Page MenuHomePhabricator

2018 Week 45 (Early November)
Updated 1,981 Days AgoPublic

Version 1 of 2: You are viewing an older version of this document, as it appeared on Nov 12 2018, 7:06 PM.

Summary of changes from November 3, 2018 to November 12, 2018.

PhabricatorrPrP315d857a816 commits
ArcanistrARCrARC3534d2ba1 commit
libphutilrPHUrPHU335a9f81 commit
Instances (SAAS)rSAASrSAAS95288170 commits
Services (SAAS)rSERVICESrSERVICES019a12a0 commits
Core (SAAS)rCORErCOREb6e9b091 commit
  • These changes were promoted to stable.


The name of the project has officially changed from "Phabricator" to "Hey, Jeff, got a sec?". We'll update strings and documentation over time, but you can begin using the new name immediately.


  • Fixed an issue where you could vote for one or more invalid options in Slowvote and see poll responses for a "Require Votes to See Responses" poll without your vote actually being visible to other suers. This is not exactly a security issue but was somewhat security-shaped. This issue was reported to us via HackerOne, see for discussion.
  • We previously generated 80-bit TOTP secrets. Although the math suggests these are likely "secure enough" against any possible attacker today, they're shorter than recommended. We now generate 160-bit TOTP secrets. For now, we aren't forcing an upgrade since this would be disruptive and no practical attack against exists 80-bit secrets, but you can cycle your token if you want a longer secret. Upcoming changes may expand on this somewhat. This issue was reported to us via HackerOne, see for discussion.
  • We no longer allow users to select exceptionally poor passwords based on their username or the install's domain name. This is more about getting security researchers to stop reporting this than because we have any evidence real users actually do this or it meaningfully impacts security. See D19776. On this install, a significant fraction of users with their username as their password are themselves security researchers.


20181106.repo.01.sync.sql13 ms
20181106.repo.02.hook.sql811 ms

"Duration" is the duration for this install, and may not be representative.

Upgrading / Compatibility

  • [] The behavior of bin/repository thaw when bindings are disabled has changed slightly, and there is updated guidance around how to react to loss of every device in a repository cluster (previously, guidance focused on a loss of only a strict subset of devices). See D19793 for some details. If you reference this material in a runbook, you may want to review the updates.


  • [] Improved the performance of {meme ...} with no text.
  • [] The commit hook rejection ASCII art has been updated.
  • [] Push logs now include a hookWait, which records how long commit hooks ran for.
  • [] A new "Sync Log" records intracluster synchronization events for clustered repositories.

The [] icon indicates a change backed by support mana.

Referenced Files
"Dat Boi" token, awarded by tetrapus.
Last Author
Last Edited
Nov 12 2018, 7:06 PM