4 ms·

Trusting Content on the KDE Store

juujian 3y ago
How Long has the KDE store been around? I only started using KDE a couple months ago, and I couldn't wrap my head around the KDE themes etc -- it's weird clicking those disclaimers just to install a wallpaper. If it's been around for a while that makes a little more sense I suppose?
- Arnt 3y ago
  It's not just a wallpaper, it's general execution, because these things are intended to be able to add general functionality. They can add a menu item to various menus and provide code to execute the new menu, and that's the goal. You can make a program that sets a wallpaper and write a description, "download my free wallpaper", but that doesn't make it into a wallpaper, it's still a program. The KDE store doesn't have a category for non-programs.
- chriswarbo 3y ago
  It goes by various names: "Get Hot New Stuff", OpenDesktop, KDE-Look, etc. Seems like it's been going since 2001 https://en.wikipedia.org/wiki/OpenDesktop.org https://en.wikipedia.org/wiki/OpenDesktop.org
TangerineDream 3y ago
Looks like this is in response to this post over on the KDE subreddit. https://old.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/ https://old.reddit.com/r/kde/comments/1bixmbx/do_not_install...
- sphars 3y ago
  Wow, a script was able to run that basically wiped the user's system? That's crazy! Someone dug into an archive of the code, looks like a bad script: https://www.reddit.com/r/openSUSE/comments/1biunsl/hacked_installed_a_global_theme_it_erased_all_my/kvnf4f5/ https://www.reddit.com/r/openSUSE/comments/1biunsl/hacked_in...
_23sd 3y ago
In my opinion as someone who just uses these Linux DEs, it seems like it would be better if they focused on “safe” content and left anything scriptable to be distributed through other means. The security risks along with bad experiences with outdated and broken software in the past have convinced me to never use these features, which is a shame as people have probably made some neat themes and widgets. On the post, I don’t buy the comparison with AUR and PPA. Whatever the risks with those systems (and don’t get me wrong, they can be significant), the end user has usually concluded based on reputation from elsewhere that they want to install a particular application and they use the AUR or PPA system to get the job done. The theme stores on desktop environments, by contrast, seem like they’re going to be the way that users discover small pieces of content that are never going to have much of an external reputation. To use such programs safely you would have to read the source code of anything you’ve thinking about using, and not many people have the ability and time/willingness to do so.
- ndiddy 3y ago
  With the AUR and PPAs, random members of the community that weren't involved with developing the original software can submit software. This means you can't go off of the software's reputation alone, as someone may have uploaded a malicious version of existing software (i.e. what happened around a month ago on the Ubuntu Snap store with a malicious Bitcoin wallet: https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-swindle/ https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-sw...). I do agree that themes don't sound like they could execute code, and KDE should be doing more to restrict what they can do to a user's computer.
csande17 3y ago
It bugs me that you seemingly can't disable the KDE Store in Discover, because it's not one of the "repositories"/"software sources" listed in its settings. I wonder if this "ghns" kiosk flag is enough to completely turn it off.
- JohnFen 3y ago
  I don't know, but I avoid this problem by simply never using Discover. I don't avoid it for any real reason other than it seems entirely unnecessary.
pdimitar 3y ago
Can somebody provide a code snippet that would be an example of something you definitely don't want these addons to run? Or is it, like, any general C / Python code?
- cassianoleal 3y ago
  I think the post that originated all this fuss was because something rimraffed the user's whole root volume. IIRC a variable that wasn't set so it nuked root instead of a specific dir.
  - pdimitar 3y ago
    Yikes, that's still pretty stupid though, I'd check if after variable expansion I am getting `rm -rf /`. Thanks for context. After all these years, the Linux community is as fringe as always, sadly.
alekq 3y ago
If you cannot audit it and supervise it, do not offer a point-and-click way to install it. Do not rely on end-users experience and sanity nor the good intentions of random people online. Installation of Gnome extensions or KDE themes (unless official package from distribution's repository is used) always seemed as unnecessary risk to me.
- ParetoOptimal 3y ago
  I posted an idea about sandboxing that I think is a middle ground between doing away entirely with the idea of gnome/kde extensions and themes using sandboxing: https://discuss.kde.org/t/sandbox-plasmoids-by-default-to-prevent-themes-from-deleting-home-directory-or-other-sensitive-data/12826 https://discuss.kde.org/t/sandbox-plasmoids-by-default-to-pr...

How Long has the KDE store been around? I only started using KDE a couple months ago, and I couldn't wrap my head around the KDE themes etc -- it's weird clicking those disclaimers just to install a wallpaper. If it's been around for a while that makes a little more sense I suppose?

Arnt 3y ago
It's not just a wallpaper, it's general execution, because these things are intended to be able to add general functionality. They can add a menu item to various menus and provide code to execute the new menu, and that's the goal. You can make a program that sets a wallpaper and write a description, "download my free wallpaper", but that doesn't make it into a wallpaper, it's still a program. The KDE store doesn't have a category for non-programs.
chriswarbo 3y ago
It goes by various names: "Get Hot New Stuff", OpenDesktop, KDE-Look, etc. Seems like it's been going since 2001 https://en.wikipedia.org/wiki/OpenDesktop.org https://en.wikipedia.org/wiki/OpenDesktop.org

TangerineDream 3y ago

Looks like this is in response to this post over on the KDE subreddit. https://old.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/ https://old.reddit.com/r/kde/comments/1bixmbx/do_not_install...

sphars 3y ago
Wow, a script was able to run that basically wiped the user's system? That's crazy! Someone dug into an archive of the code, looks like a bad script: https://www.reddit.com/r/openSUSE/comments/1biunsl/hacked_installed_a_global_theme_it_erased_all_my/kvnf4f5/ https://www.reddit.com/r/openSUSE/comments/1biunsl/hacked_in...

_23sd 3y ago

In my opinion as someone who just uses these Linux DEs, it seems like it would be better if they focused on “safe” content and left anything scriptable to be distributed through other means. The security risks along with bad experiences with outdated and broken software in the past have convinced me to never use these features, which is a shame as people have probably made some neat themes and widgets. On the post, I don’t buy the comparison with AUR and PPA. Whatever the risks with those systems (and don’t get me wrong, they can be significant), the end user has usually concluded based on reputation from elsewhere that they want to install a particular application and they use the AUR or PPA system to get the job done. The theme stores on desktop environments, by contrast, seem like they’re going to be the way that users discover small pieces of content that are never going to have much of an external reputation. To use such programs safely you would have to read the source code of anything you’ve thinking about using, and not many people have the ability and time/willingness to do so.

ndiddy 3y ago
With the AUR and PPAs, random members of the community that weren't involved with developing the original software can submit software. This means you can't go off of the software's reputation alone, as someone may have uploaded a malicious version of existing software (i.e. what happened around a month ago on the Ubuntu Snap store with a malicious Bitcoin wallet: https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-swindle/ https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-sw...). I do agree that themes don't sound like they could execute code, and KDE should be doing more to restrict what they can do to a user's computer.

csande17 3y ago

It bugs me that you seemingly can't disable the KDE Store in Discover, because it's not one of the "repositories"/"software sources" listed in its settings. I wonder if this "ghns" kiosk flag is enough to completely turn it off.

JohnFen 3y ago
I don't know, but I avoid this problem by simply never using Discover. I don't avoid it for any real reason other than it seems entirely unnecessary.

pdimitar 3y ago

Can somebody provide a code snippet that would be an example of something you definitely don't want these addons to run? Or is it, like, any general C / Python code?

cassianoleal 3y ago
I think the post that originated all this fuss was because something rimraffed the user's whole root volume. IIRC a variable that wasn't set so it nuked root instead of a specific dir.
- pdimitar 3y ago
  Yikes, that's still pretty stupid though, I'd check if after variable expansion I am getting `rm -rf /`. Thanks for context. After all these years, the Linux community is as fringe as always, sadly.

alekq 3y ago

If you cannot audit it and supervise it, do not offer a point-and-click way to install it. Do not rely on end-users experience and sanity nor the good intentions of random people online. Installation of Gnome extensions or KDE themes (unless official package from distribution's repository is used) always seemed as unnecessary risk to me.

ParetoOptimal 3y ago
I posted an idea about sandboxing that I think is a middle ground between doing away entirely with the idea of gnome/kde extensions and themes using sandboxing: https://discuss.kde.org/t/sandbox-plasmoids-by-default-to-prevent-themes-from-deleting-home-directory-or-other-sensitive-data/12826 https://discuss.kde.org/t/sandbox-plasmoids-by-default-to-pr...