Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

311–320 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#311

Post by zo1 »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Until this individual comes back and responds to at least a few of the questions/comments, I don't think we should even pay attention to this marketing-dept-written post. They basically want this to go away, and answering any questions would raise more issues most likely, so they just seemed to have done the bare minimum and left it at that. It's 3 hours later now, they might as well have not even posted anything here.

Re: Gaining access to anyones Arc browser without them even visiting a website

#312

Post by Spivak »

bruh2 wrote: post #155
shepherdjerred wrote: post #15

$2000 is an insulting amount for such a huge vuln

Judging by blog posts on HN, I got the impression that these vulnerabilities are often not rewarded at all, or rewarded by a minuscule amount. It almost seems like companies are begging hackers to sell these exploits. Perhaps because they aren't penalized by the regulator for breaches?

They offer a low price because the risk of tanking your career, landing yourself in jail, and the fact that the researcher probably doesn't know how to line up a sale means the company is the only buyer.

I would go the other way, companies offer low bug bounties because they don't want researchers to discover them in the first place. This looks terrible for Arc despite the fact if left undisclosed it probably would have continued to be unexploited for years to come.

Re: Gaining access to anyones Arc browser without them even visiting a website

#313

Post by ARandomerDude »

Borgz wrote: post #52

According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?

"Arc is the Chrome replacement I’ve been waiting for." [1]

> https://arc.net/

I guess now we know why they frame it that way.

Re: Gaining access to anyones Arc browser without them even visiting a website

#314

Post by ARandomerDude »

I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain.

I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug.

But these people want to build a web browser, with all the security expertise and moral duty that implies?! Wow.

Re: Gaining access to anyones Arc browser without them even visiting a website

#315

Post by albedoa »

randomdata wrote: post #246
albedoa wrote: post #244

Earlier quoted context omitted.

Are you defining amateurs as people who are not your coworkers? It can still be an amateur mistake.

Coworker implies paid work, and therefore they are not amateurs. They very well may make the same mistakes, but those mistakes would be professional mistakes.

That is some next-level bad faith. Impressive.

Re: Gaining access to anyones Arc browser without them even visiting a website

#316

Post by msephton »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

I misread your name as Hush which is kind of fitting considering how you're trying to make this go away

Re: Gaining access to anyones Arc browser without them even visiting a website

#317

Post by zamadatix »

titaniumtown wrote: post #288
ayhanfuat wrote: post #245

Earlier quoted context omitted.

Was the post written for HN users only? I cannot see it on your blog page ( https://arc.net/blog ). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.

Not a good look it not being on the main page! I personally use [zen browser]( https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.

Heads up: HN doesn't support link naming markdown and some of the extra characters broke the hyperlink.

In case the parent can't fix it in time for the edit window: https://github.com/zen-browser/desktop

Re: Gaining access to anyones Arc browser without them even visiting a website

#318

Post by [deleted] »

mirzap wrote: post #273
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Pay the guy properly. $2000 is an insult. It should be $50k. This kind of bug could be sold for 100-200k easily.

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#319

Post by Wingy »

latexr wrote: post #141
bluehatbrit wrote: post #134

Earlier quoted context omitted.

That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all. I wonder if this is a regional or generational thing?

> I wonder if this is a regional or generational thing? Generational is a good bet: https://news.ycombinator.com/item?id=41537994

It's definitely primarily generational. In my experience, capitalization-as-tone is used by many Generation Z people. On the other hand, it is not widely used by older generations, or the younger Generation Alpha.

Re: Gaining access to anyones Arc browser without them even visiting a website

#320

Post by johndough »

0x1ceb00da wrote: post #146
johndough wrote: post #23

Earlier quoted context omitted.

On Debian, you can install and run the cat with sudo apt install oneko oneko & Makes a great gift for colleagues who leave their computer unattended.

You have sudo access to your colleagues computers?

I don't, but I run the same system configuration, so I can compile it on my computer, transfer it and run it.

Alternatively, if a compiler such as gcc is available, you could also run

    # https seems to be broken on this website currently
    wget http://www.daidouji.com/oneko/distfiles/oneko-1.2.sakura.5.tar.gz
    tar -xf oneko-1.2.sakura.5.tar.gz
    cd oneko-1.2.sakura.5/
    gcc oneko.c -lX11 -lm -o oneko
    ./oneko &
    cd ..
    # remove all traces
    rm -r oneko-1.2.sakura.5 oneko-1.2.sakura.5.tar.gz
Post reply on HN