayland command. However, you should keep in mind that several Xfce components don’t run at all on Wayland, including the Xfwm4 window manager, Xfdashboard, Xfce4-screensaver, Xfce4-windowck-plugin, and Xfce4-xkb-plugin. “So far Xfce does not feature a compositor which supports Wayland. If you want to run Xfce in Wayland, Labwc and Wayfire will give you the best results,” said the Xfce development team. “Plans are underway to add Wayland support to Xfwm4 while preserving its existing X11 functionality. However, such a restructurization will be a major effort and we cannot tell yet when/if it will be done, so please don’t hold your breath waiting for it.”' -- source: https://9to5linux.com/xfce-4-20-desktop-environment-released-with-experimen… Cheers, Peter

1 0

How to Share Your Linux Terminal Over the Web Using Ttyd
by Peter Reutemann 16 Dec '24

16 Dec '24

Looks like an interesting project: 'Ttyd is a simple tool that allows you to share a Linux terminal over a web browser. It’s cross-platform and uses the libuv and WebGL2 Javascript APIs for performance and real-time connection between the browser and Linux terminal. The SSL support is offered by OpenSSL. It supports multiple clients at once, allowing multiple clients to connect to the same Linux terminal from different browsers (or tabs). No additional package is required on the client-side, only the correct web address is needed. You can use this tool for remote system administration, troubleshooting, assisting a friend with any specific task, debugging or recovering a process, and much more.' -- source: https://linuxtldr.com/installing-ttyd/ Cheers, Peter

3 2

Let's Encrypt Announces New-Certificate-Every-6-Days Offering
by Peter Reutemann 16 Dec '24

16 Dec '24

'The non-profit, free certificate authority Let's Encrypt shared some news from their executive director as they approach their 10th anniversary in 2025: Internally things have changed dramatically from what they looked like ten years ago, but outwardly our service hasn't changed much since launch. That's because the vision we had for how best to do our job remains as powerful today as it ever was: free 90-day TLS certificates via an automated API. Pretty much as many as you need. More than 500,000,000 websites benefit from this offering today, and the vast majority of the web is encrypted. Our longstanding offering won't fundamentally change next year, but we are going to introduce a new offering that's a big shift from anything we've done before — short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event. Because we've done so much to encourage automation over the past decade, most of our subscribers aren't going to have to do much in order to switch to shorter lived certificates. We, on the other hand, are going to have to think about the possibility that we will need to issue 20x as many certificates as we do now. It's not inconceivable that at some point in our next decade we may need to be prepared to issue 100,000,000 certificates per day. That sounds sort of nuts to me today, but issuing 5,000,000 certificates per day would have sounded crazy to me ten years ago... It was hard to build Let's Encrypt. It was difficult to scale it to serve half a billion websites... Charitable contributions from people like you and organizations around the world make this stuff possible. Since 2015, tens of thousands of people have donated. They've made a case for corporate sponsorship, given through their Donor-Advised Funds, or set up recurring donations, sometimes to give $3 a month. That's all added up to millions of dollars that we've used to change the Internet for nearly everyone using it.' -- source: https://it.slashdot.org/story/24/12/15/0059216 Cheers, Peter

1 0