Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

321–330 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#321

Post by Wingy »

PKop wrote: post #241
bluehatbrit wrote: post #134

Earlier quoted context omitted.

That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all. I wonder if this is a regional or generational thing?

[flagged]

In my experience, that isn't the case. Among people who "have gotten used to" it, using capitalization to indicate the formality and/or tone of your message allows the reader to understand the writer's intention better. I have not observed any correlation between political leanings and this.

Re: Gaining access to anyones Arc browser without them even visiting a website

#322

Post by [deleted] »

bloopernova wrote: post #221
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty. You've been handed a golden opportunity to set the right course.

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#323

Post by FactKnower69 »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

remember when reading this that this guy's company is valued at a billion dollars and his comp is 10x yours if not more. we live in a meritocracy

Re: Gaining access to anyones Arc browser without them even visiting a website

#324

Post by qubitcoder »

PKop wrote: post #241
bluehatbrit wrote: post #134

Earlier quoted context omitted.

That's really interesting, I personally don't read those tone differences based on the casing. Neither approach carries different warmth or formality to me at all. I wonder if this is a regional or generational thing?

[flagged]

That seems dubious. Consider the "stylistic choices" of the former president in social media posts.

Re: Gaining access to anyones Arc browser without them even visiting a website

#325

Post by Wingy »

AnimalMuppet wrote: post #299
bigstrat2003 wrote: post #205

Earlier quoted context omitted.

> lowercase without caps reads with a warmer, informal tone No, it reads as "I'm uneducated and don't know how to write the English language properly". It's incredibly obnoxious for people to use as an affectation.

To me, proper capitalization is easier to parse - not massively so, but a little bit. So writing without caps is a bit of a jerk move. You're making it harder for me to read, either because you're lazy or because you want to affect a style. In either case it's a bit of a jerk move. It's more of a jerk move when it's done on a discussion board, because what you write once is read multiple times. So the cost multiplies…

On a formal discussion board like this, I don't believe an informal tone is correct. To me, it doesn't make it harder to read, but it does come across as mildly disrespectful of the environment.

When texting on a phone, the default is to automatically capitalize. Using all-lowercase requires more work than doing nothing. It isn't lazy or even more efficient to go back and replace your "I"s with "i"s. With the right reader, it's done to give them a better idea of the tone you wish to deliver.

With that said, it requires a certain degree of audience awareness. Many people do not interpret lack of capitalization the same way I do, as evidenced by this thread. On my phone, I have auto-capitalization disabled. When texting someone for the first time, I tend to use proper capitalization, even if I want a casual tone. I just did a typing test with capitalization and punctuation and scored 55 wpm on my phone. It's a choice I make and it varies based on audience, and intended tone. Effort, on the other hand, is not a factor.

Re: Gaining access to anyones Arc browser without them even visiting a website

#326

Post by SushiHippie »

nickisnoble wrote: post #27
userbinator wrote: post #12

while researching, i saw some data being sent over to the server, like this query everytime you visit a site I'm not surprised in the least --- basically the vast majority of software these days is spyware. Looking at Arc's privacy page, it appears to be mainly marketing fluff similar to what I've seen from other companies. I have yet to find a privacy policy that says frankly "we only know your IP and time you downl…

Yeah, and no mention of if they addressed this.

According to their blog post https://arc.net/blog/CVE-2024-45489-incident-response they fixed it:

> We’ve fixed the issues with leaking your current website on navigation while you had the Boost editor open. We don’t log these requests anywhere, and if you didn’t have the Boosts editor open these requests were not made. Regardless this is against our privacy policy and should have never been in the product to begin with.

Re: Gaining access to anyones Arc browser without them even visiting a website

#327

Post by Wingy »

latexr wrote: post #135
Wingy wrote: post #93

Earlier quoted context omitted.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

> lowercase without caps reads with a warmer, informal tone Personally, and I’m certain I’m not alone on this, it reads as annoying. It’s harder to follow and looks as if the writer didn’t care to do the bare minimum to make the text accessible and clear to the reader. > there’s a Tom Scott Language Files video documenting it Per that video (thank you for sharing), capital letters “make a paragraph easier to read” an…

That's true. I agree with you that anything less than a formal tone would be, and is, inappropriate for this context. I also respect that you prefer standard capitalization and punctuation at all times. Being aware of the audience is critical for any writer.

Re: Gaining access to anyones Arc browser without them even visiting a website

#328

Post by Aachen »

PKop wrote: post #242
Wingy wrote: post #93

Earlier quoted context omitted.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

It's extremely irritating, distracting, and breaks focus on the content instead of the annoying stylistic choice, just an fyi..but I imagine you probably like that this is true and purposely try to annoy the people that aren't in the little club. If not, then I suggest not doing it. The tone I perceive from it is "F**** the reader"

> ... you probably like that this is true and purposely try to annoy ...

I don't know if you meant to direct this at the person you're replying to but I'm convinced the overwhelming majority of people don't get out of bed in the morning with any of that in mind

It's comments like these that make me reconsider what hateful meanings others might read into my communications or mistakes

Re: Gaining access to anyones Arc browser without them even visiting a website

#329

Post by digging »

ghodith wrote: post #296
JohnMakin wrote: post #258

Earlier quoted context omitted.

Why this level of pedantry when the meaning is absolutely clear? A professional can make an amateur mistake. This makes perfect sense. That isn't implying the professional is actually an amateur, but that he made a mistake that an amateur would make.

For some added pedantry: aren't all the mistakes that a professional might make, also ones an amateur would make? In fact, it seems like an amateur is likely to run into all mistakes more often, thereby making all mistakes amateur mistakes; unless there some class of mistake that amateurs are better at avoiding?

There are probably mistakes an amateur cannot make because they can't penetrate the problems where the mistakes would be made.

Re: Gaining access to anyones Arc browser without them even visiting a website

#330

Post by ilrwbwrkhv »

currymj wrote: post #204
ilrwbwrkhv wrote: post #201

Earlier quoted context omitted.

[flagged]

Arc is a great product, it's the nicest web browser to use, you can tell these people are really good at their jobs in many respects (though apparently not security?!?). probably a lot of investors saw that too and are willing to fund a very strong team with the hope of eventual product-market fit.

That's one explanation.
Post reply on HN