Top all-time · #11688
env.fail
Personal blog · env.failsecurityweb
env.fail is a personal blog at env.fail about security and web. Since 2024, 6 different Hacker News readers have linked it 6 times, most often “900 Sites, 125M accounts, 1 Vulnerability”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters link env.fail's security research on misconfigured Firebase sites (the firewreck post) and its write-up on gaining access to Arc browser accounts. The comments cite these as sources rather than judging the writing.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- 900 Sites, 125M accounts, 1 Vulnerability3 people · 3 mentions · first linked 2024-03-18
- You Suck at Securing S3, Here's Why2 people · 2 mentions · first linked 2024-04-10
What Hacker News says?
I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this…
Comment linking /posts/firewreck-1
on “Gaining access to anyones Arc browser without them even visiting a website”Submitted 900 Sites, 125M accounts, 1 Vulnerability as a story · 573 points
HN discussionAlso, if you're going to use firebase (don't, you don't need the scale for your 10 MAUs), you should secure it: https://env.fail/posts/firewreck-1/
Comment linking /posts/firewreck-1/
on “Firepad – An embeddable open-source collaborative code and text editor for web”Submitted You Suck at Securing S3, Here's Why as a story · 5 points
HN discussionOnce again mainstream news sites fail to properly acknowledge the source (this one is citing The Register). This is the source post of the news: https://env.fail/posts/firewreck-1/ And it was discussed on HN a few days ago: https://news.ycombinator.com/item?id=39742422 Also relevant to this is a story from 2 months ago: I pwned half of America's fast food chains simultaneously - ( https://news.ycombinator.com/item?i…
Comment linking /posts/firewreck-1/
on “Google Firebase websites might have leaked data online”Submitted You Suck at Securing S3, Here's Why as a story · 3 points
HN discussion