Greasy Fork

Off-site downloadURL

I see multiple scripts using off-site @​updateURL and @​downloadURL, most pointing to github and the old userscripts.org. Should these be disallowed/discouraged?

Just as external @require could change to something malicious outside of GreasyFork's control, does not the same apply to script updates coming from external sources?

Just curious.

@updateURL and @downloadURL are removed on *.user.js files.
They won't affect when you install the script.

Yes, the code shown will be as submitted, but the code to install will be rewritten as per https://greasyfork.org/help/rewriting

Thank you both, that is good to hear.

I was looking at "Code" because of syntax highlighting and haven't noticed the pruning... I apologize for the noise.

Came here with the same question. I'm really not trying to rush you or anything, but is this feature done now or is it a future thing? The script I uploaded and installed isn't pointing to the Fork for updates. I'm on Chrome using Tampermonkey, if that matters. I uninstalled the script before testing each time. All that seems to be added is a @namespace, and that points to the UserScripts.org site.

Guess I should link the script since it's unlisted:

https://greasyfork.org/scripts/468-youtube-video-ratings-with-like-strength

Hello lednerg. The feature is already implemented. As Jason and Lou explained above, the code you see in the "Code" tab is exactly as the author posted - it may contain @downloadURL etc.
https://greasyfork.org/scripts/468/code

But the .user.js you actually install (green button) has them stripped out.
https://greasyfork.org/scripts/468/code.user.js

See https://greasyfork.org/help/rewriting for details. Regards.

I guess what's confusing me is that the namespace pointing to userscripts instead of Greasy Fork. If it doesn't matter, then whatever. It seems to be auto-updating from the Fork regardless.

Since I'm not much into scripting, I'm actually curious how my installed script knows, where to look for an update?

I always thought, these 2 lines are mandatory to let the script know its origin, so it can check for updates.

I guess what's confusing me is that the namespace pointing to userscripts instead of Greasy Fork. If it doesn't matter, then whatever. It seems to be auto-updating from the Fork regardless.

Namespace can point wherever, it never downloads from that, just uses it as an identifier.

Since I'm not much into scripting, I'm actually curious how my installed script knows, where to look for an update?

It remembers where it was downloaded from.

are you sure all script managers would not just break updating if you remove those lines? cuz I rememer GM have by default a disabled option "use download url for updating"

See discussion here.

Remove those lines won't help promote security. It's author's freedom to choose where to update from.

But why does Greasy Fork remove @downloadURL and @updateuRL completely?.. As far as personally I see, Scriptish need them to update automatcally.

It is possible to just replace them with values on Greasy Fork site, no need to remove them...

are you sure all script managers would not just break updating if you remove those lines? cuz I rememer GM have by default a disabled option "use download url for updating"

Scriptish has the same issue. It could be ok to rewrite those URLs, but deleting them harms the scripts...