Nostr Web Client

Someone could push a malicious update with a naive app too.

We do have plans to mitigate this. You can always self host it (we're partnering with some providers for a one click deploy). Also we want to do some stuff where it'll only update the wasm binary if it is signed by us.

QnA 2y ago

At least with the app the user has to tap a button to update (if they have auto updates off ofc).

Thanks for the info, knew you'd have something up your sleeves.

Reply to this note

Please Login to reply.

Discussion

Paul 2y ago

PWAs have a way of caching their dependencies and logic for how that cache gets updated. We want to hook into that and give the user a chance to opt out of automatic updates, but haven’t built it yet. Ideally the user can check some “update bundle” against a signature from us but a ways to go before we have that.

QnA 2y ago

Thanks Paul!