Hello,I'm currently using a MacBook Pro Retina 15-inch running OSX El Capitan. To increase the security on my computer I have installed about an year ago AVG AntiVirus which I run occasionally to check for some security issues. Recently the antivirus started to warn me for some potential threats that seem to be connected with most of my apps (VLC, utorrent, appzapper, etc.). I've uninstalled the apps and whenever I try to reinstall them AVG pops a window with a warning. All of these problems seem to be connected with 'Sparkle Framework'.

Can someone please explain me what is happening and if this is an actual threat or just some malfunction of the antivirus? Thank you!PS: I don't know what triggered this, just started to happen somehow ðŸ˜.

Allow me to go a bit more in depth for you. Is a popular framework for OS X apps which enable the developer to easily handle app updates in-app without the hassle of forcing the user to visit the website, download the latest version, re-install, etc. A was discovered in an outdated version of the framework that could compromise apps using it.

Xcode on Mac OS X Maverics doesn’t allow you to sign a bundle if any nested bundle in it is unsigned. These nested bundles could be things like helper executables, libraries, embedded frameworks, plug-ins, XPC services. You should sign the unsigned bundles with your own code signing identity i.e. Your Developer Id Certificate or App Store Distribution Certificate. MacOS Code Signing In Depth. The purpose of this technote is to provide a more in depth view of code signing. It is intended to expand upon the information given in the Code Signing Guide by supplying a more detailed analysis of the technology. The target audience for this document is OS X developers who have read and presumably understand the information given in the Code Signing Guide but.

The flaw in the framework makes it possible for an adversary to execute a and, as opposed to simply updating the app, can allow said adversary to install other software, such as a virus, trojan, etc. The reason AVG is alerting you to this as a threat is, while the framework is not actually infected, it would appear that many of the apps on your Mac use a version of Sparkle that has this flaw.I recently scanned my Mac and was alerted to over 200 threats.

The majority of said threats were uninfected apps that use a vulnerable version of Sparkle to update themselves. (The other threats are files I know are on my Mac and I know what they do, and AVG considers them a threat on the average system)For your scenario, I would advise ensuring that you update these apps on a trusted network, preferably wired with nobody else on the network. This will greatly reduce the risk of a potential attack and will allow you to update your apps to versions that use a patched copy of Sparkle. I would also advise that you read the release notes for updates on all your apps to ensure they have, in fact, addressed the Sparkle issue.So just to recap, the problem exists in a single piece of software that is included in. So every instance of Sparkle on your computer (that is, in almost every app on your Mac), AVG will list it as a potential threat. At least, in the instance of VLC you show in the screenshot, you are not infected with malware, you simply have a vulnerable app on your Mac. Additionally, I would like to point out that the Sparkle vulnerability does NOT compromise your Mac or the applications using it during normal usage.

It does not mean that you will be compromised. The existence of the vulnerability simply means that it is possible for an attacker to compromise your Mac while you are updating an app that uses a vulnerable version.

Additionally, any app downloaded from the Mac App Store is NOT vulnerable as it is updated through the system's software update mechanism. Also, some apps use their own mechanisms for delivering updates while others simply download the new version to your /Downloads directory. These methods are not affected by this vulnerability.Additionally, ignore the remarks regarding antivirus made by johnb-one. Such remarks are utter foolishness. While OS X is far more secure and virus-resistant than Windows,. OS X is consistently having flaws patched in every update, many of which could be taken advantage of by a rogue application to cause harm. Running an antivirus app on your Mac is an intelligent decision.

However, you can be more lax with it than if you were on a Windows machine. I would still advise the occasional full system scan, maybe once a month or so, and a quick scan every few days. The biggest threat with Macs and malware are. It's usually much more difficult for a worm or run-of-the-mill virus to adequately infect a Mac. Sure, I'll gladly search forums where people have posted nothing but their opinion. Consider the following scenario: you have an app that uses a vulnerable version of the Sparkle framework as discussed in this thread.

You run the app and find an update is available. You download and install the update. What you didn't realize, however, is that you just got owned by an adversary exploiting the vulnerability to install a trojan horse on your Mac during the update process. Now, you proceed with your day as though everything is splendid without ever noticing that you now have a compromised system. What happens if the app you use needs administrator privileges to perform certain tasks? Are you fully aware of the fact that by escalating the privileges of the application, the trojan installed during the exploit is now operating with those privileges and can now make system-wide modifications without further notice to you?

Are you going to sit down and run a shasum check on every file in the application bundle and compare it to those provided by the developer? If so, then you're right, there is absolutely no need whatsoever to utilize any anti-virus or anti-malware software whatsoever. On the other hand, if you are like 99.9% of humans and have no intentions of manually checking the checksums of every file in your application bundle and ensuring no other files exist in it, then you are going to be using a compromised system.As I said before, the need for anti-virus and anti-malware scanners on OS X is far less than the need for such tools on Windows. However, just because the need is lower doesn't mean it is a waste of time. Should you run out and buy a subscription to the most expensive suite available? Certainly not. However, foolishly saying that OS X users need not concern themselves with such tools is as foolish as saying Linux users can be just as lax.

I'm not arguing the security and hardiness of OS X. I'm simply saying that you don't leave your fate to the OS alone. The very article you shared explicitly states ' Delegating that responsibility to software is an ineffective defense.' The reason OS X is far more secure than Windows is because of it's UNIX roots, which Linux shares. Both systems are vulnerable when an ignorant user is in control, and believe me when I say there is no shortage of ignorant users out there. No operating system is perfect. UNIX is not secure just because it's UNIX, it's secure because of the control it gives responsible users and the way it is built.

400 Day Guide 10th edition Hardcover Identifications, Repair tips, and Troubleshooting. It also includes an extensive collection of back plate and suspension illustrations which aid clock identification and the selection of replacement parts. By Terwillinger. 400 Day Anniversary Clock Repair Guide quantity. Clock will not chime. A new mechanical clock movement can ship from USA the same day you order it, so the time it takes you to get your clock up and running is quick. A repair can take months. A repair can usually take weeks and then you are still left with a used overhauled movement rather than a new one. The new movement is the same as your old movement, so all. Clockworks is your global distributor of Clock Movements, Parts, and Tools. With Clockworks, you can repair or replace your clock movement and be on time in no time. Offering quartz or mechanical clock movements to replace old units, or to repair the old movement with our parts and tools. There is phone, chat, or email support to help you.

Nonetheless, an operating system will do what it is told to do, whether by the user or by rogue software, and if the user is duped into allowing rogue software to be installed, the system will be compromised.The odds of your Mac becoming infected are minute. So are the odds of being struck and killed by lightning, but are you going to run out into the middle of a field during a thunderstorm and fly a kite? Apple Footer.This site contains user submitted content, comments and opinions and is for informational purposes only. Apple may provide or recommend responses as a possible solution based on the information provided; every potential issue may involve several factors not detailed in the conversations captured in an electronic forum and Apple can therefore provide no guarantee as to the efficacy of any proposed solutions on the community forums.

Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the.

On Aug 29, 2013, at 3:54 PM, Martin Koob wrote: I think I figured it out. It was a problem with my XCode setup. I will explain what I found in case someone else runs into this.Thanks for the info Martin.

That will be helpful for others.Also, for anyone who isn't aware, I posted a manual on code signing for the talk I gave a RunRevLive '13.I wonder if I need to add the step about installing the command line tools to the instructions for OS X?-Trevor DeVoreBlue Mango Learning Systems-Martin Koob02.09.13 07:46. On Sep 2, 2013, at 10:46 AM, Martin Koob wrote: As it seems that the commandline tools are not always installed, perhaps it would be good to remove the above sentence 'Doing so will install the codesign command line tool.'

And add a step to check the XCode Preferences PaneDownloads to ensure command line tools are installed, if they are not install them. This would be a step for people to do whether they had XCode installed previously or not.Thanks. Done. I just want to add how much I am enjoying using the GLX Application framework. I am converting an existing LiveCode app to use GLX and it has gone remarkably well.

Thanks Trevor!You're welcome.