And what about the risk of parsing file:// and ftp:// and other protocols inside the WebView component What assurances can you give that there is not security flaw on the server that allows replacing XML file?
I have been a long time Visor/TotalTerminal user and wanted to try iTerm2 on 10.11 but was concerned with its use of the Sparkle updater framework. I could find no sign through all of my research if confirm if updates are performed through https instead of http and I declined to install it. I also couldn't find a way to contact the anyone to ask, so I'm glad you posted. So? What does it use? Don't you think this may be worth noting on the announcement or changelog?
And what about the risk of parsing file:// and ftp:// and other protocols inside the WebView component What assurances can you give that there is not security flaw on the server that allows replacing XML file?