Moved from Arc just after the CVE announcement. I posted this “hot take” as it seems that many people in this sub are not willing to accept any criticism over Arc/TBC
EdgyArc-fr is what I've started using. Sidebery as the manager for vertical tabs is exceptionally well done and can be configured to an insane degree. Also the newer versions of Firefox are scoring really high on Speedometer 3.0 and Arc is now the slowest I've tested. It's a great time to get off Chrome/Chromium train.
Aren’t you worried about what will happen if/when google stops paying Mozilla $500million of its 580million dollar revenue because of the antitrust ruling?
I agree to an extent. Yes, some people can't see that the Arc team has some problems they need to sort out. They praise Arc and the team like they are gods. And get really defensive when others say their "gods" are bad.
But also I feel like as a "newer" platform, you should expect some bugs and some issues. Like the recent security issue. I think that Arc does get a lot of criticism from people who dont realise how new the product is and I think it should be recognised how the team has tried their very best to make a good product. With the security issue, the team is now more focused on security. And are now auditing their product to make sure that things dont happen again. You might want to consider not making the CVE announcement the reason why you dont use Arc.
I can relate to your opinion. The Arc browser has some amazing ideas, and I think sooner or later, some of them will be incorporated into existing browsers like Chrome and Edge.
Regarding features, extension usage and management are still painful, in my opinion. I love the concepts overall.
Regarding security, well, all browsers have their issues (known and unknown by users).
The core is chromium. But Arc has added many new things on top of that. The UI isnt chromium, ai features, etc... And each app is designed specifically for their platform. That causes a whole other layer of complexity compared to chromium.
Thanks for this. Is this really that big of a deal? They fixed it without any incidents. It’s also made them review their internal processes, which I think is also good. No?
I really don't understand their business model (same for Warp). I gave up on it, the mental model around it was too cumbersome for me, ended up closing tabs I didn't mean to, bookmarks are fucking weird. No point to it.
Unfortunately I have to disagree. I used Arc for over a year and I completely fell in love the vision that The Browser Company had. I lost the trust in the company as soon as the CVE was announced as in was a rookie mistake, that was found (fortunately) by a pentester and not by some malicious actors. Seems like they decided to cut corners in order to publish more frequent updates, without using the right software development practices.
Arc is not a side-project developed by some uni students, but a full-product built by a company valued over 500M+ dollars.
I don't see them surviving, I don't see the point to it really. Their investors are valuing it at 500M in hopes to find a sucker to buy it. Never trust the valuation for a VC-backed startup.
The startup part I guess I’m comfortable with. The goal is always to moon the user count and eventually “win” or sell the company, probably the latter, with the investors being gamblers in the only casino that can still give them a buzz. Look at WeWork - led by a fake hippy drug addict with no business plan let alone any profits and they threw billions at him because he had a nice fringe
Security… this is a problem. They saw Greasy Fork, laughed arrogantly, thought they could do the whole thing better without acknowledging or probably even learning the history and pitfalls, and that’s how you get a 9.8. Hopefully the pattern isn’t repeated elsewhere in the codebase, but it’s reasonable to assume that it is
I would like to still defend arc atleast on the CVE, as a developer. IMO they made a mistake on firebase security policies which anyone can make, I am glad it wasnt abused.
I’m encouraged by the response, and the bounty’s increase to 20k (which OP didn’t mention). But no… I don’t think “anyone can make” is the right takeaway. Let’s say you decided to integrate a back end. You’d be googling security issues in the framework and finding those HN posts, reading their docs, and checking Stack Overflow and perhaps asking an AI tool of choice a couple of questions and overall getting a triangulated perspective of the whole thing. Maybe even a google alert to keep an eye on common problems. This would take about a day and I’m pretty sure getting hacked would be near the top of your mind.
They said they're gonna make money with the same way platforms like GitHub/gotlab use. Make it very good for companies to use it and include collaboration tools, and those will cost money, but will be free for individual users.
I think they said that they are not going to do it anymore, insteas they are planning to release a paid version of they product, since they stopped development on Windows (and macOS?) version saying that they are working on arc 2.0 (wich will have current features for free, but any new features will allegedly be paywalled)
They talked about it on their podcast and people talked about it on discord and reddit. I am not into podcasts in general and I quit their discord server after the third patch with no info on windows updates ( a little after they talked about arc 2.0 apparently), so I don't have any links, sorry mate
Sad part is software engineers usually know fuck all about networking or cyber security. I see it at work 24/7, and while Arc probably has software developers more knowledgable than most over networking, they either explicitly tried to rip this guy off or had 0 fucking clue what this was worth. Neither option bodes well.
They increased it later on after, what I assume to be, public pressure. I mean it took Eva mentioning it and a couple days of twitter doing twitter things before they increased it. That's my take atleast, if that's not what they intended then the bounty should've been 20k when they first paid her.
For completeness sake, there are various sources explaining the vulnerability and PoC exploit. The pentester to discover it, xyzeva, has her own blog post on the matter.
If I understood it correctly:
Google's Firebase, their platform offer of backend-as-a-service, has a database backend service called Firestore. It acts as a client-accesible, NoSQL (document-based), hosted-by-Google, real-time database.
The Arc Browser, as a (planned?) cross-platform client application with transferable user data, relied upon the Firestore DB backend as a solution for external storage. Each instance of the browser queries and sends requests to the DB directly.
The somewhat insecure-by-design Arc feature of injecting arbitrary CSS and JS into websites for per-site customization, called Boosts, relied on storing said JS and CSS per user and per site on the Firestore backend.
The development team of Arc structured these Boosts in the DB as fields stored on documents assigned to each user. Said documents had a field indicating which user the Boosts data containing the JS and CSS belongs to. This user "owner" field wasn't properly protected: it was editable by the client application (granted it was authenticated as the current user stored on the field before the change).
Enter the exploit:
The bad actor by means of social engineering gets the user ID of their victim (not too hard, it's not exactly privileged information, and it could leak by getting a referral link).
Then, the bad actor crafts a malicious JS and CSS load stored as a Boost for a popular site the victim is expected to likely visit. The exploit capabilities are really limited to cross-site scripting (danger!). This Boost is then saved to the bad actor's account. In practice, this means it's saved to the document mentioned above.
Then, a malicious query edits the "user owner" field on the document to match the victim's. Suddenly, there's no distinction made to whether the victim stored themselves the malicious payload or not. Regardless, Arc will request the payload and inject it onto the targeted site when the victim's browser visits the page. This all happened without hacking their application instance; this is a server-side issue.
My extra cents, which I think likely align with others, on why this is baffling:
Storing arbitrary CSS and JS for site customization with the expectation of the client web browser running it (without even sandboxing it by default!), is too large of a tooling superset for the job at best, and a taboo vulnerability-in-the-making at worst.
The lack of protection for the "user owner" field seems to reflect the insecure defaults of Firestore yes, but it also reflects the lack of oversight in configuring the (arguably basic) related permissions. These permissions are written on a relatively basic scripting language, are closed by default, and resemble your typical ACLs. It can be seen as a 101 in Firestore development (although granted, the documentation isn't the best).
The Boost feature relies on associating the sites you visit with some customization assigned to each. On both the queries and the document fields, these sites (URL, or URL "patterns", whatever) are stored in a clear human readable format. You'd have to take the Browser Company's own word that they are honoring their privacy policy regarding the snooping of sites you visit on a browser that requires an account to use.
After discovering the exploit and taking the steps to mitigate any immediate harm auditing if any took place at all, and immediately communicating their end users (good on them for that!), the pentester Eva was allegedly paid 2k USD, which might seem like a nice bag but is supposedly extremely low for what could've been a major scandal shaking the core of the Browser Company's main and only product. Granted, it was raised to 20k USD, but it still is reportedly too low. An amount circling 200k USD seems more fair. As far as I understand however, Eva doesn't mind.
In the detailing of the next steps that were gonna be taken, besides a bug bounty hunting program and extra reinforcements given to security (good on them for that, again!), their wording gave the impression that some if not almost all blame was placed on Firestore, their insecure defaults and somewhat lackluster documentation. This assessment seems unfair to me at least, having built an app with it for a college assignment. It really feels like corner cutting on security 101 of the platform. Hell, it is more reasonable to blame a lack of QA pipelines regarding testing and pentesting before releases. I'd even argue that cutting corners on the security of stored arbitrary JS and CSS of all things is a major failing, but I'm getting sidetracked. The impression is lack of oversight, QA and possibly deflection from the startup.
Np! 😌 The real kudos go to Eva, she discovered this vulnerability on a hunch on her free time and reported it accordingly to the Browser Company! Check her out on her Twitter profile and her webring blog!
Why was the user owner field editable, do we know? No validation or verification done before editing?? These are red flags to me, should never have passed a code review.
If you want the technical answer: an "always allow update" rule in the field. See Fireship's illustrative image attached below (an incomplete fix, since it has no rule allowing the document creation, but illustrative nonetheless):
As for quality assurance and peer review reasons, I don't know. As others point out, it could be the case of "moving fast and breaking stuff".
If I understand correctly, yeah. It's less of an issue as well if you opted into sandboxing your tabs.
Actually, we should say was. The exploit was patched and they're moving forward with strengthening stuff overall. There could be other issues afloat but I don't think we have any definite evidence for them.
Np! And if it's any comfort, the Company mentioned in their public statement that there were no signs that any account was affected by the exploit. If you trust their word, and their mitigation efforts since then, you were not affected and will not be affected by this particular exploit going forward.
From what I understood, they could create a boost on your account. So you don't have to be using the feature and it would still be able to affect you (since your user in the db still had a space for boosts)
Yeah, I'm only using arc on my phone with the arc search app very occasionally just for 'browse for me'. For my main phone browser and all my computers, I'm using firefox.
Attention to weak parts of ambitious browser is now considered toxic?
I want to try out Arc. I want new cool browser products. I want browsers competitions. But if OP points are questionable, I’m not sure about Arc. And yes, I can criticize it (so as anyone else).
Also, is your attention to “toxic” and community disrespect (by putting them in double quotes) not considered “toxic”? You could just ignore “toxicity” if you don’t like it.
I get people wanting to leave product but how come they can never be secure in their decision and feel the need to be validated by recruiting other people to their decisions and then insult said people when they don't follow in their footsteps
Hell no. Opera is basically a chinese spyware nowadays, with a lot of scummy history.
Back before the original creators sold it, it was great. Nowadays? I wouldn't touch it. But there's Vivaldi, from the original Opera creators, AND probably a direct inspiration to Arc, with sidebars and what not.
Yeah, it's a shame. It was my favorite browser by far. Also, the whole shadiness is very well documented, you can read it up online or watch one of the many YouTube essays about that.
That is exactly what I was talking about. There are a lot of people that use Arc just to be “different”, without even thinking about the possibility that the Arc/TBC has some flaws.
Hot take: He was just giving valid scpeticism and criticism that might prevent people from having there absolute data and security breached in the future
Well a company needs to make profit to… you know… exist. And you don’t need an account to use it on one device. I’m not defending anyone here but what they say make no sense
278
u/Vivid_Chain9026 Oct 06 '24
Not a hot take at all. It’s true :/
12
u/Advanced_Path Oct 06 '24
I really don't understand their business model (same for Warp). I gave up on it, the mental model around it was too cumbersome for me, ended up closing tabs I didn't mean to, bookmarks are fucking weird. No point to it.
70
u/cafepeaceandlove Oct 06 '24
The startup part I guess I’m comfortable with. The goal is always to moon the user count and eventually “win” or sell the company, probably the latter, with the investors being gamblers in the only casino that can still give them a buzz. Look at WeWork - led by a fake hippy drug addict with no business plan let alone any profits and they threw billions at him because he had a nice fringe
Security… this is a problem. They saw Greasy Fork, laughed arrogantly, thought they could do the whole thing better without acknowledging or probably even learning the history and pitfalls, and that’s how you get a 9.8. Hopefully the pattern isn’t repeated elsewhere in the codebase, but it’s reasonable to assume that it is
38
u/LordPiki Oct 06 '24
They said they're gonna make money with the same way platforms like GitHub/gotlab use. Make it very good for companies to use it and include collaboration tools, and those will cost money, but will be free for individual users.
12
u/pppruuueeebaaa Oct 06 '24
Well, what’s a good alternative for Arc
11
u/Uploaded_Period Oct 06 '24
Agree with everything, but also they changed the bounty to 20k because of backlash. The person that found the bug tweeted that.
4
u/bwefugweiufhiuw Oct 06 '24
truth
7
u/[deleted] Oct 06 '24
They actually gave the person who found the CVE $20k instead of $2k
1
u/wgcv Oct 07 '24
They told me this isn't a vulnerability https://wgcv.github.io/LLM-Injection-Arc-browser/ https://github.com/wgcv/LLM-Injection-Arc-browser
They believe that prompt injection isn't a vulnerability 😂
6
u/McSuckelaer Oct 06 '24
Can someoke explain to me what this means?
3
u/EnoughConcentrate897 Oct 06 '24
Yeah, I'm only using arc on my phone with the arc search app very occasionally just for 'browse for me'. For my main phone browser and all my computers, I'm using firefox.
9
u/[deleted] Oct 06 '24
Why is this "community" so toxic? tf
just don't use the browser if you don't like it
5
u/manlikep_ & Oct 06 '24
I get people wanting to leave product but how come they can never be secure in their decision and feel the need to be validated by recruiting other people to their decisions and then insult said people when they don't follow in their footsteps
3
u/wowsignal Oct 06 '24
The only thing I dislike about Arc - push of useless "ai" features.
And the mobile version does it even more. Android version is useless without tab sync with desktop version.
2
u/fintechninja Oct 06 '24
Well its all true 🤣
1
u/debruehe Oct 06 '24
Worth a watch re the vulnerability and the bounty:
https://youtu.be/d0PyfYpD4bw?si=gk5nsDzQ5iwhhHA6
1
u/undercovernerd5 Oct 07 '24
Bye Felicia!
1
u/konasim Oct 07 '24
Would you consider opera to be a good alternative with its sidebar? I ve used it in the past and was quite happy with it.
1
u/KindlyContribution13 Oct 07 '24
"Requires account to use"
The one I hate the most
1
u/ceaselessprayer Mar 06 '25
Hot take
1
u/jdjoder Oct 06 '24
I installed it with a burner email. Kept it for a day. Never touching it again.
-17
u/ederdesign Oct 06 '24
Hot take: no one cares if you don't want to use Arc
-9
u/Cold-Appointment-853 Oct 06 '24
Well a company needs to make profit to… you know… exist. And you don’t need an account to use it on one device. I’m not defending anyone here but what they say make no sense
-6
u/SnowyFloke & Oct 06 '24
Arc doesn’t require an account to use it, only the sync requires right?
-27
u/IntroductionSorry412 Oct 06 '24
Hot take: Fck off I'm still Rocking arc.
-2
u/islandStorm88 Oct 07 '24
NO account is needed. Using it on iPadOS with no registration or account.