Nostr Web Client

I would highly advise against such a setup, where every app imports the server. Logistically, that is a nightmare due to how aggressive Android is in killing processes.

Instead, I'd create a dedicated companion application users can install, and a client SDK with a thin API/protocol for developers to hook into and communicate locally via IPC.

The separation is a huge benefit for everybody (especially users) because the less code in that SDK, the more you can huck into the app and manage from 1 place. Security wise, this is beneficial too.

Vitor Pamplona 4mo ago

So, is the plan for your Tor lib to also only work on a specific app and people have to install that app to use it?

Reply to this note

Please Login to reply.

Discussion

Matt Nelson 4mo ago

Never. kmp-tor's Android service is configured to export=false. Developers can lock down notification action Intents even further by declaring a signature permission in their manifest, and configuring the service with their custom string. Giving any app on the device access to a Service or BroadcastReceiver requires careful work given the security implications.

Most app's only need access to the tor network while they're running. kmp-tor provides that for them. Archiving kmp-tor and doing something like an Orbot app would be asinine.

The application I am working on uses kmp-tor, but yes, I have baked into the SDK's IPC protocol InetSocketAddress and UnixDomainSocketAddress information for immediate access to a tor socks/http proxy, either by requesting it via Intent, and always being sent along with the forwarded http calls.