June 2026 - wlug - list.wlug.org.nz

New Attack On AI Bots: Prompt Injection
by Lawrence D'Oliveiro 01 Jul '26

01 Jul '26

A Twitter bot account run by a company that posts remote job listings was programmed to respond to tweets directed to it with general inoffensive comments touting the positive aspects of remote work. However <https://arstechnica.com/information-technology/2022/09/twitter-pranksters-d…>, some other Twitter users discovered that if they began their tweet with directives to “ignore previous instructions”, they could get the bot to say just about anything. And much hilarity ensued. Basically, the way the bot program works is it begins with some standard instructions on what to say, provided by the people who set up the account, to which is appended whatever tweet content was sent to the bot by the other user. This is then processed by the AI system to produce a response. This attack has been dubbed “prompt injection”, by analogy with “SQL injection” and other similar attacks on non-AI systems. But whereas those attacks can be blocked using basic, well-known syntactic quoting techniques, there seem to be no easy equivalents for stopping an AI paying attention to instructions it should not be obeying.

1 2

The Last Week Was UN Open-Source Week
by Lawrence D'Oliveiro 27 Jun '26

27 Jun '26

Only found out about “UN Open-Source Week” today <https://www.zdnet.com/article/digital-sovereignty-un-global-push-to-replace…>. So it’s not just Europe pushing for “Digital Sovereignty” -- lots of other parts of the world see the risks of being too dependent on one particular country for vital IT infrastructure. Tanzania’s Minister for Legal and Constitutional Affairs ... framed Tanzania's shift to open source as a move "from passive consumers of technology to… active creators of technology," and argued that "this is what digital sovereignty means in practice – not isolation, but ownership; not dependence, but partnership on our terms." [She] backed the rhetoric with numbers: more than 90% of Tanzania's government systems now run on open-source technologies, under a legal framework that includes the 2020 e‑Government Authority Act, a Personal Data Protection Act (2023), cybercrime law, and sectoral regulations, all built around shared national infrastructure and open interfaces. The country has also reallocated money from proprietary licenses to people. According to Kairuki, Tanzania has trained around 500 public officials as "a collaborative community of digital developers – citizens building for citizens" who run and evolve the systems they create. The CTO of Cloudera ... spelled out what AI sovereignty and "private AI" should mean for institutions: being able to answer seven practical questions, from "Where does your data really reside?" and "Who can access it, and under what conditions?" to "Can we replace the models instantly and the systems continue working?" and "Can we continue operating if a provider changes its commercial or political position?" Clearly, the answer, as Trump's administration's recent stoppage of Claude Fable 5 and Mythos 5 in their deployment tracks, showed is "No." If your AI workflow can be shut down by a government's whim, you really can't rely on it. Ireland’s Government CIO ... argued that sovereignty is "about choice and resilience," not "owning every technology," ... Also: On the policy side, European voices such as OpenForum Europe's Dr. Sachiko Muto stressed that digital sovereignty "is not being defined as a zero-sum game," but about "bringing user control into the discussion" and reducing single‑country or single‑vendor dependence for critical infrastructure. Germany’s Sovereign Tech Agency Director ... said governments can't rely on open-source volunteers as "involuntary suppliers" of critical components and must treat foundational open source like roads and bridges – infrastructure that the public sector has a duty to maintain, not just consume. And more: Throughout the week, speakers stressed that "digital sovereignty" should not be equated with national isolation. [Tanzania’s] Kairuki captured the consensus in a line many speakers later echoed: this is "about ownership in partnership, but not independence," ... Of course the Americans are not keen on all this. They seem to take their own continuing leadership for granted, even as the warning signs grow all around.

1 0

How France’s education ministry built an open-source file-share platform for 400K users
by Lawrence D'Oliveiro 26 Jun '26

26 Jun '26

There has been a certain amount of scaremongering among those watching Europe’s burgeoning “Digital Sovereignty” movement. Yes, there will be pitfalls and mistakes made along the way. The move is being made with great reluctance, with grudging acceptance of the fact that the USA is no longer an entirely reliable partner either politically or economically. Here <https://www.computerworld.com/article/4187951/how-frances-education-ministr…> is one remarkable success story: an open-source file-sharing platform that is currently serving around 400,000 users, offering them up to 100GB of storage per user. And look at the budget: a limit of €10 per user per year. And just three staff members handling it all. In terms of comparison to USA-based proprietary offerings, Benoît Piédallu, national project manager for digital services at the French Ministry of National Education, said “They are very happy to use it. They don’t make a comparison to Google Drive or OneDrive…, it’s just working.” However, The Collabora-based office application suite has been less well-received, in part because its interface is unfamiliar to many users. “When they want to edit documents, work on a [spreadsheet] or something like that, they want it to be exactly like they are used to — if they have Microsoft Office, they want [it] to work the same, to have the same options,” he said. I guess this is where Euro-Office comes in ...

1 0

Cory Doctorow Has A New Book Out
by Lawrence D'Oliveiro 25 Jun '26

25 Jun '26

Following on from his polemic on “enshittification” last year, Cory Doctorow now takes on AI -- the ways in which it can be good, and also the all too many ways in which it can be bad <https://arstechnica.com/gadgets/2026/06/how-to-burst-the-ai-bubble-strike-a…>. Some of his quotes, as usual, are just too delicious: There’s an enormous amount of liquidity in growth stocks, which means that you can use growth stocks to grow. You can buy other companies with shares, and shares are an endogenous substance that you make on the premises by typing zeros into a spreadsheet. Firms with growth stocks can grow by typing zeros, whereas firms that are mature, they have to use money if they want to grow, and you’re not allowed to make money on the premises. If you do, the Treasury Department shows up and takes you away in handcuffs. So you can see why firms would be very anxious to maintain the perception that they have room for growth even after they have 90 percent market shares. That’s why those firms started promoting stories about how they were going to conquer imaginary markets. Imaginary markets have no agreed-upon valuation because you just made them up. Unless you can turn an imaginary market into a real market pretty quickly, you need to come up with another imaginary market and announce that this is the new imaginary market you’re going to conquer. It’s easier than you’d think because the capital markets have the object permanence of a toddler, and they would lose a game of peekaboo if they were drafted to play in the league. So you can say, “Oh, actually, it’s not metaverse. It’s crypto. It’s not crypto. It’s Web3. It’s not Web3. It’s something else.” And the markets will forgive you, provided you do it quickly enough. AI, it seems, is building on a lot of these same old history-repeats-itself trends, just carrying them to the next level. There could be some good to it, but all too often big companies are using it as a way to boost their profits while getting rid of human staff.

1 0

large-scale malware distribution campaign on GitHub
by Peter Reutemann 22 Jun '26

22 Jun '26

Hi everyone I came across the following blog post: "This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find such repositories. I have a project on GitHub, and I wanted to check whether search engines had indexed it. I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results, with the exact same name and description. It was a copy of my repository with all the commits, and I was listed as a contributor. But an hour ago, another commit was pushed with a change to the readme. A link to a zip archive has been added to it. I was choosing appropriate tags for another one of my projects on GitHub. I clicked through those tags to look at similar projects. In the list, I found a repository whose name and description matched exactly those of another repository on that list. It turned out that it also contained copies of all the commits from that repository, and two hours ago, a link to a zip archive has been added to the readme. After monitoring these two repositories, I discovered that every few hours they delete the previous commit and push the exact same commit again. This commit contains only one change: adding a link to the archive in the readme file." -- blog: https://orchidfiles.com/github-repositories-distributing-malware/ -- source: https://mastodon.social/@nixCraft/116773118183897006 Cheers, Peter

1 0

Nextcloud CEO: Open source moves from ‘a nerdy audience’ to the geopolitical stage
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

Germany-based Nextcloud is one of the prime movers behind the recent Euro-Office open-source package. Here <https://www.computerworld.com/article/4184628/nextcloud-ceo-open-source-mov…> is an interview with its CEO where he gives his views on the current European “Digital Sovereignty” movement and related matters, like the increasing importance of Open Source. US-based companies (Microsoft etc) have really tried to tie themselves in knots to be more appealing to European customers seeking Digital Sovereignty, but ultimately the attitude of US lawmakers renders this futile: **US firms have attempted to address European customers’ concerns in different ways, with sovereign marketed cloud services and joint ventures with European providers. Microsoft 365 Local is designed to run on premise. Where do you draw the line between what’s actually a sovereign solution and what some call ‘sovereignty washing?** “Sovereignty has different dimensions, of course. But if you look at the problem of the CLOUD Act alone, which gives foreign agencies full access to the data here, then the whole idea that it’s enough to have European data centers — that’s not enough. It’s clearly written in the CLOUD Act, that even with [European] data centers, or subsidiaries, it still applies. “Microsoft tries to find a solution there with its Delos idea; a company that is owned by SAP — a German company — and Microsoft delivers only the software. But even then, you have this dependency, because software needs updates and software security updates. And if they’re not available, or if someone puts a backdoor into the software, which is possible, then you still have a problem. “So, they’re trying really, really hard to find a way around the problem, but it’s not easy for them.” I like that term, “sovereignty washing”. It gives you something to watch out for, the next time a US-based cloud company comes a-calling ...

1 0

Re: Microsoft Previews Linux-Powered Windows AI Studio
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

On Mon, 18 Dec 2023 10:17:34 +1300, I wrote: > When I first heard about WSL2, I predicted that Microsoft would, not > from any conscious plan but simply from following the path of least > resistance (and cost), start to rely on the Linux kernel more and > more for important Windows functionality. I think this represents a > step along that path. Here <https://www.zdnet.com/article/windows-subsystem-for-linux-3-for-developers-…> is another major step along that path: the new version of WSL, i.e. WSL3, is getting even more of the bloat of Windows out from between the Linux kernel and the underlying hardware: Microsoft promised that WSL 3 will bring you "GPU and NPU without the performance tax." Under WSL 2, Microsoft added GPU support and improved graphics integration, but those features still operated through the VM. The resulting context-switching and translation overhead meant you had to deal with slowdowns when you needed GPUs and NPUs. That approach was OK for many developer workflows, but it seriously limited your performance when working with AI workloads, even if your PC came with dedicated NPUs. WSL 3 improves performance by implementing a new paravirtualized VM approach. Paravirtualization provides both a VM and access to the native hardware. According to Microsoft, "This means Linux containers will now run directly on Windows, with no additional configuration required." SJVN appreciates the irony of these attempts by Microsoft to get WSL closer to the performance of native Linux: Mind you, if you really want the best AI developer experience, you really should be running a Linux distro without Windows. However, if you're stuck with Windows, and many programmers are, thanks to out-of-date technology policies, WSL 3 will be a good alternative.

1 0

The RISKS Man Has Passed Away
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

I just heard on Usenet that the RISKS Digest moderator for over 40 years, Peter Neumann, died earlier this year. This Digest (mirrored on Usenet in the comp.risks group) was a regular compilation of stories about safety failures in the use of computers, in things like aircraft control systems, security systems ... a wide range. I remember reading about things like an Airbus flight test that killed the entire crew because the automatic system was left in a mode where it was trying to descend while the crew were trying to take off. Oh, and the first Ariane 5 test launch, which blew up (along with its uninsured -- and uninsurable --- cargo) because they tried to cut costs with the rocket control software by reusing the code from Ariane 4. The maintainer of the website <https://catless.ncl.ac.uk/risks/> has no idea whether the Digest can continue or not. Will someone else step in with the capacity to do so? Who can say ...

1 0

After Six Years Of Work and Over 360 Patches, Linux 7.2 Finally Removes Bug-Prone strncpy
by Peter Reutemann 22 Jun '26

22 Jun '26

'Linux 7.2's merge window closed out a cleanup campaign on Friday that most kernel developers had stopped expecting to see end: the complete removal of strncpy(), a C string-copy function that the kernel's own documentation labels "actively dangerous," from every subsystem, driver, and architecture-specific file in the kernel source tree. The merge landed June 20, 2026. After around 362 commits spread across six years of incremental work, no call site using the function remained, and the function itself — including the last per-CPU-architecture optimized implementations — was struck from the source. The removal matters beyond housekeeping. strncpy() is a persistent source of a specific class of memory error: kernel buffers that contain sensitive data can leak bytes past an unterminated string boundary, a pattern that enables memory disclosure vulnerabilities. Eliminating the function from the tree removes that entire class from the kernel's attack surface — and, critically, makes strncpy() unavailable to any future contributor, turning a best-practice suggestion into an enforced policy.' -- source: https://m.slashdot.org/story/455726 Cheers, Peter

1 0

So you want to buy a handheld gaming PC
by Lawrence D'Oliveiro 22 Jun '26

22 Jun '26

Quite a comprehensive overview <https://www.theverge.com/games/949010/best-handheld-gaming-pc> of the range of products available for handheld PC gaming. That is, devices for playing Windows games, not console games. After giving a TL;DR summary, and before going over the full list, the author says But before I go down the list, let’s talk Windows and Linux. While I’ve dinged many of the handhelds I’ve reviewed for The Verge for Windows woes, that’s not as big a deal today — because you can install Bazzite or even SteamOS on many of them for a better pick-up-and-play experience. The same exact handheld is often more stable and performant with Linux, and you often get instant sleep and resume that’s hit or miss on the operating system it shipped with. It’s still true that many competitive online multiplayer games don’t work on Linux because of anti-cheat fears, though others do. It’s also true that Windows has gotten better at sleep and resume with certain handhelds like the Xbox Ally X. But it’s a misconception that Linux can’t play as many games as Windows. The reality is that Linux can play *more* — decades of Windows games work better on Linux thanks to Proton patches and community profiles that translate old mouse and keyboard controls to your gamepad. Did you see what he said there? Windows is less of a problem than it used to be, because you can get rid of it! And it becomes more clear as you look down the list, that a big factor in the product ratings is being able to dump the preinstalled Windows OS to put on Bazzite or SteamOS.

1 0