Implementing an auto updater/notifier?

[Casey Kolb]

@orange said in Implementing an auto updater/notifier?:

Looks great. What about the security? Can R2R team or others hack the website with this? Is it secure?

That's a good question. Everything is sent over https, so I think the only way it could be hacked is if someone gets a hold of your API keys. I'll need to do some more research though. This is no less secure than any other plugin that uses an external API, and it seems lots of companies are beginning to do this (see PercX :winking_face: )

@Natan There's always going to be a trade off between security and convenience, but you're right that there's a risk. However, the AWS Server is not a real concern. It's no different than someone going to your site to download the update, and you want your customers to always be on the most up to date version anyway.

[Casey Kolb]

Also, it's worth mentioning that if someone does get a hold of your API keys, you can immediately revoke the keys.

[orange]

@Lunacy-Audio There is a woocommerce plugin called License Manager.

It has an API key. So the connection between plugin and server should be done with that? Or do we need to modify woocommerce anyway?

[Casey Kolb]

There's a free and super robust Woocommerce License Manager with all 5-star reviews that I use. I'm still in alpha testing for my plugin, but the license API has been tested on probably 20 different machines with varied operating systems without any issues. You have to set up your API keys with that plugin and I'd strongly suggest you make your keys Read-Only. I don't think there's ever a reason to Write from the HISE plugin in this case.

For the actual server file downloads, that's a separate API. You interact directly with the Woocommerce REST API, so you need a different pair of keys, which you make through the Woocommerce Settings.

[Lindon]

@Lunacy-Audio said in Implementing an auto updater/notifier?:

wp-json/wc/v3/products/20

Thanks Casey, it turned out mine was a postman issue...so having sorted it to work there I will now try in HISE

[Lindon]

• hmm, I can get a lot of data back from this call.....very very useful....for expansions...

[Casey Kolb]

Definitely! And once the download function is improved, I think it would super easy to set up preset packs to be downloaded right from the plugin without the user ever needing to restart

[Lindon]

@Lunacy-Audio said in Implementing an auto updater/notifier?:

Definitely! And once the download function is improved, I think it would super easy to set up preset packs to be downloaded right from the plugin without the user ever needing to restart

Presets yes - and expansions, but ... I'm trying to work out a meaningful way to authorise/authenticate expansions when they install -without having to know (perhaps years) ahead what expansions I will be shipping...

[ustk]

@Lindon It's a big question that definitely needs to be addressed! ;)

[d.healey]

My plan is the user will purchase an expansion and will be sent a code. They enter the code into the plugin which will check on my server that it is valid and download/install the expansion.

[ustk]

@d-healey Yeah that's what I plan too, it seems rather simple to implement. Well, speaking only about the request side since I haven't dug into expansions yet but I'll need to for my current project.

[Lindon]

@ustk said in Implementing an auto updater/notifier?:

@d-healey Yeah that's what I plan too, it seems rather simple to implement. Well, speaking only about the request side since I haven't dug into expansions yet but I'll need to for my current project.

OK great, glad it's simple : can you demonstrate?

[hisefilo]

@d-healey this thread makes me think a Software Center can be done with actual HISE tools. like Arturias Software center or NI app.

Is this possible? What do you think

[d.healey]

@hisefilo I'd recommend doing it as an Electron app. You might be able to do it with HISE but it will be quite limited.

[d.healey]

@hisefilo Now that I've played with the Server API I think it's definitely possible to make a software centre type app.

[hisefilo]

@d-healey yeahhhhh mate!!!!! Will be digging on it soon.

[ustk]

I definitely think it's possible... I'm just afraid that if it's cracked, everything would be available at once

[d.healey]

@ustk Not at all. You never put anything that requires security on the client side, that goes on the server side.

[ustk]

@d-healey me->reassured() :)

[d.healey]

An idea I've been having, which I think we should all discuss, is a download manager for HISE based plugins/expansions. I'm building one for my own plugin, I was originally going to include the functionality inside my plugin but for various reasons I think it would be better as a separate app. I considered building it with Electron, but since HISE has such a sophisticated file api and server api, and also the ability to encrypt/encode/extract/install expansions it makes sense to build it directly in HISE.

Play, Native Access, Spitfire, SINE, Pulse, VSL, I'm sure we could add a few more to the list. And now every single one of us is thinking of creating a new one :D I'm not so sure it's the best thing for users to have to install a separate download manager for every single vendor.

Mine will of course be open source, but it has occurred to me that maybe I could make it suitable for other developers to use too. They would have to be using WooCommerce for their webshop and there would be some other requirements to make everything work nicely. I'll provide a wordpress plugin that has the necessary API endpoints and of course these can be modified as needed for each developer's setup.

The app won't require the user to sign-in, it will be decentralised, each vendor will provide a code when the user buys a product that can be entered into the app and it will get the product from the vendor's server - a bit like Steam keys.

This benefits the user as there is no single point of failure, they won't have their buying habit tracked by a single company, if they move to a different machine they just need to export/import their codes.

It benefits the developer because they don't have to pay a third party to supply a download manager service and the developer is in control of their own products. If the developer wants to watermark their software or incorporate some kind of DRM they are free to do that on the server side and on the installed plugin side, the app itself is agnostic in this regard and merely acts as a channel between the user and the products they've purchased on the developer's server.

I think it would also be good if as well as acting as a download/software manager the app also provides a catalogue of products that the user can click on to visit the vendor's website.

Let me know your thoughts/suggestions.

There is currently no way to get a reference to a generic folder, such as the user's VST2, VST3, AAX, or AU installation locations. I think out of those VST2 is the only one that doesn't have a standard location.

@Christoph-Hart Would it be possible to add location constants for these? Or perhaps have some kind of user customisable location. I appreciate that we don't want to give access to the entire file system but letting the user pick a location seems mostly harmless.