I currently only have to check the source on one app - Amber - and I'm done, my trust can take a little nap.
yes, every new open source nostr app I could fully verify and compile myself... but there's a lot to be said about only having to trust/audit one thing.
yeah fair. async signing is annoying but doable. complicates the code a bunch
interesting. I haven't dealt with it yet but have wondered why client devs seem to punt on it for so long.
I guess every signed action needs to turn into some kind of async/promise rather than using keys directly at hand..?
yeah exactly. it's even more annoying in notedeck since you have to keep state around for more then one frame
is it the kind of thing that is hard to add later but wouldn't have been so bad to start with?
yeah maybe. I don’t trust some random signer app with my key, which is why i’ve never prioritized it. I do think it would be good to have a signer subprocess which is network sandboxed, so i’m not totally against async signing
yea I mean I probably trust you more than most other apps out there - at least on par with Amber. so maybe I was being a jackass saying I wouldn't paste my nsec into Notedeck.
it's not like you're Primal or something! 🤪
