4 ms·
Sparkle is an open source update framework for osx. I guess the private key is for signing the updates, so the user knows that the update is legit.
by txdv 11y ago
Sparkle is an open source update framework for osx.
I guess the private key is for signing the updates, so the user knows that the update is legit.
- dchest 11y agoCorrect. Sparkle is an open source updater framework used by many Mac applications for built-in updates. When a vendor publishes an update, it signs it with a private key (which should be kept secret). When the app downloads the update, it verifies the signature using the public key distributed with the app, and proceeds with update if the signature is correct. Publishing private key breaks this trust: anyone can now sign updates, pretending to be the vendor of ICQ. Edit: I just checked and their updater endpoint is served over unencrypted HTTP connection. If you use ICQ and update it, anyone who can MiTM your connection can install software on your Mac. PR: https://github.com/mailru/icq-desktop/pull/3 https://github.com/mailru/icq-desktop/pull/3 For ICQ for Mac users the best way to protect against this is to use Mac App Store version.