27.7.1 has no security certificate!

[beansandfranks]

I noticed no certificate on install.
My firewall also caught it. I had to allow.
Same true for the plug-in container.
>> Important to fix this issue!!
Thx

[Nightbird]

viewtopic.php?f=1&t=17859

[dark_moon]

You can and should always check the checksum and GPG signature before start the binary

[gulf-of-mexico]

When the Pale Moon browser says "an update is available" it downloads a file named "update" to Pale Moon / updates folder to be installed the next time the browser restarts.

Is there a place where the checksum for this update file is published to compare with before confirming to "allow" to update?

It's different than the installer or zip file checksums published on the website.

[gulf-of-mexico]

I think I was too wordy above.

Where can I find the SHA-256 for the update file which Pale Moon x64 downloads to

/Users/username/AppData/Local/Moonchild Productions/Pale Moon/Pale Moon/updates/0/update.mar (44,279,651 bytes)

[gulf-of-mexico]

You can and should always check the checksum and GPG signature before start the binary

How do you check the checksum for the update.mar file Pale Moon downloads when an update is available?

[dark_moon]

You can and should always check the checksum and GPG signature before start the binary

How do you check the checksum for the update.mar file Pale Moon downloads when an update is available?

I dont. I only can check the binarys from website.
If the updater check the files before starting the upgrade? I dont know. Only Moonchild knows

[Moonchild]

The internal updater file is already hash checked when it is downloaded. The update method is secure:

1. The browser sends an https request to the update server (so no MitM rewriting is possible)
2. The update server responds with a manifest file that includes both SHA256 and exact file size of the update file, as well as the URL of the update file
3. The browser downloads the update file, and any mismatch in size or SHA256 will reject it

MAR files are not cryptographically signed because it is not necessary.

[gulf-of-mexico]

Excellent. Much appreciated.Thank you.