February 2026 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

A Taste Of CDE
by Lawrence D'Oliveiro 02 Mar '26

02 Mar '26

An emulation of an early-1990s Linux GUI in a browser <https://www.tomshardware.com/software/linux/nostalgic-developer-recreates-t…>. Actually, who says CDE was ever “dead”? GNU created their own version of the OSF Motif GUI toolkit, called “Lesstif”, and it continues to be available in Linux distros to this day.

3 4

The Two Linuses
by Lawrence D'Oliveiro 28 Feb '26

28 Feb '26

This 53-minute video <https://www.youtube.com/watch?v=mfv0V1SxbNA> was posted back in January, but I only discovered it more recently. In it, Linux creator Linus Torvalds pays a visit to the offices of Linus Sebastian (the brains behind the “Linus Tech Tips” YouTube channel), while the latter builds the former a new custom PC to the former’s requirements. With a 24-core, 48-thread CPU (great for kernel builds, which is what Torvalds spends much of his work day doing), and 64GiB worth of memory -- proper ECC memory (a long-time pet peeve of the Linux man). As the build progresses, they discuss many things, including questions previously collected from the community, addressed to Linus T. Asked which of his software “children” he is more fond of, Linux or Git, Torvalds reveals that he only spent 6 months working on Git, before passing it off to Junio Hamano, who has been the prime mover behind it for the past 20 years. (What, no mention of Subsurface?) He also brought in one of the guitar-effects pedals that he has been designing, purely as a hobby to unwind from his day job, with no expectation that they will ever be useful to anybody, not even himself (he doesn’t play guitar). Which distro does he use? It turns out his current fave is Fedora, because (unlike, say, Ubuntu) they make it easy for him to replace their kernel with his custom, fresh-built ones.

1 0

Firefox 148 Lets You Kill All AI Features in One Click
by Peter Reutemann 27 Feb '26

27 Feb '26

'Mozilla has released Firefox 148 for Windows, macOS and Linux, bringing a new AI Settings section that lets users disable all of the browser's AI-powered features in one click and then selectively re-enable the ones they actually want, such as the local translation tool that works locally rather than in the cloud. The update also patches more than 50 security vulnerabilities -- none known to be under active exploitation -- over half of which Mozilla classifies as high risk, including five sandbox escape flaws and eight use-after-free bugs in the JavaScript engine that could allow code execution.' -- source: https://news.slashdot.org/story/26/02/26/182239 Cheers, Peter

1 0

Austria Military Ditches Microsoft for Open-Source Libreoffice – Here’s Why
by Peter Reutemann 26 Feb '26

26 Feb '26

'Austria's military has completed a major IT overhaul, replacing Microsoft Office with the open-source LibreOffice suite across all its desktop systems. The change, finalized this month, affects approximately 16,000 workstations in the Austrian Armed Forces. This move will substantially reduce Austria's software bill. At $33.75 per user per month, a Microsoft 365 E3 subscription for 16,000 workstations costs approximately $6,480,000 per year, compared to LibreOffice's zero cost. But this move isn't about saving money. The real motivation is to gain digital sovereignty and control over critical data. As Michael Hillebrand of Directorate 6 information and communications technology (ICT) and Cyber Defense, explained: "It was very important for us to show that we are doing this primarily to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and to ensure that data is only processed in-house."' -- source: https://www.zdnet.com/article/this-european-military-just-ditched-microsoft… Cheers, Peter

2 2

Fear Of Forking, Revisited
by Lawrence D'Oliveiro 23 Feb '26

23 Feb '26

Was rereading this old essay <http://linuxmafia.com/faq/Licensing_and_Law/forking.html> that I found some years ago. It’s a commentary on the status of the Free Software movement (unfortunately referred to as “freeware” at one point) as of late 1999, at a point when various parties (*cough* proprietary software propagandists *cough*) were still trying to spread FUD about how “forks” of software projects could leave them fragmented and users without a coherent support framework. He recaps the unfortunate history of Unix, and the swallowing up of essentially its entire market by Microsoft: Those companies bought the right [from AT&T] to make their own Unixes: IBM released AIX. Apple did A/UX. DEC did Ultrix[8], OSF/1, and Digital Unix (later renamed "Compaq Unix" and now "Compaq Tru64 Unix"). Data General did DG/UX, SGI did IRIX, HP did HP/UX, and SCO did Xenix[9] which eventually mutated into SCO Open Server. And we could cite others, but I'll spare you. The point is that these were the jokers who ruined Unix. Every one of them marketed his mutant Unix as "Unix plus" — everything the other guys have and more. Needing to create differentiators, they deliberately made their Unixes incompatible while giving lip service to "standards". For customers, this was simply a mess, and Microsoft drove right through these guys' disunity like a Sherman tank. It is the classic instance of forking that sticks in people's minds. Which is why you folks are expected to assure customers that the same won't happen to GNU/Linux. We'll return to this point later. Among various other examples, the author tries to explain why this is not a serious possibility with the Linux kernel, and how even the BSD forks were not really forks, and would stay largely in sync. Well, he was mostly right on the first of those cases, but somewhat wrong on the second one. As to how the release of Open-Source BSD came about: One fine day in 1991, grad student Keith Bostic came to the BSD lead developers, inspired by Richard M. Stallman's (remember him?) [13] GNU Project, and suggested replacing BSD's remaining AT&T work to create a truly free BSD. Dreading the confrontation likely to result with AT&T, they tried to stall by assigning Bostic the difficult part of this task, rewriting some key BSD utilities. This backfired when he promptly did exactly that. So, they grumbled but then completed the job[14], and tried to prevent AT&T from noticing what they had done. AT&T did notice[15], panicked, and sued. That, too, is a long story best omitted. Under the stress of the lawsuit, freeware BSD split into three camps (FreeBSD, NetBSD, and OpenBSD).[16] But there were also several proprietary branches[17], made possible because U.C. Berkeley's "BSD Licence" allowed creation of those: Sun Microsystems's SunOS, Tenon Intersystems's MachTen, BSDI's BSD OS [18], and NeXT Computer's NeXTStep OS all came out for sale without public access to source, and were all based on the Berkeley BSD source code. For one thing, I thought *every* proprietary Unix was based on code licensed from AT&T; but this is saying that SunOS and NeXTStep, among a few others, came from BSD and owed nothing to AT&T. A word about the three free BSD variants: All three were splinters from a now-dead project called 386BSD. All have talked about re-merging in order to save duplication of effort, but they now persist as separate projects because they've specialised: FreeBSD aims for the highest possible stability[19] on Intel x86 (IA32) CPUs, NetBSD tries to run on as many different CPU types as possible, and OpenBSD aims to have the tightest security possible. In other words, the 386BSD project remains forked because there are compelling reasons that make this a win for everyone. Also, where possible, these three sister projects collaborate on tough tasks — and they also collaborate with GNU/Linux programmers. Some of the best hardware drivers in the Linux kernel are actually BSD drivers. There's a high level of compatibility among the three BSDs and between them and GNU/Linux: Unlike the proprietary Unix vendors, BSD and GNU/Linux programmers have an incentive to eliminate incompatibility and support standards. But as we know from more recent history, the BSDs don’t cooperate that much at all, at least not any more. As of today, they are well and truly fragmented. As for the AT&T lawsuit, it seems it had no legal basis at all: At the time, the lawsuit's allegation of infringement of AT&T source-code copyright cast a shadow over not just Berkeley's BSD and BSDI's BSD OS, but also William and Lynne Jolitz's free-software 386BSD project, which was a patchkit of about 180 patches based on Berkeley's "NET/2" BSD release. (In retrospect, there is grave doubt about whether AT&T's complaint ever had merit, on several grounds, but this was not clear at the time. Kirk McKusick told me that defendants ultimately agreed in the settlement that seven BSD files were encumbered by AT&T copyrights only to let AT&T save face on what would otherwise have been a dead loss, allowing that concession because the seven files were dreadful spaghetti code and overdue for replacement anyway.) Apparently in part because of the legal threat, the Jolitzes withdrew from the project, leaving copyright questions and a leadership vacuum on top of the project's other problems. Anyway, there are other examples of forks that were successful versus those that were not so successful. I don’t think the pattern the author claims to see holds up; I think it is far more an issue of management culture: if the original project leaders try to be too controlling and reject useful-looking ideas, then forks will happen. The new ideas in the forks may or may not succeed; but of course that success (or not) is key to the success of the fork.

1 0

Dutch Defence Secretary Threatens To “Jailbreak” Their F-35 Fighters
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

Gijs Tuinman, when asked if the EU can make changes to the fighter jet without US approval, replied <https://www.tomshardware.com/tech-industry/dutch-secretary-of-defense-threa…>: “I’m going to say something I should never say, but I’ll do it anyway,” the defense secretary said. “Just like your iPhone, you can jailbreak an F-35. I won’t say more about it.” The operating system apparently runs to 8 million lines of code, and of course it’s encrypted/obfuscated. But so are lots of games on consoles and PCs that use elaborate copy-protection and anti-cheat mechanisms. And there are quite a few people with experience wading their way through mazes like that. Of course the US officially denies that the hardware it sells to other countries has any kind of “kill switch” in it. So maybe the EU has a Plan B, maybe it doesn’t ...

1 0

Seasoned Windows Expert Gives Linux A Try
by Lawrence D'Oliveiro 19 Feb '26

19 Feb '26

The article title seems optimistic enough: “I replaced Windows with Linux, and there's only one feature I miss” <https://www.zdnet.com/article/how-to-replace-windows-with-linux/>. The article is by Ed Bott, “Senior Contributing Editor” at ZDNet, and he is definitely a long-standing Windows guy. After suggesting, in a previous article, that Windows users could consider switching to Linux as a way to keep old machines, that Microsoft won’t support on Windows 11, going, he finally decides to try it for himself. (With the help of ongoing advice from Google’s Gemini chatbot.) His choice of hardware to use in the experiment was ... interesting. One might almost say he picked on hardware which is known to be troublesome with Linux ... First he tried a couple of ARM-based Windows machines, and recorded failure for both. There was a suggestion that this could be made to work by extracting proprietary firmware blobs from the Windows install and incorporating them into the Linux kernel build (by “editing some device trees”, which sounds like building a kernel from source to me), but he decided not to bother. Next he tried a couple of Microsoft Surface models. Both were x86-based, but Surface machines do have some odd hardware not present in common-or-garden PCs. In this case he was helped out by a project on GitHub specifically to get Linux running on these devices. Finally he was able to get Zorin OS 18 Core working on one Surface, and Fedora 43 on the other. The latter had sleep problems, and he had no luck getting a webcam working (the “one feature” that he misses as mentioned in the title, being Windows Hello facial recognition). After all the setup headaches, the part that gave him the least trouble was accessing the apps he is used to -- he didn’t even have to resort to WINE for any of these. His conclusion: All in all, this was not a friction-free experience. I do not recommend it for novices or for anyone who wants a PC that is easy to operate and troubleshoot. But if you're a reasonably knowledgeable PC hobbyist and you're willing to accept a learning curve that includes time in a terminal session, Linux is a perfectly acceptable alternative. I do not recommend that you tell your tech-challenged relatives to try the upgrade on their own. They'd be better off with a Mac, honestly. I’m not sure that people would be better off with a Mac any more. The current sky-high prices of RAM mean that some might decide to buy a lower-spec machine initially, in the hope of upgrading it later; you can’t do this with Apple products any more. Also, I think the installed base of desktop Linux is already larger than that of Mac users anyway.

1 0

KDE Says Plasma Desktop Will Never Force Users to Use systemd
by Peter Reutemann 17 Feb '26

17 Feb '26

'The KDE project has addressed some recent concerns from users that they are forcing the systemd init system on current or future versions of its Plasma desktop environment. This comes after the developers of the KaOS Linux independent distro announced that they decided to replace the KDE Plasma desktop environment with a Niri/Noctalia setup to move away from systemd, saying that “Plasma pretty much demands systemd, and will be fully mandatory soon.“ Well, when asked if Plasma or any of its components demands systemd or if it is forced on users, the KDE project said no, except for the new Plasma Login Manager display manager that will be introduced with the upcoming KDE Plasma 6.6 release tomorrow. “So you are forcing Plasma users to use systemd?” No, the Plasma Login Manager is one of probably half a dozen login managers (or more) that can boot Plasma,” said the KDE devs. “We made PLM because it will give distro creators a cool piece of kit that can (not “must”, not “should”: can) be tacked onto a system to boot into Plasma.” The KDE project also said that they are not planning on making any of Plasma’s core components dependent on systemd, and that it will also continue to work on non-Linux systems like FreeBSD, as there were many recent reports on various news outlets that “KDE will drop support for non-systemd systems.” So there you have it, only the Plasma Login Manager will be dependent on systemd, but future Plasma desktop releases aren’t dependent on Plasma Login Manager, nor systemd. Therefore, Linux distros that want to ship the latest Plasma releases will have to use a different login manager, such as SDDM.' -- source: https://9to5linux.com/kde-says-plasma-desktop-will-never-force-users-to-use… Cheers, Peter

1 0

Origins Of PipeWire
by Lawrence D'Oliveiro 16 Feb '26

16 Feb '26

Just been watching this video of a talk at FOSDEM 2020 <https://www.youtube.com/watch?v=m5Y8VLv0CQ8>, entitled “PipeWire in the Automotive Industry”. I had never heard of PipeWire back then, so it was interesting to discover that it was originally called “PulseVideo”, because it was supposed to be like PulseAudio, but only for video streams. But then it gradually took over the functions of PulseAudio, by offering a more efficient architecture for dealing with both audio and video streams. And also supporting security isolation between applications, which is something PulseAudio never had. PipeWire also subsumes the functionality of JACK as well (the architecture for audio and MIDI routing that is used in music/audio production workflows), and its interconnection functions naturally support the patchbay model of JACK. The presenter of the talk, George Kiagiadakis, is the creator of WirePlumber, which does PipeWire session management. He created it as part of his job contributing to the “Automotive Grade Linux” project, specifically working on the part dealing with automotive audio: this includes not just car entertainment systems, but also navigation interactions, voice activation functions and emergency notifications -- who knew the audio system in a modern car could be so complex?

1 0