301–310 of 538 posts
According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?
I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.
I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…
Was the post written for HN users only? I cannot see it on your blog page ( https://arc.net/blog ). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.
Earlier quoted context omitted.
On the other hand, this is pretty impressive: aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh aug 25 6:02pm: vulnerability poc executed on hursh's arc account aug 25 6:13pm: added to slack channel after details disclosed over encrypted format aug 26 9:41pm: vulnerability patched, bounty awarded sep 6 7:49pm: cve assigned (CVE-2024-45489) Four hours from out-of-the-blue initial con…
Reacting fast is the least the vendor could do. Bare minimum. This should not be applauded. It should be treated as "well, at least they reacted at a reasonable speed so the root cause was probably not malice". In other words, a quick turnaround with a fix does not lessen the impact of being negligent about security when designing the product.
It's certainly the least a vendor should do, but it's absolutely not the least a vendor could do, as we see the vast majority of vendors do far, far less. It's worth holding people up and saying, "This is how you should be doing it."
Earlier quoted context omitted.
> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…
Nah, just ask ChatGPT.
It is remarkable that Arc has taken billions of dollars in VC cash but makes these rookie mistakes in securing their own backend that all of their users are accessing. Where are those billions of dollars going? Is it all just in marketing?
Earlier quoted context omitted.
> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…
Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.
And that's because a lot of devs think it's perfectly dandy to just put perfunctory docstrings in their methods, point it at whatever "doc generation" tool, wire it up to a github.io domain and call it a day.
There is a reason people crave, want and seek things like SO and blog-posts. They're packed full of insight, working examples and just plain old "how TF do you use this thing". Oh and of course, the "this problem A didn't work when using setup B and C, and that's because of reasons X,Y,Z. Here, try H,I & K and it'll work.