September 2024 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

New systemd update will bring Windows’ infamous Blue Screen of Death to Linux
by Peter Reutemann 18 Nov '24

18 Nov '24

'Windows' infamous "Blue Screen of Death" is a bit of a punchline. People have made a hobby of spotting them out in the wild, and in some circles, they remain a byword for the supposed flakiness and instability of PCs. To this day, networked PCs in macOS are represented by beige CRT monitors displaying a BSOD. But the BSOD is supposed to be a diagnostic tool, an informational screen that technicians can use to begin homing in on the problem that caused the crash in the first place; that old Windows' BSOD error codes were often so broad and vague as to be useless doesn't make the idea a bad one. Today, version 255 of the Linux systemd project honors that original intent by adding a systemd-bsod component that generates a full-screen display of some error messages when a Linux system crashes. The systemd-bsod component is currently listed as "experimental" and "subject to change." But the functionality is simple: any logged error message that reaches the LOG_EMERG level will be displayed full-screen to allow people to take a photo or write it down. Phoronix reports that, as with BSODs in modern Windows, the Linux version will also generate a QR code to make it easier to look up information on your phone.' -- source: https://arstechnica.com/gadgets/2023/12/linux-distros-are-about-to-get-a-ki… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Juice TV Hiccup
by Lawrence D'Oliveiro 15 Oct '24

15 Oct '24

Currently when I switch to FreeView Channel 200, it shows a frozen image with the text “Cinegy” and “Demo Version” on it. Searching for that name takes me to a site that talks about “software defined television”. Either their product licence has expired, or they never had one in the first place ...

2 3

Critical Unauthenticated RCE Flaw Impacts All GNU/Linux Systems
by Peter Reutemann 27 Sep '24

27 Sep '24

'"Looks like there's a storm brewing, and it's not good news," writes ancient Slashdot reader jd. "Whether or not the bugs are classically security defects or not, this is extremely bad PR for the Linux and Open Source community. It's not clear from the article whether this affects other Open Source projects, such as FreeBSD." From a report: A critical unauthenticated Remote Code Execution (RCE) vulnerability has been discovered, impacting all GNU/Linux systems. As per agreements with developers, the flaw, which has existed for over a decade, will be fully disclosed in less than two weeks. Despite the severity of the issue, no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned yet, although experts suggest there should be at least three to six. Leading Linux distributors such as Canonical and RedHat have confirmed the flaw's severity, rating it 9.9 out of 10. This indicates the potential for catastrophic damage if exploited. However, despite this acknowledgment, no working fix is still available. Developers remain embroiled in debates over whether some aspects of the vulnerability impact security.' -- source: https://it.slashdot.org/story/24/09/25/2150210 Cheers, Peter

4 4

Tor Project Merges With Tails
by Peter Reutemann 27 Sep '24

27 Sep '24

'The Tor Project: Today the Tor Project, a global non-profit developing tools for online privacy and anonymity, and Tails, a portable operating system that uses Tor to protect users from digital surveillance, have joined forces and merged operations. Incorporating Tails into the Tor Project's structure allows for easier collaboration, better sustainability, reduced overhead, and expanded training and outreach programs to counter a larger number of digital threats. In short, coming together will strengthen both organizations' ability to protect people worldwide from surveillance and censorship. Countering the threat of global mass surveillance and censorship to a free Internet, Tor and Tails provide essential tools to help people around the world stay safe online. By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools. In late 2023, Tails approached the Tor Project with the idea of merging operations. Tails had outgrown its existing structure. Rather than expanding Tails's operational capacity on their own and putting more stress on Tails workers, merging with the Tor Project, with its larger and established operational framework, offered a solution. By joining forces, the Tails team can now focus on their core mission of maintaining and improving Tails OS, exploring more and complementary use cases while benefiting from the larger organizational structure of The Tor Project. This solution is a natural outcome of the Tor Project and Tails' shared history of collaboration and solidarity. 15 years ago, Tails' first release was announced on a Tor mailing list, Tor and Tails developers have been collaborating closely since 2015, and more recently Tails has been a sub-grantee of Tor. For Tails, it felt obvious that if they were to approach a bigger organization with the possibility of merging, it would be the Tor Project.' -- source: https://yro.slashdot.org/story/24/09/26/1431201 Cheers, Peter

1 0

NIST proposes barring some of the most nonsensical password rules
by Peter Reutemann 26 Sep '24

26 Sep '24

'The National Institute of Standards and Technology (NIST), the federal body that sets technology standards for governmental agencies, standards organizations, and private companies, has proposed barring some of the most vexing and nonsensical password requirements. Chief among them: mandatory resets, required or restricted use of certain characters, and the use of security questions. Choosing strong passwords and storing them safely is one of the most challenging parts of a good cybersecurity regimen. More challenging still is complying with password rules imposed by employers, federal agencies, and providers of online services. Frequently, the rules—ostensibly to enhance security hygiene—actually undermine it. And yet, the nameless rulemakers impose the requirements anyway. [...] 1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length. 2. Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters. 3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords. 4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length. 5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords. 6. Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. 7. Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant. 8. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords. 9. Verifiers SHALL verify the entire submitted password (i.e., not truncate it).' -- source: https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-… Cheers, Peter

2 1

OpenSSH 9.9 Features Enhanced Quantum-Resistant Algorithms
by Peter Reutemann 26 Sep '24

26 Sep '24

'The OpenSSH project announced the release of OpenSSH 9.9, now available for download on its official mirrors. This new version introduces significant features, including support for hybrid post-quantum key exchange using a formally verified ML-KEM implementation, improved controls for managing unwanted connections, faster NTRUPrime key exchange code, and more.' -- source: https://linuxiac.com/openssh-9-9-released/ Cheers, Peter

1 0

Kubuntu Focus Ir14 Gen 2 review: Using Linux instead of messing with it
by Peter Reutemann 25 Sep '24

25 Sep '24

'There are lots of laptops—maybe all of them—on which you can run a Linux desktop. There are a few vendors that offer laptops with extensive Linux compatibility. And then there are a select few that specialize in Linux laptops, support them, and even customize them. Kubuntu Focus is one of the select few. It sent me one of its laptops to test the Ir14 Gen 2, which runs, of course, Kubuntu, the KDE desktop variant of Ubuntu. The “Focus” in the company name comes from what it is hoping to provide: a device on which you can just do your work without worrying about what’s happening deeper in your system. Go ahead and sudo apt update, says the Focus team; we’ve got you. I used the Ir14 Gen 2 for Ars Technica work and my personal needs for at least two weeks. Setting the system up with Focus’ guided wizard, installing apps from its store, and refusing to touch any of the deeper system files, I achieved something pretty remarkable: no unexpected behaviors on a Linux laptop. Had anything gone wrong, I could reasonably lean back on the system’s rollbacks, which I used a couple of times with no problem. Is this what it could be like? Does using Linux on the desktop not have to involve compiling from source, searching for that one relevant forum comment related to a problem, wondering where the fault lies along the chain from kernel to desktop to repository to me? Maybe. Can you surrender a bit of your upgrade and tinkering curiosity in exchange for knowing that things will work when they get to you? It might be trickier than you think. A Kubuntu Focus Ir14 Gen 2 laptop includes these things: - A laptop made by Carbon Systems, which supplies a lot of fleet and enterprise systems, and happens to make them relatively upgrade and repair-friendly - A stock Kubuntu 24.04 LTS system with a Plasma desktop, with Focus’ integrations built in - A few software tools from Focus, including power profiles and rollback The Focus is not meant to let you do whatever you want but to keep doing what you do. Researchers, developers, and jet propulsion labs are some of Focus’ customers. Focus tests everything that will arrive on official update channels to the device. When kernel updates appear in the upstream, Focus makes sure everything on the device works with it, while also contributing back to Ubuntu, Kubuntu, KDE, and the kernel itself. You don’t get interim releases. You don’t get staff in the forums helping you with running Arch or Fedora. There’s no custom desktop environment or windowing system (“We felt building a separate distribution and ecosystem is the last thing anyone needed,” the company writes). Focus chose reliability for daily-driver devices running Linux. It can, in other words, save you from yourself, if you’re a lot like me. Besides testing, Focus also makes a bunch of tweaks to the system before shipping: some keyboard shortcuts, screen scaling and console font alterations, automatic power profiles on plug and unplug, and the like. Focus has also written up almost every corner of your system you want help on; you can check it out on its site.' -- source: https://arstechnica.com/gadgets/2024/09/kubuntu-focus-ir14-gen-2-review-usi… Cheers, Peter

1 0

Linux boots in 4.76 days on the Intel 4004
by Peter Reutemann 24 Sep '24

24 Sep '24

'Hardware hacker Dmitry Grinberg recently achieved what might sound impossible: booting Linux on the Intel 4004, the world's first commercial microprocessor. With just 2,300 transistors and an original clock speed of 740 kHz, the 1971 CPU is incredibly primitive by modern standards. And it's slow—it takes about 4.76 days for the Linux kernel to boot. Initially designed for a Japanese calculator called the Busicom 141-PF, the 4-bit 4004 found limited use in commercial products of the 1970s before being superseded by more powerful Intel chips, such as the 8008 and 8080 that powered early personal computers—and then the 8086 and 8088 that launched the IBM PC era. If you're skeptical that this feat is possible with a raw 4004, you're right: The 4004 itself is far too limited to run Linux directly. Instead, Grinberg created a solution that is equally impressive: an emulator that runs on the 4004 and emulates a MIPS R3000 processor—the architecture used in the DECstation 2100 workstation that Linux was originally ported to. This emulator, along with minimal hardware emulation, allows a stripped-down Debian Linux to boot to a command prompt.' -- source: https://arstechnica.com/gadgets/2024/09/hacker-boots-linux-on-intels-first-… Cheers, Peter

1 0