KDE Global Themes Are Inherently Unsafe

When you think of a theme you probably think of images, config files and mayve some CSS but when we're talking about a KDE Global theme that's not really accurate. A Global Theme is just an addon and can run arbitary code.
==========Support The Channel==========
► Patreon: brodierobertso...
► Paypal: brodierobertso...
► Liberapay: brodierobertso...
► Amazon USA: brodierobertso...
==========Resources==========
Reddit Post: / hacked_installed_a_glo...
Related Repo: github.com/paj...
Steam Issue: github.com/Val...
Steam Article: www.theregiste...
KDE Blog: blog.davidedmu...
=========Video Platforms==========
🎥 Odysee: brodierobertso...
🎥 Podcast: techovertea.xy...
🎮 Gaming: brodierobertso...
==========Social Media==========
🎤 Discord: brodierobertso...
🐦 Twitter: brodierobertso...
🌐 Mastodon: brodierobertso...
🖥️ GitHub: brodierobertso...
==========Credits==========
🎨 Channel Art:
Profile Picture:
/ supercozman_draws
#KDE #Linux #OpenSource #FOSS
🎵 Ending music
Track: Debris & Jonth - Game Time [NCS Release]
Music provided by NoCopyrightSounds.
Watch: • Debris & Jonth - Game ...
Free Download / Stream: ncs.io/GameTime
DISCLOSURE: Wherever possible I use referral links, which means if you click one of the links in this video or description and make a purchase I may receive a small commission or other compensation.

[@niccoloveslinux]

It's not a reasonable assumption to make that themes on the KDE store are official or tested when we explicitly say they aren't whenever you open the store...

[@BrodieRobertson]

I completely disagree, the store is hosted on an official KDE domain, it's reasonable to assume that the KDE project thinks that all of these are ok for the user to install. Yes it says the content is made by the community but a reasonable person would assume if it's on an official KDE website it won't nuke their system.

[@Sherwinnicus]

@@BrodieRobertson I would back this up by saying, installing themes and customisation in this way is how it occurs on MS Windows and the Microsoft Store. When KDE is the DE that new linux users coming from Windows are likely to feel most at home in, they are also likely to expect this behaviour to be the same or similar. If KDE doesn't fix this, it will be a reason that some linux noobies quit and go back to windows.

[@excidium_]

Nobody is reading that when they are installing the themes directly from the system settings application

[@BrodieRobertson]

​@@Sherwinnicus both my first video and the LTT videos a few years ago should already a clear indication that sometimes new users will miss things that a long term user thinks is obvious

[@phrtao]

Maybe it is time that the KDE store limited the scope of global themes to purely cosmetic settings. As Brodie said, people expect a theme to be just that - cosmetic. Whereas with scripts and widgets people will have an expectation to be careful and think twice. In the store description for a theme the developer can always suggest other modifications to complete the experience (some do this anyway). Architecturally it is a real faux pas to conflate functionality and cosmetics and the topics discussed in this video only emphasise that principle.

[@envynoir]

oopsie deleted your home folder 😋

[@Redmage913]

ZFS/BTRFS snapshots to the rescue :)

[@kreuner11]

​@@Redmage913or regular backups

[@yusefaslam9675]

or clonezilla, make backups regularly!

[@Berkshire-Hathaway]

Yummy

[@GSBarlev]

​@@Redmage913I'm trying to remember the permissions set by Timeshift-I *hope* it's not u+w but I'm not positive.

[@moomew64]

If anything, Canonical's flubs and now this are showing how shockingly lax most Linux software distributors are on user security. The assumption is that "just audit the code lol" but come on, no one's doing that. It's been an honor system for forever, but as the marketshare grows, it painfully shows Linux's weak points due to things like this just never being considered. If we ever get attacked at the same scale Windows does, we're super screwed with our current systems lol.

[@Batwam0]

Exactly. The increased market share is starting to attract bad actors. Time to switch to TempleOS!

[@anon_y_mousse]

@@Batwam0 HolyC for the win!

[@SR-ti6jj]

The home folder is bloat

[@knghtbrd]

Shit, don't say that where Gnome devs can hear it, even in a story about a KDE/Qt stupid idea like executable themes.

[@USB3.2]

the /usr/bin folder is bloat

[@AshnSilvercorp]

every time I saw KDE's plug-in store, I was CERTAIN, since it is a user-submitted page, that downloading anything there is a security risk. I could tell instantly that it was not an official repo.

[@Lampe2020]

Especially considering it says "By: XYZ" on every tile in the theme store, so only the ones where it says something like "By: Plasma Team" are by KDE themselves.

[@YannickBo]

Yes, but if it says theme I assume it's just a theme, a few images and that's it. For the applets I assumed that they were sandboxed and unless there's an exploit it should be safe to download. So with those assumptions I don't think it's unexpected that I just download and try whatever looks interesting. Knowing that themes can include shell scripts changes that, not that they're user submitted.

[@AshnSilvercorp]

@@YannickBo true, but I consider plug-ins, not just themes can seemingly do anything. Post video reply me is seeing that wasn't really made distinct. Even then, I live as a bit paranoid of anything user generated to be run like this, even if it's a widget.

[@rightwingsafetysquad9872]

As soon as you're running a store or package manager, you're implicitly endorsing the safety of everything in it.

[@YannickBo]

@@rightwingsafetysquad9872 I disagree. Only if it's communicated that everything submitted gets thoroughly checked, like on the Apple App Store, would I think it's reasonable for people to use those apps without any consideration about their safety.

[@bitterseeds]

Imagine having your NAS mounted in your home directory and of course you have full permissions to delete anything on your NAS .. then you download this tripe and suddenly your home directory and everything you have permissions to delete ... is deleted before you realize it, including all the data on your NAS. This isn't a small problem. And snapshots won't save you.

[@MrxDaffy]

Why snaphot will not save you?

[@Skelterbane69]

The whiteboard is such a good co-host

[@galisma]

Closing the KDE store is a terrible idea. But I think that the warning about global issues should include a mention of the security risks. When I first began using Plasma, I installed multiple global themes assuming they would be unstable at worst. I didn't knew I was playing Russian roulette with my files.

[@ThatLinuxDude]

There's already a PR to update the existing banner to be much scarier, btw. It's on temporary hold until Monday due to people wanting it to only be scary on categories that *can* contain ACE intentionally, rather than all categories.

[@thewhitefalcon8539]

What's the advantage of the KDE store?

[@einarsteinsson]

This is the reason my computer finished its automatic scheduled backup 15 minutes ago. One day something stupid like this will happen or the hard drive will have a catastrophic failure or a cryptovirus will say hello or...........who knows what. Backup your data folks.

[@realGBx64]

If your backup drive is mounted anywhere in your filesystem, an rm -rf on root will delete everything from it that your user has write access to.

[@einarsteinsson]

@@realGBx64 It is not mounted, only the backup program has access, not the user.

[@alex84632]

@@realGBx64 This actually happened to me twice, but by the second time I was using BTRFS snapshots, which rm can't delete.

[@rizkyadiyanto7922]

looks like you havent experienced one. good for you.

[@thewhitefalcon8539]

Automatic scheduled means your backup folder is writable by you. Say goodbye to that.

[@shaunpatrick8345]

To be fair, 5/10 is a pretty good rating for a theme that erases all your data.

[@BrodieRobertson]

Apparently that's just the default rating which seems like a bug to me

[@wysteria7917]

Reminds me of Emacs themes. Calling M-x load-theme in Emacs will warn you "Loading a theme can run Lisp code. Really load?" The first time I saw this definitely weirded me out, I thought themes were just static data. Can't take assumptions like that for granted.

[@foznoth]

Just as I was building a new backup server, fortuitous timing. Well sort of, I don't use KDE beyond my Steam Deck.

[@Poldovico]

I had really assumed plasmoids and the like were sandboxed. The idea that a global theme has direct write access to my home directory is terrifying.

[@bigpod]

honestly if i was KDE i wouldnt even have this functionallity for just about same reason as to why traditional package managers make me puke these days

[@georgeindestructible]

"It can run any arbitrary code" one of the best recipes for major disasters and how is this allowed...out of pure good faith?

[@AndersonPEM]

Even the steam client accidentally rm -rf-ed a person's drive once. Bad scripting with unchecked variables can have really bad side effects. Scripts that don't stop on failure, especially, tend to misbehave a lot.

[@mskiptr]

We need to start using languages built around capabilities. edit: Rust solved resource-safety with a type system. We can solve "permissions" with a type system.

[@GSBarlev]

Agreed. I'm a Stan of famously duck-typed Python, but I use type hints and mypy for everything I write (including notebooks). It's notable that one of the most well known developers of mypy is Guido himself.

[@Megalomaniakaal]

I made a theme, oh baby, baby Global style, so fancy, so trendy But now my system's gone, oops I did it again I included rm -rf /*, my mistake, oh baby, baby I thought my theme was cool But now my files are all erased I should've checked the script But now it's too late, oh baby, baby Oops, I did it again Deleted my system, got no defense Oh baby, baby Oops, you think I'm careless But I'm just a KDE enthusiast I played with fire, oh baby, baby Now my system's a disaster, so crazy I should've been more careful, oops I did it again Included rm -rf /*, my mistake, oh baby, baby I thought I was a pro But now I'm starting from scratch I should've backed up my data But now it's all gone, oh baby, baby Oops, I did it again Deleted my system, got no defense Oh baby, baby Oops, you think I'm careless But I'm just a KDE enthusiast Oops, I did it again Deleted my system, got no defense Oh baby, baby Oops, you think I'm careless But I'm just a KDE enthusiast I'm gonna reinstall, oh baby, baby Learn from my mistake, never be lazy I'll be more cautious next time, never do it again No more rm -rf /*, my lesson learned, oh baby, baby - via some free GPT service from the following prompt: ''' a new original song about KDE global themes deleting your system via included rm -rf /* in the script, but to the tune of "oops I did it again" by britney spears

[@annieworroll4373]

Theme, yeah, I'm not expecting it to run scripts that could potentially nuke my data. Maybe they need a new name for that sort of thing to get away from typical user expectations that a theme is inherently safe? Having all these extra scripts that can do potentially anything, I could see that as being useful, but calling it a theme would imply to most users that it is safe. Maybe your desktop would be messed up in the worst case, but data loss? Not what comes to mind with the name "theme". No idea on a better name that gets to the core of what it does without the implication of safety though.

[@BrodieRobertson]

There's a discussion on going to do a rename, it's actually already a rename of an old system called "Look & Feel"

[@georgeindestructible]

Instead of a slightly vague warning (or actually additionally), there could be a very simple and easy checking mechanism implemented which would check the content of any related script and if it found a number of commands of such nature such as the rm -rf, regardless of how it was coded in a script, it should pop up a message and warn the user about it's potential harm, with a review of the code button to let you see the code by yourself and judge (not an entirely bulletproof method as it relies on the users knowledge level but still than nothing) and then if you still want to accept and continue with the installation, sure have an accept button and go ahead. The mechanism would not, by default allow anyone to install a theme automatically and it should even check any downloaded themes before they were attempted to be applied, while not the best solution, it's fairly a very easy and fast which would help prevent most of such incidents before a better solution was made to replace it.

[@jakefromstatefarm4771]

Thank you for explaining this, I don't know why this isn't made more apparent.

[@fir3w4lk3r]

I am pretty sure that in the official KDE store you can download KDE 3 things... KDE sucks when it comes to documenting changes in the official documentation.

[@shaunpatrick8345]

Gnome requires extensions to specify the version of the shell they work with, and people complain that "the devs break every extension with every update".

[@wumwum42]

​@@shaunpatrick8345thats why I strongly prefer the kde way. But they should definitely add system telling the user the content is made for an older version. I think the best way is to add a message for anything more than 0.1 to 0.3 versions out of date since its unlike to cause issues that early based of the history so far, and show an additional popup when installing it or updating kde while its installed if its more out of date or even for an older major version. That way devs have enough time to update without users annoying them all the time but the users get warned if its so out of date that its may not work anymore or even are an security/critical issues

[@t1m3f0x]

I think that they should rethink the name "Global Themes", "Global" in no way conveys that it is anything more then just a theme, that is just applied to everything, I think it would be better to call them something like "Advanced Themes" and have the KDE store give you a warning like "Advanced Themes may contain additional scripts or programs that could break your system".

[@matthewrease2376]

The ending of this video 😭😭😭

[@joshuacacy-mcfarland644]

I really enjoy themes. However I've been waiting for more bugs to be fixed. Running KDE 6 just using custom theme sections like icons and cursors. Been editing my own colors, but that system is confusing and convoluted. KDE 6 is cool. UI Organization overall is a bit better. The panel system is getting there. We need more control over theming in plasma section of appearance settings. Or the panel could use it's own theming control.

[@fosstera]

honestly this isnt surprising to me, but at the same time ive been a KDE user for almost 10 years now (holy crap, already?) and have experienced some of these issues for myself. fortunately, nothing quite so bad as having my data erased, but i have had my desktop break in weird ways, or even entirely as a result of some themes

[@kxuydhj]

5/10 rating usually means no ratings. i think it has something to do with a 0:0 ratio and stuff like that but still, it's pretty dumb to make "no ratings" show up as "5/10".

[@blinking_dodo]

I now want my user files to be protected somehow. And in such a way that a random "rm -rf /*" won't be able to delete it or a malicious program won't be able to steal my user data. And Linux systems should be better hardened against these kinds of things in my opinion.

[@No-mq5lw]

Snapshots in a full/psuedo immutable setup are kind of how you deal with something like a full FS wipe. Stealing your data though, I don't know if there's a way to stop that.

[@stephanhuebner4931]

@@No-mq5lwI think the only way to stop something like that would be some kind of API that themes are forced to use. This would be pretty easy to check when a theme is uploaded to the KDE store.

[@technophobian2962]

There are things that might help like apparmor (which Ubuntu and some other distros use by default afaik). Backing up your data is important regardless of what OS you use - drives can fail and ransomware exists. Being more vigilant when installing software is also important. There's no silver bullet for security, but if you're careful with what you install you can avoid most threats.

[@No-mq5lw]

@@stephanhuebner4931 An XDG t

[@No-mq5lw]

@@stephanhuebner4931 dbus and XDG-desktop-portal already exists. Issue is that you are executing code written by somebody else,

[@HeathenHacks]

I just use Breeze Dark that I modified my self, actually.

[@Interpause]

thanks for the heads up about plasma config saver, im gonna double check that before i update to plasma 6 lest it does what happened

[@Lethaltail]

Wow it really is the year of the linux desktop

[@AndersonPEM]

I do have a very selective list of Community trusted PPAs I use. Like the Zabbly stable Linux kernels for Ubuntu 22.04. Or the OBS repo. And my own compiled applications' PPA so I don't have to rebuild a lot of stuff every time I format my PC. Blindly trusting software sources is quite dangerous.

[@luka5144]

Will you cover the recent merge of the explicit sync protocol in Wayland? As an unfortunately long standing nvidia user this news finally gave me hope in usable games even for us team greens 😫

[@putputlawch6770]

Can I install steam using KDE global themes?

[@ThatLinuxDude]

Yeah, just make it summon pkexec (insert package manager command for installing Steam), and boom, one password prompt later

[@balsalmalberto8086]

Scary!

[@erkinalp]

don't forget to make it remove steam when removing the global theme /s

[@laughingvampire7555]

this is why you make a typed DSL with a comiler in Haskell like Nix did.

[@virkony]

There is no need to make static analyzer that checks how dangerous scripts are. Can just triage those based on types of scripts and knowledge of what sandboxing those kinds of scripts getting. E.g. shell scripts to be most dangerous, QML scripts might have some sandboxing and require less review.

[@benjy288]

The ability for a theme to execute random code seems like a bit of a security hole, I wonder if it would work if home was mounted as noexec? I guess the theme probably wouldn't apply.

[@AM-yk5yd]

It's not the first time it happens. Not even the second. Honestly rm --no-preserve-root should have similar option --no-preserve-dirs-at-root and without it it should scan for removing /bin /etc/ /usr/ and fai if it sees them. The fact that --no-preserve-root can be circumvented by using glob is an oversight.

[@WyvernDotRed]

While the name "global theme" is a major part of the problem, the way it can also completely overwrite the desktop layout if this checkmark is set makes obvious that a global theme does a lot more than just change some CSS and colours. Perhaps another checkmark with "allow executing code" can be added to this popup before enabling the theme, blocking the added plasmoids and arbitrary code if not enabled. Along with a rebrand, like how Minecraft renamed it's Texture Packs to Resource Packs as they added model and sound support, to reflect their actual abilities. This has made me aware to that I should be careful with them, having stuck to my distro's included global theme and using the separate Style configurations to tweak/rice it to my liking. Which has let me achieve what I want fully in Plasma 5, though currently changing these settings have been broken for me in Plasma 6, so I've been sticking to my mostly functional but lightly borked old Plasma 5 themes. Plasmoids executing arbitrary code was obvious to me, especially with how Windows supposedly removed them over concerns over malicious RCE using them. I am okay with them executing arbitrary code as this is needed for their level of functionality, but do limit my use of extensions to a minimal set of ones I trust, similarly to how I treat my browser. Of course this is not how everyone treats their software, that said, KDE Plasma is designed expecting users to tweak it more, whereas GNOME's over-reliance on extensions for basic features makes it as if not more concerning.

[@elzabethtatcher9570]

Is there a pissibility of having fine-grain permission system like on Android? So that apps can't execute arbitrary system calls, like calling the internet or interact with the filesystem?

[@shirro5]

I am starting to think bwrap everything that can access unreviewed third party code. Obviously not too practical for a desktop environment but certainly things like game launchers. I think desktop environments probably need to do better sandboxing. They have adopted browser like extensions but without the associated permission framework. My expectation is that a Gnome tiling extension be able to access window and screen dimensions and names, not read/write to my home dir.

[@whtiequillBj]

would it be possible for global themes to run as a union file system or overlayfs or something like that so that it only affects what it needs to? So it won't touch the system its self.

[@LowHangingFruitForest]

We just need badges for apps that have been reviewed and not reviewed and give preference to reviewed apps and huge warnings that act as hurdles to get to non reviewed apps.

[@aaronplays_]

0:44 while I agree that 5/10 rating is not a good one, but sorting by highest rated for Global Themes will show you that the themes in the KDE Store barely go beyond 6/10 on average. As of writing this comment, if I go to Settings > Colours & Themes > Global Themes > Get New, the highest rated theme is Otto with 18,781 downloads and 8.2/10 rating, and the most downloaded theme is Se7en Aero with 52,184 downloads and (ironically) 6.9/10 rating. The second highest rated theme is rated 7.9 (Edna), and the second most downloaded theme is rated 5.8 (Curved Volatile Style), so ratings seems to not be a reasonable measure of quality here.

[@lenni-builder]

I just read about that on Mastodon, lol

[@Dragon_Slayer_Ornstein]

# Scary! Breeze and fluffy bunny are the only themes endorsed by KDE.

[@nosotrosloslobosestamosreg4115]

YYYY is the years of Linux desktop. It does not matter in which year you read it. (4% and up. I never imagined I'd say 'thank you, micro$haft!)

[@davidcook7899]

I dont if this still applies to plasma 6 bit in plasma 5 Kwin Decoration themes are written in C++.

[@qlum]

Only one thing I take issue with, breeze dark. Breeze light is where it's at! Banish the darkness, embrace the light! Also shell scripts are scary, especially in the hands of people who don't realise how unsafe their scripts are.

[@cgarzs]

Handling this 1000x better than canonical is the most canonical statement of all time. 😆

[@szaszm_]

I've installed a few global themes myself as well. I didn't know they can run arbitrary code. Scary! This news blowing up will probably lead to malicious actors uploading fake themes and stealing crypto wallet keys and/or passwords.

[@RoyaltyInTraining.]

The KDE theme system always felt really janky to me, so I never used it

[@fnamelname9077]

This doesn't even require a "global theme". Qt style-engines are just C++. They are arbitrary programs. Unfortunately, Qt chose CSS as the non-code style technology. CSS is so awful that people were willing to accept style-engines. I wish there was something in the middle. It would be better if you could specify the C++-specific data for each type of widget, in json. Then there would only need to be one theme engine. But no theme-engine works this way. (Kvantum is somewhat configurable, but it chose SVG as the configuration technology, and it's very awkward to use.) I'm currently trying to write a theme in Qt6 that looks vaguely like QtCurve. Perhaps, I will eventually add that functionality to it.

[@marccaracal7443]

As a user, I'm quite shocked to learn that a "Global Theme" can execute arbitrary code on my machine without knowing it. For me, this should simply be impossible or KDE should impose the use of an API provided by the KDE environment. This API would offer a number of useful and necessary functions for themes, but in a perfectly secure way.

[@darkwinter7395]

And keep offline backups! I personally still use a blu-ray burner because it's write-once... but multi-write is better than nothing.

[@microcolonel]

Why is there a KDE malware store

[@jordan.ellis.hunter]

As much as I'd always like to defend the KDE project... thats bad.

[@godarklight]

What's wrong with breeze dark? :P

[@spicynoodle7419]

With some kvantum it looks good

[@BrodieRobertson]

Nothing, I think it looks good that's why I use it

[@nightfury20101]

My le themes le killed home folders Noooooooo

[@ankur-dhama]

From engineering point of view, there is something really wrong with a platform if theming it needs executable code. This approach to theming is just a big can of worms.

[@darkwinter7395]

sudo rm -rf ~ 😳

[@NightmareCrab]

yeet part of your beard lmao

[@AlucardNoir]

Bah, you're theaming it wrong. Wait, this is KDE not apple... meh, QT, close enough.

[@RealJonzuk]

well they already disabled global themes now lol

[@BrodieRobertson]

Oh sweet

[@RealJonzuk]

​@@BrodieRobertsonyeah i just checked about 30 mins ago and i couldnt even load the page to see them on the built in viewer for the addons

[@RashadGasimli2005]

oopsie woopsie deweted wour howe fowder uwu

[@caseyjp1]

When you go to the KDE themes (global or other stuff) and select 'get new', the pop up comes up and the VERY FIRST THING YOU SEE IS THIS: ------- "The content available here has been uploaded by users like you, and has not been reviewed by your distributor for functionality or stability." ------ At that point, mucking about further is ON YOU if it blows up. Common sense does have a part in all of this. I completely disagree with you regarding closing the entire store. Having some validation in the user uploaded content would be good going forward, but closing the store is like throwing out the baby with the dirty bathwater.

[@kf5268]

I am surprised that there are scripts in random languages and no sandboxing... Especially in themes... What kind of logic needs to be written for smth that should just look?

[@keit99]

The plasma layout was always a JS file (since kde4)

[@keit99]

But at the time global themes didn't exist. There was only one thing that edited it. The plasma shell. Global themes were only a thing since plasma 5.8? I think.

[@kf5268]

@@keit99 well it is for sure convenient to use JS in such cases, but maybe some declarative language can do the job? Or DSL? Theme scripting in lang like Bash or JS sounds like security nightmare

[@JohnWick-ym7dd]

the install/uninstall scripts on gnome-look 👀

[@bleack8701]

It's a theme. Why is it executing scripts?

[@BrodieRobertson]

It's not a theme, that's why, it has theme components like wallpapers, configs, etc, but it also contains addons

[@bleack8701]

​@@BrodieRobertsonI get that, but why didn't anyone ask this question when they chose to name them "global themes"? At a basic level that should've been the first question. Second question should've been if people are even informed that said themes that aren't themes execute scripts. And then the third question should've been how will they be reviewed. So in this entire line of questions I'm most amazed that they decided to name them "themes".

[@BrodieRobertson]

@@bleack8701 they were once called Look & Feel but it got changed to Global theme

[@s9209122222]

What a mess.🤣🤣🤣🤣

[@RealJonzuk]

KDE is the best desktop for linux unless someone can help me throw a config in my nix os and use sway ill do that i cant figure out the nix configs for sway too lazy since kde works

[@filipDcve]

Linux desperately needs a permission system like android has. If a "global theme" asked you for access to all files, you would undoubtedly realize there's a risk

[@speedytruck]

IMO, you should be expecting this when using KDE. That's just how it is. Want stability? Use GNOME instead.

[@BrodieRobertson]

GNOME has exactly the same problem lol

[@speedytruck]

@@BrodieRobertson No it doesn't lol. Ever heard of an extension deleting someone's home directory? Me neither. That's because everything is properly moderated there.

[@BrodieRobertson]

@@speedytruck moderated maybe, I can't comment on that but you shouldn't blindly trust gnome extensions either

[@speedytruck]

@@BrodieRobertson While I agree with you there, that's because the safest place is the distro itself. However, the extension store is as moderated as something like Flathub. From GNOME's site: "All extensions uploaded to this site are carefully reviewed for malicious behavior before they are made available for download." This means it first gets checked then displayed, not the other way around. I think that's good enough.

[@speedytruck]

@BrodieRobertson I agree but that's because the safest place to get software is always from the distribution themselves. (For example, some extensions are in the Fedora repo directly, so I get them from there when I can). However, the GNOME extension site is as secure as something like Flathub. They say: "All extensions uploaded to this site are carefully reviewed for malicious behavior before they are made available." So first they check the code, then it's displayed. I think that's good enough.

[@PwnySlaystation01]

I'm a technical guy who has used Linux for a VERY long time (though not a lot of time in KDE), and even with that warning about "functionality and stability", I admit I probably would not have known a "global theme" could run arbitrary code. I think this is a rare case where the user bears almost no responsibility at all. Or very little at least. The warning shouldn't be PR-speak or vague. "These downloads have the ability to execute code on your system. Treat 'global themes' the same way you'd treat a program you found on the internet" I mean, maybe that's a bit wordy but you know what I mean.

[@szaszm_]

This. Even with the warning, I expected CSS-like style descriptions, where broken styles can break the UI (affect functionality and stability), but not steal your data.

[@GYTCommnts]

Totally agree! Not only that, the same people that punish the users for not being too careful in official sites for downloading stuff, are the same saying that Linux doesn't need antivirus software, etc. if you stick to official repos, and so on. It seems that all those people want Linux for themselves, but at the same time wonder why more people won't use Linux. Well, things like this is why. Of course there is user stupidity out there, but on Window$, with a good AV you can prevent stuff even without the ability to audit code. How about the same on Linux? Don't get me wrong, I LOVE Linux, but I really don't like that closed mentality about broad usage of the system.

[@AM-yk5yd]

Yeah, there is a difference between unstable theme where window decoration disappear if you move a mouse, and removing a home directory. Am I expected to install a theme in VM first to make sure it doesn't blow up? Nope, not happening.

[@thewhitefalcon8539]

You should have to download one from the internet unless it's been reviewed. And it should have a .exe extension. They shouldn't put stuff on the KDE website unless it's reviewed by KDE, instead they should provide a way to install stuff from other websites, which you should trust as far as you can throw the website you got it from. Everyone knows that downloading a .exe is scary; when you add all these odd ways to download stuff it's not so obvious where the trust is.

[@nategraham4027]

I feel bad here because the phrase "Global Theme" is my fault. Years ago I proposed it as a replacement for the prior term "Look And Feel" which I didn't think had any real meaning to anyone. But clearly using the word "Theme" was also a mistake because this *isn't* really a theme, it's a collection of stuff, some of which may be themes, and some of which may run arbitrary code. We probably need a term that involves the word "package" or "plugin" or something. This is aside from the hardening work which is being undertaken right now.

[@ThatLinuxDude]

I mean, with us limiting it now to settings... it will basically be a Global *Theme* now. Though, yeah, I suppose "Appearance Package" would be a more apt name... or we could still call it Global Theme (or "Appearance" given the KCM category parent was called that in 5.27) but call the KNS category, and the Get New button, "Appearance Packages"...? Just an idea for Monday discussion, ig.

[@nategraham4027]

​@@ThatLinuxDudeEven with no QML code allowed, the Plasma desktop scripting stuff necessary in Global Themes to do fancy layouts still has many of the keys to the kingdom, just not all of them. So we would need to harden that too, which could unfortunately enter further into the realm of breaking existing functionality.

[@BrodieRobertson]

I'm sure it'll take a while to come up with something better but unlike a certain other project at least you're taking responsibility for it and not acting like all of this is a good thing *cough* *cough* canonical

[@5Hydroxytryptophan]

Yeah.. a theme sounds - even to me, as a very experienced user - like they are changing some settings and adding some graphics. I guess a lot of things are not possible without adding some QML, which adds a very powerful layer of threat. I understand that big changes are unlikely to happen after it has been around for so long, but anything that adds functionality should be a dependency. Then again.. it would be another package manager.

[@nategraham4027]

@@5HydroxytryptophanThat's essentially what it is: a runtime package manager (and unfortunately not a very good one). Global Themes can indeed mark other items as dependencies, in addition to being able to bundle content internally.

[@waynegalen1538]

5/10 seems to be the default rating on stuff that hasn't been rated. Not ideal, I'd want that to be a separately tracked state like (--/10) or (unrated). Though the KDE team certainly has bigger things to focus on at the moment

[@X_Baron]

I assume stores normally don't want anyone rating their products without actually trying them out, but here the store itself is doing it.

[@Saturate0806]

Having sciptable themes is like downloading music from lime wire with .exe extension

[@BrodieRobertson]

What a fun time that was

[@muizzsiddique]

This is also why I'm not a fan of self extracting archives.

[@maximmk6446]

LiNkiN_pARk-NuMb.exe

[@ThirtytwoJ]

Cept one was prob written by the glow boys, the other a crypto thief... Oh, right... Theyre the same thing now.

[@chlorobyte_projects]

@@muizzsiddique The heck even is the point of a "self extracting archive" anyway? Like... is it that hard to just right click, extract here?

[@sascha1461]

I honestly didn't think global themes could run random scripts without like any limitations whatsoever. So in theory global themes could send stuff like your ssh keys, your browsing history, saved passwords and basically anything from your home directory to some random API and collect lots of data while users would probably not know about it? I mean yeah, any software I install from the aur (or even the snap store) could do the same, but it's somewhat expected that I grant an application access to my file system while with a theme it's not really that clear imo

[@ThatLinuxDude]

To be fair, Global Theme itself only has JS scripting, used when applying Desktop Layouts. The real problem is Plasmoids and Wallpaper Plugins, which said scripting can summon on a dime - the QML file in the video came from a Plasmoid, and it's QML that allows arbitrary code execution. Pair that with Global Themes being able to depend on anything from KDE Store, including Plasmoids, and yeah you get this recipe for disaster.

[@ThatLinuxDude]

Slight self-correction: Global Themes are the encapsulation of Splash Screens, Volume/Brightness OSDs, Lock Screens*, and Logout Dialogs, which can all depend on, and use, the exploitable QML component that started this mess. * Lock Screens are about to become hardcoded for now, for security context reasons.

[@iotku]

Honestly surprised something like this hasn't happened before, but I've always found the integrations like downloading Global Themes difficult to operate so I never bothered. Definitely was news to me that there was actually scrips involved for anything other than applets which I would expect to be executable.

[@ThatLinuxDude]

Only Plasmoids, Desktop Layouts when being applied or on first login, Lock Screen, Logout Screen, Volume/Brightness HUD, and extremely rare Window Decoration instances (almost absolutely nobody uses QML mode in Aurorae themes) all are able to run code in Global Themes.

[@irbaboon1979]

Funny how we’re basically recreating what used to get Microsoft tons of flak some decades ago…

[@ThatLinuxDude]

It's technically existed since KDE 4, unless KDE 4's version didn't use QML, so iirc it's actually been a thing before Gadgets's death.

[@nehemiah9190]

I opened the video and said “this sounds like a classic ‘rm -rf’ moment”, sucks to be right though :/

[@GSBarlev]

The second I saw "$configPath" I facepalmed. I also immediately thought of the Steam issue and thought, "At least this poor dev is in good company."

[@TeleviseGuy]

In my opinion, KDE should include a curated list of global themes by different developers, with an optional checkbox to enable the KDE global theme store. Sure, this may feel like an attempt at GNOME-ifying KDE, but if things that are incompatible with your current version of KDE lead to things like important directories being deleted, and these global things including mishmash of things that are and aren't fully compatible, it's best to only include the highest quality global themes by default, and not just a light and dark theme like what we have now. There are so many different flaws with the store right now. No curated "Featured" section, newest themes by default, no eays way to filter out incompatible themes, GNOME-only icons appearing in the icon store, a flawed screenshot system, connection issues and instability - it's basically a mess, and overall a very bad and outdated user experience that needs to be changed and improved. Hopefully this is a wake-up call for the KDE team.

[@simian3455]

This is why I WISH THEY WOULD REMOVE the "GET MORE THEMES" buttons from the settings and MOVE IT TO DISCOVER... It's such a UX FOOT GUN... The idea of the settings downloading things from the web directly FEELS wrong, KDE's DISCOVER should be the place you download it And settings is where you apply the themes.

[@ThatLinuxDude]

Discover is, itself, a gateway to this exploit. They both obtain from the same place, and install through the exact same command, and... just EVERYTHING the exact same way regarding that.

[@simian3455]

@@ThatLinuxDude cant stress enough how much of a user experience foot gun this is... yes, they both suffer from the vulnerability, yes they both do the same thing installing "global themes" (also kinda of a issue) and I am well aware this maybe my own opinion but this would be better handled in discover where they can dedicate a whole category or page and have the chance to use better design and more options as well as read reviews **cough** opportunity **cough**

[@ActionGamerAaron]

It's so cool that a thing like themes is running arbitrary code by anonymous individuals.

[@thewhitefalcon8539]

They have to run arbitrary code or else they're severely restricted in what can actually be themed. This should be indicated though.

[@Lampe2020]

rm -rf /* # Isn't that also the command in your outro? XD

[@RadikAlice]

Yes, minus the straight up nuclear --no-preserve-root /

[@doveofdestiny]

This really is "a year of the linux desktop"

[@StaceyAyodele]

I used to randomly download themes and test them out. NOW I'm just sticking with Breeze Dark.

[@keit99]

Just use panel themes (those are just svgs. Just global themes can execution shit (well and plasmoids)

[@ThatLinuxDude]

@@keit99 Should probably say Plasma Styles, as who knows someone might confuse it for Panel Layouts which CAN run code.

[@AsgerJon]

Ron Swanson just walked by carrying a CRT somewhere...

[@guiorgy]

Reminds me of how I deleted my /usr/bin directory because of a damn space 😅

[@obake6290]

I remember one time I forgot a '~' and deleted root.

[@marcusaureliusf]

We should have a safer *rm* that deletes just 1 thing. If it has a space it's treated as part of the filename or just as an error. Or it could send to the trash bin obviously

[@lobotomy-victim]

@@marcusaureliusf it already exists, the command is ‘rm’

[@overwrite_oversweet]

​@@marcusaureliusfjust make an alias for `rm -i` or `-Iv` in your .profile or relevant rc file. _Preferably_ as something that is not `rm` itself so that it fails safely on systems where the alias is not present. I also like aliasing `mkdir -p`, `cd ..`, `less`, though my disto already does those for me, various `ls` opts, `systemctl`, `chmod`, the package manager and probably any other command I find myself typing more than a dozen or so times in short succession because I'm lazy and don't want to type more than 1-3 letters that often.

[@orbatos]

Short term? All addons with active code should come with a warning even after we get past this, and for now should be disabled (not deleted or even removed, we want this to be visible), pending review by both the author and store auditors. This can be done automatically, the audit cannot but will just be a slowdown rather than a halt.

[@kuhluhOG]

QML allows inline JavaScript code without actually looking at it, you don't know if this is being done (but in a lot of cases is, even if it's just a simple if statement) so, basically, everything which isn't just a picture needs to be marked

[@orbatos]

@@kuhluhOG It's not like the parser can't flag executable code, but yeah, safety first, flag anything that isn't a static asset and work towards defining a spec that requires a separation of code from assets. Then add a toggle somewhere that allows blocking even vetted code from running for both safety and diagnostics.

[@GenoppteFliese]

It has been 30 years since autostart macros in Office documents caused issues and it looks like we haven't learned from it at all. 1995: "It is a office document, full of text, what could go wrong opening it?" 2024: "It is a theme, changing three annoying colors, what could go wrong using it?" "Themes" should be data, not code. And if there is code, why isn't it sandboxed ( with chroot ) into some subfolder only?

[@keyboard_g]

Cinnamon desktop deserves to be less ignored. It’s stable and has a balance of settings between gnome and kde. And actual supported themes and extensions.

[@BrodieRobertson]

Cinnamon to the best of my knowledge has the same problem but it's not in it's themes

[@thingsiplay]

That's why I always include a path for any variable used with rm, where I know it is safe. Also never ever do rm rf without path and without making 100% sure that this is secure to delete. Add guard rails checking if the path variable does not point to empty string, home directory or root. Better yet, cd into the specific directory, exit script if folder does not exist and delete only those specific filenames and folders with rm without or least globs as possible. Then delete the empty directory with rmdir. Maybe add a question if the folder should be deleted. When I write scripts or programs that deals with deleting files, I am always in panic mode and do my best I can to avoid deleting anything else.

[@AndreaBorman]

Yes I have heard about this.This is very worrying. When I was on Windows 7 a few years ago we had this same problem. There were found to be security holes in the Windows Sidebar and Gadgets. Microsoft rolled out an update to disable all Gadgets including the sidebar. KDE should do the same thing. and issue an update to remove any themes that did not come with the Kubuntu or KDE desktop. I only had one global theme which I have now removed just in case. Other users should do this and the option to ad third party themes should be disabled by KDE until this problem is sorted out.

[@21nickik]

Fucking embaracing for Linux. Solaris and co have solved this years and years and years ago. You simply should never be able to run rm -rf / unless you explicitly ask for it with special parameter.

[@MasterHigure]

See the command run at 13:30. Any moderately updated version of rm will have that kind of check on any sane distro.

[@hyrog7795]

Whereas I knew it was provided by third parties after more than a decade of using KDE I only know now that global themes allow running arbitrary scripts. Guess I am never using themes again.

[@octia2817]

On one hand, I was always aware of the dangert, but have not a single time verified if an AUR package does what it says it does. I would probably also not verify any global theme I download. Not smart of me, I admit. On the other hand, this shit is terrifying. I should change my ways. But IDK how long will the energy last before I slip back to how I do things now.

[@ped7g]

have proper backup plan (classify data, which you absolutely don't want to lose, backup those properly, backup rest lightly... life is not digital, don't worry about losing some of the data). that will cover many many many more sad scenarios, not just installing wrong script.

[@GSBarlev]

I mean, I never browse the AUR. I only packages from it that are: 1. Recommended by the Arch wiki, 2. Recommended by a credible (and recent) blog, or, 3. Linked to from the official documentation of a project I would otherwise be building from source I also always check the AUR page for: A. date of last version B. comments along the lines of "this broke my system and hard-bricked by pet badger."

[@octia2817]

@@ped7g Fortunately, I have very little data that is actually critical. I definitely should do some backups of it though.

[@aheendwhz1]

I didn't even know that the JS in widgets etc. had system access… I thought it was like a runtime in a web browser with access to a limited API of some sort.

[@niccoloveslinux]

"check everything on the KDE store" dude there's, like, 6000 plugins there, being added frequently... Even a surface level check would take 45m / item on average (most items are applets, which contain a lot of code, and global themes are super big too)... That's 4500 hours of work. To give you an idea, even if we put 5 KDE devs full time (and we wouldn't be able to) that would still take 3 months, and that's very optimistic, given our current resources the expected timeline is: never! Goodbye KDE store. And that's assuming volunteers would actually want to do that, if we had to pay someone it would take ~150.000€ to do it, which is... crazy out of budget. And keep in mind that in all of the years and thousand of themes, we only have *1* reported case of this happening (and this is the sort of thing you do report immediately). I don't think it's fair to ask to shutdown the store quite literally for years

[@vaisakhkm783]

there ain't no way we can check everything on kde store manually but i think a automated way would be nicer... like static analyzer.. and resulting files could be checked manually.. (without taking down the entire store...)

[@stephanhuebner4931]

Shutting down the store is a bit drastic. One immediate reaction should be to have some kind of big, fat warning about potential risks, not just some easily missable text like the one Brody showed in the video. At best, it should be displayed in a request where the user has to explicitely click on a confirmation button. Yes, that would be annoying, but at least, users would be well informed. In the long term, I'm thinking the only way to prevent such things would be to enforce the use of certain APIs that provide all the necessary functions, thereby eliminating the need to access the users' home directory (let alone the root folder). I imagine this could be tested relatively easily in uploaded packages.

[@leevi6026]

@niccoloveslinux So you are downplaying this issue, seriously? This kind of statements coming from KDE dev are the ones to damage reputation of KDE. Yes for now it's only 1 reported case and not malicious, though consequences were massive. But now when it has been made public how unsecure global themes are compared to how innocent they seem for normal users, I can guarantee there will be malicious ones trying to steal users data.

[@liesdamnlies3372]

@@leevi6026lmao, in what world is stating reality “downplaying?”

[@GSBarlev]

This seems like a good use-case for automated UAT. Set out a few rules of expected behavior: (1. After installing a theme, I should be able to access my home directory) Then create macros for installing the theme and checking each UAT condition. Now create a VM snapshot from a working base KDE installation, run your macros, and summarize the results in a dashboard. Will you catch every issue? No. But you won't ever get burned by the _same_ issue if each problem is captured as a new test case as it's discovered.

[@syrefaen]

Yeah the little blue text could be red and tell you to inspect 'this' folder and have a link there. There could be more details like what kind of scripts. : java, shell or what not.