Is Clave the only #iOS NIP-46 singer published on AppStore/AltStore today? #asknostr And why do we still allow pasting a raw nsec/ncryptsec into the clients? Why? Something is still not working with these signers? Somebody believes that all clients actually securely store the secrets, properly zeroize memory after exiting, and so on? Properly managing these secrets was never an easy thing to do. It should never be delegated to some random vibe-coded stuff, that was not designed specifically for that; very few normal users are capable of understanding the significance of that, yet we happily provide them an input field for nsec like it's something acceptable! This is, BTW, the only signer I'm aware of that hardens memory with `mlock`; there's nothing close to that in normal clients and probably never will be there:

Gitea on NOSTR

n_signer

nsigner is a single statically-linked program that holds signing key material in locked memory and signs on request.

I've recently had an experience of explaining why pasting nsec should never be practiced with ordinary clients, why it's not the same thing as a changeable password—yet this person pasted it anyway to "fix" something: Armada Android client was failing to publish a NIP-65 relay list. This will never change: if there's a wrong button, it will be pressed for stupid reasons, many times. I think the "nsec SHOULD never be used directly in clients; NIP-46 and NIP-07 SHOULD be used instead" should be written in some NIP already. With blood. #security #devstr