7 ms·

There isn't really anything you can do to convince me that your team has the expertise to maintain a browser after this. It doesn't matter that you have fixed i

by tyho 2y ago

There isn't really anything you can do to convince me that your team has the expertise to maintain a browser after this. It doesn't matter that you have fixed it, your team is clearly not capable of writing a secure browser, now or ever. I think this should be a resigning matter for the CTO.

avarun 2y ago
And what, you’re going to find them a new CTO? What kind of magical world do you live in where problems are solved by leaders resigning, instead of stepping up and taking accountability?
- smt88 2y ago
  Taking accountability can and should include admitting you're the wrong person for the job and resigning.
  - radicaldreamer 2y ago
    CTO is simply a title, the proper response here would be to hire a head of security and build it into the culture from the ground up. I'm looking at all of the Arc Max features which probably need to be architected correctly to be secure/privacy-preserving. They could take a lot of inspiration from iCloud Private Relay and iOS security architectures in addition to really understanding the Chrome security model.
    - kiddingright 2y ago
      If the devs didn't take security seriously before, why would another node in the communication graph change anything?
      - knowitnone 2y ago
        because sometimes it's a deadline pushed by management so a change could result in allow more time for design, programming, review, or even full time security personnel. Nobody writes the best most secure software under deadline
        cutemonster 2y ago
        Yes, the right person maybe can change the culture in the company (plus contribute lots of technical skills)
- deleted 2y ago
  [deleted]
- strunz 2y ago
  What kind of accountability is it when there's no personal consequences?
- yas_hmaheshwari 2y ago
  Yeah, I also think that asking someone to resign for this does not look like a proportionate response They are owning up to their mistakes and making sure such things don't happen again (and increasing the amount from 2K :-)) seems like the right approach to me
Insanity 2y ago
Well, the current team perhaps. But it's also likely part of the startup mentally of "move fast and break things", which is not entirely compatible with the goal of the browser.
pembrook 2y ago
Surprise surprise, turns out it takes a looong time for every software startup to finally strip out all the hacky stuff from their MVP days. Apparently nobody on this startup community forum has ever built a startup before. Pro tip: if stuff like this violently upsets you, never be an early adopter of anything. Wait 5-10 years and then make your move. Personally, I expect stuff like this from challenger alternatives, this is the way it should be. There is no such thing as a new, bug-free software product. Software gets good by gaining adoption and going through battle testing, it’s never the other way around like some big company worker would imagine.
- kiddingright 2y ago
  [flagged]
- thruway516 2y ago
  I don't think you understood the severity or the noobiness of the error. This is a browser not a crud app or electron app. A browser is a complex system level piece of software not a hacky mvp and this kind of error shows that maybe they don't have the competence to be building something like this. It makes you wonder what other basic flaws are there just waiting to be exploited, even if its built on top of chromium. Would you fly in an mvp airplane built by bicycle engineers? (maybe not the best analogy since the first airplane was built by bicycle engineers)
  - pembrook 2y ago
    Agreed, I wouldn’t have hopped on the first airplane with some bicyclist named Wilbur. That would involve risk of immediate physical harm. On the other hand, we’re talking about a 2 year old browser leaking what websites you visit. Do you also think Firefox in 2006 was bulletproof? The entire internet and every single OS & browser was a leaky bucket back then. The current safety-ism, paranoia and risk-aversion around consumer software on this forum is hilarious to me. Maybe they shouldn’t have called this place “Hacker” news, because it’s now full of people LARPing as international intelligence agency targets from a 90s movie. If the prying Five Eyes are such a concern for you, maybe use a fake email when signing up for stuff and your browser history is instantly anonymized. Yes, startups involve lots of risk (to everyone involved, users/employees/founders/investors). But risk is the only way we get new things. If you those risks are too scary for you, stay far away startups.

by tyho 2y ago

avarun 2y ago

And what, you’re going to find them a new CTO? What kind of magical world do you live in where problems are solved by leaders resigning, instead of stepping up and taking accountability?

smt88 2y ago
Taking accountability can and should include admitting you're the wrong person for the job and resigning.
- radicaldreamer 2y ago
  CTO is simply a title, the proper response here would be to hire a head of security and build it into the culture from the ground up. I'm looking at all of the Arc Max features which probably need to be architected correctly to be secure/privacy-preserving. They could take a lot of inspiration from iCloud Private Relay and iOS security architectures in addition to really understanding the Chrome security model.
  - kiddingright 2y ago
    If the devs didn't take security seriously before, why would another node in the communication graph change anything?
    - knowitnone 2y ago
      because sometimes it's a deadline pushed by management so a change could result in allow more time for design, programming, review, or even full time security personnel. Nobody writes the best most secure software under deadline
      - cutemonster 2y ago
        Yes, the right person maybe can change the culture in the company (plus contribute lots of technical skills)
deleted 2y ago
[deleted]
strunz 2y ago
What kind of accountability is it when there's no personal consequences?
yas_hmaheshwari 2y ago
Yeah, I also think that asking someone to resign for this does not look like a proportionate response They are owning up to their mistakes and making sure such things don't happen again (and increasing the amount from 2K :-)) seems like the right approach to me

Insanity 2y ago

Well, the current team perhaps. But it's also likely part of the startup mentally of "move fast and break things", which is not entirely compatible with the goal of the browser.

pembrook 2y ago

Surprise surprise, turns out it takes a looong time for every software startup to finally strip out all the hacky stuff from their MVP days. Apparently nobody on this startup community forum has ever built a startup before. Pro tip: if stuff like this violently upsets you, never be an early adopter of anything. Wait 5-10 years and then make your move. Personally, I expect stuff like this from challenger alternatives, this is the way it should be. There is no such thing as a new, bug-free software product. Software gets good by gaining adoption and going through battle testing, it’s never the other way around like some big company worker would imagine.

kiddingright 2y ago
[flagged]
thruway516 2y ago
I don't think you understood the severity or the noobiness of the error. This is a browser not a crud app or electron app. A browser is a complex system level piece of software not a hacky mvp and this kind of error shows that maybe they don't have the competence to be building something like this. It makes you wonder what other basic flaws are there just waiting to be exploited, even if its built on top of chromium. Would you fly in an mvp airplane built by bicycle engineers? (maybe not the best analogy since the first airplane was built by bicycle engineers)
- pembrook 2y ago
  Agreed, I wouldn’t have hopped on the first airplane with some bicyclist named Wilbur. That would involve risk of immediate physical harm. On the other hand, we’re talking about a 2 year old browser leaking what websites you visit. Do you also think Firefox in 2006 was bulletproof? The entire internet and every single OS & browser was a leaky bucket back then. The current safety-ism, paranoia and risk-aversion around consumer software on this forum is hilarious to me. Maybe they shouldn’t have called this place “Hacker” news, because it’s now full of people LARPing as international intelligence agency targets from a 90s movie. If the prying Five Eyes are such a concern for you, maybe use a fake email when signing up for stuff and your browser history is instantly anonymized. Yes, startups involve lots of risk (to everyone involved, users/employees/founders/investors). But risk is the only way we get new things. If you those risks are too scary for you, stay far away startups.