- wlug - list.wlug.org.nz

Just 10 lines of code can steal AI secrets from Apple, AMD, and Qualcomm GPUs
by Peter Reutemann 18 Jan '24

18 Jan '24

'As more companies ramp up development of artificial intelligence systems, they are increasingly turning to graphics processing unit (GPU) chips for the computing power they need to run large language models (LLMs) and to crunch data quickly at massive scale. Between video game processing and AI, demand for GPUs has never been higher, and chipmakers are rushing to bolster supply. In new findings released today, though, researchers are highlighting a vulnerability in multiple brands and models of mainstream GPUs—including Apple, Qualcomm, and AMD chips—that could allow an attacker to steal large quantities of data from a GPU’s memory. The silicon industry has spent years refining the security of central processing units, or CPUs, so they don’t leak data in memory even when they are built to optimize for speed. However, since GPUs were designed for raw graphics processing power, they haven’t been architected to the same degree with data privacy as a priority. As generative AI and other machine learning applications expand the uses of these chips, though, researchers from New York-based security firm Trail of Bits say that vulnerabilities in GPUs are an increasingly urgent concern. “There is a broader security concern about these GPUs not being as secure as they should be and leaking a significant amount of data,” Heidy Khlaaf, Trail of Bits’ engineering director for AI and machine learning assurance, tells WIRED. “We’re looking at anywhere from 5 megabytes to 180 megabytes. In the CPU world, even a bit is too much to reveal.” To exploit the vulnerability, which the researchers call LeftoverLocals, attackers would need to already have established some amount of operating system access on a target’s device. Modern computers and servers are specifically designed to silo data so multiple users can share the same processing resources without being able to access each others’ data. But a LeftoverLocals attack breaks down these walls. Exploiting the vulnerability would allow a hacker to exfiltrate data they shouldn’t be able to access from the local memory of vulnerable GPUs, exposing whatever data happens to be there for the taking, which could include queries and responses generated by LLMs as well as the weights driving the response.' -- source: https://arstechnica.com/security/2024/01/new-attack-steals-ai-secrets-from-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating PDF Files From man Pages
by Lawrence D'Oliveiro 17 Jan '24

17 Jan '24

I’ve been writing documentation for some of my published scripts in the form of man pages. The troff/groff markup is not hard to get to grips with--the man pages for the relevant tools have a lot of useful info. And it’s easy to view the results without any special installation step, since the man(1) command includes the “-l” option to treat its argument as a file name. But if the topic name has any slashes in it, such treatment is automatic without even needing this option. Thus, in my project source directory, I can type something as simple as man ./render-batch.1 to view the man page I wrote for the “render-batch” command. Conversion to PDF is easy, too, using the underlying groff command that man itself uses to format the page, just specifying a different output “device” (i.e. format), e.g. groff -man -Tpdf «troff-file» >«output-file» Or, if I don’t want to save the output PDF file, but just pipe it straight to a viewer like Okular, this works: groff -man -Tpdf «troff-file» | okular - This is particularly useful, for example, for debugging the difference between dashes and hyphens. You are supposed to use “\-” for the hyphen-minus character (as used to prefix command-line options, for example), while hyphens in regular text should be written as “-”. The two look the same in a normal man-page view, but they get rendered differently in PDF files. However, I found that groff does not correctly render various Unicode UTF-8 characters when generating PDF output. For example, I like to use curly quotes “”. These look OK in regular man output, but get turned into junk in PDF output. After some searching online, it appears this is a known limitation of groff, because it uses various 8-bit byte codes internally for its own purposes, precluding their use as part of UTF-8 encoding. But there is a tool called “preconv” that can convert various encodings into a more groff-friendly text representation. For example preconv -e utf-8 «troff-file» | groff -man -Tpdf | okular - Since my locale is set to a UTF-8 one by default, I don’t even need the “-e” option: preconv «troff-file» | groff -man -Tpdf | okular - Or, if you want to save the output: preconv «troff-file» | groff -man -Tpdf >«output-file» Going back to the example filename I used before, these translate to something like preconv render-batch.1 | groff -man -Tpdf | okular - preconv render-batch.1 | groff -man -Tpdf >render-batch.pdf Another variation is to use preconv «troff-file» | groff -man -Tpdf | { okular - & } This spawns the Okular part of the pipeline in the background, so it comes back to the shell prompt immediately that starts running. This is convenient with a GUI tool like Okular, because I can run other commands while continuing to view the output PDF file. So how is it that groff is capable of handling these characters just fine when invoked via man? That I haven’t figured out yet ...

1 2

Chrome Updates Incognito Warning To Admit Google Tracks Users In 'Private' Mode
by Peter Reutemann 17 Jan '24

17 Jan '24

'Ars Technica: Google is updating the warning on Chrome's Incognito mode to make it clear that Google and websites run by other companies can still collect your data in the web browser's semi-private mode. The change is being made as Google prepares to settle a class-action lawsuit that accuses the firm of privacy violations related to Chrome's Incognito mode. The expanded warning was recently added to Chrome Canary, a nightly build for developers. The warning appears to directly address one of the lawsuit's complaints, that the Incognito mode's warning doesn't make it clear that Google collects data from users of the private mode. Many tech-savvy people already know that while private modes in web browsers prevent some data from being stored on your device, they don't prevent tracking by websites or Internet service providers. But many other people may not understand exactly what Incognito mode does, so the more specific warning could help educate users. The new warning seen in Chrome Canary when you open an incognito window says: "You've gone Incognito. Others who use this device won't see your activity, so you can browse more privately. This won't change how data is collected by websites you visit and the services they use, including Google." The wording could be interpreted to refer to Google websites and third-party websites, including third-party websites that rely on Google ad services. The new warning was not yet in the developer, beta, and stable branches of Chrome as of today. It also wasn't in Chromium. The change to Canary was previously reported by MSPowerUser. Incognito mode in the stable version of Chrome still says: "You've gone Incognito. Now you can browse privately, and other people who use this device won't see your activity." Among other changes, the Canary warning replaces "browse privately" with "browse more privately." The stable and Canary warnings both say that your browsing activity might still be visible to "websites you visit," "your employer or school," or "your Internet service provider." But only the Canary warning currently includes the caveat that Incognito mode "won't change how data is collected by websites you visit and the services they use, including Google." The old and new warnings both say that Incognito mode prevents Chrome from saving your browsing history, cookies and site data, and information entered in forms, but that "downloads, bookmarks and reading list items will be saved." Both warnings link to this page, which provides more detail on Incognito mode.' -- source: https://yro.slashdot.org/story/24/01/16/2110250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 9.0 Released
by Peter Reutemann 17 Jan '24

17 Jan '24

'Version 9.0 of Wine, the free and open-source compatibility layer that lets you run Windows apps on Unix-like operating systems, has been released. "Highlights of Wine 9.0 include an experimental Wayland graphics driver with features like basic window management, support for multiple monitors, high-DPI scaling, relative motion events, as well as Vulkan support," reports 9to5Linux. From the report: The Vulkan driver has been updated to support Vulkan 1.3.272 and later, the PostScript driver has been reimplemented to work from Windows-format spool files and avoid any direct calls from the Unix side, and there's now a dark theme option on WinRT theming that can be enabled in WineCfg. Wine 9.0 also adds support for many more instructions to Direct3D 10 effects, implements the Windows Media Video (WMV) decoder DirectX Media Object (DMO), implements the DirectShow Audio Capture and DirectShow MPEG-1 Video Decoder filters, and adds support for video and system streams, as well as audio streams to the DirectShow MPEG-1 Stream Splitter filter. Desktop integration has been improved in this release to allow users to close the desktop window in full-screen desktop mode by using the "Exit desktop" entry in the Start menu, as well as support for export URL/URI protocol associations as URL handlers to the Linux desktop. Audio support has been enhanced in Wine 9.0 with the implementation of several DirectMusic modules, DLS1 and DLS2 sound font loading, support for the SF2 format for compatibility with Linux standard MIDI sound fonts, Doppler shift support in DirectSound, Indeo IV50 Video for Windows decoder, and MIDI playback in dmsynth. Among other noteworthy changes, Wine 9.0 brings loader support for ARM64X and ARM64EC modules, along with the ability to run existing Windows binaries on ARM64 systems and initial support for building Wine for the ARM64EC architecture. There's also a new 32-bit x86 emulation interface, a new WoW64 mode that supports running of 32-bit apps on recent macOS versions that don't support 32-bit Unix processes, support for DirectInput action maps to improve compatibility with many old video games that map controller inputs to in-game actions, as well as Windows 10 as the default Windows version for new prefixes. Last but not least, the kernel has been updated to support address space layout randomization (ASLR) for modern PE binaries, better memory allocation performance through the Low Fragmentation Heap (LFH) implementation, and support memory placeholders in the virtual memory allocator to allow apps to reserve virtual space. Wine 9.0 also adds support for smart cards, adds support for Diffie-Hellman keys in BCrypt, implements the Negotiate security package, adds support for network interface change notifications, and fixes many bugs. For a full list of changes, check out the release notes. You can download Wine 9.0 from WineHQ.' -- source: https://tech.slashdot.org/story/24/01/16/2253237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is No Longer Bringing the Full Chrome Browser To Fuchsia
by Peter Reutemann 16 Jan '24

16 Jan '24

'Google has formally discontinued its efforts to bring the full Chrome browser experience to its Fuchsia operating system. 9to5Google reports: In 2021, we reported that the Chromium team had begun an effort to get the full Chrome/Chromium browser running on Google's in-house Fuchsia operating system. Months later, in early 2022, we were even able to record a video of the progress, demonstrating that Chromium (the open-source-only variant of Chrome) could work relatively well on a Fuchsia-powered device. This was far from the first time that the Chromium project had been involved with Fuchsia. Google's full lineup of Nest Hub smart displays is currently powered by Fuchsia under the hood, and those displays have limited web browsing capabilities through an embedded version of the browser. In contrast to that minimal experience, Google was seemingly working to bring the full might of Chrome to Fuchsia. To observers, this was yet another signal that Google intended for Fuchsia to grow beyond the smart home and serve as a full desktop operating system. After all, what good is a laptop or desktop without a web browser? Fans of the Fuchsia project have anticipated its eventual expansion to desktop since Fuchsia was first shown to run on Google's Pixelbook hardware. However, in the intervening time -- a period that also saw significant layoffs in the Fuchsia division -- it seems that Google has since shifted Fuchsia in a different direction. The clearest evidence of that move comes from a Chromium code change (and related bug tracker post) published last month declaring that the "Chrome browser on fuchsia won't be maintained."' -- source: https://tech.slashdot.org/story/24/01/15/2350230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 21.3: Its First Official Release with Wayland Support
by Peter Reutemann 15 Jan '24

15 Jan '24

'Linux Mint 21.3 is now available to download, reports the blog OMG Obuntu. It's the first version to offer Wayland support in its Cinnamon desktop: Following a successful bout of bug-busting in last month's beta release, Mint devs have gone ahead and rubber-stamped a stable release. Thus, you can reasonably expect to not encounter any major issues when installing or using it... [I]t's based on Ubuntu 22.04 LTS and continues to use the Linux 5.15 kernel by default, but newer kernels are available to install within the OS... In my own testing I find Cinnamon's Wayland support to be well-rounded. It's not perfect but I didn't hit any major snafus that prevented me from working (though admittedly I did only attempt 'basic' tasks like web browsing, playing music, and adding applets). However, Cinnamon's Wayland support is in an early state, is not enabled by default, and Linux Mint devs expect it won't be good enough for everyone until the 23.x series (due 2026) at the earliest. Still, try it out yourself and see if it works for you. Select the 'Cinnamon on Wayland (Experimental)' session from the login screen session selector, and then login as normal... Additionally, the latest version of Mozilla Firefox is pre-installed (as a deb, not a Snap) Among the new features are a whole new category of desktop add-ons — "Actions" — which upgrade the right-clicking context menu. (So for .iso files there's two new choices: "Verify" or "Make bootable USB stick".) The article says there's also "a raft of smaller refinements," plus "a bevvy of buffs and embellishments" for Linux Mint's homegrown apps. Any Linux Mint users reading Slashdot? Share your thoughts or experiences in the comments...' -- source: https://linux.slashdot.org/story/24/01/14/1830255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub: With Great Power Comes Great Responsibility ... For Both Good And Evil
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Seems GitHub has become a popular place to host malware in a form that is difficult to shut down <https://www.theregister.com/2024/01/12/github_malware_popularity/>. One thing I was surprised to learn from that article is that, as far as China is concerned, GitHub has apparently grown too big to block <https://www.npr.org/2019/04/10/709490855/github-has-become-a-haven-for-chin…>. Which means it becomes a sort-of-safe haven for activity which might be seen as politically subversive (such as demanding your rights to limited working hours as supposedly guaranteed under the law). Of course, that report was from nearly five years ago, and things could have changed since then. But the 996.icu repo referenced in there still exists, and still shows signs of activity as of a few months ago.

1 0

“I’m Sorry Dave, I’m Afraid I Can’t Do That” -- Or Not
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

There has been a flood of products with very odd descriptions on Amazon lately <https://arstechnica.com/ai/2024/01/lazy-use-of-ai-leads-to-amazon-products-…>. For example, “I’m sorry but I cannot fulfill this request it goes against OpenAI use policy—Black”. Also available in other colours, and similar in sizes like 10mm×3m. And unique features like “Regrettably, the information you’re searching for is not available — we strive to maintain the highest standards of integrity and will not compromise the authenticity and accuracy of our product descriptions”. And who wouldn’t want to buy after hearing “Our [product] can be used for a variety of tasks, such [task 1], [task 2], and [task 3]]”? Are you thinking “I gotta get me some of that”?

1 0

X11 Conservancy Project
by Lawrence D'Oliveiro 13 Jan '24

13 Jan '24

Here’s a website <https://x11cp.org/> dedicated to trying to keep alive GUI programs dating from the early days of X11. I think they’re also trying to ensure that the code can still be built and run. This is the second time I’ve come across Codeberg, which offers an open-source-based hosting facility for Git repositories.

1 0

Why More PC Gaming Handhelds Should Ditch Windows For SteamOS
by Lawrence D'Oliveiro 12 Jan '24

12 Jan '24

The success of the Steam Deck is encouraging at least one third-party vendor to bring out its own gaming handheld that will be running the Linux-based SteamOS instead of Microsoft Windows <https://arstechnica.com/gaming/2024/01/why-more-pc-gaming-handhelds-should-…>. While compatibility with the overwhelming majority of Windows-only games still leaves something to be desired, the usability of the platform is already a definite selling point: While Proton does come with at least some performance overhead, a variety of Steam Deck benchmarks show games running under SteamOS tend to perform comparably (or sometimes better) than those running under Windows on the handheld. That's also a huge change from the Steam Machines era, when Ars' testing showed that many SteamOS games ran significantly worse than their Windows counterparts on the same desktop hardware. The Windows platform is just plain unsuited to a handheld gaming device: Our review of the ROG Ally highlights just how annoying it can be to have to fiddle with Windows settings on a touchscreen running "an awkwardly scaled" version of the OS. Though Microsoft has not been sitting still: And while Microsoft has experimented with a handheld-friendly version of Windows meant for portable gaming devices, nothing public has yet come of the effort. But unless it launches a much more concerted effort than it has managed to date, there’s a chance Windows may lose its undisputed dominance in the last major market where it has one: PC gaming.

1 0