3 ms·
This is a terrible idea, especially as used as in the examples in the comments. You think enterprise apps would fix security holes using an updater that grabs a
by jmgao 13y ago
This is a terrible idea, especially as used as in the examples in the comments. You think enterprise apps would fix security holes using an updater that grabs arbitrary code off the internet using http, and does no signature validation whatsoever?
- vpanyam 13y agoIt does do signature validation. https://github.com/VivekPanyam/EvolveWrapper/blob/master/src/com/vivekpanyam/TestApp/DynamicApp.java#L64 https://github.com/VivekPanyam/EvolveWrapper/blob/master/src... The user can use HTTPS if they want to; just put in the appropriate URL. I updated the example to reflect that.
- jmgao 13y agoSignature validation should not be an optional thing that gets done if people choose to do so. Any sane updater library will mandate it in the library, and force users to jump through hoops to turn it off.
- notthetup 13y agoHmm. From my understanding, PackageInfo.signature is an Array of public keys used to Sign the app. Not sure of comparing the public keys can be considered as signature verification.