3 ms·

There is independent confirmation of this at the MacRumors forums. http://forums.macrumors.com/showthread.php?t=768932 http://forums.macrumors.com/showthread.p

by e1ven 17y ago

There is independent confirmation of this at the MacRumors forums. http://forums.macrumors.com/showthread.php?t=768932 http://forums.macrumors.com/showthread.php?t=768932

potatolicious 17y ago
That thread actually brings up a really good point: we need to train users to update apps only via the official OS-sanctioned update method (Windows Updater, OSX Update, etc), or via the app's built-in update mechanism. The sort of "oh hey, QuickTime needs to update, run this file" should automatically set up alarm bells in everyone's heads. OSX is lucky in this respect - it has Sparkle, which for a large part has become the de facto software updater for OSX. It has a simple UI that users recognize and approaches universal adoption.
- blasdel 17y ago
  Except that Sparkle is ridiculously terrible for doing security updates. Since it doesn't ship with the OS or even provide a means to have a centralized second-party updater, every app has its own copy in its bundle, and it only gets run when the app is running (and by default only on launch). Vulnerabilities in need of patching for desktop apps generally take the form of accidentally executing malicious input -- with Sparkle in a document-based Cocoa app, that input is already being parsed before Sparkle is loaded. It's even worse for plugins -- if you use ClickToFlash you know exactly what I mean -- as a plugin to a Webkit plugin, Sparkle runs roughshod over the address spaces of every Webkit app. If said Webkit app itself uses Sparkle, you're fucked, especially if it's a different version of Sparkle, or one of it's many forks.
  - wmf 17y ago
    Sparkle seems pretty good to me compared to the Windows world where apps either don't self-update at all or each app has its own updater daemon. Perhaps a single Sparkle daemon would be better, but it's hardly terrible as it is now.

by e1ven 17y ago

There is independent confirmation of this at the MacRumors forums. http://forums.macrumors.com/showthread.php?t=768932 http://forums.macrumors.com/showthread.php?t=768932

potatolicious 17y ago

That thread actually brings up a really good point: we need to train users to update apps only via the official OS-sanctioned update method (Windows Updater, OSX Update, etc), or via the app's built-in update mechanism. The sort of "oh hey, QuickTime needs to update, run this file" should automatically set up alarm bells in everyone's heads. OSX is lucky in this respect - it has Sparkle, which for a large part has become the de facto software updater for OSX. It has a simple UI that users recognize and approaches universal adoption.

blasdel 17y ago
Except that Sparkle is ridiculously terrible for doing security updates. Since it doesn't ship with the OS or even provide a means to have a centralized second-party updater, every app has its own copy in its bundle, and it only gets run when the app is running (and by default only on launch). Vulnerabilities in need of patching for desktop apps generally take the form of accidentally executing malicious input -- with Sparkle in a document-based Cocoa app, that input is already being parsed before Sparkle is loaded. It's even worse for plugins -- if you use ClickToFlash you know exactly what I mean -- as a plugin to a Webkit plugin, Sparkle runs roughshod over the address spaces of every Webkit app. If said Webkit app itself uses Sparkle, you're fucked, especially if it's a different version of Sparkle, or one of it's many forks.
- wmf 17y ago
  Sparkle seems pretty good to me compared to the Windows world where apps either don't self-update at all or each app has its own updater daemon. Perhaps a single Sparkle daemon would be better, but it's hardly terrible as it is now.