Thank you for posting this. I do not trust this client due to a few reasons, the largest being that at least 75 API endpoints are live on nostrich.org that do not appear in the published source code; the current repo implements 5. These include wallet management, paid engagement, follower tracking, that blocklist, and more.
When asked about open-sourcing the mobile apps, Nostrich said: "As for the source code, we've released it under the MIT license on GitHub. The code currently available powers all our applications, including Nostrich mobile apps and Nostrich Deck, since they're all built on the same web application and packaged using WebView."
And when asked "Is there a repo I can go to and compile a build from source that matches your binary?": "It's about a month behind the current release… which we'll push to GitHub soon to bring it in sync with the current version."
The phone app is more than just a webview, as it appears to have unique logic for key storage, signing, and over-the-air app updates. These are innocuous behaviors, but the greater point is that there is a notable gap between published code, what is claimed, and what is live. There is no way to verify that a build matches the source.
Use this client as you wish, of course. I'm sure most of its users won't mind these caveats. I hope this information may prove helpful to anyone with a similar curiosity.
