ghost
commented
2 years ago Seems normal. The patcher doesn't block internet access. It does patch out some telemetry calls but benign update mechanisms are left untouched. I tested with a fresh install + patch and this is the only request made:
Request:
GET https://www.sublimetext.com/updates/4/stable_update_check?version=4126&platform=windows&arch=x64&now=1654754535 HTTP/1.1
Accept: */*
User-Agent: sublime-version-check/3.0
Host: www.sublimetext.com
Response:
HTTP/1.1 200 OK
Via: Px
Date: Thu, 09 Jun 2022 05:58:54 GMT
ETag: "629025e4-2c2"
Vary: Accept-Encoding
Server: nginx
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Accept-Ranges: bytes
Cache-Control: no-cache
Last-Modified: Fri, 27 May 2022 01:14:12 GMT
Content-Length: 706
{
"latest_version": 4126,
"license_lapse_timestamp": 450389,
"last_license_number_lapsed": 1189819,
"update_url": "https://www.sublimetext.com/download",
"manifest_host": "download.sublimetext.com",
"update_host": "download.sublimetext.com",
"manifest_path_osx": "/_pak/sublime_text_osx_4126.manifest.xz",
"update_path_osx": "/sublime_text_osx_4126.pak.xz",
"manifest_path_windows_x64": "/_pak/sublime_text_windows_x64_4126.manifest.xz",
"update_path_windows_x64": "/sublime_text_windows_x64_4126.pak.xz",
"manifest_path_windows_x32": "/_pak/sublime_text_windows_x32_4126.manifest.xz",
"update_path_windows_x32": "/sublime_text_windows_x32_4126.pak.xz"
}
Right after entering any license the "Thanks for purchase" popup appears and it wants internet access. image Port 443 so it is most likely https. After running strings I found that it is either sublimehq.com, sublimetext.com or sublimemerge.com all pointing to this IP. Or a crafted string from an array. It might have been an initial version check, Im too lazy to open up wireshark tho. I just block it and we good. If you want to find out you could use dnsproxy with --verbose to see all dns requests.