Roadstr v0.5.9 is out ā a security hardening release. š
An independent audit turned up a few real issues, now fixed:
ā¢ Favorites sync was auto-publishing on every edit for anyone signed
in with Nostr, with no separate opt-in despite the app claiming it
was optional. Now off by default ā a real "Sync automatically"
toggle in Settings.
ā¢ Logging in used to publish a profile-visibility event even if you
never touched the setting, tying your key to "uses Roadstr" for no
reason. Only publishes now if you actually chose public visibility.
ā¢ A relay outage could get hammered every ~1.25s forever instead of
backing off ā fixed the reconnect logic.
ā¢ Capped a few unbounded growth paths in the Nostr event stream that a
flood of throwaway identities could have abused.
ā¢ Store listing no longer claims things that weren't true (GPS
handling, offline routing, license).
Full changelog + APKs: https://github.com/roadstrapp/roadstr-app/releases/tag/v0.5.9
Free, open-source, no tracking, no Google dependency.
#Nostr #Roadstr #OpenStreetMap #GrowNostr #FuckGoogle
roadstrapp
npub1cwā¦65mmc
2026-09-16 20:11:27 UTC
Author Public Key
npub1cwft0dmtw5gtwhmu5r2f8fjpw0l5f006egs8fmltdc3jrxxcpe6q965mmcSeen on
wss://nos.lolPublished at
2026-09-16 20:11:27 UTCEvent JSON
{
"id": "ff171b7db132a2f0773cf7e2c35814d42d6c70fd4ec17ca7dc1ced0b802dee7d",
"pubkey": "c392b7b76b7510b75f7ca0d493a64173ff44bdfaca2074efeb6e232198d80e74",
"created_at": 1789589487,
"kind": 1,
"tags": [
[
"t",
"Nostr"
],
[
"t",
"Roadstr"
],
[
"t",
"OpenStreetMap"
],
[
"t",
"GrowNostr"
],
[
"t",
"FuckGoogle"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://purplepag.es/"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://indexer.coracle.social/flint-yonder-zulu"
],
[
"client",
"Primal Web"
]
],
"content": "Roadstr v0.5.9 is out ā a security hardening release. š\n\nAn independent audit turned up a few real issues, now fixed:\n\nā¢ Favorites sync was auto-publishing on every edit for anyone signed\n in with Nostr, with no separate opt-in despite the app claiming it\n was optional. Now off by default ā a real \"Sync automatically\"\n toggle in Settings.\nā¢ Logging in used to publish a profile-visibility event even if you\n never touched the setting, tying your key to \"uses Roadstr\" for no\n reason. Only publishes now if you actually chose public visibility.\nā¢ A relay outage could get hammered every ~1.25s forever instead of\n backing off ā fixed the reconnect logic.\nā¢ Capped a few unbounded growth paths in the Nostr event stream that a\n flood of throwaway identities could have abused.\nā¢ Store listing no longer claims things that weren't true (GPS\n handling, offline routing, license).\n\nFull changelog + APKs: https://github.com/roadstrapp/roadstr-app/releases/tag/v0.5.9\n\nFree, open-source, no tracking, no Google dependency.\n\n#Nostr #Roadstr #OpenStreetMap #GrowNostr #FuckGoogle\n",
"sig": "bc108b2a75df64bf8bb008e2ae94f36df68bb4419a9e39b593fab779d4b7c02d3b5b09eb4ad1b66b0f76fec68933b7db81d345064b7b102dd12ff5974aa5dda6"
}