Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

91–100 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#91

Post by sorrythanks »

nottorp wrote: post #28
ko_pivot wrote: post #2

This is such a fantastic bug. Firebase security rules (like with other BaaS systems like Firebase) have this weird default that is hard to describe. Basically, if I write my own API, I will set the userId of the record (a 'boost' in this case) to the userId from the session, rather than passing it in the request payload. It would never even occur to a developer writing their own API past a certain level of experience…

> On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is. Tbh you're doing it wrong if you go that way. Default deny, and then you only have to imagine the legitimate uses.

And then when you imagine the legitimate uses you have to imagine how allowing those legitimate uses could be misused. You always need to think red and blue.

Re: Gaining access to anyones Arc browser without them even visiting a website

#92

Post by notoverthere »

throwaway48540 wrote: post #82
endigma wrote: post #10

Earlier quoted context omitted.

Also, firebase? seriously? this is a company with like, low level software engineers on payroll, and they are using a CRUD backend in a box. cost effective I guess? I wouldn't even have firebase on the long list for a backend if I were architecting something like this. Especially when feature-parity competitors like Supabase just wrap a normal DBMS and auth model.

I don't see an issue, using something like Firebase is what a smart engineer would do. Just this one piece of logic is a problem.

I tend to agree with this. Why re-invent the wheel by spending engineering effort building a CRUD backend?

If you're trying to bring value to market, focus on your core differentiator and use existing tooling for your boilerplate stuff.

Re: Gaining access to anyones Arc browser without them even visiting a website

#93

Post by Wingy »

latexr wrote: post #78
Aachen wrote: post #67

Earlier quoted context omitted.

I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text la…

It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone.

lowercase without caps reads with a warmer, informal tone

there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

Re: Gaining access to anyones Arc browser without them even visiting a website

#94

Post by Wingy »

bestest wrote: post #29

the developers working with firebase should enforce common-sense document crud restrictions in the rules. that's just how firebase is. everyone knows it. now, when talking about ARC BROWSER, i am seriously starting to doubt the competence of the team. I mean, if the rules are broken (no tests? no rules whatsoever?), what else is broken with ARC? are we to await a data leak from ARC? any browser recommendations with p…

Zen and MS Edge have proper vertical tabs.

Re: Gaining access to anyones Arc browser without them even visiting a website

#95

Post by netdevnet »

prmoustache wrote: post #66
aaomidi wrote: post #7

Earlier quoted context omitted.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

> You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that. only the 17 users they have. Shouldn't a government sue you if you try to sell him out vuln unless you personally know people in charge?

I guess not since they used the services of a company that could exploit vulns in ios

Re: Gaining access to anyones Arc browser without them even visiting a website

#96

Post by 63stack »

michaelt wrote: post #41
ahoef wrote: post #25

Nice article, but this is hard to read without proper capitalization. My brain uses capitals to scan beginning and ending of text.

If you were using Arc you could add a Boost for "Case: toggle between different capitalization settings - they will apply to all text on the webpage" [1] /s [1] https://resources.arc.net/hc/en-us/articles/19212718608151-B...

Depending on the version you are using, you might not even need to add it, someone else might just add it for you!

Re: Gaining access to anyones Arc browser without them even visiting a website

#97

Post by cassianoleal »

School-Cotton wrote: post #48
doix wrote: post #46

Earlier quoted context omitted.

If I had to guess, the typical Arc user is a Mac user in tech. It doesn't run on Linux, most windows users wouldn't run it, and non-tech people haven't heard of it. Then most engineering IC people will most likely run Firefox or Chrome, so you're probably looking at designers/founders/managers as your target. Probably some interesting targets there, but not the type that the NSA cares about. Just pure conjecture on m…

The only person I ever saw using Arc was a designer at a tech startup, so this checks out.

I've seen quite a few. In one of my clients's Slack there are at least a couple people advocating for it all the time. They're mostly DLs or in similar roles. I also know at least one developer who uses it.

I used it for a while for a very limited use case. Some interesting concepts. Mostly I found it annoying though. I also didn't like the sign-in thing but still wanted to experiment. I have dropped it altogether and kept Firefox as main browser (as it's been for many years) and Safari as a secondary. Both work much better overall for my needs.

Re: Gaining access to anyones Arc browser without them even visiting a website

#98

Post by ForHackernews »

bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

What is Arc?

Re: Gaining access to anyones Arc browser without them even visiting a website

#99

Post by rpastuszak »

bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy.

50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

Re: Gaining access to anyones Arc browser without them even visiting a website

#100

Post by coffeeling »

JumpCrisscross wrote: post #43
endigma wrote: post #10

Earlier quoted context omitted.

Also, firebase? seriously? this is a company with like, low level software engineers on payroll, and they are using a CRUD backend in a box. cost effective I guess? I wouldn't even have firebase on the long list for a backend if I were architecting something like this. Especially when feature-parity competitors like Supabase just wrap a normal DBMS and auth model.

> low level software engineers on payroll How does The Browser Company make money? They're giving their product away for free. Browsers are complicated. It doesn't inspire confidence that the folks in charge of that complexity can't get their heads around a business model. (Aside: none of their stated company values have anything to do with the product or engineering [1]. They're all about how people feel.) [1] https…

They don't have a business model yet, is the thing.
Post reply on HN