How to setup an updater program to keep users of my applications updated?

[HaLo2FrEeEk]

I've wrtten quite a few programs over the last few months and I find myself updating them all the time. Each time I do an update, I zip up the new files and upload them to their respective folder on my server, then post a topic on my forum letting people know about the update. In one of my more recent programs I built an updater into it that would check a dynamically-generated (from the database) XML file and compare versions to determie if a file with a higher version was available on the server.

That's all fine and dandy, but the user still has to check for the updates (or it prompts them to if it's been more than a week,) and I still have to make a forum post everytime I put up an update.

So I had an idea for a program that would constantly keep in contact with the database and keep a record of which programs need updates. When that program is started, instead of it checking the server, it would check the updater program's records and be able to instantly tell the user that an update is available.

My question is, what would be the best way to accomplish this? Obviously the updater will need to be running constantly, so should I make it a service, or simply minimize it to the taskbar. How should I save these records? I thought about doing it in the registry, or using a flat file system, but both of those options can be manipulated.

Another thing to keep in mind is the fact that HTTP is not secure, so I'd be distributing an application with access to my database. I could get around that by having my server gnerate an XML file with details of all potential programs, and the updater would download and parse that, but then I'm still stuck with the issue of how do I store the records without the user being able to tamper with them? Registry would probably be best, since it's globally accessible and people would have to hunt around to find where I'd hidden the information.

I thought about instead of having the program simply notify the user that an update is available, actually download the updated file and replace the existing one with the new one. That would work too, I guess I'll just wait to see what people have to say about this before I start anything.

[GaryTexmo]

Mmm opinions :D Here's my thoughts, likely by no means the best solutions.

What are you updating? Are these key systems, or are they things that people run when they wish to use them and leave off when they don't? If the former, an updater service would probably be the best way to go; however, if the latter, perhaps an alternative to a minimized program?

Can the programs themselves, upon startup, check with a server to see if they're up to date? The programs should be aware of their own versions, so when they check with the server they can tell they are out of date, download the update, then close down and trigger the updater program? The updater program could run, update, then relaunch the program?

This might save you from having to keep track of what's what on the client, letting everything check with the server. Might be a little more secure?

That's just the first thing that came to my mind... I've never tried this before. Were I to approach it, I think that's how I would start. I may find that's not a good approach, maybe you've found that out already?

[HaLo2FrEeEk]

I'm trying to avoid having each program check with the server on startup, causing a slight hang in the program's start time. If I could have this other program running constantly in the background, keeping track of which program's the user has run and the versions the user is using and the version on the server, I could cut out the step of each program contacting the server each time it's run. If this other program knows that I've run a specific program and that the version is, say, 2.1.3, and the version on the server is, for example, 2.2.0, then notify the user that an update is available. That way the program itself doesn't have to check the server.

[BRawn]

I'm working on an application at the moment which uses updater that we coded but I haven't ever worked on the product version. Bearing in mind it's c# app. What we did is worked on the date. If the date of the file on the server is a greater than the date on the user's machine, the application updates. This is the very first thing I check for on the startup of the application.

In your case I don't think this is what you're looking for. I think the best way for you to accomplish your situation is to write a service perhaps which runs on it's own thread. That way you can call that thread whenever you need to without necessarily putting unwanted strain on your application.

In my personal opinion, the best way I've found to save your records in a case like this is to use encryption. Write you information to an encrypted file only your application can decrypt. You can clear it's contents at will.

I have a security class if you'd like which encrypts files. We use it to encrypt our connection string and it works well as its really hard to decrypt if the you don't have the right decryption key. That's my feel. Hope it help :)

[HaLo2FrEeEk]

Well that's another thing I have problems with, communication between applications. I just don't know how to do it. If I were to write a program and I wanted it to be able to communicate with another program that I'd written, I'd have the first program save a file and the second program read it. I'm sure it's possible to have application 1 actually communicate directly with application 2, but I don't know how.

Also, encryption has always been a weird thing for me. I just don't understand how you can use a key to encrypt a file or it's contents, without it being something super simple, like repeat the key string until it is the same length as the contents (truncate it if necessary,) then XOR each byte of the contents by the corresponding byte in the key string. That can't be a good encryption scheme though, of course without the password it'd be difficult to reconstruct the data, but if you had the unencrypted data and the encrypted data it would be trivial to figure out the key.

I just planned on using the registry to store the version of each application that I wanted to be able to update, each time it's run. Then the updater program sees which applications I've run and knows their versions. When it checks the server for updates, it'll compare the current version from the registry to the version on the server.

Another thing I just thought about, how do I ensure that the user has downloaded and is running the updater? I know I can check for existing processes, so I could probably just check to ee if the updater process exists and if it doesn't, notify the user and ask if they want to download it.

This is all becoming very complicated...