WARNING: Global themes and widgets created by 3rd party developers for Plasma can and will run arbitrary code. You are encouraged to exercise extreme caution when using these products.

On the one hand, if any commercial store put out a statement like this and did no vetting of submitted applications people would (rightly) be up in arms. But on the other, this is pretty much the standard with FOSS, right? Unless you’re paying for a supported commercial license from someone like Red Hat, everything is as-is, without warranty, caveat emptor. The power of open source is that anyone can review the code and look for problems or malicious behavior, but also (especially with smaller projects) there’s no guarantee that anyone else has looked at the code. So is it a best practice with Linux and FOSS to run a system backup before installing any software or update? I mean I guess that’s technically true for any OS, but especially for open source?

As a big fan of KDE Plasma, I feel like this is a huge blunder on their side, and am rather disappointed. I do hope they can move forward learning from this.

The same risks apply to any software proprietary or open source which is why Microsoft have the following in their licence agreement:

12. DISCLAIMER OF WARRANTY.The software is licensed “as-is.” You bear the risk of using it. Microsoft gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, Microsoft excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement. FOR AUSTRALIA ONLY: You have statutory guarantees under the Australian Consumer Law and nothing in these terms is intended to affect those rights.

LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES. You can recover from Microsoft and its suppliers only direct damages up to U.S. $5.00. You can't recover any other damages, including consequential, lost profits, special, indirect or incidental damages.

Knowing that and knowing that themes can have code is two different things though. I wasn't particularly surprised as I thought (maybe wrongly) that global themes just installed all the other bits which would require code.

KDE can't get away with "user at risk" for a DE designed for general purpose users. That means users who aren't technically minded or linux experts. Maybe hyprland and i3 can tell users to RTFM but an embedded store distributed with ALL KDE versions should have some sensible design decisions such as "maybe dont allow arbitrary JS execution as root within a feature people don't expect to be doing more than changing the background pic and some fonts"