2018 Week 45 (Early November)

Updated 1,990 Days AgoPublic

Actions

Summary of changes from November 3, 2018 to November 12, 2018.

• These changes were promoted to stable.

General

The name of the project has officially changed from "Phabricator" to "Hey, Jeff, got a sec?". We'll update strings and documentation over time, but you can begin using the new name immediately.

Security

• Fixed an issue where you could vote for one or more invalid options in Slowvote and see poll responses for a "Require Votes to See Responses" poll without your vote actually being visible to other suers. This is not exactly a security issue but was somewhat security-shaped. This issue was reported to us via HackerOne, see https://hackerone.com/reports/434116 for discussion.
• We previously generated 80-bit TOTP secrets. Although the math suggests these are likely "secure enough" against any possible attacker today, they're shorter than recommended. We now generate 160-bit TOTP secrets. For now, we aren't forcing an upgrade since this would be disruptive and no practical attack against exists 80-bit secrets, but you can cycle your token if you want a longer secret. Upcoming changes may expand on this somewhat. This issue was reported to us via HackerOne, see https://hackerone.com/reports/435648 for discussion.
• We no longer allow users to select exceptionally poor passwords based on their username or the install's domain name. This is more about getting security researchers to stop reporting this than because we have any evidence real users actually do this or it meaningfully impacts security. See D19776. On this install, a significant fraction of users with their username as their password are themselves security researchers.

Migrations

"Duration" is the duration for this install, and may not be representative.

Upgrading / Compatibility

• [] The behavior of bin/repository thaw when bindings are disabled has changed slightly, and there is updated guidance around how to react to loss of every device in a repository cluster (previously, guidance focused on a loss of only a strict subset of devices). See D19793 for some details. If you reference this material in a runbook, you may want to review the updates.
• Some qsprintf/queryfx() semantics will change in a future version of Phabricator. If you run custom extensions, you may want to begin evaluating these changes. See T13217 for details.

Minor

• [] Improved the performance of {meme ...} with no text.
• [] The commit hook rejection ASCII art has been updated.
• [] Push logs now include a hookWait, which records how long commit hooks ran for.
• [] A new "Sync Log" records intracluster synchronization events for clustered repositories.

The [] icon indicates a change backed by support mana.