8 ms·

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. Thi

by bhaney 2y ago

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

aaomidi 2y ago
You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.
- nemomarx 2y ago
  Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.
  - shepherdjerred 2y ago
    Having arbitrary browser access would be pretty valuable, even for just a small number of users.
  - viraptor 2y ago
    Lots of developers and power users make a good chunk of Arc's use base. If you're after some interesting credentials then "every Arc user" is a perfect group with little noise.
    - nicce 2y ago
      > power users Not that many. Most power users don't like to be forced for logging in, before they are able to use the browser.
      - sulandor 2y ago
        confirmed i don't even like logging in WHILE using the browser and have never heard of arc
        cozzyd 2y ago
        I've only heard of ARC the obsolete archive format ...
      - doix 2y ago
        If I had to guess, the typical Arc user is a Mac user in tech. It doesn't run on Linux, most windows users wouldn't run it, and non-tech people haven't heard of it. Then most engineering IC people will most likely run Firefox or Chrome, so you're probably looking at designers/founders/managers as your target. Probably some interesting targets there, but not the type that the NSA cares about. Just pure conjecture on my part of course ;).
        School-Cotton 2y ago
        The only person I ever saw using Arc was a designer at a tech startup, so this checks out.
        cassianoleal 2y ago
        I've seen quite a few. In one of my clients's Slack there are at least a couple people advocating for it all the time. They're mostly DLs or in similar roles. I also know at least one developer who uses it. I used it for a while for a very limited use case. Some interesting concepts. Mostly I found it annoying though. I also didn't like the sign-in thing but still wanted to experiment. I have dropped it altogether and kept Firefox as main browser (as it's been for many years) and Safari as a secondary. Both work much better overall for my needs.
  - Imustaskforhelp 2y ago
    my brother uses arc browser , he is a developer . I think he saw it from somebody using it (maybe theo t3 or some other creator he watches) , and he found it cool (plus there were lot of videos flooded with saying arc is really great IDK) If someone finds something cool on the internet. They are going to try it , given that they are capable to do so. He had a mac so he was able to do so , Even I tried to run arc on windows once when it was really beta and only available to mac (I think now it supports windows not sure) I just kindly want to state that if the nsa could've bought this exploit , they could've simply waited and maybe even promote arc themselves (seems unlikely) Maybe they could've tried to promote the numbers of arc users by trying to force google and microsoft search engine through some secret shady company advertising / writing blog posts for arc / giving arch funding or like how we know that there are secret courts in america ( and since these search engines basically constitutes for a high percentage of discovery of stuff by search engine by users) People could've credited the success to arc in that case for getting more users but the real winner would've been NSA.
    - timeon 2y ago
      > He had a mac so he was able to do so How? I have mac as well but when I've download it some time ago it required login. Has that changed?
      - adiabatty 2y ago
        No. You still need to create a login. Everyone else at work likes it, so I signed up with my work e-mail address and use it for work. All of my complicated browsing needs are done for work, so there's a good fit there.
      - Imustaskforhelp 2y ago
        no I meant that though you need to login , i think arc isn't available on linux , only mac (or maybe windows though not sure , I see some issues + the security issue) Ye it required login and my brother logged in (just see ! , the amount of friction to login etc. yet my brother , whom I would consider to be a little conscious of security still gave to try it in the first place) sry if I didn't respond correctly
  - cutemonster 2y ago
    > As of July 2023, The Browser Company has 100,000+ users https://www.boringbusinessnerd.com/startups/the-browser-company#:~:text=Company%20Traction&text=As%20of%20July%202023%2C%20The,from%20751%20in%20June%202022 https://www.boringbusinessnerd.com/startups/the-browser-comp... That's a year ago. Looking at how upvoted this bug has been, they do have many users
- Thorrez 2y ago
  The page says $2,000.
- Imustaskforhelp 2y ago
  yes. I feel sad that now we have created an incentive where selling to the govt.'s is often much lucrative than telling to the vulnerable party (arc in this case) (just imagine , this author was great for telling the company , this is also a cross platform exploit with very serious issues (I think arc is available on ios as well)) how many of such huge vulnerabilities exist but we just don't know about it , because the author hasn't disclosed it to the public or vulnerable party but rather nsa or some govt. agency
- prmoustache 2y ago
  > You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that. only the 17 users they have. Shouldn't a government sue you if you try to sell him out vuln unless you personally know people in charge?
  - netdevnet 2y ago
    I guess not since they used the services of a company that could exploit vulns in ios
  - girvo 2y ago
    Arc has a lot more than 17 users. It’s surprisingly popular.
- 255kb 2y ago
  Firestore rules are in "lock mode" (no read or write allowed) by default since a long time. Then, everything is ultra well explained in the docs. I was already aware of it when being a noob dev 10 years ago, and could easily write a rule to enforce auth + ownership in the rules. No way, seasoned devs can miss that.
- rmbyrro 2y ago
  A couple? A vuln like this is worth >$1M very easily on the market.
endigma 2y ago
Also, firebase? seriously? this is a company with like, low level software engineers on payroll, and they are using a CRUD backend in a box. cost effective I guess? I wouldn't even have firebase on the long list for a backend if I were architecting something like this. Especially when feature-parity competitors like Supabase just wrap a normal DBMS and auth model.
- JumpCrisscross 2y ago
  > low level software engineers on payroll How does The Browser Company make money? They're giving their product away for free. Browsers are complicated. It doesn't inspire confidence that the folks in charge of that complexity can't get their heads around a business model. (Aside: none of their stated company values have anything to do with the product or engineering [1]. They're all about how people feel.) [1] https://thebrowser.company/values/ https://thebrowser.company/values/
  - coffeeling 2y ago
    They don't have a business model yet, is the thing.
  - bschmidt1 2y ago
    Well, it's an app that users access all their online info through - bank, email, search, work, social - everything. Even an open-source, decentralized, blockchain, grass-fed, organic, extra virgin, written in nothing but HTML, released by W3C itself browser could monetize just ~5% of market share if users are downloading their build (or if its baked into the source), considering how much a browser reveals about its user and to the extent the user can be retargeted for: Ads, marketing, surveillance, analytics. The biggest opportunity has to be driving search traffic to the major search providers all these browsers partner with. Could also get acquired by a major browser vendor if you have a better product and people are downloading it more than the major ones, especially if both are based on the same underlying engine. Even Firefox still sucks to this day. I'm using it right now (Waterfox) the product still sucks! I know of some browser vendors acquiring others, especially as mobile took off and it was hard to get it right. Seems like the opportunity is similar to that of social media but slightly more modern because nobody uses new social media anymore but people are trying out new browsers (and you get richer user/usage data).
Imustaskforhelp 2y ago
I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this can be contributed to firebase or arc On the following page from same author (I think) https://env.fail/posts/firewreck-1 https://env.fail/posts/firewreck-1 , tldr states - Firebase allows for easy misconfiguration of security rules with zero warnings - This has resulted in hundreds of sites exposing a total of ~125 Million user records, including plaintext passwords & sensitive billing information So because firebase advocates itself to the developers as being safe yet not being safe , I think arc succumbed to it. firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, Also , you say that you have been convinced to never use arc again. Did you know that chrome gives an unfair advantage to its user sites by giving system information (core usage etc.) and some other things which are not supposed to be seen by browsers only to the websites starting with *.google.com ? this is just recently discovered , just imagine if something more serious is also just waiting in the shadows Couldn't this also be considered a major security vulnerability just waiting to be happen if some other exploit like this can be discovered / google.com is leaked and now your cpu information and way more other stuff which browsers shouldn't know is with a malicious threat actor ?
- prmoustache 2y ago
  You do know that there are more than chrome and arc right?
  - Imustaskforhelp 2y ago
    I understand. I use firefox / earlier used librewolf But a lot of people use chrome so I wanted to atleast try to give justification on why / how arc messed up so hard.
- nine_k 2y ago
  I very much agree with the idea that browsers are security-sensitive software, unlike, say, a picture editor, and more like an ssh server. It should be assumed to be constantly under attack. And browser development is exactly not the area where I would like to see the "move fast, break things" attitude. While firebase may be sloppy with security and thus unfit for certain purposes, I would expect competent developers of a browser to do due diligence before considering to use it, or whatever else, for anything even remotely related to security. Or, if they want to experiment, I'd rather that be opt-in, and come with a big banner: "This is experimental software. DO NOT attempt to access your bank account, or your real email account, or your social media accounts". With that, I don't see much exploit potential in learning stats like the number of cores on your machine. Maybe slightly more chances of fingerprinting, but nothing comparable to the leak through improper usage of firebase.
arcisbad 2y ago
This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19ceaf53ba https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea... TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.
- Sakos 2y ago
  Unfortunately, Zen Browser simply isn't an alternative. If you like Arc, then Zen's UI for tabs and splitting views isn't really anywhere close to satisfying the same needs.
  - liamkearney 2y ago
    I was literally using Arc because of the ability to hide most of the userchrome. Every time I open split views or tabs I curse. I've said this in the past but layering view multiplexors has to be the most stupid modern "super-user" trap. You have the ability to open multiple browser windows and composite them side by side, use it. Does anyone know of any other browsers that are chromium based and have very little features aside the ability to hide most of the UI?
  - EraYaN 2y ago
    At least Firefox seems to be borrowing some of the UI features slowly. At least the Mozilla Foundation is very public with their wants and goals.
  - EraYaN 2y ago
    Firefox seems to be borrowing some of the UI features slowly (at least the vertical tabs). And at least the Mozilla Foundation is very public with their wants and goals.
- trumad 2y ago
  I also wrote a guide on ARC features that work better on Firefox: https://thannymack.com/#Arc%20features%20that%20work%20better%20on%20Firefox https://thannymack.com/#Arc%20features%20that%20work%20bette...
tailspin2019 2y ago
The mandatory account just to try Arc was always a massive red flag to me - and led to me never trying it. Now I’m glad I didn’t!
- shermantanktop 2y ago
  You could have just borrowed someone else’s, it appears.
  - mdaniel 2y ago
    Ironically, that would help the privacy concerns since it would intermingle all traffic in their analytics system. Win-win!
- bschmidt1 2y ago
  No Linux version prevented me from trying it, didn't even get to the account wall, who knows if there's a pay wall. Perhaps the "moat" concept was misunderstood.
  - mrinfinitiesx 2y ago
    Same
gwd 2y ago
On the other hand, this is pretty impressive: aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh aug 25 6:02pm: vulnerability poc executed on hursh's arc account aug 25 6:13pm: added to slack channel after details disclosed over encrypted format aug 26 9:41pm: vulnerability patched, bounty awarded sep 6 7:49pm: cve assigned (CVE-2024-45489) Four hours from out-of-the-blue initial contact until a fix pushed is pretty good, even given how simple this fix probably was. EDIT: Oh, the date changed; so it was 28 hours until fix. Still decent; and half an hour from initial contact to "Join our slack channel" is incredibly fast response time.
- tadzik_ 2y ago
  28 hours (note the date), but still
- Rygian 2y ago
  Reacting fast is the least the vendor could do. Bare minimum. This should not be applauded. It should be treated as "well, at least they reacted at a reasonable speed so the root cause was probably not malice". In other words, a quick turnaround with a fix does not lessen the impact of being negligent about security when designing the product.
  - MoreenDichele 2y ago
    [dead]
  - darby_nine 2y ago
    > Reacting fast is the least the vendor could do. And yet, so few do. Let's remind ourselves the bar sank into the floor a long time ago.
  - gwd 2y ago
    > Reacting fast is the least the vendor could do. It's certainly the least a vendor should do, but it's absolutely not the least a vendor could do, as we see the vast majority of vendors do far, far less. It's worth holding people up and saying, "This is how you should be doing it."
ForHackernews 2y ago
What is Arc?
- homebrewer 2y ago
  https://news.ycombinator.com/item?id=36862546 https://news.ycombinator.com/item?id=36862546
rpastuszak 2y ago
Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.
- danpalmer 2y ago
  Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally over the page content. That feels like a huge violation of what it means to be a browser. I don’t want their AI features. I don’t want growth hacks. I don’t want to sign in except for sync. I’d happily pay $40 a year for Arc as a product-focused-product, but as a VC-focused-product it’s heading downhill.
  - rawsta 2y ago
    Have you tried Vivaldi? It's really customizable and has a lot of features.
    - danpalmer 2y ago
      Vivaldi feels like a cross platform port in all the ways I try to avoid. I understand the feature set is good, but it doesn't feel nice to use. Hard to state exactly why though.
  - jwells89 2y ago
    It does get a lot right and feels smooth in ways that Chrome, the various Chrome-clones, and Firefox just don't. It's also ironically the only browser even trying to feel native on Windows, using WinUI/WinAppSDK for its UI there, despite originally being Mac only. It's unfortunate that other cross platform browsers have such a strong tendency to phone in these little things, because they really do add up to make for a nicer experience.
deleted 2y ago
[deleted]

by bhaney 2y ago

aaomidi 2y ago

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

nemomarx 2y ago
Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.
- shepherdjerred 2y ago
  Having arbitrary browser access would be pretty valuable, even for just a small number of users.
- viraptor 2y ago
  Lots of developers and power users make a good chunk of Arc's use base. If you're after some interesting credentials then "every Arc user" is a perfect group with little noise.
  - nicce 2y ago
    > power users Not that many. Most power users don't like to be forced for logging in, before they are able to use the browser.
    - sulandor 2y ago
      confirmed i don't even like logging in WHILE using the browser and have never heard of arc
      - cozzyd 2y ago
        I've only heard of ARC the obsolete archive format ...
    - doix 2y ago
      If I had to guess, the typical Arc user is a Mac user in tech. It doesn't run on Linux, most windows users wouldn't run it, and non-tech people haven't heard of it. Then most engineering IC people will most likely run Firefox or Chrome, so you're probably looking at designers/founders/managers as your target. Probably some interesting targets there, but not the type that the NSA cares about. Just pure conjecture on my part of course ;).
      - School-Cotton 2y ago
        The only person I ever saw using Arc was a designer at a tech startup, so this checks out.
        cassianoleal 2y ago
        I've seen quite a few. In one of my clients's Slack there are at least a couple people advocating for it all the time. They're mostly DLs or in similar roles. I also know at least one developer who uses it. I used it for a while for a very limited use case. Some interesting concepts. Mostly I found it annoying though. I also didn't like the sign-in thing but still wanted to experiment. I have dropped it altogether and kept Firefox as main browser (as it's been for many years) and Safari as a secondary. Both work much better overall for my needs.
- Imustaskforhelp 2y ago
  my brother uses arc browser , he is a developer . I think he saw it from somebody using it (maybe theo t3 or some other creator he watches) , and he found it cool (plus there were lot of videos flooded with saying arc is really great IDK) If someone finds something cool on the internet. They are going to try it , given that they are capable to do so. He had a mac so he was able to do so , Even I tried to run arc on windows once when it was really beta and only available to mac (I think now it supports windows not sure) I just kindly want to state that if the nsa could've bought this exploit , they could've simply waited and maybe even promote arc themselves (seems unlikely) Maybe they could've tried to promote the numbers of arc users by trying to force google and microsoft search engine through some secret shady company advertising / writing blog posts for arc / giving arch funding or like how we know that there are secret courts in america ( and since these search engines basically constitutes for a high percentage of discovery of stuff by search engine by users) People could've credited the success to arc in that case for getting more users but the real winner would've been NSA.
  - timeon 2y ago
    > He had a mac so he was able to do so How? I have mac as well but when I've download it some time ago it required login. Has that changed?
    - adiabatty 2y ago
      No. You still need to create a login. Everyone else at work likes it, so I signed up with my work e-mail address and use it for work. All of my complicated browsing needs are done for work, so there's a good fit there.
    - Imustaskforhelp 2y ago
      no I meant that though you need to login , i think arc isn't available on linux , only mac (or maybe windows though not sure , I see some issues + the security issue) Ye it required login and my brother logged in (just see ! , the amount of friction to login etc. yet my brother , whom I would consider to be a little conscious of security still gave to try it in the first place) sry if I didn't respond correctly
- cutemonster 2y ago
  > As of July 2023, The Browser Company has 100,000+ users https://www.boringbusinessnerd.com/startups/the-browser-company#:~:text=Company%20Traction&text=As%20of%20July%202023%2C%20The,from%20751%20in%20June%202022 https://www.boringbusinessnerd.com/startups/the-browser-comp... That's a year ago. Looking at how upvoted this bug has been, they do have many users
Thorrez 2y ago
The page says $2,000.
Imustaskforhelp 2y ago
yes. I feel sad that now we have created an incentive where selling to the govt.'s is often much lucrative than telling to the vulnerable party (arc in this case) (just imagine , this author was great for telling the company , this is also a cross platform exploit with very serious issues (I think arc is available on ios as well)) how many of such huge vulnerabilities exist but we just don't know about it , because the author hasn't disclosed it to the public or vulnerable party but rather nsa or some govt. agency
prmoustache 2y ago
> You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that. only the 17 users they have. Shouldn't a government sue you if you try to sell him out vuln unless you personally know people in charge?
- netdevnet 2y ago
  I guess not since they used the services of a company that could exploit vulns in ios
- girvo 2y ago
  Arc has a lot more than 17 users. It’s surprisingly popular.
255kb 2y ago
Firestore rules are in "lock mode" (no read or write allowed) by default since a long time. Then, everything is ultra well explained in the docs. I was already aware of it when being a noob dev 10 years ago, and could easily write a rule to enforce auth + ownership in the rules. No way, seasoned devs can miss that.
rmbyrro 2y ago
A couple? A vuln like this is worth >$1M very easily on the market.

endigma 2y ago

Also, firebase? seriously? this is a company with like, low level software engineers on payroll, and they are using a CRUD backend in a box. cost effective I guess? I wouldn't even have firebase on the long list for a backend if I were architecting something like this. Especially when feature-parity competitors like Supabase just wrap a normal DBMS and auth model.

JumpCrisscross 2y ago
> low level software engineers on payroll How does The Browser Company make money? They're giving their product away for free. Browsers are complicated. It doesn't inspire confidence that the folks in charge of that complexity can't get their heads around a business model. (Aside: none of their stated company values have anything to do with the product or engineering [1]. They're all about how people feel.) [1] https://thebrowser.company/values/ https://thebrowser.company/values/
- coffeeling 2y ago
  They don't have a business model yet, is the thing.
- bschmidt1 2y ago
  Well, it's an app that users access all their online info through - bank, email, search, work, social - everything. Even an open-source, decentralized, blockchain, grass-fed, organic, extra virgin, written in nothing but HTML, released by W3C itself browser could monetize just ~5% of market share if users are downloading their build (or if its baked into the source), considering how much a browser reveals about its user and to the extent the user can be retargeted for: Ads, marketing, surveillance, analytics. The biggest opportunity has to be driving search traffic to the major search providers all these browsers partner with. Could also get acquired by a major browser vendor if you have a better product and people are downloading it more than the major ones, especially if both are based on the same underlying engine. Even Firefox still sucks to this day. I'm using it right now (Waterfox) the product still sucks! I know of some browser vendors acquiring others, especially as mobile took off and it was hard to get it right. Seems like the opportunity is similar to that of social media but slightly more modern because nobody uses new social media anymore but people are trying out new browsers (and you get richer user/usage data).

Imustaskforhelp 2y ago

I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this can be contributed to firebase or arc On the following page from same author (I think) https://env.fail/posts/firewreck-1 https://env.fail/posts/firewreck-1 , tldr states - Firebase allows for easy misconfiguration of security rules with zero warnings - This has resulted in hundreds of sites exposing a total of ~125 Million user records, including plaintext passwords & sensitive billing information So because firebase advocates itself to the developers as being safe yet not being safe , I think arc succumbed to it. firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, Also , you say that you have been convinced to never use arc again. Did you know that chrome gives an unfair advantage to its user sites by giving system information (core usage etc.) and some other things which are not supposed to be seen by browsers only to the websites starting with *.google.com ? this is just recently discovered , just imagine if something more serious is also just waiting in the shadows Couldn't this also be considered a major security vulnerability just waiting to be happen if some other exploit like this can be discovered / google.com is leaked and now your cpu information and way more other stuff which browsers shouldn't know is with a malicious threat actor ?

prmoustache 2y ago
You do know that there are more than chrome and arc right?
- Imustaskforhelp 2y ago
  I understand. I use firefox / earlier used librewolf But a lot of people use chrome so I wanted to atleast try to give justification on why / how arc messed up so hard.
nine_k 2y ago
I very much agree with the idea that browsers are security-sensitive software, unlike, say, a picture editor, and more like an ssh server. It should be assumed to be constantly under attack. And browser development is exactly not the area where I would like to see the "move fast, break things" attitude. While firebase may be sloppy with security and thus unfit for certain purposes, I would expect competent developers of a browser to do due diligence before considering to use it, or whatever else, for anything even remotely related to security. Or, if they want to experiment, I'd rather that be opt-in, and come with a big banner: "This is experimental software. DO NOT attempt to access your bank account, or your real email account, or your social media accounts". With that, I don't see much exploit potential in learning stats like the number of cores on your machine. Maybe slightly more chances of fingerprinting, but nothing comparable to the leak through improper usage of firebase.

arcisbad 2y ago

This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19ceaf53ba https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea... TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.

Sakos 2y ago
Unfortunately, Zen Browser simply isn't an alternative. If you like Arc, then Zen's UI for tabs and splitting views isn't really anywhere close to satisfying the same needs.
- liamkearney 2y ago
  I was literally using Arc because of the ability to hide most of the userchrome. Every time I open split views or tabs I curse. I've said this in the past but layering view multiplexors has to be the most stupid modern "super-user" trap. You have the ability to open multiple browser windows and composite them side by side, use it. Does anyone know of any other browsers that are chromium based and have very little features aside the ability to hide most of the UI?
- EraYaN 2y ago
  At least Firefox seems to be borrowing some of the UI features slowly. At least the Mozilla Foundation is very public with their wants and goals.
- EraYaN 2y ago
  Firefox seems to be borrowing some of the UI features slowly (at least the vertical tabs). And at least the Mozilla Foundation is very public with their wants and goals.
trumad 2y ago
I also wrote a guide on ARC features that work better on Firefox: https://thannymack.com/#Arc%20features%20that%20work%20better%20on%20Firefox https://thannymack.com/#Arc%20features%20that%20work%20bette...

tailspin2019 2y ago

The mandatory account just to try Arc was always a massive red flag to me - and led to me never trying it. Now I’m glad I didn’t!

shermantanktop 2y ago
You could have just borrowed someone else’s, it appears.
- mdaniel 2y ago
  Ironically, that would help the privacy concerns since it would intermingle all traffic in their analytics system. Win-win!
bschmidt1 2y ago
No Linux version prevented me from trying it, didn't even get to the account wall, who knows if there's a pay wall. Perhaps the "moat" concept was misunderstood.
- mrinfinitiesx 2y ago
  Same

gwd 2y ago

On the other hand, this is pretty impressive: aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh aug 25 6:02pm: vulnerability poc executed on hursh's arc account aug 25 6:13pm: added to slack channel after details disclosed over encrypted format aug 26 9:41pm: vulnerability patched, bounty awarded sep 6 7:49pm: cve assigned (CVE-2024-45489) Four hours from out-of-the-blue initial contact until a fix pushed is pretty good, even given how simple this fix probably was. EDIT: Oh, the date changed; so it was 28 hours until fix. Still decent; and half an hour from initial contact to "Join our slack channel" is incredibly fast response time.

tadzik_ 2y ago
28 hours (note the date), but still
Rygian 2y ago
Reacting fast is the least the vendor could do. Bare minimum. This should not be applauded. It should be treated as "well, at least they reacted at a reasonable speed so the root cause was probably not malice". In other words, a quick turnaround with a fix does not lessen the impact of being negligent about security when designing the product.
- MoreenDichele 2y ago
  [dead]
- darby_nine 2y ago
  > Reacting fast is the least the vendor could do. And yet, so few do. Let's remind ourselves the bar sank into the floor a long time ago.
- gwd 2y ago
  > Reacting fast is the least the vendor could do. It's certainly the least a vendor should do, but it's absolutely not the least a vendor could do, as we see the vast majority of vendors do far, far less. It's worth holding people up and saying, "This is how you should be doing it."

ForHackernews 2y ago

What is Arc?

homebrewer 2y ago
https://news.ycombinator.com/item?id=36862546 https://news.ycombinator.com/item?id=36862546

rpastuszak 2y ago

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

danpalmer 2y ago
Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally over the page content. That feels like a huge violation of what it means to be a browser. I don’t want their AI features. I don’t want growth hacks. I don’t want to sign in except for sync. I’d happily pay $40 a year for Arc as a product-focused-product, but as a VC-focused-product it’s heading downhill.
- rawsta 2y ago
  Have you tried Vivaldi? It's really customizable and has a lot of features.
  - danpalmer 2y ago
    Vivaldi feels like a cross platform port in all the ways I try to avoid. I understand the feature set is good, but it doesn't feel nice to use. Hard to state exactly why though.
- jwells89 2y ago
  It does get a lot right and feels smooth in ways that Chrome, the various Chrome-clones, and Firefox just don't. It's also ironically the only browser even trying to feel native on Windows, using WinUI/WinAppSDK for its UI there, despite originally being Mac only. It's unfortunate that other cross platform browsers have such a strong tendency to phone in these little things, because they really do add up to make for a nicer experience.

deleted 2y ago

[deleted]