21–30 of 40 posts
Earlier quoted context omitted.
If I recall correctly, Google is facing a patent lawsuit over the Courgette technology. I don't remember if the complainant was a patent troll or not.
Whatever the outcome would be, that is enough to stop people from using this piece of open source software to provide safer updates.
And this is one of many reasons I love that almost all my software is installed through a secure package manager.
Earlier quoted context omitted.
Yes, but it's very difficult to setup outside Google.
courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…
That's VeriSign for you. Thawed sells the very same certificates for $200, and Comodo runs a coupon deal for Tucows members that gets you the cert for $99 (though the actual process is a bit too contrived compared to Thawte's).
Earlier quoted context omitted.
courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…
> $400/yr That's VeriSign for you. Thawed sells the very same certificates for $200, and Comodo runs a coupon deal for Tucows members that gets you the cert for $99 (though the actual process is a bit too contrived compared to Thawte's).
https://github.com/apankrat/assorted/blob/master/validate_pa...
Basically the idea is to get an Authenticode certificate and sign the update .exe with it. Then, when a program checks for an update and pulls it down, it would validate the package signature and will not proceed if the details - the application and the certificate subject names - are wrong. It is as simple as it gets.
And this is one of many reasons I love that almost all my software is installed through a secure package manager.
pacman cough cough sorry I just lost it for a second...
Earlier quoted context omitted.
May I suggest Deluge ( http://deluge-torrent.org/ )? It's open-source, cross-platform and very similar to µTorrent in both functionality and looks.
Transmission ( http://www.transmissionbt.com/ ) is an open source torrent client with a nice web interface (as well as native interface) just like Deluge. I think it is somewhat lighter resource-wise (I'm running it on my NAS), but apart from that I don't know the exact differences between Deluge and Transmission, but I thought I'd mention it for completeness' sake.
Earlier quoted context omitted.
courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…
If I recall correctly, Google is facing a patent lawsuit over the Courgette technology. I don't remember if the complainant was a patent troll or not.
Earlier quoted context omitted.
Yes, but it's very difficult to setup outside Google.
courgette is just a binary diff algorithm -- there's nothing fancy to it (they use some really neat tricks, though), and apparently (I haven't verified) the source is in the chromium tree. validating your updates via asymmetric crypto can be mildly expensive ( http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.…