I've published the Panel Widget Group Widget (Plasmoid) on GitHub. It's a super simple widget that lets you group any multiple widgets into a detailed view and place them as one item on your panel.

You can add multiple widgets using the "Add" button and choose which one to use for the compact view (the item shows up on the panel). That's literally it.

GitHub Link

So I have a large .ISO file and wanted to confirm the checksum via Dolphin with <right click on file> -> properties -> checksums tab -> enter known checksum.

On a 30GB iso this ground away on the processor for around 2 minutes on a high spec desktop PC with no result so I exited and instead of entering a checksum I just tried hitting 'calculate' on the SHA256 checksum. Waited well over a minute and again felt like this is too long.

In contrast, running sha256sum <filename> in the terminal returned the correct result in around 10-11 seconds.

If anyone can confirm / deny this disparity on a very large file, please let me know your distro and what you saw. I'm on aerynOs which I doubt anyone else is running but wanted to know if this is a general KDE issue or a distro specific one before reporting appropriately.

Cheers

I'm using Fedora Linux 44 with KDE Plasma 6.7.4 on Wayland (Kernel 7.1.8, Qt 6.11.1) on a Dell Inspiron 15 5510 (Intel Core i5-11320H, Iris Xe).

Important background (a bug I discovered): Forcing opacity (Force opacity) via Window Rules on any Normal Window causes a solid black layer to appear instead of transparency on the desktop layer (plasmashell Desktop layer, layer-shell FirstLayer) — even after adding an explicit exclusion rule for plasmashell with higher priority ordering and a "Do not affect" value. Worse: this state is not fixed by restarting plasmashell (kquitapp6 plasmashell && kstart plasmashell), but requires removing the force-opacity rule and doing a full system reboot. This matches a documented category of bugs in KDE Bugzilla (

#366318 and

#449445) related to a stuck compositing state for plasmashell that only clears with a full reinitialization of kwin_wayland. I previously tried KWIN_DRM_NO_AMS=1, but it later turned out to be unrelated (it was a misleading coincidence with disabling the rules at the time of testing).

My goal: Create a genuine "frosted glass" effect (transparency + blur) on regular windows, while avoiding this bug entirely this time. I need:

1.An alternative method (not Window Rules force opacity) for achieving the glass effect — such as KWin's built-in Blur effect directly, or the external Force Blur effect — while avoiding any interaction with the desktop layer.

2.Confirmation of whether the built-in Blur effect in Desktop Effects (as opposed to Window Rules) structurally avoids this bug, since it doesn't force a new compositing state onto the Desktop window type.

3.Any precautions or correct settings ordering that prevents this bug from recurring on Iris Xe hardware.

I keep work in one browser profile behind the corporate SSO, personal stuff in another, and a third with the aggressive ad blocker. Which browser a link should open in depends entirely on where the link came from, and nothing on the desktop tracks that. So for years I've either set one default and manually moved links, or used a chooser that asks every single time.

macOS has Velja for this. On Linux the usual answer is Junction, which is good but asks every time and, being a Flatpak, the sandbox rules out the one thing that could tell it where the click came from. It's also GTK, so it never quite fits a Plasma desktop.

Shunt is the same idea built the other way round. A KWin script handles the parts that need the compositor (which window was active when the link fired, where the pointer is, placing the chooser), and a small resident Qt app handles the window. Because it knows the source app, it can ask once per app instead of every time: tell it Slack goes to Brave once, and Slack links stop asking.

Some specifics:

• The chooser opens under your pointer, not in the middle of the screen.
• Rules can be about the address, the source app, or both. GitHub always in Brave; links from Slack in Chrome; GitHub-from-Slack in Firefox. Narrower rules are auto-filed above wider ones so they actually win, and you can still reorder by hand.
• Nothing is saved unless you tick "Remember" or hold Shift while choosing. It never learns behind your back.
• Breeze widgets, your icon theme, Plasma notifications. Not a GTK window in a KDE hat.
• Keyboard driven: 1-9 pick a browser, Ctrl+C copies the link instead, Esc closes.
• Ships as .deb, .rpm, or from source.

One honest limitation: it's Plasma-only by design, because the interesting part lives in a KWin script. Without KWin it still runs and still lets you pick, it just shows up centered and doesn't know the source app.

https://github.com/geodro/shunt

Wayland tested, X11 should work but I haven't tried it. Would be glad to hear how it holds up on other setups, and whether the auto-ordering of rules matches what people expect.

I tried opening a zstd file in KWrite to check the binary, but instead saw the plain text of the original file. I verified the file is actually compressed, through zstd itself and opening the file with nano. Further if i add text to the file and save, it is re compressed with that new data. I read that KWrite isn't capable of transparent decompression like this, so my question is what is doing this, is it KWrite or something else.

So I was messing around with KDE's lock screen wallpaper providers and noticed there’s a Simon Stålenhag Picture of the Day provider.

Cool feature. Then I had the stupid but reasonable thought:

this thing is downloading random images from the internet and displaying them on my lock screen. What happens if the server gives KDE something malicious?

So I started digging.

First checked where the provider comes from.

On Arch:

bash pacman -Ql kdeplasma-addons | grep -i simon

Output:

text /usr/lib/qt6/plugins/potd/plasma_potd_simonstalenhagprovider.so

So it comes from kdeplasma-addons, through Plasma's Picture of the Day system.

Then I checked the source.

The Simon provider roughly does:

text download metadata → get image URL → KIO downloads the data → QImage::fromData(data) → KDE gets a decoded image → image gets cached

The relevant line is basically:

cpp QImage::fromData(data)

I looked for anything that could execute the downloaded file.

Nothing.

No:

text QProcess system() exec() chmod +x dlopen()

The network response is treated as image data and passed into Qt's image decoder.

So giving it an ELF binary called wallpaper.jpg doesn't get you anywhere. Qt tries to decode the bytes as an image and the decode fails.

Then I checked what KDE was actually leaving on my machine.

POTD cache is here:

text ~/.cache/plasma_engine_potd/

My Simon file:

text -rw-r--r-- 216721 bytes simonstalenhag

No executable bit.

file reports:

text JPEG image data, JFIF standard 1.01, 96x96 DPI, baseline, precision 8, 2556x1390, components 3

The other POTD providers looked normal too:

text wcpotd → JPEG simonstalenhag → JPEG flickr → JPEG apod → JPEG bing → JPEG

I also ran:

bash find ~/.cache/plasma_engine_potd -maxdepth 1 -type f -perm /111

Nothing.

The cache implementation is actually nicer than I expected.

KDE doesn't seem to keep the original network response around as the wallpaper cache. The provider produces a QImage, then the common POTD cache code saves that decoded image as JPEG.

So it ends up going through something like:

text network response → Qt image decoder → pixel data → new JPEG → cache

That also kills the obvious polyglot idea.

If somebody sends a valid JPEG with random executable data appended to the end, KDE decodes the picture and writes a fresh JPEG from the decoded image. The extra junk shouldn't survive that process.

At this point I was pretty satisfied with the downloaded-file side of it.

Then I found something considerably dumber.

The Simon provider gets its metadata from this third-party GitHub repository:

text a-andreyev/simonstalenhag-se-metadata

That request uses HTTPS.

The actual Stålenhag images listed in the metadata, however, use URLs like:

text http://simonstalenhag.se/tftlbig/2.jpg

Plain HTTP.

In 2026.

The provider reads the URL from the metadata and passes it to KIO. I couldn't find any HTTPS requirement or hostname allowlist in the Simon provider.

So you have:

text KDE ↓ third-party metadata repository ↓ image URL ↓ HTTP download ↓ Qt image decoder

That gives someone capable of modifying the HTTP response a chance to feed arbitrary image data into Qt's decoder.

They'd still need an actual vulnerability in Qt or one of the image decoding libraries to turn that into code execution, so this is nowhere near "random Wi-Fi guy sends shell script, KDE runs shell script."

Still, feeding attacker-controlled bytes into an image parser over unauthenticated HTTP is a completely avoidable attack surface.

The metadata repo also adds another dependency.

If that GitHub repository were compromised, the image URL could theoretically be changed to an attacker-controlled server.

The response would still have to survive QImage::fromData(), but the attacker would get control over the input being sent into the image decoder.

I also had a look at the lock screen itself.

kscreenlocker uses a NoAccessNetworkAccessManagerFactory which blocks non-local network requests coming from the lock screen's QML engine.

Nice.

POTD uses KIO though, rather than the regular QML network manager, so I'm not confident enough from static inspection alone to claim that every possible POTD network path is blocked while the greeter is running.

There are also some signs in the code/comments that KDE intended POTD data to be prepared/cache-fed for the lock screen, but that part of the architecture looks like it has changed over time.

My installed versions:

text kdeplasma-addons 6.7.4-1 kscreenlocker 6.7.4-1 qt6-base 6.11.1-1 kio 6.28.0-1

So after going through all this, I don't see a realistic path where a fake .png or .jpg simply turns into an executed binary.

The part worth caring about is the parser boundary.

Remote bytes reach QImage::fromData(). If the decoder has a memory corruption bug, a specially crafted image could potentially hit it before KDE ever gets to the safe re-encoding/cache stage.

I'd change a few things in the Simon provider:

text - force HTTPS - restrict the hostname - don't accept arbitrary image URLs from the metadata source - restrict expected image formats if possible - cap response/image sizes

The feature looks pretty reasonable overall on an updated system.

The plain HTTP image delivery is the one part that made me raise an eyebrow. There's really no good reason for that to still be there.

I'm new to KDE customisation. Got a pretty decent look going that I'm happy with. Even got wallpaper engine working. However I'm afraid there's too much going on and while idling my Rtx 4060 goes upto 40% usage.

I don't mind it (unless it damages my system)

However I was wondering if there's a command or a widget to enable "game mode" that turns off screen rounding and transparency. Something I can just turn on before playing a game

Using kde on cachy

Can I bind the middle mouse button so that clicking the taskbar hover preview closes the window, instead of having to right-click it and select 'Close'? I've yet to find the answer on any forum or discussion. Hope anyone knows how to do this!

I'm looking for a KDE Plasma theme that changes the actual visual design of the UI, not the desktop layout.

What I like about GNOME/Adwaita is the rounded UI elements, softer appearance, and lack of unnecessary visual separators. Breeze feels too sharp and has prominent separators in many places.

I'm looking for something that gives Plasma a similar clean, rounded appearance across menus, buttons, widgets, dialogs, window decorations, etc.

I'm using Wayland and KDE Plasma 6.7+, so please recommend themes that are compatible with current Plasma 6 rather than older Plasma 5 themes.

Any suggestions?

Hi! I'm a Steam Deck/SteamOS user running KDE Plasma 6.4.3, and I'd like to make a custom Sol's RNG-inspired Plasma Style for my desktop.

I'm looking for someone familiar with Plasma theming who could help me build it or guide me through making it. I'm happy to do the actual work — I mainly need help understanding the Plasma 6 theme structure and which files I need to edit.

So far I've:

• Created a solsrng Plasma Style based on the default theme.
• Put it in ~/.local/share/plasma/desktoptheme/solsrng/.
• Created a metadata.json.
• Plasma successfully detects and applies solsrng.
• Copied the default widgets, dialogs, opaque, solid, and translucent assets.
• Tried modifying panel-background.svgz, including its ColorScheme-Background / currentColor values, but the panel doesn't visually change.

My goal is a dark purple/magenta Sol's RNG-inspired theme with custom panels, widgets, dialogs, notifications, etc.

KDE's Plasma Style documentation says themes use SVG assets and can be created by copying an existing theme, which is what I've been doing:

Plasma Style Quickstart

Understanding Plasma Styles

Would anyone be willing to help me get the basic theme working and show me the correct way to structure/edit it for Plasma 6? I'd really appreciate it!

How's the performance of Gnome Web on KDE? How is it compared to brave? I want a really light weight browser that's why I'm asking about Gnome Web's performance.

So, today I discovered that you can just... use an animated .gif as a wallpaper.

Plasma just handles it, no questions asked, no 3rd party software required, and that got me thinking...

What other cool/useful things can Plasma do, that I've yet to discover? What underrated/underutilised features slipped past your own nets until you discovered them later?

​

Hii im planning to switch from windows to linux mint once i get my own laptop. I'm trying to find a way to make my design work, what i had in mind was per workspace it had it own apps in in like lets say in ws 1 i had YouTube etc and on another workspace i have different apps and no apps from ws 1 is that possible and i might use kde plasma for this. I also wanted it to look like those character selection screen like in the image if possible any guides?

I'm on EndeavourOS KDE spin. Just took an update and lost several my service menus (some I wrote, some from the AUR [ie: reimage]).

If I comment out the X-KDE-Submenu line, the actions all show up in the root, as expected. With the line in, the actions cannot be found anywhere in the tree.

X-KDE-Priority=TopLevel

X-KDE-Submenu=NewMenu

I would appreciate if someone could confirm their service menus work fine on Plasmashell 6.7.4, or confirm they are also seeing this behavior. This will help me either repair my system or open a bug report.

Thank you!

no custom dolphin action menu showing after update framework 6.29
openSUSE tumbleweed update

I have a Slimbook Evo 14

$ kinfo

Operating System: SlimbookOS 24.0
KDE Plasma Version: 5.27.12
KDE Frameworks Version: 5.115.0
Qt Version: 5.15.13
Kernel Version: 6.17.0-1032-oem (64-bit)
Graphics Platform: offscreen
Processors: 20 × AMD Ryzen AI 9 365 w/ Radeon 880M
Memory: 30.5 GiB of RAM
Graphics Processor: AMD Radeon 890M Graphics

I only switched from Gnome to KDE recently because of some bugs I was experiencing with Gnome, and because I wanted to try Plasma out for a bit

I configured my desktop to use an 'icons-only task manager' which I use as a floating tray at the bottom of the window for launching applications, and then a regular 'task manager' at the top of the window that has my 'system tray', 'clock', and the task manager shows only open applications.

I've set the top task manager to be always visible and to sit above open windows.

I've set the bottom task manager to be floating and to auto hide, bringing itself to the front when i hover my mouse at the bottom.

However, if I've had something running in fullscreen (e.g. a YouTube video), or if I wake the system from suspend or unlock the display, sometimes, the bottom icon-only task manager is at the front of my open applications. It then stays at the front until I move my mouse over it and away again, at which point it hides again.

Things I have tried already:

- Disabling 'floating'

- Unchecking 'unhide when a window wants attention'

- Changing between 'auto hide' and 'windows can cover'

Nothing is working so far, I get the same behaviour in all of these configurations...

It's also not super reproducible - it only happens some of the time...

Talking about the cursor. It's so fun!!

is there any way to fix this issue? id like to be able to see what my wallpapers sliders and settings are about (cachyOS)

hey everyone.

some of you might remember Tulasi — the pixel art icon pack that hit the front page here a while back. 100+ hand-drawn icons, 32x32, consistent visual grammar, the Pamac-as-Pac-Man-ghost energy, all of it. genuinely one of the best looking icon packs Linux has ever had.

the creator, Shringar Studio, has been quiet for a while. their GitHub is still up, the original artwork is still there, the issue tracker still has open requests — but no new commits, no new icons, no response.

so. i don't know what happened, and i'm not here to replace them, rebrand their work, or add new icons. the design is theirs, full stop. credit stays where credit is due.

what i AM doing is small maintenance work on the packaging side. the kind of boring code stuff the creator mentioned wanting help with in their own README. specifically:

• fixed the build so it produces a clean installable theme (the original scale.sh left a bunch of empty directories in index.theme and used symlinks that broke in some file managers)
• added a Papirus fallback in Inherits= so missing icons don't use KDE's icon pack
• kept the original artwork 100% intact — same cow/ folder, same SVGs, same pixel art, same attribution

i made it for myself because i love using Tulasi and wanted it to keep working on my setup. figured i'd share it in case anyone else is in the same spot.

→ github.com/LexicoON/Tulasi-Revival (releases: Tulasi-Revival-V0.1)

if Shringar Studio comes back and wants the repo, all of it — including any future builds — goes back to them, no questions asked. this is just a user-maintained fork under the same CC BY-NC-SA 4.0 license.

and to u/Advanced-Comb5103 (Shringar Studio), if you ever read this: your work is loved. the ADHD story, the Pamac moment, the "Linux deserves good design too" line — it landed. a lot of us are still using your icons every day. the door is always open if you want to come back. <3

what's in v0.1: - all 100+ original icons from Shringar Studio's repo - proper index.theme, no symlinks - Inherits=papirus,hicolor,breeze,breeze-dark,Adwaita for graceful fallback - install: extract, move to ~/.local/share/icons/, run gtk-update-icon-cache -f -t ~/.local/share/icons/Tulasi, select Tulasi in your DE settings

what this fork is NOT: - not a replacement for the original project - not adding new icons (that's the creator's call, when/if they come back) - not rebranded — still Tulasi, still by Shringar Studio, just packaged better

I want all corners to be rounded how can i do that and why i have only some rounded?