undefined | Better HN

0 pointsnine_k1y ago0 comments

I very much agree with the idea that browsers are security-sensitive software, unlike, say, a picture editor, and more like an ssh server. It should be assumed to be constantly under attack.

And browser development is exactly not the area where I would like to see the "move fast, break things" attitude. While firebase may be sloppy with security and thus unfit for certain purposes, I would expect competent developers of a browser to do due diligence before considering to use it, or whatever else, for anything even remotely related to security. Or, if they want to experiment, I'd rather that be opt-in, and come with a big banner: "This is experimental software. DO NOT attempt to access your bank account, or your real email account, or your social media accounts".

With that, I don't see much exploit potential in learning stats like the number of cores on your machine. Maybe slightly more chances of fingerprinting, but nothing comparable to the leak through improper usage of firebase.

0 comments

Imustaskforhelp1y ago

hmm interesting. Other thing to add is if we treat it as a ssh server , we actually won't try to go out and break things.

But I think that was the whole point of arc , to break the convention and be something completely new

and I have a reason why

They were competing with the giants called google , safari , firefox which have insanely large funding and their whole point was trying to sell something later built on this arc browser.

and since chrome , firefox etc. don't try to come up with these ideas because well security reasons (which I agree to / as seen in the post)

I think arc wanted to seperate itself from chrome / firefox and that's why they became a bit reckless you could say since this exploit was available.

Also the other thing I want to convey , is that "With that, I don't see much exploit potential in learning stats like the number of cores on your machine"

this was only recently discovered. Just imagine the true amount of exploits in these proprietory solutions which we don't know about.

Yeh. Just like a ssh server , I would personally like the source code to be available but developing browsers is time consuming and money intensive for developers but ladybird exists , but its in beta.

that being said , not open source is also that private , (xz) , but atleast it got discovered way quickly and was able to mitigate it quickly

j / k navigate · click thread line to collapse