Comments (7)
I'm leaning towards verifying Authenticode signatures instead (or in addition to DSA). Sparkle is moving in that direction already, so it seems a bit pointless to adopt a to-be-obsoleted scheme now:
sparkle-project/Sparkle#48
sparkle-project/Sparkle@21f9546
from winsparkle.
Do you have a timeline of when you'll be supporting verifying Authenticode signatures?
from winsparkle.
No, I don’t (seriously? In OSS?). One thing that would definitely speed things up, though, would be contributions...
from winsparkle.
Slightly related question: Does WinSparkle support downloading the xml from https:// but only if ssl cert is okay?
I couldn't find any mention about this about the doc, but either executable signature checking or https xml fetching seems to be a minimum for not opening a backdoor on user's machine.
Thank You for the quick answer, and the awesome work so far!
from winsparkle.
related
That word doesn’t mean what you think it means. Please don’t post completely off-topic comments like this.
Does WinSparkle support downloading the xml from https:// but only if ssl cert is okay?
You have the code at your disposal, why don’t you verify it yourself and if there’s any issue, submit a patch?
for the quick answer
This is a volunteer, community project, please don’t treat it as a commercial offering with support. Instead, contribute — even if it’s “only” information or documentation improvements.
from winsparkle.
I think it's not off topic at all. The same people who think they need DSA signed updates might just be satisfied with https based xml download.
Anyway, looking into the code, it uses InternetOpenUrl(), which is not very well documented in this regard, but trying it out (see http://stackoverflow.com/questions/29545544/is-internetopenurl-function-on-windows-secure-enough-if-not-how-to-make-it-str/29576201#29576201), it seems that it indeed checks https validity by default. So the answer to my own question is yes.
from winsparkle.
I think it's not off topic at all.
This issue is for tracking support for DSA signatures. You ask a question about validation of certificates, which is something that has zero overlap with the issue’s subject, technically or thematically. You are off topic by definition. By your the-same-people logic, anything about WinSparkle would be on-topic in any issue...
from winsparkle.
Related Issues (20)
- UI bug when moving an error alert between different-DPI displays HOT 5
- Without a DSAPub key win_sparkle_set_registry_path() causes crash on 2nd+ launch HOT 2
- Internet Explorer won't be supported for long HOT 8
- Qt widgets support HOT 4
- Using cached release notes HOT 3
- Question: how to add custom HTTP header in webbrowser?
- Question: WinSparkle deadlock if automatic updates enabled and update manually triggered and installed HOT 5
- vcpkg integration HOT 1
- Question: How to close and relaunch application when installer runs HOT 1
- Add support for `<sparkle:CriticalUpdate>` HOT 4
- Windows App SDK / WinUI3 Gui ? HOT 1
- How should "Remind me later" work? HOT 1
- Support `sparkle:channel` HOT 2
- Release notes webview shown detached from its parent window HOT 9
- Possibility of check but no download? HOT 3
- Installation instructions need updated HOT 3
- Translation Support for WinSparkle HOT 1
- UI didn't show message completely HOT 2
- Using old TLS 1/1.1 HOT 4
- [Question] Silent update does not restart the application HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from winsparkle.