A user has had a bad experience installing a global theme on Plasma and lost personal data.

Global themes do not only change the look of Plasma, but also the behavior. To do this they run code, and this code can be faulty, as in the case mentioned above. The same goes for widgets and plasmoids.

We are calling on the community to help us locate and quarantine defective software by using the “Report” buttons available on each item in the KDE Store.

Please see this linked image to locate them.

Meanwhile, KDE is taking measures to properly warn users before each download and we are also putting in place ways of auditing and curating what is uploaded to the KDE store.

Nevertheless, this will take time and resources. We recommend all users to be careful when installing and running software not provided directly by KDE or your distros.

And remember to report any faulty products you find!

  • Brickardo@feddit.nl
    12·
    1 year ago

    I must ask, isn’t that explicitly mentioned on the top side of the “get new…” menu?

  • forgotmylastusername@lemmy.ml
    121·
    1 year ago

    Are we all forgetting rm -rf has the --no-preserve-root safeguard? The accidental engine DataSource culprit seems unlikely. You can experiment yourself with in VM. It’s only a couple lines of QML code. Nothing will happen without explicitly turning off safety.

    The pling account that posted the theme was registered on February 25 2024. And suddently it has 3800 downloads without anyone else saying anything?

    Things aren’t adding up. I think this had to be intentional malicious crafted code.

      • nexussapphire@lemm.eeEnglish
        2·
        1 year ago

        Unless you have your root dir mounted in your home directory! Thanks btrfs. It might be protect by permissions but I wiped a whole disk without --no_preserve_root. It hurts being too clever sometimes. dink meme

    • Nia_The_Cat@beehaw.org
      11·
      1 year ago

      I thought Wayland just keeps running apps from seeing into eachother, doesn’t help when a theme can somehow rm -rf your entire system which is absolutely absurd that it’s even possible to happen. Like I saw someone else say in another thread, every time I think Linux is in a situation where it can get some more marketshare, I see something like this that reminds me why we only have 4%

      edit: Still much love for KDE and Linux, this is just quite the unfortunate situation

      • jaxil6@futurology.todayEnglish
        223·
        1 year ago

        In that case the wayland project should be held accountable for false marketing and deceiving users

        • fallingcats@discuss.tchncs.de
          11·
          1 year ago

          Clearly you don’t know the first thing about Wayland. If you run an application without a sandbox, of course it can execute commands. That’s just common sense. Qt themes are also kind of an application. Now that’s where the fault lies, not with the protocol applications use to interact with the compositor (Wayland).

          • krimson@feddit.nl
            9·
            1 year ago

            Ignore him. You would think people have something better to do but apparently creating an account just to trashtalk wayland is a thing. I’ve seen it before, probably the same dude.

    • gomp@lemmy.ml
      120·
      1 year ago

      The wayland project was originally started by George Soros… what did you expect?

        • Grangle1@lemm.ee
          3·
          1 year ago

          I lean center-right myself (and yet somehow continue to use Lemmy) and still marvel at the complete lunacy of conspiracy theories about him that right-wingers can dream up.