bitchat @ v1.8.0

integrity

size: 14.9 MiB
downloaded: 2026-10-23 22:02 UTC
last checked: 2026-10-23 22:02 UTC

source https://github.com/permissionlesstech/bitchat · available · github

release notes

bitchat 1.8.0 makes busy location channels fast. It also collects the features and security hardening that landed since 1.7.1.

Performance

Busy geochats are fast again. In a room of 100 people, the people list opens in about 60 ms (it took 1.5 s) and stays at 60 fps. At 300 people it opens in about 180 ms (it took 4–12 s) (#1788).
Presence traffic no longer rebuilds the roster on every event. The timeline at 300 people goes from 3.5–7 dropped frames per second to none (#1789).
The timeline no longer fights you.
- It no longer snaps back while you scroll during a burst.
- It no longer cascades to the oldest message when you reach the top.
- It keeps following at the 1,337-message cap.
- Channel and DM switches land at the newest message (#1790).
Geochat scaling is now gated by CI's performance floors (#1791).

Fixes

Your own messages are recognized by sender ID, not nickname. Someone who shares your name no longer pulls you to the bottom, hides their message actions, or gets your threads folded into theirs (#1793).
No more dark-gray band at the bottom of sheets in dark mode with the Matrix theme (#1794).
Builds with Xcode 27. swift-secp256k1 0.24.0 brings byte-identical crypto output, verified across versions (#1782). String catalog keys and Swift 6.4 warnings are fixed (#1795).

New since 1.7.1

Drafts survive switching between mesh, location channels and private chats (#1569).
Location channels:
- one-tap quick join for nearby channels (#1444);
- share channel invites from the share sheet (#1513).
Identity and verification:
- a local alias on the fingerprint sheet (#1507);
- a verification seal in private chats (#1573).
Chat list and safety:
- a recent chats section (#1598);
- a persistent connectivity banner (#1597);
- a panic wipe that confirms first (#1588).
Mac: camera QR scanning for verification (#1477).
Keyboard: navigation for @-mention suggestions (#1542).
Localization: the remaining UI strings are localized in all 30 languages (#1654, #1656, #1657).

Security

Noise and identity: sessions rekey on absolute age (#1675), and unverifiable handshake peer IDs fail closed (#1645).
Timestamps: sanity windows for QR codes, Nostr DM rumors and sync replies (#1647, #1717).
Size bounds: per-type packet payload caps and byte-bounded sync stores (#1719).
Groups and DMs:
- private-group creator pinning (#1720);
- the mesh peer ID is kept out of geohash DMs (#1718).
Input handling: ambiguous nicknames are refused instead of guessed (#1689), and Data(hexString:) rejects signed byte pairs (#1687).
Privacy: the public-channel screenshot broadcast is removed (#1596), and privacy claims are corrected (#1595).

Every tagged release ships a SOURCE-MANIFEST.txt; see docs/VERIFYING-A-BUILD.md.

What's Changed

Peer ID rotation: working primitives + spec for iOS/Android review by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1487
Add macOS camera QR scanning for peer verification by @Ayush7614 in https://github.com/permissionlesstech/bitchat/pull/1477
Localize hardcoded macOS image picker copy by @Ayush7614 in https://github.com/permissionlesstech/bitchat/pull/1478
Location channels: locale-derived one-tap quick join by @RodsF1 in https://github.com/permissionlesstech/bitchat/pull/1444
feat: local alias field on the fingerprint sheet by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1507
feat: share location channel invites via the system share sheet by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1513
feat: verification seal on private message sender rows by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1573
Keyboard navigation for @-mention suggestions by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1542
Fail closed on unverifiable handshake peer IDs; check SecRandomCopyBytes results by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1645
Make SwiftLint blocking in CI now that the violation backlog is zero by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1646
Timestamp sanity windows: future-dated QR codes and implausible Nostr DM rumors by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1647
Make the Periphery scan blocking by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1648
Deflake gift-wrap tests: settle deadlines, not latency budgets by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1651
Stop claiming encryption and privacy properties that aren't live by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1595
Remove the public-channel screenshot broadcast by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1596
Add a recent-chats section so DM conversations can't become unreachable by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1598
Make the panic wipe confirmable and its outcome visible by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1588
Add a persistent connectivity banner and stop the radar lying by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1597
Deflake AppArchitectureTests: raise the local waitUntil to settleTimeout by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1653
Localization: add 26 code-referenced keys and a test that closes the coverage blind spot by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1654
Localize CommandProcessor: all 48 command strings, 30 locales by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1657
Localize the last hardcoded UI strings; wire up two dead translations by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1656
Keep the mesh peer ID out of geohash DMs; ack only after block checks by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1718
Pin the stored creator on incoming private-group state by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1720
Bound future timestamps on sync replies and in the gossip store by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1717
Cap packet payload size per type and bound sync stores by bytes by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1719
fix: refuse an ambiguous nickname instead of picking the first peer by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1689
Trigger Noise session rekey on absolute age, not just idle time by @krishrathi1 in https://github.com/permissionlesstech/bitchat/pull/1675
fix: reject a signed byte pair in Data(hexString:) by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1687
fix: evict fully-aged-out geohashes from activity tracker by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1642
Compile mention autocomplete regex through SafeRegex by @Ayush7614 in https://github.com/permissionlesstech/bitchat/pull/1604
test(l10n): per-catalog attribution and file:line output for the coverage guard by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1679
Add golden test vectors for the courier wire format by @ecgang in https://github.com/permissionlesstech/bitchat/pull/1472
Validate relay-directory changes in PR CI by @jozanek in https://github.com/permissionlesstech/bitchat/pull/1711
ci: prevent manual source manifests from overwriting releases by @vekovius in https://github.com/permissionlesstech/bitchat/pull/1636
docs: why rotating the service UUID does not work by @RodsF1 in https://github.com/permissionlesstech/bitchat/pull/1704
Keep composer drafts across mesh, geohash, and DM switches by @Chessing234 in https://github.com/permissionlesstech/bitchat/pull/1569
build(deps): bump swift-secp256k1 from 0.21.1 to 0.24.0 by @csjones in https://github.com/permissionlesstech/bitchat/pull/1782
Make the geochat people list linear in the participant count by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1788
Stop rebuilding the geochat roster on every inbound event by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1789
Fix geochat timeline scrolling and cut per-row render work by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1790
Gate geochat scaling regressions in the performance floor check by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1791
Tell my own messages apart by sender ID, not nickname by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1793
Fix dark-gray band at the bottom of Matrix sheets in dark mode by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1794
Fix swift build on Xcode 27 and clear its Swift 6.4 warnings by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1795
Bump version to 1.8.0 by @jackjackbits in https://github.com/permissionlesstech/bitchat/pull/1796

New Contributors

@Ayush7614 made their first contribution in https://github.com/permissionlesstech/bitchat/pull/1477
@vekovius made their first contribution in https://github.com/permissionlesstech/bitchat/pull/1636

Full Changelog: https://github.com/permissionlesstech/bitchat/compare/v1.7.1...v1.8.0

download

unix · zip

curl -fL -o v1.8.0.zip https://ratatoskr.space/pkg/bitchat/v1.8.0.zip
                    printf '%s  %s\n' '1b79a0c7ad30a7a92d22bd739b68fb19adb513c207a0cbe8c3d7eb205b4ca869' 'v1.8.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/bitchat/v1.8.0.zip"
$out = "v1.8.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "1b79a0c7ad30a7a92d22bd739b68fb19adb513c207a0cbe8c3d7eb205b4ca869") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.8.0.tar.gz https://ratatoskr.space/pkg/bitchat/v1.8.0.tar.gz
                    printf '%s  %s\n' '5c2054b0cc0d5c0addccf74559722c2744bef9a914cdc54a5e3e194cb040bf25' 'v1.8.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/bitchat/v1.8.0.tar.gz"
$out = "v1.8.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "5c2054b0cc0d5c0addccf74559722c2744bef9a914cdc54a5e3e194cb040bf25") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.8.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.zip
                    printf '%s  %s\n' '1b79a0c7ad30a7a92d22bd739b68fb19adb513c207a0cbe8c3d7eb205b4ca869' 'v1.8.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.zip"
$out = "v1.8.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "1b79a0c7ad30a7a92d22bd739b68fb19adb513c207a0cbe8c3d7eb205b4ca869") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.8.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.tar.gz
                    printf '%s  %s\n' '5c2054b0cc0d5c0addccf74559722c2744bef9a914cdc54a5e3e194cb040bf25' 'v1.8.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.tar.gz"
$out = "v1.8.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "5c2054b0cc0d5c0addccf74559722c2744bef9a914cdc54a5e3e194cb040bf25") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.8.0.zip	zip	15.5 MiB	blake3-24 5d65b4a742508a4aa051e86bb8f323d357351a7f69a58e3a sha256 1b79a0c7ad30a7a92d22bd739b68fb19adb513c207a0cbe8c3d7eb205b4ca869 sha1 2296fdf20fc83b99458b1a18acef815bfda5d633
v1.8.0.tar.gz	tar.gz	15.1 MiB	blake3-24 1d788e209b6946c6eae5f6cc369391fe9929756dca247c6d sha256 5c2054b0cc0d5c0addccf74559722c2744bef9a914cdc54a5e3e194cb040bf25 sha1 6c38f5b3a9b76059d07684c916adb07bdde063cf

install

bazel

http_archive(
    name = "bitchat",
    urls = ["https://ratatoskr.space/pkg/bitchat/v1.8.0.tar.gz"],
    integrity = "sha256-XCBUsMwNXArdzPdFWXIsJ0S++akUzcVKXj4ZTLBAvyU=",
    strip_prefix = "bitchat-v1.8.0",
)

zig

.url = "https://ratatoskr.space/pkg/bitchat/v1.8.0.tar.gz",

install via yggdrasil mesh

bazel

http_archive(
    name = "bitchat",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.tar.gz"],
    integrity = "sha256-XCBUsMwNXArdzPdFWXIsJ0S++akUzcVKXj4ZTLBAvyU=",
    strip_prefix = "bitchat-v1.8.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat/v1.8.0.tar.gz",

v1.7.1 →