It is remarkable that Arc has taken billions of dollars in VC cash but makes these rookie mistakes in securing their own backend that all of their users are accessing. Where are those billions of dollars going? Is it all just in marketing?
Gaining access to anyones Arc browser without them even visiting a website
281–290 of 538 posts
Re: Gaining access to anyones Arc browser without them even visiting a website
#282Earlier quoted context omitted.
I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text la…
It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.
Social media? I remember people doing the lowercase thing back on IRC. It was an indicator of informality and "coolness".
Re: Gaining access to anyones Arc browser without them even visiting a website
#283Great catch ! Also very cool to know a bit more about the tech they are using.
Re: Gaining access to anyones Arc browser without them even visiting a website
#284I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…
Pay the guy properly. $2000 is an insult. It should be $50k. This kind of bug could be sold for 100-200k easily.
[deleted]
Re: Gaining access to anyones Arc browser without them even visiting a website
#285Re: Gaining access to anyones Arc browser without them even visiting a website
#286Earlier quoted context omitted.
As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.
> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…
Nah, just ask ChatGPT.
Re: Gaining access to anyones Arc browser without them even visiting a website
#287I wish we didn't have to sign up to use a browser in the future
With Brave you don't need to, even for sync.
Re: Gaining access to anyones Arc browser without them even visiting a website
#288I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…
Was the post written for HN users only? I cannot see it on your blog page ( https://arc.net/blog ). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.
Not a good look it not being on the main page! I personally use [zen browser](https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.
Re: Gaining access to anyones Arc browser without them even visiting a website
#289Oop and I just convinced my wife and brother to move over :o Props to her, she asked about the security and privacy of the browser and I played it off with some fanboy propaganda. Lesson learned on that one. If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now?
I just use Brave with a shitton of profiles. That does cause problems for mobile use since no Android browser dev has bothered with proper profiles or ability to install multiple copies of the browser, except for Google I guess.
Re: Gaining access to anyones Arc browser without them even visiting a website
#290Earlier quoted context omitted.
Nobody reads docs dude. They copy and paste stack overflow answers, and now, copilot answers, which is going to be based on stack overflow ultimately anyway.
Maybe docs should try to be consistently more accurate, up to date, and legible than (even) stack overflow answers ¯ \ _ ( ツ ) _ / ¯
I have heard this said by many people: “I don’t look at documentation because it usually is inaccurate/out of date”
There’s plenty of people sharing anecdata about bad docs, and I’ve dealt with my fair share. But my anecdata is that engineers who habitually go to the docs directly and read them gain a better understanding and write better software than those who do not. I believe that most software for engineers has documentation that is more informative than stack overflow and blog posts.