mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 16:14:40 +00:00
Vitor PamplonaandClaude Opus 4.8
996b800da5
An audit of the v1.13.0 notes against the implementation found several claims that are wrong or overstated. These are user-facing release notes, so a false claim changes what people believe about their own security. Corrected: - **Privacy Lock.** The notes said it gates Messages "behind a password or biometric" on "Android and Desktop", with inactivity auto-lock and optional preview redaction. It does not exist on Android at all — no code, no settings entry — and there is no biometric implementation on any platform (`CredentialPrompter` has no implementations). Preview redaction persists a setting nothing reads, and the auto-lock is a fixed timer, since the idle-reset modifier is never applied. It is also a screen gate rather than encryption at rest: the account stays live and messages keep syncing while locked. Now described as what ships — a password gate on the Desktop Messages and Wallet columns. - **"Every signature, payment, or data read needs your explicit approval."** Only payments require per-use consent; everything else can be granted once and reused, and the default trust level auto-signs notes, reactions and encryption after a single tap. - **Web of Trust (GrapeRank)** was listed under app features, but crawling and scoring exist only in the `amy` CLI — no app module references it. The app consumes NIP-85 cards published by an operator, which is what the entry now says. - **"One-tap trust for your follows' relays"** described bulk-granting relays used by people you follow. What exists is category rules evaluated per challenge. - **Pinned web apps "show the app's own icon"** — they render a generic placeholder. - **PoW** contradicted itself: "all cores" in one entry, "half the device's cores" in another. The latter matches `PoWPolicy.minerWorkers`. - **Onion-Location "through every HTTP client"** — the Android app's clients only; the desktop, CLI, geode and sandbox blob clients don't install it. - **Relay hardening** claimed REQ refusals stop immediately and failures evict "on the first strike"; both take repeated failures, and the first-strike eviction applies only to crawls. - **`bunker://` links cannot be pasted in** — Amethyst only emits them. - **Git code browser** needs a repository with an http(s) clone URL. - **Geohash anonymous identity** — the per-area identity is unlinkable, but the optional nickname is one global handle, so setting it links your posts across areas. - **Concord ban** is read-time enforcement for everyone else; the banned member keeps the keys until a Refounding. Adds an Upgrading section for the user-visible effects of the per-account isolation work: sites signed out once, permissions re-asked per account, and relay logins now prompting under the default remote-signer policy. Contributor and translator credits are left as they are — several entries are unresolved npubs and Crowdin-generated usernames, but correcting attribution is not a call to make from the code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>