Riffle 1.0.1

What's new

Riffle 1.0.1: security fixes

• Decks can no longer send any request to your device or local network
  (router, NAS, local services), directly or through the offline cache.
  Host names are checked by their real address, so a public-looking name
  that points at a private address is blocked too.
• A deck can only open a link or trigger a shortcut right after you click
  or press a key in it, and can't open pop-ups by itself.
• Restoring a stats backup only accepts the stats database's own columns.
• CSV stats export stops spreadsheet apps from treating card text as
  formulas.
• Linux updates download into a private temporary folder.

Install

Windows 10/11: download Riffle-Setup-1.0.1.exe and run it.
SmartScreen may warn because the installer isn't code-signed: choose More info → Run anyway.

Android 8.0+: download Riffle-1.0.1.apk, allow "Install unknown apps" for your
browser or file manager, and open it. Keep Android System WebView updated from the Play Store.

Already installed? The app finds new versions by itself and offers to update (Settings → About).

Linux: git clone the repo and run ./install.sh (see README).

SHA256SUMS.sig is an Ed25519 signature of SHA256SUMS; check it with the public key in
packaging/release-signing-key.pem (see SECURITY.md).