[KDE] Do not install global themes!

[oshunluvr]

I saw this on Reddit this morning and thought it worth re-posting. TL/DR "Global" themes can have executable code in them and thus are dangerous.

The poor soul in the linked Reddit thread lost his entire /home folder and contents. Obviously this is a known issue know and the devs are working on it. However, I would recommend you either not install any new Global Themes or at a minimum, test thoroughly in a VM before installing and have backups!

https://www.reddit.com/r/kde/comment..._wipe_out_all/

[claydoh]

Global Themes sometimes have come off as a bit sketchy at times. They are nothing more than a list of individual widgets and theme bits, plus some configuration files and javascript files, etc.

What appears to have happened is that this particular Global Theme included the PlasmaConfSaver widget which is not Plasma 6 compatible, and also seem to use a few <rm -rf> instances.
My guess is the theme's creator uses this widget to apply the custom changes, maybe.
I quickly found another "plasma 6" global theme that includes this widget.

This doesn't seem to be a malicious event, but possibly just an unfortunate result of bad code and slight changes in Qt.
More context from the reporter on reddit:
https://www.reddit.com/r/openSUSE/co...erased_all_my/

And a reply from a KDE dev:
https://blog.davidedmundson.co.uk/bl...store-content/

[rossdv8]

SInce one of the main things I do with Linux is theme experiments (as I've been doing for over 20 years) and one of my favourite things to play theming with is Kubuntu, 'Thanks' for posting this.
There's a good chance I'm going to be tripped up by this at some point, so I'll uninstall Kubuntu 23.10 from this computer and also try to remember not to install Neon, although if it is caused by an incompatibility between Qt 5 and Qt 6, Neon might not be an issue. My system blacklists Reddit most of the time - so I'll have to bypass it to read those articles

[claydoh]

SInce one of the main things I do with Linux is theme experiments (as I've been doing for over 20 years) and one of my favourite things to play theming with is Kubuntu, 'Thanks' for posting this.
There's a good chance I'm going to be tripped up by this at some point, so I'll uninstall Kubuntu 23.10 from this computer and also try to remember not to install Neon, although if it is caused by an incompatibility between Qt 5 and Qt 6, Neon might not be an issue. My system blacklists Reddit most of the time - so I'll have to bypass it to read those articles

Actually this particular issue is expressly from Plasma 6, so there is no reason to switch to neon, especially if you like theming. Not much has been posted to Plasma 6, and I'm sure a LOT won't be. Plus, you will very likely need to get your hands a
bit dirtier than with other distros (wine, Nvidia drivers among other things).

The Linux related Subs on Reddit are actually a great place to discover a ton of useful information and ideas. Reddit is only a cesspool if you actually go to the cesspool parts

[Schwarzer Kater]

[…]
There's a good chance I'm going to be tripped up by this at some point, so I'll uninstall Kubuntu 23.10 from this computer and also try to remember not to install Neon, although if it is caused by an incompatibility between Qt 5 and Qt 6, Neon might not be an issue. […]

No need to panic (and no need to ditch Kubuntu either).
In theorie this could happen to you with a complete third-party theme in any desktop environment…

The best protection is - as always and with any operating system - to have frequent good and working backups!
And to verify foreign code as extensive as possible before running it, of course…

[rossdv8]

No need to panic (and no need to ditch Kubuntu either).
In theorie this could happen to you with a complete third-party theme in any desktop environment…

The best protection is - as always and with any operating system - to have frequent good and working backups!
And to verify foreign code as extensive as possible before running it, of course…

I should have been a bit more specific. 'This machine' is my aging Lenovo m900 Tiny 'daily driver' that I have set up with Mint 21.3 KDE 'FrankenMint' as someone christened it - which is one of the nicest, smoothest Desktop experiences I ever used. It also has a second /root partition where I used to keel a default Mint current latest Mint Xfce for Justin (Case).
At the moment it has Kubuntu 23.0 on it, because I was doing some Neon 6 Beta testing on the 'spare' Lenovo, which is an m93p Tiny.

Because the KDE Team has implemented my suggestions and fixed one particular thing in Neon (which will probably eventually flow into Kubuntu in Plasma 6) - and because it doesn't imact Desktop comptuers - I also installed Kubuntu 23.10 on that m93p. There are screenshots of the horrible things I am doing to Kubuntu 23.10 in this forum

Since

And to verify foreign code as extensive as possible before running it, of course…

is not really practical for what I do - I am better off risking losing stuff on a spare machine, rather than my daily driver.
So stripping Kubuntu from this machine will also ease a lot of conflicts between Kubutu and my Mint KDE (due to config files living in ~home.

So I won't be ditching Kubuntu. I only just got back after years of work on other distros.
One thing about Kubuntu is that I don;t haver to spend time trying to help people who don;t want to be helped. There has always been a more convivial atmosphere in the Kubuntu forums And people who ask for help are less likely to be treated as idiots for asking than on some other distros' forums I've visited briefly.

[rossdv8]

Actually this particular issue is expressly from Plasma 6, so there is no reason to switch to neon, especially if you like theming. Not much has been posted to Plasma 6, and I'm sure a LOT won't be. Plus, you will very likely need to get your hands a
bit dirtier than with other distros (wine, Nvidia drivers among other things).

The Linux related Subs on Reddit are actually a great place to discover a ton of useful information and ideas. Reddit is only a cesspool if you actually go to the cesspool parts

I agree. I've been helping people develop Distros since my Mandrake days, and I'm still regularly invited to participate in Software Alpha and Beta testing even now after being long retired from active 'useful' computing.
That's why I've been absent from here for 10(ish) years. Not because I suddenly stopped liking Kubuntu - but because I was more use elsewhere.
Mandrake got me 'into' KDE (from Red Hat that we switched to completely in 1998) and since them KDE in one distro or another, depending which one I was active with at the time, has been my Desktop. To the extent that my 'Permanent Desktop' is still Mint 21.3 KDE.

I got back into the Neon thing because I wanted to solve a problem using KDE / Plasma on Microsoft Surface Pro tablets. Kubuntu had already 'half solved' it, but I got the team doing the Neon 6 Betas to implement a full solution in Plasma 6, which it probably just as easy to implement in Kubuntu, if it hasn;t already been done. It was still using the 'half solution' last tiem I tried Kubuntu on the Surface Pros.

Anyway, since that problem was solved - and since I (like most other who want to use KDE with Mint) use Kubuntu Backports for my mods - I decided to haunt Kubuntu as soon as 23.10 was released - and now that 24.3 is available (with Plasma 5) I want to play with that until I see if Plasma 6 makes it to 24.10 - by which time it shoudl be stable and in backports.

From my Neon 6 experience since late last year, and from how plasma 6 is performing on the MS tablets - I suspect though, I may end up going 100% Kubuntu once Plasma 6 makes it.

The Linux related Subs on Reddit are actually a great place to discover a ton of useful information and ideas. Reddit is only a cesspool if you actually go to the cesspool parts

I've been a member of reddit for many many years. So I understand what you mean. The point iI was not making very well is that reddit does not play nice with 'some' Internet Security. My main VPN is a classic. I have to swap VPN servers to access Reddit - but then if I forget to switch back, my Bank chucks a fit !

[Schwarzer Kater]

And another good video by Brodie:
KDE Global Themes Are Inherently Unsafe