November 2025 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

Austria Military Ditches Microsoft for Open-Source Libreoffice – Here’s Why
by Peter Reutemann 26 Feb '26

26 Feb '26

'Austria's military has completed a major IT overhaul, replacing Microsoft Office with the open-source LibreOffice suite across all its desktop systems. The change, finalized this month, affects approximately 16,000 workstations in the Austrian Armed Forces. This move will substantially reduce Austria's software bill. At $33.75 per user per month, a Microsoft 365 E3 subscription for 16,000 workstations costs approximately $6,480,000 per year, compared to LibreOffice's zero cost. But this move isn't about saving money. The real motivation is to gain digital sovereignty and control over critical data. As Michael Hillebrand of Directorate 6 information and communications technology (ICT) and Cyber Defense, explained: "It was very important for us to show that we are doing this primarily to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and to ensure that data is only processed in-house."' -- source: https://www.zdnet.com/article/this-european-military-just-ditched-microsoft… Cheers, Peter

2 2

Proposed Patches Make Upstream Linux Kernel Usable For The OpenWrt One Router
by Peter Reutemann 27 Nov '25

27 Nov '25

'Announced nearly one year ago was the OpenWrt One as a router/AP that is "hacker-friendly" and open-source. The OpenWrt One is powered by a Filogic 820 SoC and features WiFi 6. This official OpenWrt device is manufactured by Banana Pi. While there is downstream open-source code available for customizing the OpenWrt One to your heart's content, the upstream Linux kernel support to date hasn't been full-featured. Sjoerd Simons of Collabora today posted a set of 15 patches for making the OpenWrt One AP functional with the upstream Linux kernel. As Sjoerd puts it, to make the OpenWrt One "actually useful as an access point" with the mainline Linux kernel. The patches get PCI Express working as tested with NVMe storage, the wired network interfaces enabled, the WiFi/wireless networking brought up, status LEDs enabled, SPI NOR, and related bits. The patches bring the necessary Device Tree support and extensions to existing drivers to make everything work without any new drivers being required. There are various kernel quirks required too at this point for making the device happy with the mainline Linux kernel. All in just over 500 lines of code for making the OpenWrt One useful with these patches that will be hopefully mainlined to the Linux kernel.' -- source: https://www.phoronix.com/news/OpenWrt-One-Useful-Linux Has anyone experience with this router? Cheers, Peter

1 0

Arduino's New Terms of Service Worries Hobbyists Ahead of Qualcomm Acquisition
by Peter Reutemann 25 Nov '25

25 Nov '25

'Ars Technica: Some members of the maker community are distraught about Arduino's new terms of service (ToS), saying that the added rules put the company's open source DNA at risk. Arduino updated its ToS and privacy policy this month, which is about a month after Qualcomm announced that it's acquiring the open source hardware and software company. Among the most controversial changes is this addition: "User shall not: translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform's operation, unless expressly allowed by Arduino or by applicable license agreements ..." In response to concerns from some members of the maker community, including from open source hardware distributor and manufacturer Adafruit, Arduino posted a blog on Friday. Regarding the new reverse-engineering rule, Arduino's blog said: "Any hardware, software or services (e.g. Arduino IDE, hardware schematics, tooling and libraries) released with Open Source licenses remain available as before. Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications. Anything that was open, stays open." But Adafruit founder and engineer Limor Fried and Adafruit managing editor Phillip Torrone are not convinced. They told Ars Technica that Arduino's blog leaves many questions unanswered and said that they've sent these questions to Arduino without response. "Why is reverse-engineering prohibited at all for a company built on openly hackable systems?" Fried and Torrone asked in a shared statement. There are also concerns about the ToS' broad new AI-monitoring powers, which offer little clarity on what data is collected, who can access it, or how long it's retained. On top of that, the update introduces an unusual patent clause that bars users from using the platform to identify potential infringement by Arduino or its partners, along with sweeping, perpetual rights over user-generated content. This could allow Arduino, and potentially Qualcomm, to republish, modify, monetize, or redistribute user uploads indefinitely.' -- source: https://hardware.slashdot.org/story/25/11/24/2144256 Cheers, Peter

1 0

The DoorDash Problem: Amazon Sues Perplexity
by Lawrence D'Oliveiro 22 Nov '25

22 Nov '25

A lot of companies are making a comfortable living by selling goods or services online: Amazon, DoorDash, Uber etc. A key part of the business model is that the visitors to their site are actual humans, who can be shown ads, or otherwise persuaded to upsell to some enticing extra product (“Would you like chips with that?”) and thereby disgorge a little bit of extra revenue. This is part of what’s called “building a relationship with the customer”. Which is a nice way of saying “owning the customer”. But what if the visitors to your site are AI bots, looking for deals on behalf of a human that ends up one step removed from contact with you? Then all those ads and extra persuasive messages fall on the worst kind of deaf ears -- no ears at all. The human says to the AI agent “get me a ride to the airport”, the agent goes away to the Uber and Lyft sites (or whatever else turns up), and picks the cheapest option at that moment. The human doesn’t know which company is providing the ride that turns up on their doorstep, and they won’t care. The providers of these products have become mere commodity suppliers. This thought does scare some of these online retailers. And now Amazon, just about the biggest such e-tailer out there, is suing Perplexity, a provider of just such an AI agent service. Amazon says that this is about maintaining a “positive customer experience”; but surely the form of the “customer experience” is something for the customer to choose. Amazon also says that access by AI bots is against the terms of service for its site, and that is clearly the core of its legal claim. But will such a claim hold up in court? How far can companies go in dictating exactly what form users’ accesses to their site can take? <https://www.theverge.com/podcast/823909/the-doordash-problem-ai-agents-web-…>

1 0

The EU made Apple adopt new Wi-Fi standards, and now Android can support AirDrop
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

People in the US like to make fun of the seemingly endless bureaucratic hurdles that the EU Governments keep putting in the way of US companies looking to make a quick buck. You know, having to worry about boring things like “privacy” and “interoperability” and “security”, that kind of thing. Oh, and maintaining free-market competition -- imagine lecturing the USA about how to achieve that! But every now and then, this endless stream of new regulations hits the jackpot. Like how Google is suddenly able to offer full two-way compatibility with Apple’s formerly-proprietary “AirDrop” feature for exchanging files between mobile devices -- the file exchange is done directly, peer-to-peer, without going through any central servers. It’s all down to the fact that the EU forced Apple to move away from the completely proprietary low-level radio protocol it was originally using for AirDrop, towards something that was more amenable to exactly the sort of reverse-engineering of the higher-level protocol that Google did. Of course Apple did also contribute work towards the new standard, just as it did with USB Type-C; it’s better to be seen to be cooperating with inevitability, rather than futilely trying to fight it tooth and nail. <https://arstechnica.com/gadgets/2025/11/the-eu-made-apple-adopt-new-wi-fi-s…>

1 0

HP And Dell Disable HEVC (H.265) Support Built Into Their Laptops’ CPUs
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Some owners of HP and Dell laptops are finding that their machines can no longer playback HEVC/H.265-encoded video content, even though this capability is supposed to be built into their hardware <https://arstechnica.com/gadgets/2025/11/hp-and-dell-disable-hevc-support-bu…>. Why is this happening? The obvious answer: patent issues. The royalty rates these companies have to pay to offer this functionality is going up quite substantially from next year, and they have to cut costs. So the users will have to pay extra money to get this capability back. Synology also used to offer the capability to transcode videos to H.265 on some of its products, but discontinued that as of last year. This is why AV1 was created by Google and other companies: to offer a patent-free alternative to H.265. But in spite of all the patent issues that were clear from the beginning, lots of companies went ahead with H.265-based products regardless. Maybe now we will see the popularity of AV1 increase?

1 0

The Origin Of The Smiley
by Lawrence D'Oliveiro 21 Nov '25

21 Nov '25

Here’s a report <https://arstechnica.com/gadgets/2025/11/in-1982-a-physics-joke-gone-wrong-s…> on the precise origins of the use of the character sequences “:-)” and “:-(”, not quite to denote happiness/unhappiness as they are commonly used today, but to distinguish jokes from serious postings. The discussion happened back in September 1982, on a bulletin-board system running on a DECsystem-20 at Carnegie-Mellon University. It came about as a result of a joke posting being taken way too seriously (of course ...). To add to the interest, there is more than personal testimony to back up the record: original backup tapes of bboard postings from that time were dug up, and the actual transcript of those discussions was extracted, and are now available online <https://www.cs.cmu.edu/~sef/Orig-Smiley.htm>.

1 0

Taming The Data Destroyer
by Lawrence D'Oliveiro 17 Nov '25

17 Nov '25

I use the “dd” command fairly frequently, to put new versions of SystemRescue on the USB stick I dedicate to that purpose, for example. The command has been nicknamed the “data destroyer”, because while doing sector-level copies as root, it can be all too easy to write to the wrong device, and destroy an important filesystem. The “lsblk” command can be handy for confirming which block device you should be writing to, before pressing Enter on that fateful command. There’s lots of information it can display, to help you identify the right device. For example, a command like lsblk -o NAME,SIZE,SERIAL,WWN,VENDOR,MODEL shows a little tree display of devices and partitions in the first column, followed by a lot of info you can use to identify what is currently plugged in. I tried a couple of USB sticks, and they showed amazingly long strings for their serial numbers. My SystemRescue stick shows the vendor as “TOSHIBA” and the model as “TransMemory”. Interestingly, both Western Digital and Seagate drives show the vendor as “ATA”, though the model name begins with “WDC” for the one and “ST” for the other. The SSD boot drives in both my main workstation and laptop display blank for the vendor, but again the model field shows some vendor-specific information.

1 0

Glitch Tokens
by Lawrence D'Oliveiro 16 Nov '25

16 Nov '25

Added something more to my modest store of AI knowledge with this little item about “glitch tokens” -- inputs that make AI language models respond in bizarre and inexplicable ways <https://www.youtube.com/watch?v=WO2X3oZEJOA>. Some people assumed this behaviour was just a random consequence of the whole neural-network concept. Others probed a bit deeper, and discovered some actually explicable, if surprising, causes of particular glitches. What else is lurking in there ... ?

1 0