Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

141–150 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#141

Post by latexr »

bluehatbrit wrote: post #134
Wingy wrote: post #93

Earlier quoted context omitted.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all. I wonder if this is a regional or generational thing?

> I wonder if this is a regional or generational thing?

Generational is a good bet:

https://news.ycombinator.com/item?id=41537994

Re: Gaining access to anyones Arc browser without them even visiting a website

#142

Post by jeroenhd »

Semaphor wrote: post #22
water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

As I didn’t get that, it seems like the dev honors prefers-reduced-motion, and doesn’t display it in that case. Excellent of them, give joy to those who want it, prevent annoyances for those who hate them.

It does: https://github.com/adryd325/oneko.js/blob/main/oneko.js

       const isReducedMotion =
         window.matchMedia(`(prefers-reduced-motion: reduce)`) === true ||
         window.matchMedia(`(prefers-reduced-motion: reduce)`).matches === true;
     
       if (isReducedMotion) return;
Simple but effective. More websites should include this check. Well done, adryd325!

Re: Gaining access to anyones Arc browser without them even visiting a website

#143

Post by zachrip »

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff.

The real issue here is that someone wrote an api that trusted the client to tell it who they were. At the end of the day this is an amateur mistake that likely took a 1 line diff to fix. Don't believe me? Check out the docs: https://firebase.google.com/docs/rules/rules-and-auth#cloud-... - `request.auth` gives you the user id you need (`request.auth.uid`).

Re: Gaining access to anyones Arc browser without them even visiting a website

#144

Post by notoverthere »

serial_dev wrote: post #110
notoverthere wrote: post #92

Earlier quoted context omitted.

I tend to agree with this. Why re-invent the wheel by spending engineering effort building a CRUD backend? If you're trying to bring value to market, focus on your core differentiator and use existing tooling for your boilerplate stuff.

It’s the “chrome replacement we have been waiting for”, but (if I read this right), my data is still sent to Firebase? Also it’s a browser, not a “tinder but for cats” startup idea I’m writing for my cousin for a beer. It’s not only not a smart engineering decision, it’s also a terrible product, reputation and marketing decision.

I'm not disagreeing about the severity of the security vulnerability that has been uncovered – to be clear, it's an absolute shocker of a bug. It's really disappointing to see.

But I still disagree that the use of Firebase, in and of itself, is a bad engineering decision. It's just a tool, and it's up to you how you use it.

Firebase gives you all features needed to secure your backend. But if you configure it incorrectly, then _that's_ where the poor engineering comes into play. It should have been tested more comprehensively.

Sure. You could build your own backend rather than using a Backend-as-a-Service platform. But for what gain? If you don't test it properly, you'll still be at risk of security holes.

Re: Gaining access to anyones Arc browser without them even visiting a website

#145

Post by ko_pivot »

nottorp wrote: post #28
ko_pivot wrote: post #2

This is such a fantastic bug. Firebase security rules (like with other BaaS systems like Firebase) have this weird default that is hard to describe. Basically, if I write my own API, I will set the userId of the record (a 'boost' in this case) to the userId from the session, rather than passing it in the request payload. It would never even occur to a developer writing their own API past a certain level of experience…

> On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is. Tbh you're doing it wrong if you go that way. Default deny, and then you only have to imagine the legitimate uses.

Fair enough, but my point is more conceptual, in that you still have to write `boost.userId == auth.userId` as an allowed pattern rather than making that pattern the only technically possible result, which is the convention in a traditional API.

Re: Gaining access to anyones Arc browser without them even visiting a website

#146

Post by 0x1ceb00da »

johndough wrote: post #23
water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

On Debian, you can install and run the cat with sudo apt install oneko oneko & Makes a great gift for colleagues who leave their computer unattended.

You have sudo access to your colleagues computers?

Re: Gaining access to anyones Arc browser without them even visiting a website

#147

Post by rmbyrro »

aaomidi wrote: post #7
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

A couple? A vuln like this is worth >$1M very easily on the market.

Re: Gaining access to anyones Arc browser without them even visiting a website

#148

Post by pixxel »

Sakos wrote: post #124
hollywood_court wrote: post #119

Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.

Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.

[flagged]

Re: Gaining access to anyones Arc browser without them even visiting a website

#149

Post by girvo »

prmoustache wrote: post #66
aaomidi wrote: post #7

Earlier quoted context omitted.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

> You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that. only the 17 users they have. Shouldn't a government sue you if you try to sell him out vuln unless you personally know people in charge?

Arc has a lot more than 17 users. It’s surprisingly popular.
Post reply on HN