An issue with SSL was disclosed today: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
Roughly:
- The issue seems to break SSLv3 (a very old version of the SSL protocol).
- An attacker who controls a network may be able to force clients that would otherwise use a newer protocol version to downgrade to SSLv3 by interrupting connections, so this can affect users on modern machines.
This is a configuration issue, and Phabricator itself is not affected or vulnerable, per se. We can't do anything to prevent the issue, and I believe it would be very difficult for us to detect and warn about it in the software.
From an administrative perspective, I've responded by disabling SSLv3 on the `secure.phabricator.com` host. It is possible this may prevent a small number of users from reaching the host, but SSLv3 is quite old and apparently now broken, so these users need to fix their clients anyway. These users should basically all be on browsers/systems we don't support anyway (like IE6 on XP or older).
I'll keep an eye on things in the coming days and may adjust our response based on feedback or growing consensus in the security community about how to practically respond to this issue, but I suspect we're on solid ground here.