{"action":"created","issue":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/578","labels_url":"https://api.github.com/repos/ShareX/ShareX/issues/578/labels{/name}","comments_url":"https://api.github.com/repos/ShareX/ShareX/issues/578/comments","events_url":"https://api.github.com/repos/ShareX/ShareX/issues/578/events","html_url":"https://github.com/ShareX/ShareX/issues/578","id":65126633,"number":578,"title":"Only install signed updates","user":{"login":"dwendt","id":1041796,"avatar_url":"https://avatars.githubusercontent.com/u/1041796?v=3","gravatar_id":"","url":"https://api.github.com/users/dwendt","html_url":"https://github.com/dwendt","followers_url":"https://api.github.com/users/dwendt/followers","following_url":"https://api.github.com/users/dwendt/following{/other_user}","gists_url":"https://api.github.com/users/dwendt/gists{/gist_id}","starred_url":"https://api.github.com/users/dwendt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwendt/subscriptions","organizations_url":"https://api.github.com/users/dwendt/orgs","repos_url":"https://api.github.com/users/dwendt/repos","events_url":"https://api.github.com/users/dwendt/events{/privacy}","received_events_url":"https://api.github.com/users/dwendt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ShareX/ShareX/labels/Enhancement","name":"Enhancement","color":"009800"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-03-30T03:29:49Z","updated_at":"2015-04-01T06:53:53Z","closed_at":"2015-03-31T17:48:33Z","body":"The update functionality in ShareX is currently insecure. It will download whatever's on github right now and execute it. Instead, the developer of ShareX should keep a private key that the updates are signed with. The client will check if the update is signed before executing it. The developer should keep in mind secure storage best practices in relation to the private key.\r\n\r\nThis issue is made in light of the puu.sh compromise where a malicious update was pushed out, as they perform no code signing."},"comment":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/comments/88371484","html_url":"https://github.com/ShareX/ShareX/issues/578#issuecomment-88371484","issue_url":"https://api.github.com/repos/ShareX/ShareX/issues/578","id":88371484,"user":{"login":"dwendt","id":1041796,"avatar_url":"https://avatars.githubusercontent.com/u/1041796?v=3","gravatar_id":"","url":"https://api.github.com/users/dwendt","html_url":"https://github.com/dwendt","followers_url":"https://api.github.com/users/dwendt/followers","following_url":"https://api.github.com/users/dwendt/following{/other_user}","gists_url":"https://api.github.com/users/dwendt/gists{/gist_id}","starred_url":"https://api.github.com/users/dwendt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwendt/subscriptions","organizations_url":"https://api.github.com/users/dwendt/orgs","repos_url":"https://api.github.com/users/dwendt/repos","events_url":"https://api.github.com/users/dwendt/events{/privacy}","received_events_url":"https://api.github.com/users/dwendt/received_events","type":"User","site_admin":false},"created_at":"2015-04-01T06:53:53Z","updated_at":"2015-04-01T06:53:53Z","body":"Hey Jaex, \r\n\r\nIssues don't mean \"I will do this issue,\" it means \"this issue might be done by **someone** eventually.\" Closing an issue means you as the \"ShareX\" project and all contributors (not you personally) have completed or rejected it. Open issues have no other implications to the English-speaking world than this.\r\n\r\nPast versions may not be able to auto-update if you lose your private key. This is why you should certainly back that private key up. Thus, it will never get lost. If you cannot keep a single file backed up, maybe there is another reliable contributor that could handle signing releases? Alternatively, if the file could not be verified, let the user know and shellexecute the github page to open it in a browser so that they may determine the legitimacy of an update themselves.\r\n\r\nIf you do not understand public key encryption in 2015, and are in a non-English speaking country, it is of utter importance to yourself to learn it and how to use it anyways -- regardless of this issue."}}