Live data from Hacker News

The weirdest bug I've seen yet

engineering.gusto.com

151–160 of 334 posts

Re: The weirdest bug I've seen yet

#151

If they can figure it out, they're sitting on potentially a very valuable exploit.

Yes, I too would like to read more details about this. It's a great writeup from an engineer who got stuck debugging this. But I hope some experts in security or reverse-engineering can replicate it and take a closer look. There's definitely a more interesting story here, probably regarding the localhost bridge between Grammarly extension and desktop. (Grammarly has a bug bounty btw... and their chrome extension has…

I'd also be interesting in seeing the raw .gif file - as a hobbyist wannabe researcher myself, I'd love to investigate this.

Re: The weirdest bug I've seen yet

#152
As I was reading this I was thinking to myself "I wonder if it is grammarly related" because I experienced a bug some time ago that presented itself in a similar way. It was impossible to reproduce but affecting lots of people internally within certain departments. Eventually we figured out the thing they had in common was that they had the Grammarly extension installed.

The other key thing was that the bug only appeared on our staging preview urls, not on the live website. It turned out it was because of a bad regex in the grammarly extension that caused the page to hang if the domain name was more than about 100 characters. Our staging domains were pretty long, I think they contained a few subdomains and had a job number or something in there.

This one is more crazy though if it is really caused by the desktop app - that's pretty scary!

Re: The weirdest bug I've seen yet

#153
post #82
post #63

> Using open-source Chromium instead of Chrome did not cause crashes, so we couldn’t see what Chrome code was failing either. They don't address why they didn't just run Chromium. Or Firefox. (This is potentially better than the 'solution' they much later ended up with, in which they probably only relieved a symptom of an underlying problem that can exhibit again, and in the meantime is a zero-day exploit waiting to…

> They don't address why they didn't just run Chromium. Or Firefox. The article implies that Gusto's employees can whatever browser they want. And, honestly, telling your employees to run a browser that only techies have heard of sounds like a really dumb idea.

> The article implies that Gusto's employees can whatever browser they want.

For users of their security-sensitive internal software?

> And, honestly, telling your employees to run a browser that only techies have heard of sounds like a really dumb idea.

Sounds like they're using this for internal tools, as a kind of thin-client layer. They could recommend or mandate a particular browser, and people would just use it. ("Click this icon, and a window opens with our internal tool. It's pretty much the same as any other browser, as far as you care.")

Re: The weirdest bug I've seen yet

#154

Once my college professor was working on her research paper and told me she was struggling get text to stay underlined. Assuming a simple user error, I expected to help her out in 5 minutes. Over three hours later, we discovered that the combo of her specific video card driver version along with her specific printer driver version would keep text from printing out underlined.

Huh? How does a video card affect printing?

A lot of rendering will go through the video card if available, like the jvm does this as an optimization.

Re: The weirdest bug I've seen yet

#155
post #140

Earlier quoted context omitted.

Yes, I too would like to read more details about this. It's a great writeup from an engineer who got stuck debugging this. But I hope some experts in security or reverse-engineering can replicate it and take a closer look. There's definitely a more interesting story here, probably regarding the localhost bridge between Grammarly extension and desktop. (Grammarly has a bug bounty btw... and their chrome extension has…

It wasn't the Grammarly extension, it was the desktop app.

I guess I just assumed the extension was installed too, and communicating with the desktop app. But now I see the post doesn't mention the extension. If it was triggered even without the presence of the extension then that's quite strange, and even more suspicious - is that gif triggering a call to a localhost endpoint? Is the grammarly desktop app interacting with browser elements without using the extension? (IIRC the grammarly app uses some accessibility privileges to inject into textareas across all apps)

Grammarly is honestly insane, I can't believe corporations allow it to run on employee machines.

Re: The weirdest bug I've seen yet

#156

Earlier quoted context omitted.

There are a lot of people whose professional outcomes are meaningfully constrained by their ability produce clear business English. I know a guy who used to get inexplicable feedback about his communication that boiled down to “write better.” This limited his ability to get promoted. He runs all his comms through ChatGPT and asks it to “make this more professional” and doesn’t get that feedback anymore.

I suspect it all started with two Ukrainian who got tired of checking how much of "a" and "the" they forgot to sprinkle into their texts.

I read comments online, and in my experience the most difficult writing to parse isn't from foreign speakers who drop articles or mis-conjugate things - it's from people whose writing is just, for the lack of a better term, bad. This is very common on places like Nextdoor or Facebook.

It's things like:

- total stream-of-consciousness gibberish that could probably be assembled into a coherent statement if the writer would re-read what they wrote and edit it

- A complete lack of punctuation, or even understanding of sentence and paragraph structure; at a glance, it looks like what I described above, but it's different because there's definitely a topic and a point they're looking to make, but they can't put the words together correctly.

- spelling so bad, that even with context, it's unclear what word they're intending to use.

- A wild misunderstanding of how to start and stop conversations online. (One recent example is me asking someone on Facebook if I could stop by to check out a garage sale, and a clarifying question about a term they used, only to get the response "ok." Note that in their post, they didn't specify an address beyond the name of the town they live in.)

You can definitely point out flaws in the way I grew up - somewhat solitary, spending a lot of time alone in my room on a computer connected to the internet - but I think that it at least taught me how to make myself understood in written form.

Re: The weirdest bug I've seen yet

#157

Earlier quoted context omitted.

There are a lot of people whose professional outcomes are meaningfully constrained by their ability produce clear business English. I know a guy who used to get inexplicable feedback about his communication that boiled down to “write better.” This limited his ability to get promoted. He runs all his comms through ChatGPT and asks it to “make this more professional” and doesn’t get that feedback anymore.

I get that people don't care or understand this, but that's also saying he cc's OpenAI, and therefore probably Microsoft, and therefore almost definitely the NSA, on all his business communications. What a world.

I've seen people do this on the same week as mandatory trainings featuring this exact scenario. At multiple companies

Re: The weirdest bug I've seen yet

#158

Earlier quoted context omitted.

Does Grammerly hook something in Chrome? If not, then it's still probably a Chrome bug, even if some second-order effect of Grammerly is necessary to trigger it.

I'm thinking the same thing. It could be that Grammerly injects it's own loading spinner with the same filename into the HTML. I wish they tried to simply rename the file instead of remove it.

The pr seems to suggest it's not the filename though given the new file was named the same and didn't crash.

I would guess grammarly is hooking chrome and potentially trying to read metadata about images, and the particular gif had metadata in a format they hadn't expected.

Re: The weirdest bug I've seen yet

#159

Once my college professor was working on her research paper and told me she was struggling get text to stay underlined. Assuming a simple user error, I expected to help her out in 5 minutes. Over three hours later, we discovered that the combo of her specific video card driver version along with her specific printer driver version would keep text from printing out underlined.

Huh? How does a video card affect printing?

It often did, particularly on older versions of Windows. I helped uncover a bug in Epson printer drivers ~20 years ago that was caused by a specific graphics card.

Re: The weirdest bug I've seen yet

#160
I randomly had the issue that after booting up Linux, I didn't have any sound. Turns out it was related to my Windows dual-boot setup!

When restarting from Windows, Windows doesn't shut down my realtek audio device, but only puts it to sleep and Linux fails to start it. Only solution is to always do a shutdown from Windows and then hitting the power button. The issue is still there: https://askubuntu.com/questions/1032543/no-sound-in-ubuntu-1...

Post reply on HN