4 ms·

Was the post written for HN users only? I cannot see it on your blog page (https://arc.net/blog https://arc.net/blog). It’s not posted on your twitter either. Y

Was the post written for HN users only? I cannot see it on your blog page (https://arc.net/blog https://arc.net/blog). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.

deleted 2y ago
[deleted]
titaniumtown 2y ago
Not a good look it not being on the main page! I personally use [zen browser](https://github.com/zen-browser/desktop); https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.
- zamadatix 2y ago
  Heads up: HN doesn't support link naming markdown and some of the extra characters broke the hyperlink. In case the parent can't fix it in time for the edit window: https://github.com/zen-browser/desktop https://github.com/zen-browser/desktop
  - apitman 2y ago
    I wouldn't be surprised if some HN client apps support markdown.
    - FractalHQ 2y ago
      I use the Octal app on iOS which does, though it seems the trailing ; broke the link for this md renderer.
      - apitman 2y ago
        I think GP is my most downvoted comment ever. Of all things haha.
- zem 2y ago
  zen looks really nice! thanks for the pointer.
- gukkey 2y ago
  The only feature Zen browser missing is tab folders, once they implement it I really don't have a reason to have Arc browser anymore.
  - GreenWatermelon 2y ago
    Hell despite missing tab groups, Zen browser is the only browser that finally had a "good enough" vertical tabs implementation, which allowed me to finally drop Edge as my main browser.
    - dotancohen 2y ago
      What do you not like about Firefox's Tree Style Tabs? I might be open to an alternative.
      - GreenWatermelon 2y ago
        I Cant't hide the tab bar without some userProfile.css hacks, while in Zen it has first class support. It's more a matter of saving precious vertical space.
        dotancohen 2y ago
        I see. Yes, I already hid the stock tab bar years ago and forgot about it.
    - MrAlex94 2y ago
      I'd be curious for your comparison to Waterfox, which added vertical tab integration a while ago.
- footy 2y ago
  I used Arc for a while because despite my misgivings about using a browser that requires an account etc the workflow was very good for me I started moving to Zen about a week ago, hearing about this vulnerability yesterday and especially seeing their reaction to it I know I made the right choice in leaving Arc.
sushid 2y ago
Hursh, can you please respond to the above commenter? As an early adopter, I find it fairly troubling to see a company that touts transparency hide the blog post and only publicly "own up to it" within the confines of a single HN thread.
- wahnfrieden 2y ago
  Pretty obvious now that Arc will only share security alerts with the people who "catch" them at it - as few as possible Leaves no choice but for this community to make the rest of the Arc community aware of it as they refuse the transparency
- ha470 2y ago
  We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.
  - deleted 2y ago
    [deleted]
  - zamadatix 2y ago
    Right now You and Arc are advertising it's ideal to position posts such as "Hidden Features in Arc Search" to users but security bulletins and remediations are something that need a hidden stopgap until you've scrambled to build an alternative site to hide them away at instead. Browser security is more than finding the best PR strategy, it's a mindset that prioritizes the user's well being over the product's image. I've deleted my account and uninstalled Arc. Not because of the issue in itself, but because it's clear what the response has been aiming to protect (not my data).
    - sieabahlpark 2y ago
      [dead]
    - zamadatix 2y ago
      The sibling comment to this by sieabahlpark is already dead but to respond in case they get a chance to read the thread again anways: The engineers already closed the hole, the blog post was already published, more work was (/is still?) going to be done to make a new site to hide them in. I wasn't asking for them to move engineers off patching to blog posting, I was asking for the already created blog posting to be made as visible in the blog the same as the posts were (which is now the case, so at least there is that). In regards to whether or not they did analysis to show it wasn't exploited that was indeed nice to see but you still have to make the post visible anyways because you're not always right, even if you're one of the biggest companies in the world https://www.theregister.com/2024/09/17/microsoft_zero_day_spoofing_flaw/ https://www.theregister.com/2024/09/17/microsoft_zero_day_sp... The measure to meet here is transparency, not perfection. And no, I wasn't really sitting around waiting for a good opportunity to delete my account and uninstall my main browser. That would be... very odd? I'm free to change browser without a reason to blame haha. I didn't say what I was switching to either (it's quite irrelevant to the topic), which can certainly be more than one of 2 options you have quips for. Regardless which option, the measure to meet here is again not perfection but transparency and yes, others do meet that well and above how Arc did in this case. More than anything, the reason for responding is less to argue about most of those points (I even debate just removing them now as they may detract from the point) and more to point out "real" transparency on security incidents (not just what a PR person would say gives the best image) is as big a factor in trusting a company with your data as their actual response to vulnerabilities. It doesn't matter that a company looks great 100% of the time they tell you about things if you know they are being intentionally stingy on showing you anything about it since you now have no way to trust they'd show you the bad anyways.

deleted 2y ago

[deleted]

titaniumtown 2y ago

Not a good look it not being on the main page! I personally use [zen browser](https://github.com/zen-browser/desktop); https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.

zamadatix 2y ago
Heads up: HN doesn't support link naming markdown and some of the extra characters broke the hyperlink. In case the parent can't fix it in time for the edit window: https://github.com/zen-browser/desktop https://github.com/zen-browser/desktop
- apitman 2y ago
  I wouldn't be surprised if some HN client apps support markdown.
  - FractalHQ 2y ago
    I use the Octal app on iOS which does, though it seems the trailing ; broke the link for this md renderer.
    - apitman 2y ago
      I think GP is my most downvoted comment ever. Of all things haha.
zem 2y ago
zen looks really nice! thanks for the pointer.
gukkey 2y ago
The only feature Zen browser missing is tab folders, once they implement it I really don't have a reason to have Arc browser anymore.
- GreenWatermelon 2y ago
  Hell despite missing tab groups, Zen browser is the only browser that finally had a "good enough" vertical tabs implementation, which allowed me to finally drop Edge as my main browser.
  - dotancohen 2y ago
    What do you not like about Firefox's Tree Style Tabs? I might be open to an alternative.
    - GreenWatermelon 2y ago
      I Cant't hide the tab bar without some userProfile.css hacks, while in Zen it has first class support. It's more a matter of saving precious vertical space.
      - dotancohen 2y ago
        I see. Yes, I already hid the stock tab bar years ago and forgot about it.
  - MrAlex94 2y ago
    I'd be curious for your comparison to Waterfox, which added vertical tab integration a while ago.
footy 2y ago
I used Arc for a while because despite my misgivings about using a browser that requires an account etc the workflow was very good for me I started moving to Zen about a week ago, hearing about this vulnerability yesterday and especially seeing their reaction to it I know I made the right choice in leaving Arc.

sushid 2y ago

Hursh, can you please respond to the above commenter? As an early adopter, I find it fairly troubling to see a company that touts transparency hide the blog post and only publicly "own up to it" within the confines of a single HN thread.

wahnfrieden 2y ago
Pretty obvious now that Arc will only share security alerts with the people who "catch" them at it - as few as possible Leaves no choice but for this community to make the rest of the Arc community aware of it as they refuse the transparency
ha470 2y ago
We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.
- deleted 2y ago
  [deleted]
- zamadatix 2y ago
  Right now You and Arc are advertising it's ideal to position posts such as "Hidden Features in Arc Search" to users but security bulletins and remediations are something that need a hidden stopgap until you've scrambled to build an alternative site to hide them away at instead. Browser security is more than finding the best PR strategy, it's a mindset that prioritizes the user's well being over the product's image. I've deleted my account and uninstalled Arc. Not because of the issue in itself, but because it's clear what the response has been aiming to protect (not my data).
  - sieabahlpark 2y ago
    [dead]
  - zamadatix 2y ago
    The sibling comment to this by sieabahlpark is already dead but to respond in case they get a chance to read the thread again anways: The engineers already closed the hole, the blog post was already published, more work was (/is still?) going to be done to make a new site to hide them in. I wasn't asking for them to move engineers off patching to blog posting, I was asking for the already created blog posting to be made as visible in the blog the same as the posts were (which is now the case, so at least there is that). In regards to whether or not they did analysis to show it wasn't exploited that was indeed nice to see but you still have to make the post visible anyways because you're not always right, even if you're one of the biggest companies in the world https://www.theregister.com/2024/09/17/microsoft_zero_day_spoofing_flaw/ https://www.theregister.com/2024/09/17/microsoft_zero_day_sp... The measure to meet here is transparency, not perfection. And no, I wasn't really sitting around waiting for a good opportunity to delete my account and uninstall my main browser. That would be... very odd? I'm free to change browser without a reason to blame haha. I didn't say what I was switching to either (it's quite irrelevant to the topic), which can certainly be more than one of 2 options you have quips for. Regardless which option, the measure to meet here is again not perfection but transparency and yes, others do meet that well and above how Arc did in this case. More than anything, the reason for responding is less to argue about most of those points (I even debate just removing them now as they may detract from the point) and more to point out "real" transparency on security incidents (not just what a PR person would say gives the best image) is as big a factor in trusting a company with your data as their actual response to vulnerabilities. It doesn't matter that a company looks great 100% of the time they tell you about things if you know they are being intentionally stingy on showing you anything about it since you now have no way to trust they'd show you the bad anyways.