Windows/.NET 自动更新框架功能集和安全性
我看过几篇关于 Window/.NET 的不同自动更新框架的文章，包括：
我对这些自动更新框架之间的主要区别感兴趣，以及为什么人们会选择其中一个而不是另一个。
我也对它们的安全性感兴趣。我知道对于大多数人来说，您必须使用托管 XML 文件来更新应用程序清单。如何确保其安全，以便未购买您的应用程序或不使用您的应用程序的人无法访问您的托管站点并下载您的二进制文件？
I've seen several posts about different auto-update frameworks for Window/.NET including:
I was interested in the main differences between these auto-update frameworks, as to why one would choose one over the other.
I am also interested in how secure all of them are. I know for most of them, you must use a hosted XML file to have your app update manifests. How does one make it secure so that a person that hasn't purchased your application, or doesn't use your application simply can't go to your hosted site and download your binaries?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
还有另一种解决方案，称为 Applife。
http://www.kineticjump.com/update/
关于保护下载。
您可以做的就是保护 Forefront 服务器后面的下载。
然后，该服务器可以使用 Active Directory 进行身份验证。
There is another solution called Applife.
http://www.kineticjump.com/update/
Regarding securing the download.
What you could do is secure the download behind an Forefront server.
This server could then authenticate using Active Directory.
如果您是一家希望扩大规模的企业或初创公司，那么奥马哈是最强大的解决方案。否则，您的选择将受到个人偏好和主要应用程序编写语言的影响。如果您使用 C# 并希望静默更新，那么 Squirrel 可能是一个不错的选择。如果您使用 .NET 并需要图形更新，请选择 AutoUpdater.NET 或商业 wyUpdate。最后，如果您不使用 .NET 但仍需要图形更新，那么 WinSparkle 可能是您的最佳选择。
取自 本文。
关于您的问题，即它们在防止人们获得他们可能无权获得的新版本方面有多安全：这需要在服务器端实现。例如，您可以使用 签名 S3 URL 仅当符合条件的用户检查更新时才提供下载链接。
If you are an enterprise or a startup wishing to scale, then Omaha is the most powerful solution. Otherwise, your choice will be affected by personal preference and the language in which your main application is written. If you are using C# and want silent updates, then Squirrel might be a good fit. If you are using .NET and want graphical updates, then pick AutoUpdater.NET or the commercial wyUpdate. Finally, if you are not using .NET but still want graphical updates then WinSparkle may be your best choice.
Taken from this article.
Regarding your question of how secure they are in terms of preventing people from obtaining a new version to which they may not be entitled: This needs to be implemented on the server side. You could for instance use a signed S3 URL to only make the download link available when an eligible user checks for an update.