KDE Plasma 6 Refinements Continue, Fixes 3+ Important Crashes This Week

[phoronix]

Phoronix: KDE Plasma 6 Refinements Continue, Fixes 3+ Important Crashes This Week

For the weekly "This Week In KDE" development summary, developer Nate Graham highlighted the opt-in DrKonqi crash reporting wizard. Thanks in part to that opt-in automatic crash reporting, details were gathered for fixing at least three important crashes within Plasma 6 this week...

https://www.phoronix.com/news/Plasma-6-Fixing-3-Crashes-Week

[NSLW]

Nothing surprising. Discover crashes, is affected by endless loops, and doesn't show all available packages for a long time. Another app that crashes regularly is NeoChat.

I don't use them + I avoid Baloo, so great to hear that at least core KDE is not impacted by the crashes.

[varikonniemi]

I would have hoped some basic stability work for the new system monitor. I cannot believe how easy it is to make it crash: click the edit page button, click discard changes ->crash

QProcess: Destroyed while process ("/usr/lib/ksysguard/ksgrd_network_helper") is still running.
org.kde.ksysguard.plugin.network: Helper process terminated abnormally: ""
Segmentation fault (core dumped)

This is the second easiest thing to do; 2 mouse clicks after starting a program. The easiest bugs are thankfully fixed, i have not found out a way to crash it using only 1 mouse click.

[Beherit]

I was hoping for a fix for 'rm -Rf /' when installing a global theme made for kde 5.

[markg85]

I would have hoped some basic stability work for the new system monitor. I cannot believe how easy it is to make it crash: click the edit page button, click discard changes ->crash

QProcess: Destroyed while process ("/usr/lib/ksysguard/ksgrd_network_helper") is still running.
org.kde.ksysguard.plugin.network: Helper process terminated abnormally: ""
Segmentation fault (core dumped)

This is the second easiest thing to do; 2 mouse clicks after starting a program. The easiest bugs are thankfully fixed, i have not found out a way to crash it using only 1 mouse click.

Report it and/or provide a fix. Help them. Just whining about a crash isn't going to get it fixed.
If you don't report it either be quiet and take the bugs for granted or move on to another desktop environment that suits your needs better.

[ngraham]

I would have hoped some basic stability work for the new system monitor. I cannot believe how easy it is to make it crash: click the edit page button, click discard changes ->crash

QProcess: Destroyed while process ("/usr/lib/ksysguard/ksgrd_network_helper") is still running.
org.kde.ksysguard.plugin.network: Helper process terminated abnormally: ""
Segmentation fault (core dumped)

This is the second easiest thing to do; 2 mouse clicks after starting a program. The easiest bugs are thankfully fixed, i have not found out a way to crash it using only 1 mouse click.

That's already fixed in Plasma 6.0.3, which was released 4 days ago.

[ngraham]

I was hoping for a fix for 'rm -Rf /' when installing a global theme made for kde 5.

That's already fixed by removing the global theme that shipped with faulty code in it.

A generic fix is much more difficult as, by design, global themes are basically plugins/mods with full access to the entire system.If they weren't, they couldn't do most of the things they do. So hardening against this is a balancing act and involves more content moderation on the pling.com side, as well as better messaging to users so they understand the risks. All of this is ongoing and in progress, but nothing concrete has gotten merged yet so there isn't anything to report at the moment.

[varikonniemi]

That's already fixed by removing the global theme that shipped with faulty code in it.

A generic fix is much more difficult as, by design, global themes are basically plugins/mods with full access to the entire system.If they weren't, they couldn't do most of the things they do. So hardening against this is a balancing act and involves more content moderation on the pling.com side, as well as better messaging to users so they understand the risks. All of this is ongoing and in progress, but nothing concrete has gotten merged yet so there isn't anything to report at the moment.

Yes, the issue has apparently been present at least since release of plasma5, the question is why was it decided to allow arbitrary code execution to happen when user is just playing around with themes? One would think the minimum would be to do all writes into a tmp file structure and ensure no paths outside those that can contain theme related files get touched before applying the changes.

[ngraham]

Yes, the issue has apparently been present at least since release of plasma5, the question is why was it decided to allow arbitrary code execution to happen when user is just playing around with themes? One would think the minimum would be to do all writes into a tmp file structure and ensure no paths outside those that can contain theme related files get touched before applying the changes.

So the concept behind global themes was originally to be used for distro customization, where they would be made by actual developers with some QA provided by the org. This is why global themes can override things like the entire lock screen. And indeed, there are a bunch of Plasma deployments throughout the world making heavy use of this sort of thing.

The problem started when the decision was made to allow user-provided global themes, and to distribute them using pling.com. It was before my time, around 2015 or earlier IIRC. But this opened it up to a whole world of amateurs limited technical skill or QA ability. Hence the current situation.

Now, despite this, most global themes are indeed safe, and people use them to do amazing things. So now it's challenging because there's a culture built up around using global themes for essentially full system modding. We don't want to break this entirely.

What we're working on doing is removing the ability to override bits of the system with arbitrary QML, and move this into a new, more locked-down distro only thing for the distros that want to use it for their own extensive customization. Thus global themes will return to being collections of harmless assets that can at most be broken or look ugly. One thing still under discussion is whether or not to keep the ability to distribute widgets in global themes. Widgets are of course understood as being able to do anything; if you download a 3rd-party widget and it blows up your universe, it's pretty clearly your fault, and the widget author's fault. But if widgets can be embedded in global themes, you can get one if you're not expecting this. So we might make this obvious with a warning, or we might just ban widgets from living in global themes in the first place. It's still under discussion.

[Beherit]

A generic fix is much more difficult as, by design,

right. So it's not fixed.