yay

literally, your patch is identical to mine, except those characters

This doesn't quite fix it. /diffusion/new has this:

Yeah, should be restarted with my custom dumb script:

• Mark file metadata as 'deleted' in controller

Fix usage of public vs protected

(This isn't done yet, because once you click Delete the daemon task isn't immediately queued up, meaning it looks like the file is still in the UI for a little while.)

Actually, now that I think about it, the chunked representation overlays the underlying object storage system, so file.info by itself isn't enough - it needs to also extend file.querychunks.

Actually, now that I think about it, the chunked representation overlays the underlying object storage system, so file.info by itself isn't enough - it needs to also extend file.querychunks.

I think adding it to conduit is a good compromise; there's very little that's useful in the UI, and if anyone complains about something it should be easy enough to pin just using file.info. file.info already is very short anyway, so adding a fileHandle field should be relatively kosher, I think.

Try again.

Attempt a staging push with my SSH key, now.

I've confirmed this fixed our instance of T10234 on phabricator.haskell.org

Update: I freshly reinstalled Phabricator on Ubuntu 14.04, and couldn't reproduce this... but between the three instances there's very little in common. I'd never enabled Almanac stuff before on my other instance, and never on Haskell.org, but those exhibit this bug. A fresh install does not seem to, and there doesn't seem to be a stack trace.

In T9716#143297, @epriestley wrote:

Someone else ran into issues with Rocket Loader too, although everything broke completely for them in Chrome (although fine in Safari).

Hitting this means you have your primary install behind CloudFlare, right? Not just the file domain? Do you have any particular reasons for doing that? I don't normally expect installs to put both domains behind CloudFlare.

Just as a note: I was thinking about this, and in fact, I cooked up a small (untested) patch for it to require Administrators to have MFA (see end of post) through a new setting.

One more vote from Haskell.org: I appreciate all the help in the past, but even then I am also of the opinion you should end the real time support. I think moving to something like a daily queue with Nuance is probably the best bet. I know for a fact we've pinged @epriestley more than once with breaking issues since we kind of live on the edge but for the most part all of our components are now very stable and I doubt they will fundamentally change soon, so we can live with the slight breakages sometimes (with solid backups upon every update of Phabricator).

Yup, confirmed fixed. Thanks again y'all!

Looks like it's fixed, thanks!

The source code for my extension is available here: https://github.com/thoughtpolice/libphutil-yubikey

I'll also note that my perspective is probably somewhat skewed, because I sometimes often jump into high security mode because I use things like Passphrase a lot to manage credentials - so cutting down the time from "take out phone and fiddle with application" to "touch my USB port" is a nice win for me. (For mobile apps, I actually prefer Duo Security since it takes it from "fiddling" to "push notification I confirm from lock screen".)

You do need an API key to talk with their servers - but you can get an API key for free with your Yubikey that allows use of their service as you need. So, the administrator just needs to have a registered Yubikey on their service and request an API token, then configure Phabricator to use it (the extension also adds configuration options into /config to do this properly.) Users don't need to configure anything; they just need a registered key (which it comes with out of the box).

Yup, thanks!

Related, the actual summary the UI box gives me when the exception is thrown is: