15 replies

1. Brent Larson Bluesky 2 min later

   wasn't it security issues?
   www.theverge.com/2024/9/20/24...

2. Zach Leatherman Bluesky 4 min later

   Thank you to @nerdcowboy.bsky.social:

   www.theverge.com/2024/9/20/24...

3. Zach Leatherman Mastodon 5 min later

   Thank you to Brent Larson (Bluesky) for the answer:

   https://www.theverge.com/2024/9/20/24249919/arc-browser-boost-firebase-vulnerability-patched

   1. Jim Nielsen Mastodon 11 min later

      @zachleat you gotta love it when vulnerability disclosures by security researchers are blog posts with BLACK backgrounds and pixelated graphics moving across the page. that's when you know it's legit.

      1. Zach Leatherman Mastodon 14 min later

         @jimniels before vibe coding we had only vibes

   2. Jason Garber Mastodon 55 min later

      @zachleat love me some catastrophic security flaws in my web browser software

      1. Zach Leatherman Mastodon 58 min later

         @jgarber I’m not sure if this issue even communicates the depth of the original problem — how long did they let folks share Boosts with arbitrary JavaScript in them? This truly seems like XSSaaS to me

         1. Jason Garber Mastodon 1 hr later

            @zachleat XSStremely yikes

   3. amd Mastodon 2 hr later

      @zachleat yikes. That’s a bad one.

4. Ben Schwarz Bluesky 49 min later

   They realised it was maybe a bad idea when the CEOs account was the one that got popped

   1. Zach Leatherman Bluesky 1 hr later

      whoa — what

      1. Ben Schwarz Bluesky 2 hr later

         kibty.town/blog/arc/ write up of the hole 🕳️ that allowed any account to be exploited

         1. Zach Leatherman Bluesky 15 hr later

            ahh yeah I did read that but I didn’t see any reference to the CEO’s account being compromised (though it very easily *could* have)

            1. Ben Schwarz Bluesky 16 hr later

               I don’t remember where that tidbit of info came from 🧠 but as I recall the exploit demo used the ceos account in a non threatening manner as a high impact case

               1. Zach Leatherman Bluesky 16 hr later

                  they rolled back the whole feature 😅😅😅