Security issues found

[OmgImAlexis]

Hi where should I report a security issue I've found?

[dlandon]

Probably the best way is to PM gfjardim.

[bjoerns1983]

@dlandon is @gfjardim still around. Havent seen him in the unRaid forum since June, also no activity here on Github. I am a bit worried.

[dlandon]

Preclear is not needed any longer. If you feel you have to have it, there is a Docker container.

[bjoerns1983]

Sorry if thats a dumb question, but why is the step of preclearing not needed anymore. I thought it was a good way of testing a new disk before adding it to the array.
Nevertheless doesnt the docker use the same scripts, if they are unmaintained it maybe possible that they dont work on newer unraid versions.

[dlandon]

The history of preclear is that in early versions of Unraid, a disk had to be cleared and a proper signature on the disk indicating it was clear before installing it in the array. If Unraid did a clear, the array would be offline during the time the disk was being cleared. Not having the array available during a clear was a real issue. That's why it was called 'preclear'. As a sideline it would also exercise the disk to offer some confidence about it's reliability as people would install used disks when they were not as affordable as they are now. You really don't need to exercise a new disk these days.

There are several people who can maintain the preclear script. I don't think there have been any changes needed for years. There are also some SMART disk functions that will exercise a disk.

[RVijay007]

Why do new disks not need to be exercised before trusting valuable data to them? What makes the new drives better in this regard?

[dlandon]

It's not necessary, but some feel more comfortable running a preclear. When I add or replace a disk in my array, I just install it and go. Never had a problem.

If you are that concerned about protecting your data, keep it backed up. The parity in Unraid is not a backup.

This started with your concern about not being able to do a preclear potentially because of lack of support. There are options for doing a preclear, and there are people here that can work on the script.

[bjoerns1983]

Thanks for the clearification. Nevertheless i hope that @gfjardim is okay. When somebody vanishes from Communites like Github etc. from one day to another thats normally no good sign.

May the security issues that @OmgImAlexis are mentioned should be explained here. Maybe someone else could fix them.

[dlandon]

@gfjardim has a reputation of being off the forums at times, so I would be concerned about him.

Since there is a Docker container that does a preclear, I doubt there is any interest from developers to work on this plugin.