they did their autoupdate through an unencrypted connection, without any verification, and just executed the payload locally. when pressed about it they added https but then it turned out they had no auth on the update server. it was a whole thing, took several years for them to correct and they complained every step.












that trend continued, i’d say. ever seen shark boy and lava girl?