Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

131–140 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#131
post #121

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

What sort of data does Arc track? Our plain-english Privacy Policy summarizes it well: We don’t know which websites you visit

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#132
post #52

According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?

I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.

Re: Gaining access to anyones Arc browser without them even visiting a website

#134
post #93
post #78

Earlier quoted context omitted.

It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all.

I wonder if this is a regional or generational thing?

Re: Gaining access to anyones Arc browser without them even visiting a website

#135
post #93
post #78

Earlier quoted context omitted.

It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

> lowercase without caps reads with a warmer, informal tone

Personally, and I’m certain I’m not alone on this, it reads as annoying. It’s harder to follow and looks as if the writer didn’t care to do the bare minimum to make the text accessible and clear to the reader.

> there’s a Tom Scott Language Files video documenting it

Per that video (thank you for sharing), capital letters “make a paragraph easier to read” and “context matters” and “the conventions change fairly quickly” and typing in all lowercase is “sometimes okay”.

This is a post documenting a serious browser vulnerability, shared to the wide internet, not an informal conversation between buddies. Clarity matters. I don’t fully buy the tone argument and find words and sentence structure are more important. Take the following two examples:

> Just heard about your promotion, you beautiful bastard! Let’s go get pissed to celebrate, on me!

And:

> good afternoon mrs bartlet. the limousine will be available in twenty minutes. i would also like to apologise for my behaviour yesterday when i inadvertently insulted your husband it was a faux pas i promise will not be repeated. my resignation will be on your desk by noon.

I get that language evolves. You do you. Personally I hope this trend subsides like so many others before it. Maybe you don’t like to read properly structured text and prefer all lowercase. My preference is the reverse. And that’s OK, we don’t all have to be the same. I merely wish that people who prefer a certain style understand not everyone will see it the same way they do (and I’m including myself).

Re: Gaining access to anyones Arc browser without them even visiting a website

#136

Earlier quoted context omitted.

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

Have you tried Vivaldi? It's really customizable and has a lot of features.

Re: Gaining access to anyones Arc browser without them even visiting a website

#139
post #117
post #85

Earlier quoted context omitted.

On the other hand, this is pretty impressive: aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh aug 25 6:02pm: vulnerability poc executed on hursh's arc account aug 25 6:13pm: added to slack channel after details disclosed over encrypted format aug 26 9:41pm: vulnerability patched, bounty awarded sep 6 7:49pm: cve assigned (CVE-2024-45489) Four hours from out-of-the-blue initial con…

Reacting fast is the least the vendor could do. Bare minimum. This should not be applauded. It should be treated as "well, at least they reacted at a reasonable speed so the root cause was probably not malice". In other words, a quick turnaround with a fix does not lessen the impact of being negligent about security when designing the product.

[dead]
Post reply on HN