I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q
That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all. I wonder if this is a regional or generational thing?
It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.
I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q
It's extremely irritating, distracting, and breaks focus on the content instead of the annoying stylistic choice, just an fyi..but I imagine you probably like that this is true and purposely try to annoy the people that aren't in the little club. If not, then I suggest not doing it. The tone I perceive from it is "F**** the reader"
> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…
Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.
I often wonder how much this can be attributed to the pretty awful SEO of most documentation. I write mostly Python at work and it's infuriating how often GeeksForGeeks, W3Schools, Programiz, or RealPython pop up when I'm just trying to reference like, the arg order of a builtin, or the particular behavior. Django is worse, I often feel like I can't even find the doc when I know it's there and read it before.
I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…
At the end of the day this is an amateur mistake God I wish. More than one of my coworkers has made this exact mistake with our (thankfully internal) front-end apps.
Are you defining amateurs as people who are not your coworkers? It can still be an amateur mistake.
I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…
Was the post written for HN users only? I cannot see it on your blog page (https://arc.net/blog). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.
At the end of the day this is an amateur mistake God I wish. More than one of my coworkers has made this exact mistake with our (thankfully internal) front-end apps.
Are you defining amateurs as people who are not your coworkers? It can still be an amateur mistake.
Coworker implies paid work, and therefore they are not amateurs. They very well may make the same mistakes, but those mistakes would be professional mistakes.
Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase. Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.
> Firebase's authentication model is inherently broken I'm not very familiar with Firebase. In what way is it broken and what issues does it cause?
The fact that clients write directly into the database and that it's widely encouraged.
There are security rules in Firebase to prevent this, but bolt-on security models that the user has to explicitly enable haven't shown to work.
I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…
> We’re also bolstering our security team, and have hired a new senior security engineer.
Is there a reason why you don’t have any security-specific positions open on your careers site?
Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.
my brother uses arc browser , he is a developer . I think he saw it from somebody using it (maybe theo t3 or some other creator he watches) , and he found it cool (plus there were lot of videos flooded with saying arc is really great IDK) If someone finds something cool on the internet. They are going to try it , given that they are capable to do so. He had a mac so he was able to do so , Even I tried to run arc on w…
> He had a mac so he was able to do so
How? I have mac as well but when I've download it some time ago it required login. Has that changed?
I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.
Truly. I was looking for a privacy respecting Chromium-based browser to use for Web MiniDisc ( https://web.minidisc.wiki/ ) and came across some enthusiastic praise for Arc. I downloaded it and it immediately wanted me to create an account to even use it. How can that possibly respect my privacy? It went right in the trash.
What is also strange that I only found out about account after download. Like it was standard thing for the browser. (Sure there are optional accounts in others but login-walled browser?)