Skip to content

MegaGlass 0.2.0

Choose a tag to compare

View all tags
@Turtlecute33 Turtlecute33 released this 17 Oct 00:40
· 26 commits to main since this release
v0.2.0
599b314
This commit was signed with the committer’s verified signature.
Turtlecute33 Turtlecute
SSH Key Fingerprint: 1fgzJlwk8OlOBEuXdLl+m01foZIi1UWGyvcb0b6zxh8
Verified
Learn about vigilant mode.

This release fixes the problems that a full security and code review found before the first users.

Security

  • Downloaded files get the macOS quarantine attribute, so Gatekeeper checks downloaded apps, installers and scripts.
  • File names with bidi or control characters (for example a .terminal file that looks like a .pdf) are shown and saved without these characters.
  • The network stack is now curl 8.23.0 with OpenSSL 3.6.5. The old stack (curl 8.14.1 with Apple Secure Transport) could get no more curl security fixes. Certificate pinning to MEGA stays on.
  • Thumbnails from shared folders are decoded only for the image types that MEGA clients make, with a size limit. Video thumbnails and previews cannot load other files.
  • Bypass reads pages off the main thread with limits, keeps at most 50 MEGA links per job, and blocks local network addresses.
  • Clipboard watch uses the macOS pasteboard privacy API and reads a copy only when macOS finds a web address in it.
  • Only one MegaGlass process runs at a time.

Data safety

  • Opening the app from a MEGA link no longer deletes the saved open links.
  • Two-way sync and backup stop, and do not delete cloud files, when a folder listing fails or the volume changes. The status shows stopped syncs. Unsafe sync folders (home, system and app folders) are refused.
  • Emptying the Rubbish Bin, deleting a version, and removing a contact or a public link ask for confirmation.
  • Long file names are shortened to fit, so downloads do not fail at the end.

Other fixes

  • The app shows when MEGA ends the session or the engine stops with an error.
  • Links from other apps open the main window.
  • Links with a query (for example ?fbclid) keep their key.
  • Folder links start their engine only when you open them, with a limit and Close All.
  • Many smaller fixes in transfers, previews, the browser and the menu bar.

License

MegaGlass is now GPL-3.0. The license and the third-party notices are in Settings > General and in the disk image.

The app was not tested at run time with a live account. The engine passed megaglass-bench (public test links) with the new network stack.

Assets 4
Loading