Please how can i download it

Aha! That works wonderfully. I think this is INVALID, then.

i'd like to remark that this ticket is supposed to be about perhaps u2f or other direct hardware security, not saml, and thus i've had to unsubscribe from the recent back and forth :)

It's possible that didn't get everything, but yell if you hit anything else and we can shovel on some more test cases. Thanks for the report!

Thanks for the fixes! Most folks are on Chrome at Dropbox, so Safari being subject to the Heisenprod Uncertainty Principle doesn't worry me much.

This is still not working very well for me in Safari in production, although I don't seem to be able to break it in Chrome or Firefox anymore after a few tries.

makes sense. thanks!

There may also be a similar attack possible by adding address in local network space as a JIRA install, outbound HTTP hook (unlikely a problem today, but maybe in the future), Phabricator OAuth install, LDAP server, etc. Today, we're generally balancing things as "by default, it's OK for administrators to register services in local network space".

Harbormaster and Diffusion do not use the outbound blacklist, since it would prevent users from interacting with local-network build hosts (for example, a local install of Jenkins) or local-network repositories (for example, a local install of GitHub Enterprise). We currently consider these use cases to be common / valuable.

In practice, every paying customer who has ever asked us about SAML has wanted to use OneLogin as a SAML provider. OneLogin's breach does not imply SAML is bad; it implies OneLogin is bad. For paying customers who are interested in understanding our stance on SAML support, criticism of OneLogin is materially relevant because they all want to use OneLogin.

Shouldn't this behavior be blocked by the default settings of security.outbound-blacklist? 169.254.0.0/16 appears in that list, but as you say, a Harbormaster fetch to http://169.254.169.254 succeeds as expected

@epriestley I'm not saying you didn't do a serious technical evaluation of SAML. I can't see where I might have even vaguely implied that? For all I know you could be an expert on SAML. I've done multiple SAML implementations and frankly I can't blame you for not wanting to do / maintain one.

Looks like it was deprecated a while ago, without explanation. Luckily, there's --log-junit, which we have some code to parse.

ahhhhh

Why do you believe I haven't performed a serious technical evaluation of SAML?

@epriestley I can see how that last sentence could be perceived as such. I probably should have put a smiley there since it wasn't intended as harsh as you (seem to) perceive it.

@epriestley yes, the tested owner packages were both weak dominion. Sorry for not mentioning that earlier. You've explained the issue perfectly as far as I can tell. The changes you have planned make a lot more sense than the current behavior and should fix the issues we were seeing. Thank you!

Why did you think that a sarcastic, condescending comment was the best way to convince me to reserve judgement?

@epriestley I'm hoping you'll see you shouldn't pass judgement that fast.

@siepkes, what are you hoping to get out of making that comment? How do you believe it benefits you?

@lvital, I can only reproduce this if use "Weak Dominion". Is that the case in your example, too?

@epriestley Onelogin does way more then just SAML. They also do OAuth for example. The screenshot also says to regenerate your Oauth keys. I assume your going to remove all OAuth stuff from Phabricator now?

This transaction uses shouldHideForFeed(), which isn't currently supported by Modular Transactions. It got swapped over in D17844 or some related change and we didn't catch that the logic wasn't firing anymore since this is a bit of an obscure case.

More on SAML:

My guess is they updated early in the week, saw the broken image, and updated and still saw the broken image. Not that they updated and tested the reproduction steps again.

Thanks - I didn't know about Herald and your answer was spot on!

Thanks, this reproduces here for me.

(This is still on my radar.)

I believe this was fixed by 7b290b94a726f7c9eb3efd9e065499fde1b0ad00. Are you 100% sure that the image was updated after that change?

Use tsprintf() ("terminal string print formatted") instead of phutil_console_format():

From T12771:

Global Rule for Differential Diffs
When:
[ Repository ] [ does not exist ]
Take these actions:
[ Block diff with message ] [ "Repository unrecognized. See https://helpful-docs.com/repository-help for details." ]

I think all the bad bad stuff is resolved and I'll have more design tweaks outside of this.

Oh! If it's just a comment on an item, admins can remove comment on the drop down on the item and it should also be removed from feed.

You're likely right. I'll move down both corridors and see what I find. The system is fine.

I get what you're asking, but professionally it feels like you're trying to put a band-aid on a broken bone. It needs to be addressed. As admin you should be able to nuke most things from CLI or DB.

Bad hires are not a reason to ask the upstream to prioritize work. Even if feed had "delete" it doesn't solve the emails that already left the system.

Task deletion usage:
Colleague submits something for archival, but accidentally leaves in a bunch of dramatic content which does not reflect positively on hisself.

需求故事收集看板

In T1026#224714, @epriestley wrote:

I currently expect to revert this change and decline to implement the feature because it makes using Differential on a phone more difficult for left-handed users

But most of all, it shouldn't depend on ... any bloated framework. That's why clipboard.js exists.

Yeah I'm surprised this seems to have reasonable adoption now.

Sorry I guess it is 5 lines:

I super hate that feature but it looks like it's literally three lines of JS. How does that repository have 18K stars? This is like left-pad v2.

Ah f*ck that's more node

family thing? Wouldn't you rather write a clipboard js implementation like https://github.com/zenorocha/clipboard.js

Yeah, I think we get even more design leeway here if we do T9713 and the actual commit page becomes less of "big blog of poorly aligned text" and more "list of revisions, tasks, diffs, builds" + "option to view raw".

So punt to improving commit pages?

(I've got some kind of family thing going on myself so I may not be around too much longer tonight.)

I think the link to the revision is probably the most generally useful piece of information, but we could replace this:

You can just click the commit title to get to builds/diffs/etc. GitHub has no direct link to builds/tasks/issues; GitLab has a direct link to builds only.

Imma get kids to be, then some diffs 4 u

In T12780#225628, @epriestley wrote:

The "Browse" buttons also don't actually do anything right now, but probably don't need an icon.

Maybe just a single status icon, that's a pass/fail, that's a menu with links to Tasks, Diffs, Builds?

The "Browse" buttons also don't actually do anything right now, but probably don't need an icon.