>If vendors are forced to abuse updates in this way then users are going to demand a certificate transparency-like system to stop the abuse. I always thought t

>If vendors are forced to abuse updates in this way then users are going to demand a certificate transparency-like system to stop the abuse. I always thought this would be a neat use of Ethereum: a smart contract publicly stores the hash+url of the latest version of $softwareProduct (and maybe also the hash+url for the latest beta release, etc). The software would only update to a version named by the smart contract. The smart contract would only allow the application developers' addresses to be able to update the published hash+urls. The smart contract could have arbitrary logic here, like to allow the developers to add new addresses that can publish new versions, or to implement voting logic so a majority of the developers have to agree on publishing a new version, etc. In this system, it's not possible to secretly push a malicious update to one user.