If they can figure it out, they're sitting on potentially a very valuable exploit.
Yes, I too would like to read more details about this. It's a great writeup from an engineer who got stuck debugging this. But I hope some experts in security or reverse-engineering can replicate it and take a closer look. There's definitely a more interesting story here, probably regarding the localhost bridge between Grammarly extension and desktop. (Grammarly has a bug bounty btw... and their chrome extension has…
The weirdest bug I've seen yet
151–160 of 334 posts
Re: The weirdest bug I've seen yet
#152The other key thing was that the bug only appeared on our staging preview urls, not on the live website. It turned out it was because of a bad regex in the grammarly extension that caused the page to hang if the domain name was more than about 100 characters. Our staging domains were pretty long, I think they contained a few subdomains and had a job number or something in there.
This one is more crazy though if it is really caused by the desktop app - that's pretty scary!
Re: The weirdest bug I've seen yet
#153> Using open-source Chromium instead of Chrome did not cause crashes, so we couldn’t see what Chrome code was failing either. They don't address why they didn't just run Chromium. Or Firefox. (This is potentially better than the 'solution' they much later ended up with, in which they probably only relieved a symptom of an underlying problem that can exhibit again, and in the meantime is a zero-day exploit waiting to…
> They don't address why they didn't just run Chromium. Or Firefox. The article implies that Gusto's employees can whatever browser they want. And, honestly, telling your employees to run a browser that only techies have heard of sounds like a really dumb idea.
For users of their security-sensitive internal software?
> And, honestly, telling your employees to run a browser that only techies have heard of sounds like a really dumb idea.
Sounds like they're using this for internal tools, as a kind of thin-client layer. They could recommend or mandate a particular browser, and people would just use it. ("Click this icon, and a window opens with our internal tool. It's pretty much the same as any other browser, as far as you care.")
Re: The weirdest bug I've seen yet
#154Once my college professor was working on her research paper and told me she was struggling get text to stay underlined. Assuming a simple user error, I expected to help her out in 5 minutes. Over three hours later, we discovered that the combo of her specific video card driver version along with her specific printer driver version would keep text from printing out underlined.
Huh? How does a video card affect printing?
Re: The weirdest bug I've seen yet
#155Earlier quoted context omitted.
Yes, I too would like to read more details about this. It's a great writeup from an engineer who got stuck debugging this. But I hope some experts in security or reverse-engineering can replicate it and take a closer look. There's definitely a more interesting story here, probably regarding the localhost bridge between Grammarly extension and desktop. (Grammarly has a bug bounty btw... and their chrome extension has…
It wasn't the Grammarly extension, it was the desktop app.
Grammarly is honestly insane, I can't believe corporations allow it to run on employee machines.
Re: The weirdest bug I've seen yet
#156Earlier quoted context omitted.
There are a lot of people whose professional outcomes are meaningfully constrained by their ability produce clear business English. I know a guy who used to get inexplicable feedback about his communication that boiled down to “write better.” This limited his ability to get promoted. He runs all his comms through ChatGPT and asks it to “make this more professional” and doesn’t get that feedback anymore.
I suspect it all started with two Ukrainian who got tired of checking how much of "a" and "the" they forgot to sprinkle into their texts.
It's things like:
- total stream-of-consciousness gibberish that could probably be assembled into a coherent statement if the writer would re-read what they wrote and edit it
- A complete lack of punctuation, or even understanding of sentence and paragraph structure; at a glance, it looks like what I described above, but it's different because there's definitely a topic and a point they're looking to make, but they can't put the words together correctly.
- spelling so bad, that even with context, it's unclear what word they're intending to use.
- A wild misunderstanding of how to start and stop conversations online. (One recent example is me asking someone on Facebook if I could stop by to check out a garage sale, and a clarifying question about a term they used, only to get the response "ok." Note that in their post, they didn't specify an address beyond the name of the town they live in.)
You can definitely point out flaws in the way I grew up - somewhat solitary, spending a lot of time alone in my room on a computer connected to the internet - but I think that it at least taught me how to make myself understood in written form.
Re: The weirdest bug I've seen yet
#157Earlier quoted context omitted.
There are a lot of people whose professional outcomes are meaningfully constrained by their ability produce clear business English. I know a guy who used to get inexplicable feedback about his communication that boiled down to “write better.” This limited his ability to get promoted. He runs all his comms through ChatGPT and asks it to “make this more professional” and doesn’t get that feedback anymore.
I get that people don't care or understand this, but that's also saying he cc's OpenAI, and therefore probably Microsoft, and therefore almost definitely the NSA, on all his business communications. What a world.
Re: The weirdest bug I've seen yet
#158Earlier quoted context omitted.
Does Grammerly hook something in Chrome? If not, then it's still probably a Chrome bug, even if some second-order effect of Grammerly is necessary to trigger it.
I'm thinking the same thing. It could be that Grammerly injects it's own loading spinner with the same filename into the HTML. I wish they tried to simply rename the file instead of remove it.
I would guess grammarly is hooking chrome and potentially trying to read metadata about images, and the particular gif had metadata in a format they hadn't expected.
Re: The weirdest bug I've seen yet
#159Once my college professor was working on her research paper and told me she was struggling get text to stay underlined. Assuming a simple user error, I expected to help her out in 5 minutes. Over three hours later, we discovered that the combo of her specific video card driver version along with her specific printer driver version would keep text from printing out underlined.
Huh? How does a video card affect printing?
Re: The weirdest bug I've seen yet
#160When restarting from Windows, Windows doesn't shut down my realtek audio device, but only puts it to sleep and Linux fails to start it. Only solution is to always do a shutdown from Windows and then hitting the power button. The issue is still there: https://askubuntu.com/questions/1032543/no-sound-in-ubuntu-1...