Edit: Sparkle uses signature verification as mikeash pointed out in reply to my comment. I&#x27;ll leave it because I still agree with my second paragraph but feel free to downvote since it doesn&#x27;t really contribute much to the topic at hand.<p>The fact that sparkle renders the feed in a webview is bad, but the reason this is a big issue is because developers aren&#x27;t using TLS&#x2F;SSL&#x2F;https for their update feed URLs. Even if Sparkle is fixed in the app itself your list of binaries can still be hijacked. It always could and always will.<p>It&#x27;s 2016, every developer needs to take this seriously. Just because it&#x27;s a pain in the ass to install an SSL certificate on a web server doesn&#x27;t mean you can just skip it.