I think 2024 might truly be the year of
the Linux desktop yesterday we had the
whole snap situation with a bunch of
fake crypto that's being uploaded and it
seems like seems that canonical is doing
at least a little bit to address it
we'll see if they do everything they
need to do in the long term and now we
have another situation this one
affecting the KDE project what I will
say off the bat is even though a lot of
the people in the KD project are
volunteers and the project is
considerably smaller they are handling
this are thousand times better than
canonical this all started with a simple
plasma 6 Global theme called gray layout
now personally I never would have
installed a theme that had a 5 out of 10
rating but this used one to take a look
and when they did well do not install
Global themes some wipe out all your
data hacked installed a global theme it
erased all my drives installing this
theme had the potential to delete all
the data writable by your user this
includes things like your home directory
now you're probably thinking a very
obvious
question this is a theme how in the
world does a theme modify my system it's
just a theme well going forward KD needs
to be incred incredibly clear about what
a global theme is and what a global
theme isn't so when we look at something
like a plasma theme this is a separate
thing from a global theme a plasma theme
is just a bunch of image files and
config files assuming there's no issue
with paing these files these are
completely
safe when we looking at a global theme
though that is not the case okay so here
is an example of the source files of a
very popular Global theme called sweet
now different Global themes are going to
have a different number of these
directories in these directories you'll
find a number of things you'll find
things like image files you'll find text
files but you will also find qml files
this is a highle language used to write
QT interfaces but more importantly are
files like this this is a Javascript
file other Global themes might also make
use of shell scripts inside of these
files you can run arbitrary code much
like any other application on your
system these files can contain any valid
code inside of them every Global theme
is not really a theme what it really is
is an add-on and inside of an add-on you
can run arbitrary code these Global
themes should be treated like installing
something from the a or a random GitHub
repo where where you are going to treat
it with caution or if you want to put it
in KD terms Global themes should be
treated the exact same way as things
like kwin scripts widgets effects you
should treat a global theme with extreme
care again it can run any arbitrary code
so with that being said if you are not a
developer and you don't know how to
examine this code I would highly
recommend not installing any Niche
Global themes only install things that
you know other people have used and you
know are safe now unlike the snap
situation where it was very clear that
that was malicious in this case it
doesn't seem to be in this case it seems
more likely it was just incompetence so
this user downloaded all the files
before they got deleted and actually
took a look at them the two main lines
we care about are in full
representation. qml on line 144 and
save. sh online 6 I had a look at the
code and it stems from plasma comp saver
and seams benign this is a plasma 5
widget that allows you to save your
current desktop layout configuration and
restore previous saved layouts on the
Fly keep in mind this was a plasma 6
Global theme this is a plasma 5 widget
that is going to be very important the
CMD do index of pattern does not
actually execute the pattern in this
case Bas save. sh or rm-rf but checks
what command has been run to act
accordingly it's a poor man State
machine EG this right here is used to
check whether save. sh or rm. RF will
run in the last command the save Dosh
script is only ever called with these
arguments here the critical part is the
config folder this line right here is
never empty or set to route even if the
config path was by accident or malice
set to an empty string the resulting
config folder would be unequal to rout
and for the other location of rm-rf the
save path there's also a save property
that all said this is a plasmoid that
was written for
KD5 maybe some interaction with KD6 led
to this issue one issue that could have
happened is that this line right here
now users standards path. stands
location due to KD6 this could lead to
config path looking something like some
path and then a space and then slash
which expands to sh save Dosh some path
space slash and then the rest of it
which will happily remove everything the
whole situation reminds me of the Ste
uninstaller where single space had some
remarkable results for anyone unaware of
that situation this happened back in
2015 moved lo/ share steam ran steam it
deleted everything on the system owned
by the user this was caused by two very
simple lines firstly setting the steam
root variable to whatever this evaluates
to and then rm-rf the variable slst star
now what would happen if this right here
became an empty string well what you end
up running is rm-
rf/ star which this comment is right
that is scary but that comment shouldn't
be there that should be making sure that
this is never empty now I was already
planning to give a much lighter hand
than what I gave
canonical however the KD developers have
shown that they are actually willing to
step up and take responsibility for what
happened so when he found out Nate
Graham said this gee how awful this
particular theme has been removed too
dangerous to live we're discussing a
path forward for making sure this kind
of thing can't happen alongside this
David Edmonson also made a blog post
trusting content on the KD store a
global theme on the KD third party store
had an issue where it executed a script
that removed users data it wasn't
intended as malicious but mistake in
some shell paing it was was promptly
identified and removed but not before
doing some damage to that user to
developers it's not a surprise that a
third party plugin can do this sort of
thing it's as intended a global theme
can ship custom lock screens custom
applets custom settings and all of these
can run arbitrary bundled code you can't
constrain this without limiting
functionality to that end there's an
explicit warning when downloading
plugins that warning saying the content
available here has been uploaded by
users like you and is not been reviewed
by your distributor for functionality or
stability I think this warning is a good
start but it probably should mention
something about safety instead
functionality and stability yeah that's
fine but making sure the user is aware
that this may not be safe I think is a
lot more important our primary issue
boils down to expectation management and
communication there are plenty of other
ways where users can download and run
unfetter code from the internet the arch
user repository adding a bunch of ppas
downloading from random GitHub repos so
on and so forth this isn't a bad thing
it's useful and people do amazing things
with this to benefit users in those
cases though there's an expectation that
because it's a program that is
inherently unsafe and a user needs to
trust the source our issue is phrases
like Global theme or plasma appet don't
always carry this message especially
Global theme this point here absolutely
hits the nail on the head users will
look at things like the A ppas and
things like that and know that they
shouldn't be trusted now some users will
just blindly trust them anyway but
anyone who's using Linux and has been
using it for a long time should be aware
that they shouldn't be trusting them but
when you install something like a global
theme you think theme you think CSS you
think that can't be harmful but that's
not the case so what can we do better in
the short term we need to communicate
clearly what security expectations
plasma users should have for extensions
they download into their desktops
applets scripts and services being
programs can easily be recognized as
potential risks it's harder to recognize
that plasma themes wallpaper plugins and
cwin scripts are not just passive
artwork and data but may potentially
also include scripts that can have
unintended or malicious consequences we
need to improve the balance of accessing
third party content that allows creators
to share and have users to get this
content easily with enough speed bumps
and checks that everyone knows what
risks are involved now my suggestion in
the shortterm and I don't think they're
going to do it is shutting down the KD
store doing a sweep of everything that
is currently available and I know that
it's going to take a very long time but
going through all of it and making sure
that it's not doing anything obviously
dangerous obviously doing a full check
on everything is going to take a really
long time but at least a surface level
look longer term we need to progress on
two Avenues we need to make sure we
separate the safe content where is just
metadata and content from the unsafe
content content with scriptable content
then we can look at providing curation
and auditing as part of the store
process in combination with slowly
improving sandbox Support also in the
long run I think they should look into
building static analyzers that look for
obviously dangerous patterns like using
rmrf with a variable and that variable
hasn't actually been checked obviously
this is going to be complex and maybe
human moderation is easier but at least
think about the idea pretty much all of
this stuff also got posted over on the
KD Twitter now there is one part of
their response on here that I will take
slight issue with that is the final
response nevertheless this will take
time and resources we recommend all
users to be careful when installing and
running software not provided directly
by K or your dros when something's
coming from the official KD add-on store
it's a reasonable assumption to make
like it's a reasonable assumption in the
snap case with canonical that this is
something coming directly from the
project this is something coming
directly from KDE and yes it is by a
third party developer but if it is on
the store it's a reasonable assumption
to make that this is in some way tested
or endorsed by the KD project now for
the record that doesn't mean the user is
right but it is a reasonable assumption
to make now assuming this actually gets
dealt with and this does hasn't become
another canonical situation where 5
years from now we are talking about the
exact same thing this was a good
response so it's a matter of waiting and
seeing what they actually do but in the
end this is just another reason for me
to keep running Breeze dark and be happy
about it so let me know were you aware
of the way that Global themes actually
worked are you the kind of person who
likes to install a ton of different
themes a ton of different widgets a ton
of different scripts and maybe you're
going to reconsider just randomly
installing things let me know down below
so if you like the video go like the
video and if you really like the video
and you want to become one over these
amazing people over here Che get the
patreon scrub baray Linked In the
description down below that's going to
be it for me
and oh no your home directory T I
deleted
it if itol I don't don't invol I
[Music]
don't