3 ms·

Edit: Sparkle uses signature verification as mikeash pointed out in reply to my comment. I'll leave it because I still agree with my second paragraph but feel f

Edit: Sparkle uses signature verification as mikeash pointed out in reply to my comment. I'll leave it because I still agree with my second paragraph but feel free to downvote since it doesn't really contribute much to the topic at hand. The fact that sparkle renders the feed in a webview is bad, but the reason this is a big issue is because developers aren't using TLS/SSL/https for their update feed URLs. Even if Sparkle is fixed in the app itself your list of binaries can still be hijacked. It always could and always will. It's 2016, every developer needs to take this seriously. Just because it's a pain in the ass to install an SSL certificate on a web server doesn't mean you can just skip it.

mikeash 11y ago
How can they be hijacked if Sparkle is fixed? Sparkle already uses digital signatures for the updates themselves. That's why everybody thought using HTTP was safe. The problem arose when it turned out that the feed itself, which is not signed, can be used to execute arbitrary code. Merely using HTTPS is a vast improvement, but it still means that anybody who manages to e.g. take over your server can then cause all of your users to execute arbitrary code. With good key management this is not possible with a fixed Sparkle, since the only code being executed is in the updated app, and the updated app is signed with a key which you should be keeping offline.
- brazzledazzle 11y ago
  Ah, I didn't realize it used signature verification. Nice. I edited my comment. Thanks for taking the time to cure my ignorance.
  - mikeash 11y ago
    Sure thing. For whatever it's worth I totally agree that everybody needs to quit screwing around and enable TLS, like, yesterday if they haven't already.
cheez 11y ago
Thanks for the TL;DR. I use TLS! And FWIW, it's really cheap to host downloads with Cloudfront which supports TLS.

mikeash 11y ago

How can they be hijacked if Sparkle is fixed? Sparkle already uses digital signatures for the updates themselves. That's why everybody thought using HTTP was safe. The problem arose when it turned out that the feed itself, which is not signed, can be used to execute arbitrary code. Merely using HTTPS is a vast improvement, but it still means that anybody who manages to e.g. take over your server can then cause all of your users to execute arbitrary code. With good key management this is not possible with a fixed Sparkle, since the only code being executed is in the updated app, and the updated app is signed with a key which you should be keeping offline.

brazzledazzle 11y ago
Ah, I didn't realize it used signature verification. Nice. I edited my comment. Thanks for taking the time to cure my ignorance.
- mikeash 11y ago
  Sure thing. For whatever it's worth I totally agree that everybody needs to quit screwing around and enable TLS, like, yesterday if they haven't already.

cheez 11y ago

Thanks for the TL;DR. I use TLS! And FWIW, it's really cheap to host downloads with Cloudfront which supports TLS.