On the Reddit thread people, at least one of them tagged as a KDE dev, mentions that widgets NEED to be able to run arbitrary code. I am absolutely baffled by this.
Widgets aren’t themes. They’re things on your desktop that people are using for example for showing a folder - and if that can’t interact with the system, that widget’s functionality is broken.
Of course, that should not apply to install scripts or the like, which shouldn’t be a thing at all really. And it should be made a lot more obvious which downloadable things can execute code / which ones are “guaranteed” safe and which ones may not be.
Ok, then a bad actor could enumerate all the subdirs and delete them one by one.
Even if going down this path would be a good solution, I don’t think this is rm’s job to do. This should be done by an antivirus a security suite. I think I have read that for the past few years the kernel now has a better API than inotify to get notified by file operations. I don’t remember it’s name, but I think it was even mentioned in the docs that security software is a use case of it
On the Reddit thread people, at least one of them tagged as a KDE dev, mentions that widgets NEED to be able to run arbitrary code. I am absolutely baffled by this.
Aren’t widgets pieces of software? Of course they have to run code. But they need to be isolated, or at the very least not have sudo access.
Think of html+css, themes are supposed to be that kind of code who does nothing by itself.
Widgets aren’t themes. They’re things on your desktop that people are using for example for showing a folder - and if that can’t interact with the system, that widget’s functionality is broken.
Of course, that should not apply to install scripts or the like, which shouldn’t be a thing at all really. And it should be made a lot more obvious which downloadable things can execute code / which ones are “guaranteed” safe and which ones may not be.
deleted by creator
Ok, then a bad actor could enumerate all the subdirs and delete them one by one.
Even if going down this path would be a good solution, I don’t think this is
rm’s job to do. This should be done byan antivirusa security suite. I think I have read that for the past few years the kernel now has a better API than inotify to get notified by file operations. I don’t remember it’s name, but I think it was even mentioned in the docs that security software is a use case of itdeleted by creator
deleted by creator