<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div> </div>
<div>
<div><b>Envoyé:</b> samedi 27 février 2021 à 12:02</div>
<div style="margin:0 0 10px 0;"><b>De:</b> <pascal.martine@gmx.fr></div>
<div style="margin:0 0 10px 0;"><b>À:</b> laney@debian.org, jbicha@debian.org, bigon@debian.org, tim@feathertop.org<br/>
<b>Objet:</b> Very DANGEROUS BUG in gnome-disk-utility : <strong>USER COULD DELETE THE HARD DISK BY MISTAKE WITHOUT ANY PASSWORD</strong></div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div name="quoted-content">
<div style="font-family: Verdana;font-size: 12.0px;">
<div> </div>
<div>Hi,</div>
<div> </div>
<div>I am writing to you because I have discovered a very dangerous bug in gnome-disk-utility and don't understand much about the debian bug tracking system. Still that bug really must be noticed.</div>
<div>I am now on debian 11 bullseye testing and that bug was already present on debian 10 buster and so probably before too.</div>
<div> </div>
<div>Please excuse my possibly bad english, I am french.</div>
<div> </div>
<div>Usage description :</div>
<div>- You use gnome-disk-utility (graphical interface) and you want to copy an ISO image on a USB stick.</div>
<div>- You insert your USB stick, you click on USB on the left of the gnome-disk-utility window.</div>
<div>- You then choose the "Restore Disk Image..." (translation of the french "Restaurer l'image disque..." which by the way does not sound quite clear for what we want to do).</div>
<div>- When you have chosen the ISO file to put on the USB stick, the software comes with a window that says "Begin restoration..." (translation of the french "Démarrer la restauration...".</div>
<div>- You click on "Démarrer la restauration" and then another window says "Cancel/Restore" (french : "Annuler/Restaurer").</div>
<div>- You click on "Restore" (french "Restaurer") and the software asks you for necessary authentification (password) (french "Authentification nécessaire").</div>
<div> </div>
<div><span style="font-size:16px;"><strong>BUG</strong></span> : At that point, EVEN IF YOU CLICK "CANCEL" (french "ANNULER"), THE CONTENT OF YOUR USB STICK IS <strong>LOST, ERASED</strong>, the usb stick is formatted anyway.</div>
<div>And a big concern is : What would have happened if, by mistake you had clicked on the <strong>hard disk</strong> (HDD) instead of the USB stick as a destination for your ISO image ?? It would certainly have been erased too, without even having given any password !! A child or tired person could erase the hard disk that way.</div>
<div> </div>
<div>----------------------------------</div>
<div> </div>
<div>On a lighter side, I must say that gnome (3.38) has had huge improvements recently, everything seems to be working better and quicker, even animations which did not work at all with debian buster / stretch, at least on my laptop. Even those bugs, when clicking around the top/left of the screen, seem to have disappeared.</div>
<div>Congratulations for all your work and that gnome interface which for all its elegance and simplicity, and despite the annoying bugs, remains my favourite.</div>
<div>Cordially.</div>
<div> </div>
</div>
</div>
</div>
</div>
</div></div></body></html>