Don't forget to add sudo for maximum performance
Don't forget to add sudo for maximum performance
35 comments
-
-
-
It's only 3 layers deep, shame on you and your laziness
I will await the 100 recursive layers SVG version later today, do not disappoint me (please).
-
I'm afraid I didn't make it and just stole it
-
-
-
Gottem
Seriously though we need to work on improving security. A theme probably shouldn't be running code and if it is it needs to be sandboxed with its only access being an API
-
It's kind of horrifying nobody thought that through. What else did they fail to think about?
-
I know I'm late with this but it's not just a theme. It's a global theme. Those need to run code, so they really can't be sandboxed the same way a regular theme can be
-
-
-
Why do themes need to run code?
-
Real "What does God need with a starship?" energy.
-
So they can include cool features like auto debloating /home/
-
People in one of the other threads were speculating that it is widgets, or one theme that is able to do multiple configurations. Really should be containerized or something, tho.
-
Setting themes do mant things and they are not like adding a colorscheme or so. Like there are tweaks that comes wuth themes which needs shell access to heavily modify the desktop
-
Theme applied successfully!
-
Yeah, shouldn't it say something like "ha ha get fucked"?
-
-
is this the reason Bleeping Computer made that article about malicious KDE themes? i saw it in my feed but didn't think much of it
-
Fucking CJS. Please use ESM to delete all my files 🙏
-
Make this go away. Malicious "jokes" like this one do not deserve any clout.
-
On the contrary, in my opinion if they are clearly labelled as a joke, they are a great way for people who don't understand them to ask why and, in the process, being a little more informed on what not to do and what it's dangerous.
Especially because there's really no risk of emulation in this case.
-
I wasn't originally going to up vote this post because of laziness, but your comment inspired me to lmao
-
Oh, you're going to love my fork bomb jokes. I try to slip them in everywhere.
35 comments
For those not in the know: aussie man explains. A KDE Plasma 6 global theme deleted a user's files. Global themes may contain arbitrary Javascript code, and a bug (using a library written for Plasma 5) caused it to essentially run
rm -rf /*, Steam-style. KDE have since removed the theme and are considering next steps to warn the user that the "official" KDE store contains user-submitted content, and that some addons may contain potentially dangerous code.I still remember that video I watched where a line in the Steam code back in the day was titled SCARY!!!!! and it was rm -rf $STEAMROOT. This nuked a guy's computer because short answer $STEAMROOT was actually / root, long answer here's the video. This nuked both his PC and his external drive that is some pretty bad code but this JavaScript code is up there
That's the issue I linked. The problem was that at some point a script executed
rm -rf "$STEAMROOT/*", but did not make sure that$STEAMROOTwas set. If for some reason it was empty, the path became/*after substitution.Here is an alternative Piped link(s):
video
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
Here is an alternative Piped link(s):
aussie man explains
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
Is this affecting both plasma 5&6 then?
This particular issue was caused by a breaking change in Plasma 6 and bad handling in a specific global theme.
The general security concerns that were being brought to light however apply to all versions.
It should only affect Plasma 6 because of some breaking change to how a Javascript function returns a path.