Omostrich 0.3.1: profile pictures loaded safely

Omostrich keeps your Nostr key on your own computer and signs for your apps from the Omarchy bar. Version 0.3.1 is a small security release. It changes how the panel shows your profile picture and attachment previews, so a picture someone else controls can’t stall or overload the panel.

What changed

Your profile picture is fetched with limits. Before, the panel took the picture URL from your Nostr profile and handed it straight to Qt to download and decode. Now the panel never loads that URL itself. While Omostrich is unlocked, the signer daemon downloads the picture with firm limits:

• a 10 second timeout and a 1 MB size cap, enforced even when the server doesn’t say how big the file is
• PNG, JPEG, GIF or WebP only, checked by both the content type and the file’s own signature, so SVG or HTML dressed up as an image is turned away
• at most 2048 by 2048 pixels, checked before anything is decoded, so a tiny, highly compressed file can’t blow up into a huge image in memory

A picture that passes is kept as a local copy in ~/.local/share/omostrich/, readable only by you, and the panel shows that copy at a small size. It isn’t fetched again on every restart. If a picture fails any check, you’ll see the placeholder instead, and the reason goes in daemon.log.

Attachment previews show your own file. When you attach an image to a note, the preview now shows the local file you just uploaded rather than loading it back from the Blossom server, and only when it’s within the same limits. The Blossom server’s reply is capped at 64 KB, and every image in the panel now has a bounded decode size.

Why it matters

Your profile picture URL is public data that anyone can point anywhere, and the panel sits right next to your key. Keeping remote downloads out of the panel, and behind tight limits in the daemon, means a slow or hostile image server can’t hang the bar or eat your memory. The issue was raised in the Omarchy plugin marketplace review (#12494), and nothing else in the panel loads remote content.

Get it

To update an existing install:

cd ~/Projects/omostrich
git pull
npm ci
./install-daemon.sh
./install-plugin.sh
systemctl --user restart omostrich

The restart matters, because the running signer keeps the old code until it’s restarted. The full notes are on the 0.3.1 release page, and more about Omostrich is at omostrich.com.