Grammarly is an ipso facto security hole that is extremely likely to be pwned or controlled outright by a number of state security services. It should be treated like malware.
The weirdest bug I've seen yet
261–270 of 334 posts
Re: The weirdest bug I've seen yet
#262What an interesting conflux of tech to create this bug. That's the web in 2023. I would love to know if it was a Chromium bug that got resolved, but navigating this is tough: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=gif... Also, I am fully here for Gusto posting this to say "wasn't our fault" and to throw some shade at Grammarly in the process
Something like this https://bugs.chromium.org/p/chromium/issues/detail?id=129770...
Re: The weirdest bug I've seen yet
#263As I was reading this I was thinking to myself "I wonder if it is grammarly related" because I experienced a bug some time ago that presented itself in a similar way. It was impossible to reproduce but affecting lots of people internally within certain departments. Eventually we figured out the thing they had in common was that they had the Grammarly extension installed. The other key thing was that the bug only appe…
Holy shit. I had a similar thing happen with some web based video surveillance software maybe 5 years ago.
A manager of some sort had his aging laptop replaced due to a company wide Windows 10 upgrade project. Super friendly older guy, probably in sales. IT went through all the procedures of inventorying software and network needs, backing up user profile and docs, etc. Great processes in place. I remember this because I saw the device assessment and it was like a 10 year old Thinkpad with 4G of RAM and a note saying he had to keep it plugged in at all times or it would shut down. Who puts up with that? Patience of a saint. Anyway.
Laptop was deployed by onsite IT to verify everything was gravy. All checked out except for Grammarly. License didn't get transferred properly or something so they had to put in a request to get his licensing working.
Fast forward a week and he gets his license key and Grammarly is tested good to go. He's checked off the list.
Later that day we get a call about not being able to see security cameras because the web page is crashing. Helpdesk tries the basics, reboot, clear cache, reinstall browser, rebuild profile, etc., nothing works and it gets escalated to me. I check the network, firewall logs, log into another PC, onsite, off-site, etc. All working for me, no one else having issues.
I tell him "I'm completely baffled here, have there been any changes lately? In your office? With your PC?" He jokingly says "Well yeah they installed Grammarly today maybe that's it?" We both laugh and I say well, I'm literally out of ideas, fuck it let's try it.
I remote in and uninstall Grammarly. "Ok go ahead and try the cameras lol". I then watch him open up Outlook, go to a folder named "Cameras", and open an email with a link to his cameras "home page". It fuckin worked. I turned Grammarly back on and clicked the link and sure enough it failed.
I made him a browser shortcut, moved his "email shortcuts" into his browser, blew his mind, and closed the ticket, but it definitely bugged me.
This tracks because it was some very dated camera software (you'll know what I mean if you've seen it) and the link was to his customized homepage with a super long php (or something) generated url. He was the only one at the site with Grammarly as well so it was the only time we saw the problem.
Thank you, I can finally close this cold case out in my brain.
Re: The weirdest bug I've seen yet
#264I gotta say, the ending was pretty disappointing. I was so hyped to learn why Grammarly crashes when Chrome loads a particular gif. What about the gif was different? What part of Grammarly made that happen? I hate to say it but this is modern web dev in a nutshell. Remove stuff until you find where the bug is, tweak it randomly until it's fixed, done. No root cause analysis or anything deep. This is a great post anyw…
> I hate to say it but this is modern web dev in a nutshell
I'd rather call it scientific method: observe, form a hypothesis, experiment and analyze results.
I agree it is anticlimatic to not know the root cause, but the rant about the current state of web dev seems out of place. We dont even know if it was because a web technology.
Some folks were mentioning issues from printers being caused by graphic cards drivers. One would love to blame printers, but it turned out they were not the culprit.
Re: The weirdest bug I've seen yet
#265Grammarly is awful. I remember
adding custom grammarly attributes to sensitive password fields so that Grammarly would not read and store our users' passwords inside their service. So nasty.
This company would sure make a great asset for the FBI, NSA and CIA given that they're so interested in snooping in on foreign language speakers; which happen to be grammarly's main demographic. The thing is malware.
Re: The weirdest bug I've seen yet
#266I randomly had the issue that after booting up Linux, I didn't have any sound. Turns out it was related to my Windows dual-boot setup! When restarting from Windows, Windows doesn't shut down my realtek audio device, but only puts it to sleep and Linux fails to start it. Only solution is to always do a shutdown from Windows and then hitting the power button. The issue is still there: https://askubuntu.com/questions/10…
turning off fast user switching didnt fix it?
Re: The weirdest bug I've seen yet
#267Earlier quoted context omitted.
> It turned out it was because of a bad regex in the grammarly extension that caused the page to hang if the domain name was more than about 100 characters. Just today I debugged a regex that would DoS our backend whenever the user enters the wrong thing in a form. Now I'm reading up on regex engines: https://swtch.com/%7Ersc/regexp/regexp1.html
Just in case you haven't seen the postmortem of the Cloudflare outage which also was caused by a regex based DoS: https://blog.cloudflare.com/details-of-the-cloudflare-outage...
That was a great read, but there was one thing I didn't understand: Why would the regex string have "." twice in a row? What does ".." find that "." doesn't find? Does that just mean "at least two characters"?
Re: The weirdest bug I've seen yet
#268Earlier quoted context omitted.
> The article implies that Gusto's employees can whatever browser they want. For users of their security-sensitive internal software? > And, honestly, telling your employees to run a browser that only techies have heard of sounds like a really dumb idea. Sounds like they're using this for internal tools, as a kind of thin-client layer. They could recommend or mandate a particular browser, and people would just use it…
As an employee I would be really upset if you forced me to use a specific browser to do my work.
I have been forced to use IE for some internal apps when I was working in investment banking. It's not that bad.
Re: The weirdest bug I've seen yet
#269Earlier quoted context omitted.
Just in case you haven't seen the postmortem of the Cloudflare outage which also was caused by a regex based DoS: https://blog.cloudflare.com/details-of-the-cloudflare-outage...
That was a great read, but there was one thing I didn't understand: Why would the regex string have ". " twice in a row? What does ". . " find that ". " doesn't find? Does that just mean "at least two characters"?
It means specifically 2 characters, and is equivalent to .{2}
..+ or ...* are ways of writing "at least two characters".
Re: The weirdest bug I've seen yet
#270As I was reading this I was thinking to myself "I wonder if it is grammarly related" because I experienced a bug some time ago that presented itself in a similar way. It was impossible to reproduce but affecting lots of people internally within certain departments. Eventually we figured out the thing they had in common was that they had the Grammarly extension installed. The other key thing was that the bug only appe…
I was so disappointed that the story ended with we can't look inside Grammerly or Chrome to know why the gif decode/rendering causes it to crash. This isn't interesting at all. Many problems get narrowed down to some combination but not knowing really why is unsatisfying.
It would be nice if the author would at least publish the .gif file. I want to dig into this.