Nostr Compass #45 is out. Here is what changed across Nostr this week:
Keep Android 1.3.2 (maintainer: nostr:npub1h3fzzzeq60acjvnyvw34rpn5clkaueteffmkt3ln4ygekg9lcm0qhw96sj) revokes earlier bunker grants and scopes them per account. It also drops a compromised bundled CA root and makes storage fail closed. Nostr WoT extension 0.8.14 (maintainer Leon: nostr:npub1gxdhmu9swqduwhr6zptjy4ya693zp3ql28nemy4hd97kuufyrqdqwe5zfk) adds experimental phone signing over WiFi or Web Bluetooth, and local keys stay unused if the phone disconnects. Zapstore 1.1.3 carries app comments and zaps across a catalog signing key change. Catalog links carry over too. nostr-pubsub 0.5.19 limits identified receiver EVENT and INV exports to explicit public authors, while IP and timing remain visible. A merged Napplet change checks the event ID and signature before headless browser execution. It also checks the exact raw HTML hash first. The deep dive contrasts NIP-37 (topic) encrypted drafts with NIP-48 (topic) signed bridged events.
Read the full issue:
Keep Android 1.3.2 (maintainer: nostr:npub1h3fzzzeq60acjvnyvw34rpn5clkaueteffmkt3ln4ygekg9lcm0qhw96sj) revokes earlier bunker grants and scopes them per account. It also drops a compromised bundled CA root and makes storage fail closed. Nostr WoT extension 0.8.14 (maintainer Leon: nostr:npub1gxdhmu9swqduwhr6zptjy4ya693zp3ql28nemy4hd97kuufyrqdqwe5zfk) adds experimental phone signing over WiFi or Web Bluetooth, and local keys stay unused if the phone disconnects. Zapstore 1.1.3 carries app comments and zaps across a catalog signing key change. Catalog links carry over too. nostr-pubsub 0.5.19 limits identified receiver EVENT and INV exports to explicit public authors, while IP and timing remain visible. A merged Napplet change checks the event ID and signature before headless browser execution. It also checks the exact raw HTML hash first. The deep dive contrasts NIP-37 (topic) encrypted drafts with NIP-48 (topic) signed bridged events.
Read the full issue: