How can they be hijacked if Sparkle is fixed?<p>Sparkle already uses digital signatures for the updates themselves. That&#x27;s why everybody thought using HTTP was safe. The problem arose when it turned out that the feed itself, which is not signed, can be used to execute arbitrary code.<p>Merely using HTTPS is a vast improvement, but it still means that anybody who manages to e.g. take over your server can then cause all of your users to execute arbitrary code. With good key management this is <i>not</i> possible with a fixed Sparkle, since the only code being executed is in the updated app, and the updated app is signed with a key which you should be keeping offline.