Hacker News Reader

Comment by sjsv | Hacker News Reader

interesting command from one of the comments on the original article:

find /Applications -path '*Autoupdate.app/Contents/Info.plist' -exec echo {} \; -exec grep -A1 CFBundleShortVersionString '{}' \; | grep -v CFBundleShortVersionString

This gives an overview of the programs using sparkle, and which version.

View on HN

Augmented it with a bit of Ruby in order to find the "SUFeedURL", which if using the `http` protocol, means that an application is vulnerable.

https://gist.github.com/ajb/876107d0edc0f2c11779

FYI, it can be stored in theoretically any key. But it's probably worth looking for SUFeedURL* at least.

  % plutil -p /Applications/iTerm.app/Contents/Info.plist| grep SUFeedURL
  "SUFeedURLForFinal" => "https://iterm2.com/appcasts/final.xml"
  "SUFeedURLForTesting" => "https://iterm2.com/appcasts/testing3.xml"

Good info! I really have no clue what I'm doing. Just trying to help coworkers figure out if they need to uninstall any apps, really :)

Mostly no surprises for me, but Xquartz is using 1.6!

/Applications/Utilities/XQuartz.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/Info.plist <string>1.6</string>

If you use homebrew, replace /Applications with /opt.

* a better way to read the CFBundleShortVersionString would be to use `defaults`: replace the exec grep; grep -v by exec `defaults read '{}' CFBundleShortVersionString`

* there are applications which use the Sparkle framework but not the Autoupdate app, and apparently applications which contain Autoupdate.app but it doesn't have a CFBundleShortVersionString. On my machine, 43 application bundles contain Sparkle, 10 have an Autoupdate.app and 9 have an Autoupdate.app with a CFBundleShortVersionString plist key. Reading Sparkle.framework/Versions/A/Resources/Info.plist would be more reliable, but even that is not perfect, some of those don't have a CFBundleShortVersionString, only a CFBundleVersion (those are most likely the downright ancient Sparkle versions, we're talking 1.0 and 1.1)

Why would a Homebrew app use Sparkle? Homebrew is a package manager, so updates would be under its purview.

Some applications (probably those that are also distributed outside Homebrew) do contain the Sparkle framework (which may or may not be disabled).

As an example, in my case this concerns MacVim (on one computer only though)

Edit: maybe this is somehow tied to Cask?

On my machine it is only cask.

Reply on news.ycombinator.com