Security
Check what you install.
Signing, a checksum for every file in this release, and why the extension asks for each permission.
Signing
The desktop app is not signed yet, so Windows and macOS warn before they open it. Signing an app costs money every year, and this one is free. Signing is planned. Until then, the download page shows exactly what to click, and you can check every file against its checksum below.
On Windows 11, Smart App Control blocks unsigned apps it does not recognise, and there is no way past it for one app. Recent versions of Windows let you switch it off and on again in Windows Security, but that covers every app. Until Thaumic Cast is signed, run the app on another computer on your network (a Mac, another PC, or Thaumic Cast Server on Linux) and enter its address in the extension’s Settings.
The extension comes from the Chrome Web Store, which checks and signs it.
Checksums
SHA-256 of every file in version 0.13.1, as GitHub records it for the release. If your copy’s checksum matches, it is the file we published.
| File | SHA-256 |
|---|---|
| Windows installer (.exe)Thaumic.Cast_0.13.1_x64-setup.exe | fe38a0362dda30ce86d62fae33b407590a6c3754e78f35ab3081d0007c540a06 |
| Windows installer (.msi), for managed installsThaumic.Cast_0.13.1_x64_en-US.msi | 901591b02a6985bdc24459a8533cc70aea9f5c38c193072e9b554354d0f681fe |
| macOS, Apple silicon (.dmg)Thaumic.Cast_0.13.1_aarch64.dmg | 7222aad78b79068aba08921444c4d218f0bb01a1d78503c6a745c9e5a2a0e678 |
| macOS, Intel (.dmg)Thaumic.Cast_0.13.1_x64.dmg | c42eb32f7e9ab354a2b9dd1d3f9004febd9b16a7e3ed3fc5e6bef010f9f912d2 |
| Linux, Debian-based systems (.deb)Thaumic.Cast_0.13.1_amd64.deb | 3491505c92ac4e4849dc8bc8b7482c5d5dace736aa2072af536767c9fb13f0b1 |
| Linux, Fedora (.rpm)Thaumic.Cast-0.13.1-1.x86_64.rpm | afdff9c59554f90ab1fb9a9bcda259d898100c965f69f43158e1a49e00da8443 |
| Linux, AppImage (needs FUSE 2)Thaumic.Cast_0.13.1_amd64.AppImage | 3f3ecbeb4e4b9618455cf4932a662d86d92c18966f66eb61d3a8e2d930a9ec75 |
| Thaumic Cast Server, Linux x64thaumic-server-v0.13.1-linux-x64.tar.gz | c7825a945890fa7c3c4d28d79a559e82d7212de7c5a983b8d703e2e918a4bd67 |
| Thaumic Cast Server, Linux arm64thaumic-server-v0.13.1-linux-arm64.tar.gz | 7bf1bf2fc5de480587fb7e21f0848a451b37553c1c6572b2f9fa1729f10313ef |
| Extension, to load by hand (never updates itself)thaumic-cast-extension-v0.13.1.zip | e7c869ffa138d9d34237ecf234e36fcec8cd5655942d68f06bb97c5b89048395 |
Get-FileHash .\Thaumic.Cast_0.13.1_x64-setup.exemacOSshasum -a 256 Thaumic.Cast_0.13.1_aarch64.dmgLinuxsha256sum Thaumic.Cast_0.13.1_amd64.debRun each in the folder the file is in. On Windows, in PowerShell; it prints capital letters, which is fine.
What the extension’s permissions are for
tabCapture | Captures the sound of the tab you choose to cast, and nothing until you press Cast. |
|---|---|
activeTab | Reads the tab you opened the popup on (its title, address and icon), to show what you are about to cast. |
offscreen | Runs the audio encoder in a hidden page of the extension’s own, as your browser requires for audio work. |
storage | Keeps your settings, saved sets and the companion’s address, on your device. |
power | Keeps the computer from sleeping while a cast is playing. |
scripting | Video sync only, and only while it is on: runs its small script inside each site’s player. |
localhost | Talks to the companion (the desktop app or Thaumic Cast Server) on this computer. |
Page scripts on every site | Two small scripts read what a page says is playing (title, artist, artwork, play and pause), so the popup can show it and its pause and skip buttons work. It stays in your browser unless you cast that tab; then the companion passes it to your speakers to show. Nothing is saved. |
Every site (optional) | Asked for only if you turn on video sync, or enter the address of a companion on another computer. Your browser asks you first. |
It has no analytics or advertising code. It talks to your companion, and loads the artwork the page you cast is already showing, to colour the cast card. The privacy policy has the rest.
Report a vulnerability
Thank you for looking. Please do not open a public issue. Use GitHub’s private vulnerability reporting, or write to security@thisisbrew.com.