On: “Huge” number of Mac apps vulnerable to hijacking, and a fix is elusive

[tushar-r]

If you use homebrew, replace /Applications with /opt.

[masklinn → tushar-r]

* a better way to read the CFBundleShortVersionString would be to use `defaults`: replace the exec grep; grep -v by exec `defaults read '{}' CFBundleShortVersionString`

* there are applications which use the Sparkle framework but not the Autoupdate app, and apparently applications which contain Autoupdate.app but it doesn't have a CFBundleShortVersionString. On my machine, 43 application bundles contain Sparkle, 10 have an Autoupdate.app and 9 have an Autoupdate.app with a CFBundleShortVersionString plist key. Reading Sparkle.framework/Versions/A/Resources/Info.plist would be more reliable, but even that is not perfect, some of those don't have a CFBundleShortVersionString, only a CFBundleVersion (those are most likely the downright ancient Sparkle versions, we're talking 1.0 and 1.1)

[ascagnel_ → tushar-r]

Why would a Homebrew app use Sparkle? Homebrew is a package manager, so updates would be under its purview.

[yoz-y → ascagnel_]

Some applications (probably those that are also distributed outside Homebrew) do contain the Sparkle framework (which may or may not be disabled).

As an example, in my case this concerns MacVim (on one computer only though)

Edit: maybe this is somehow tied to Cask?

[tushar-r → yoz-y]

On my machine it is only cask.