* The Business of Software

A former community discussing the business of software, from the smallest shareware operation to Microsoft. A part of Joel on Software.

We're closed, folks!


» Business of Software FAQ
» The Business of Software Conference (held every fall, usually in Boston)
» Forum guidelines (Please read before posting!)


Andy Brice
Successful Software

Doug Nebeker ("Doug")

Jonathan Matthews
Creator of DeepTrawl, CloudTrawl, and LeapDoc

Nicholas Hebb
BreezeTree Software

Bob Walsh
host, Startup Success Podcast author of The Web Startup Success Guide and Micro-ISV: From Vision To Reality

Patrick McKenzie
Bingo Card Creator

Setup File Versioning, Browser Caching, and Norton A/V Reputatio

I've had problems in the past where browsers were agressively caching setup files, which caused problems with short update release cycles. To get around caching, I started adding the version number to the setup using the script below. Recently a few users reported that Norton's reputation scan is flagging my software. From what I can tell, the name and age of the setup file are factors in the Norton reputation score. In other words, you can't build up a reputation if you are constantly changing the name of the setup file.

You can apply to Norton to get your software white-listed (https://submit.symantec.com/whitelist/isv/new/), but before I do I wanted to get clarification on file naming and versioning.

1. Does anyone have a better method to deal with caching without appending the version number to the setup? I think I tried the script below without appending the version and still had issues - but my memory is fuzzy.

2. Has anyone dealt with getting white-listed with Norton? If so, do you need to re-submit to the white-list for every update?

#### versioning script ####

Instead of pointing directly to the exe, my download button points to a URL with this PHP script:

header("Cache-Control: no-store, no-cache, must-revalidate");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");

include "version.php";
$file_path = "/downloads/MySetup-".$setup_version.".exe";

if(file_exists($file_path)) {
  $file_name = basename($file_path);
  $file_size = filesize($file_path);

  header("Cache-Control: private");
  header("Content-Type: application/stream");
  header("Content-Length: ".$file_size);
  header("Content-Disposition: attachment; filename=".$file_name);

else {
  die("A file access error occurred ... etc.");
Nicholas Hebb Send private email
Tuesday, March 05, 2013
One way to fix your problem AND improve usability of your upgrade process is: do the upgrade from within the app.

Download the upgrade in background and when it's done, notify the user and ask if he wants to upgrade.

Whatever the HTTP library you'll use, it has to have an option to not use OS-wide caching.

That being said, setting proper caching directives in your HTTP server should work as well. A browser or a proxy that doesn't respect them is not "aggressive about caching", it's just buggy.

I doubt any major browser/proxy would have such a bug, you might have been doing something wrong. A quick search brings http://serverfault.com/questions/256558/is-there-a-way-to-turn-off-client-browser-caching-for-specific-websites, http://www.anyexample.com/programming/php/completely_disable_any_browser_caching.xml, http://stackoverflow.com/questions/914027/disabling-browser-caching-for-all-browsers-from-asp-net
Krzysztof Kowalczyk Send private email
Tuesday, March 05, 2013
Thanks Krzysztof. Based on the second link it looks like I can modify the header()'s of my current script and use just the Setup.exe name without the version.

Unfortunately, since my product is a COM add-in, updaters won't work due to how add-ins are registered. The old version needs to be uninstalled before installing the update. It's a pain.
Nicholas Hebb Send private email
Tuesday, March 05, 2013
I just use a different file name for each installer version (e.g. PerfectTablePlan427.exe, PerfectTablePlan507.exe). I've not had any issues (that I am aware of). Also I prefer it when companies name their installer something helpful rather than setup.exe.
Andy Brice Send private email
Wednesday, March 06, 2013
+1 to Andy.

Our installer is named uniquely for each release this way:


Never had problems with antiviruses. Our installer is code-signed so that maybe helps.

Naming an installer Setup.exe is not very nice to your users. How would you find an installer in the downloads directory if every vendor just used Setup.exe?

We also keep all our released installers internally so our naming scheme helps us to.

Finally, we have a download archive section on our website and allow to download the previous versions. This is plain respect to old customers who purchased an old version and do not want to upgrade. It helps to have unique installer names in this case too.

It drives me crazy that to download an old Firefox or Chrome version (for testing purposes) I have to use Wayback Machine.
B2B Send private email
Wednesday, March 06, 2013
> This is plain respect to old customers who purchased an old version and do not want to upgrade.

I do this too (at least keeping the latest minor number for each major version so everyone can get the best versions they're entitled to use without paying again).

It amazes me when companies don't do this.
Jonathan Matthews Send private email
Wednesday, March 06, 2013
I just use /setup.exe?version=3, to get around caching. If argument is different, any browser servers file not from the cache.
Jim Morrison Send private email
Wednesday, March 06, 2013
What Jim said, but it doesn't even need to be that complicated:


When your next version comes out, change the url to:


etc. The URL has to exactly match for the client to match the result against its cache.

Also, proxy servers are NOTORIOUSLY bad at reading/obeying HTTP caching headers, so even if you do it correctly according to the spec, there are still (very popular) proxy servers that get it wrong. The URL munging has the best chance of working everywhere.
Robert C. Barth Send private email
Wednesday, March 06, 2013
@Robert, I've used this solution in the past. From time to time I got a support request saying "I downloaded your program and it says unknown file type". For some reason the downloaded file had no extension.

Now I just use a sefver side redirect and include version number in the installer. Stable and convenient solution.
Kuzmitskiy Dmitry Send private email
Wednesday, March 06, 2013

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics
Powered by FogBugz