Skip to content

SherlockEQ 0.6.4

Choose a tag to compare

View all tags
@smbrownai smbrownai released this 22 Jun 18:32
v0.6.4
bf16292

SherlockEQ 0.6.4

A security-hardening release. SherlockEQ runs without the macOS sandbox so it can tap system audio, which means its helper surfaces deserve extra care. This update tightens how the command-line tool talks to the app, what files that channel can touch, and the permissions on the app's own data — closing the findings from a focused security review. There are no changes to how EQ, profiles, or safe-listening work.

Security

  • The command-line control channel is now authenticated. The sherlockeq tool talks to the running app over a local channel that previously accepted any message from any program on your Mac. The app now issues a private, per-launch token that only your account can read, and ignores any request that doesn't present it — so another program can't quietly drive SherlockEQ on your behalf.
  • Profile import and export stay where they belong. Importing and exporting profiles through the command-line tool now accepts only real .json files and won't follow a symlink in place of the target. This prevents the app from being tricked into overwriting an unrelated file or reading something it shouldn't.
  • Downloaded headphone-correction files are kept inside their cache. Entries fetched from the online AutoEQ catalog are sanitized before being written to disk, so a malformed or tampered catalog entry can't place a file outside SherlockEQ's own cache folder.
  • Your data folders are now private to your account. The folders SherlockEQ creates for your profiles and cached corrections are created — and existing ones tightened — so only your account can read them. Profiles can encode details about your hearing; they shouldn't be readable by other users on a shared Mac.

Not a medical device

SherlockEQ is not a healthcare or medical application. It does not diagnose, treat, measure, or monitor any hearing condition, tinnitus, or disability. For concerns about your hearing, consult a doctor, audiologist, or licensed healthcare professional.

Previous release

See the 0.6.3 release notes for what shipped in the prior version.

Assets 3
Loading