What's new in Nostr Vault

Build 41 · iPhone, Mac and Android

3.0.0

Nostr Vault 3.0 connects your own devices directly over the FIPS mesh, with no server in between.

• Your devices, connected. Turn on FIPS Mesh in Settings and add your devices by address or QR code. On Android you can add your Mac, your other phones or a home vault. See My Devices.
• iPhone and Mac: the mesh engine runs inside the Mac app, so there is nothing else to install. The Mac serves your photos to your own devices, and your public photos to anyone else who asks. See your own photo server.
• Notes and photos to your Mac. Add your Mac as Vault on Mac and each new note and photo goes to it over the mesh. Your notes and history also sync back from the Mac.
• iPhone and Mac: Check sync with Vault on Mac now ends on "Done" with counts, or says why it stopped.
• Home vault. A spare phone can be your home vault. It gets your new posts and media and passes them on. See kiosk mode.
• Photos over the mesh. Photos kept on your devices load over the mesh in the feed, the Vault and profiles.
• Your address stays private. Once you add a device, only your devices learn this phone's address. Anyone else gets public photos only. On Android, that is up to the limit you set under Pause after. See privacy.
• Android: if the mesh was on, it starts again with the relay when the phone restarts.

Fixes

• iPhone: the phone ran hot with the app open. The relay now gets memory sized to the phone.
• iPhone and Mac: search no longer freezes while you type a common word.
• Android: on some phones the app ran out of memory and closed when a long note full of links was in the feed.

Build 40 · iPhone, Mac and Android

2.7.2 (build 40)

iPhone and Mac. This is the App Store build.

• The app now stays cool with it open all day. The relay pauses work nobody can see while the app is in the background, and backs off from flaky relays and signers. The Web of Trust globe draws more cheaply.
• On the iPhone, a locked article no longer links out to buy it on Fanfares. The Mac keeps that link. On both, it can only point at the article itself.
• New Message from a profile keeps the person you picked.

Android.

• Android now looks and acts like the iPhone app. Messages and notifications, Settings, the tab bar, setup, profiles, search, follow lists, the Web of Trust globe, the feed, note details and the composer have all been matched to the iPhone.
• The app runs cooler. The relay pauses work nobody can see while the app is in the background, and backs off from flaky relays.
• A crash at launch on a new install is fixed.

Build 39 · iPhone, Mac and Android

2.7.2 (build 39)

iPhone and Mac. The App Store release candidate.

• Your keys and settings are safer. The config file is written in one go, backed up, and never reset by a damaged copy. Imported keys are checked.
• Fanfares articles get Open in Fanfares and Already unlocked?. The app itself never pays.
• Recipes, streams, articles and profiles can be opened in the rest of Nostr.
• Zaps on posts, live streams and articles are opt-in on the Mac, as on the iPhone.
• The on-chain wallet moves to Settings → Advanced.
• Highlights and comments from people you blocked no longer show under articles.
• iPad fixes for the relay card, the tour card and the Media viewer.

Android. The App Store review pass for Android.

• Reposts, deletes, profile edits and follow-list changes are signed only as the account they belong to. Switching accounts can't carry one account's follow list into another.
• Settings are saved in one go and survive a damaged file. The owner key moves out of the config file, and a broken credential store no longer crashes the app.
• Notes backup works.
• Fanfares articles can be unlocked with a zap from the lock card. Other locked articles stay locked.
• Recipes, streams, articles and profiles can be opened in the rest of Nostr.
• Global shows a new account's web.
• Copying your nsec is marked sensitive, and secrets stay out of the log.
• The on-chain wallet moves to Settings → Advanced.
• Two-pane notes on tablets, and more matching with the iPhone.

iPhone and Mac build 19 · Android build 20

2.7.2 (first builds)

Music, hashtags, highlights, and direct messages that reach every device you own. On Android, the app now matches the iPhone: same tabs, same wording, same feed, thread and Relay tab.

Security (iPhone and Mac)

• A mention could plant a fake link (iPhone). A profile name wasn't escaped before it went into the link that makes a mention tappable. A crafted display name could break out of that link and put an attacker's link elsewhere in the note, just by being mentioned. Names are now escaped.
• A note could make your phone call out to hundreds of hosts. Every link in a note got its own preview card, and each card fetches its page. Previews now stop at 3 per note. The rest stay as text.
• An early Follow tap could wipe your follow list. A timeout or error could count as your follow list having loaded, and a tap in that window replaced your follow list everywhere with a list of one. Now only a real, signed list (or every relay agreeing there is none) counts, and an early tap waits instead.
• Setup accepted an npub that didn't match your key. A hand-edited npub could be saved next to a different nsec, and a one-character typo in an npub was accepted as a different person. The npub is now worked out from the nsec you paste, and a typed npub must pass its checksum.
• Highlights could be forged or flooded. Every highlight is now signature-checked, length-capped, and refused if dated more than 10 minutes in the future.

New

• Music. Wavlake music that keeps playing in the background. iPhone and Mac: a music feed with Trending, Artists, Following and search; lock-screen, Control Center and Mac Now Playing controls; artist and album pages, an Up Next queue, shuffle and repeat, and AirPlay. A Wavlake link in a post shows a play card, and sharing a song mentions the artist's Nostr profile so they're notified. Android: shuffle, repeat, a queue and artist pages, and MP3s shared in posts play from a card.
• Hashtags. Tap a hashtag in a post to open a live feed of everything carrying it. On iPhone and Mac you can show it from everyone or just people you follow. Android: you can also follow hashtags and get a feed of them, with a chip for each tag and suggestions to follow.
• Articles and highlights. The article reader lets you like, comment, zap, highlight and share. Select a passage to highlight it. Other people's highlights show in the text. iPhone and Mac: the actions sit under the byline and at the end of the piece, a highlight can carry an optional thought, and a highlight count shows who highlighted. Android: you can comment on highlights, and profiles have Articles, diVines and Music tabs.
• Post diVines, articles and recipes. Post from their own feeds. iPhone and Mac: the Post button writes what the feed in front of you shows. In diVines (formerly Reels) you can record up to 6 seconds or pick a video, trimmed to loop cleanly. In Articles and Recipes it opens a long-form editor.
• GIFs from nostr.build. The GIF picker searches nostr.build, which licenses its GIFs for this use.
• Text length. Choose in Settings how many lines of text Compact and Threaded views show.
• Live streams. iPhone: a quoted stream, or a zap.stream, shosho or njump link, plays in the feed, with an ENDED pill once it's over. Android: streams play inside posts, pop out to a moving mini player, rejoin after a drop, and live chat takes pictures from your Blossom servers.
• iPhone and Mac: replies follow the threads spec. Answering an article, video, highlight or a repost of one now sends a NIP-22 comment, which other apps thread correctly. Replying to a plain note still sends a normal reply. Threads gain a "Quotes & highlights" section.
• iPhone and Mac: image and link addresses are hidden from note text, with one preview card per link, and a domain-only card when a site has no preview.
• iPad: Feed, Relay, Search and Profile show the list and the note side by side in portrait too.
• Android: a Marketplace feed, a Shop tab on profiles, Sell a listing, and Message seller.
• Android: posts in another language get a Translate button. Translation runs on your phone (ML Kit), and the text is not sent anywhere.
• Android: see and vote on polls in the feed and in a note.
• Android: profiles show their banner, and Edit Profile has a Banner URL field.
• Android: tap to react, hold to pick a reaction, and a Thread Stats panel.
• Android: media on a profile opens the full viewer, with video, audio and drag to close. The Media grid has Report and Block.
• Android: the feed dashboard has Noise Filtering and Actions.
• Android: pick the sound for notifications.
• Android: select and copy text in a note.
• Android: Search has filters and tappable links. People in your Web of Trust are listed right after the people you follow, in Search and in @mentions.
• Android: every post has an Event Info panel with the relays it came from, its details and actions.
• Android: the Relay tab gets Likes Given and Zaps Given, count sheets, search, a compact layout, Whitelisted, load more, and tap the tab to jump to the top.
• Android: the Media tab can upload several files at once, paste, sort, show dates, and has a grid menu.
• Android: a Mosaic media widget, widgets you can set up, avatars in the feed widget, and a choice of app icon.
• Android: posts sent from Nostr Vault carry a small glowing badge.
• Android: pair a signer with a nostrconnect:// link, and switch signer accounts without logging in again.

Direct messages

• One inbox on every device. iPhone and Mac: your copy of a sent message could land on relays no device reads messages from. There is now one message inbox list for every device, with your Mac relay first, and messages stranded by earlier builds are fetched back once. A private Mac address is never published. Android: one message list across all your devices, and messages you sent from another app are caught up once.
• Alerts. No alert for your own sent messages. Tapping an alert opens the chat. iPhone and Mac: no alert for a chat you already have open, and the message box clears after sending. Android: notifications show the message; with notifications off, a banner shows inside the app; photos show in the conversation.
• Android: message signatures are checked, and a forged sender is rejected.
• Android: a new account can be messaged straight away, and messages arrive live.

Changed and removed

• iPhone and Mac: getyarn.io is removed from the GIF keyboard in every build. There is no permission to use it.
• iPhone and Mac: the "Post as Comment" switch is gone. The reply type is now chosen automatically.
• Android: the location is taken out of photos and videos before they upload.
• Android: the Threaded view of Global and Popular loads the replies under each post, and bare reposts show in thread lines.
• Android: the "Approve in your signer" banner is gone.
• Android: Following, Global and the shield work the same way in every feed. Everyone is a crossed-out shield.
• Android: notifications come from your Web of Trust, and zap notifications name the person who zapped you.
• Android: replies to your own posts are kept even when they come from outside your network.
• Android: the app asks to confirm before you delete or remove something.
• Android: group chats (NIP-29) are removed.

Fixes

• Blocked people stay out of every feed. On iPhone and Mac, blocking didn't refresh the feed, and reposts, replies and thread context from a blocked person slipped through. They're now filtered everywhere the moment you block.
• Photo posts no longer wait behind a signer request nobody answered. On iPhone and Mac this could hold a photo post for 90 seconds after returning to the app.
• Follow taps made while your list is still loading are applied once it loads. On iPhone and Mac, "Contacts still loading" could stick forever.
• Reposts show when the original note was written.
• iPhone and Mac: the Zaps Given list fetches sent zaps from your feed relays again, survives a refresh, and shows the note you actually zapped.
• iPhone: the feed ran hot while scrolling. There is less work on the main thread while notes stream in, and the feed picker menu no longer stutters.
• iPhone: banners and the zap strike now draw above any open sheet.
• iPhone and Mac: each remote signer keeps its own session, so switching accounts no longer reconnects from scratch, and your relay sign-in always goes to your own signer.
• iPhone and Mac: your Media tab showed reposted media. Only your own uploads appear there now.
• iPhone and Mac: in the Web of Trust, changing the depth rebuilds the graph, the graph saves at every depth, and a slow relay no longer drops lists already received.
• iPhone and Mac: GIFs beside thread lines animate and fill the square instead of sitting still and letterboxed.
• iPhone: Edit and Undo on the post countdown pill take taps again.
• Android: a repost opens, zaps, reports and replies as the note it reposts.
• Android: the Web of Trust list was read and saved wrongly, which emptied Global and Discovery. Fixed.
• Android: Following reads the people you follow from their own relays and keeps bare reposts.
• Android: big follow lists can be signed through a remote signer.
• Android: saving your profile keeps your other fields, such as your banner.
• Android: nprofile links open the right profile, link addresses are hidden behind one card per link, and a post is sent from the account that was active when you tapped Post.