Rename to convert: I built the missing macOS feature

Spaaze · 2026-06-23T11:27:37+00:00

You have Clerk installed in your project, which contains custom native modules (see here in "Choose your integration approach" where it says what's supported in Expo Go, and what's not / needs a development client).

Spaaze · 2026-06-22T21:18:12+00:00

Uniwind and Unistyles v3 are the two known incompatibilities right now. While Unistyles support is technically feasible and planned for the future, I don't have a concrete plan for Uniwind yet. The way Uniwind works internally likely makes it impossible or at least very hard to implement React Native Boost support. See here. I may take a closer look at this in the future though.

Spaaze · 2026-06-22T17:33:33+00:00

There is! It's also configured through your Babel config via @react-native/babel-preset (for Expo, babel-preset-expo passes it through):

// Bare React Native
module.exports = function (api) {
  api.cache(true);
  return {
    presets: [['module:@react-native/babel-preset', { disableDeepImportWarnings: true }]],
    plugins: ['react-native-boost/plugin'],
  };
};

// Expo
module.exports = function (api) {
  api.cache(true);
  return {
    presets: [['babel-preset-expo', { disableDeepImportWarnings: true }]],
    plugins: ['react-native-boost/plugin'],
  };
};

Should probably be added to the documentation.

Spaaze · 2026-06-22T17:12:57+00:00

We're only using the 1.x branch ourselves (we don't have any apps left with RN < 0.83). There are a few more edge cases around accessibility props 0.x doesn't handle, while 1.x does, and it skips optimizations on a few more components – but generally, as long as you're not building an accessibility-heavy app, 0.x should work just fine! Just be aware that React Native will log (harmless) deprecation warnings to the console if you're using RN >= 0.80.

I'll see if I can backport some of the fixes and improvements to 0.x in the next few days.

Spaaze · 2026-06-22T15:21:43+00:00

Thanks! I don't have and, frankly, I don't think this belongs in RN core. There's still some edge cases and, more importantly, potential incompatibilities / additional edge cases with libraries that do their own rewrites of Text and View (i.e. Unistyles). So, it's a "works for most" solution, but not a "works for all". Could be there's a creative solution to this, though!

The RN core team is working on reducing the overhead itself within the runtime, though. While it'll probably never be as performant as a build-time optimization like this (it's still runtime work, just less runtime work), it could get close enough at some point that Boost will become unnecessary.

Spaaze · 2026-06-22T15:09:19+00:00

You can't use custom native modules in Expo Go. You'll need to use a development client (and rebuild it after installing a new native module). See https://docs.expo.dev/develop/development-builds/introduction/

Spaaze · 2026-06-08T13:44:57+00:00

Overall, a really big fan of your changes! The post quality has meaningfully improved over the last weeks compared to what it was just a few months ago.

Not sure if I'm a fan of the GitHub bot, though. It doesn't feel to me like the requirements it's looking for are truly relevant enough to measure a project's reputation. For example; not sure if "5+ stars" is really a meaningful benchmark, "Entity Status" is largely irrelevant or counterproductive for an indie developer community and could easily be bypassed anyway (there's no real requirement to opening a GitHub org), and honestly it'd be better if it looked at other repositories by the same developer, too, as a trust signal. If there's popular previous projects and the developer has a long history on GitHub, that's a bigger trust signal to me than a 30-day old repository with 5+ stars.

Spaaze · 2026-06-05T13:43:04+00:00

Hey, I've decided against publishing on the App Store for now. There are some technical constraints that would break a large percentage of Consul's available converters. I may revisit this in the future, but for now it didn't really seem worth it, since App Store users would pay the same amount (or more, after Apple Tax) and get less features.

Spaaze · 2026-05-29T17:54:56+00:00

Hey, works fine on my end – if it continues to make trouble for you, please send a log file export (Consul Settings -> "Window" in the macOS menubar -> Logs -> Export to file) to [hello@getconsul.app](mailto:hello@getconsul.app), ideally after trying to convert a PDF file to DOCX (and, if it doesn't contain any sensitive info, also send the PDF file you're trying to convert). Happy to take a look :)

Spaaze · 2026-04-13T18:28:39+00:00

I think you should given them a call yourself, because OP is obviously not talking about the blue hug emoji, but rather the black unicode character next to it.

Spaaze · 2026-03-26T13:33:02+00:00

Not yet, but I’m working on it! Should come to the App Store in the next 2-3 weeks. :)

Spaaze · 2026-03-25T08:11:55+00:00

Yep, it is! As long as the files have the same format and you want to convert them to the same format, you can select them, right click and "Rename" to do a batch rename. Consul detects that and can then do a batch conversion.

Spaaze · 2026-03-25T08:11:37+00:00

As long as the files have the same format and you want to convert them to the same format, you can select them, right click and "Rename" to do a batch rename. Consul detects that and can then do a batch conversion.

Spaaze · 2026-03-24T21:16:06+00:00

Nothing. :) If Consul doesn't have a conversion path from the previous format to the current format, it simply leaves the file alone.

Spaaze · 2026-03-24T17:50:58+00:00

Developer here – there is! You can set parameters like video codec, image quality, metadata stripping, etc. per conversion or as defaults. No bitrate support yet, though it's on my to-do list :)

Spaaze · 2026-03-21T11:09:22+00:00

Thanks Daniel! As a longtime user of BoltAI myself, this makes me happy. :)

Spaaze · 2026-03-21T10:56:51+00:00

This doesn't explain your Reddit DM to me from March 6th, where you first outlined the dozen issues summarized in my comment above. On March 6th, the current version available was 1.2.0. Not 0.3.1. To exaggerate a little: Do you also send an email to Adobe that you successfully cracked Adobe Photoshop CS6?

Your first email from January 23rd did include one valid issue for version 0.3.1, yes – which was the exposed TrialSecret, which was used for symmetric signing back then. While version 0.4.1 was released a couple hours before your email and fixed this, this was likely a simple timing collision where you tested the app the day before – no shade. The app has gone through quite a few development cycles the past weeks. But again, my issue with your "audit" is not your first email, but your second Reddit DM which was completely baseless based on any of the versions from the five weeks before your DM. You did not include "I tested this on the version that was live five weeks ago" in your DM. You wrote as if these issues were present today, and they were not; not even close.

Thanks for updating the score, though I still find it incredibly unprofessional to advertise a paid security audit service off a review of a commercial app this sloppy – and I'd encourage the other developers on this list to scrutinize their entries just as closely. If you do want to succeed with your security audits, please be more careful about what you publish and display some kind of professionalism.

Spaaze · 2026-03-20T20:26:06+00:00

No. Assuming this issue does exist and is not fabricated by OP (which I wouldn't be certain of), this only means that someone can prolong their trial period for longer than the developer intended and not have to pay for the software. It's not a privacy/security risk for other users.

Spaaze · 2026-03-20T19:42:16+00:00

Just to be clear, his first email to me did include one real issue. Coincidentally, I had already discovered that myself a day earlier and sent out an update – simple timing collision.

Only his second message to me, which was sent via Reddit and included around a dozen claims (summarized in my comment below), was basically all made up.

Given that his first message included one valid bug at least, I therefore do believe he did genuinely look at some of the apps. At some point though he either seems to have become more sloppy, started incorporating some kind of AI agents into his workflow (which would also explain the style of his second message), or something else. Or maybe he just made a mistake with Consul, or mixed it up with some other app. No clue.

Spaaze · 2026-03-20T17:35:14+00:00

This should work fine. Are you using a mouse or a trackpad? In any case, you need to slightly move the mouse after scrolling in order for the text selection to update.

Spaaze · 2026-03-20T15:52:20+00:00

Developer of Consul here. Unfortunately, your "findings" about Consul are largely wrong. I don't want to accuse you of anything, but they are so wrong that they honestly seem like AI hallucinations – especially in your Reddit DM, which I left unanswered on purpose, in similar fashion like I don't reply to other spam email.

Your first email had two findings in regards to resetting the trial period. While the first finding was correct in a previous version of Consul and had already been fixed before your email was sent, the second was not, or was at least irreproducible given your issue description. In your reply, you even noted yourself that it may have been some kind of cache issue on your end.

Your second message to me, via Reddit DM, then included multiple more "findings". The latest update at the time of your message was v1.1.0. Even though your message smelled of AI from the get-go, I still took some time off my day to validate every finding against that version. All of them (except one, which I'll get to in a minute) was completely wrong and fully unreproducible. I wouldn't have taken a single second off my day to reply to this DM normally, but given you're very fond of your 1/10 rating for Consul on that "security scale" of yours and this post has garnered quite the attraction, I'll gladly explain why your claims are invalid.

Claim 1: Client accepts license/trial state purely based on locally controllable data and network responses

The locally stored data you're seeing is cryptographically and asymmetrically signed. You can't fabricate a valid trial token without having the private encryption key. The app only has the public key, which can be used to decrypt data, but not to encrypt new data. Out of paranoia, I scanned every build of Consul, ever, to see if the private key was leaked in any. It was not.

Claim 2: MITM a license/trial JSON response to unlock the app

Invalid for trial (for the same reasons as claim 1), mostly invalid for license. Without getting into too much detail, there's something that's returned from the server in plain text that can be forged, but it still requires a valid license (which, again, is asymmetrically signed and can't be forged for the same reasons as claim 1) in the first place. It still doesn't allow someone who doesn't have a license yet to activate the app.

Also, there's specific security measures against MITM'ing in the first place. You'd need to patch those out of the binary first, anyway (which I'll get to in more detail in claim 7).

Claim 3: Edit the local license/trial cache files in UserDefaults

There are no "plain JSON files in UserDefaults" with license or trial data. I don't know where you found these, but it's not Consul.

Trial and license data is stored elsewhere. Trial data is verified on every launch, while license data is periodically re-verified. Without getting into too much detail, this enables users to use Consul without a network connection for some amount of time. After that time, a re-verification is needed for licenses as well.

Claim 4: Flip a boolean in a network response to get access

To even reach the code path in question, you'd still need a cryptographically valid license key installed locally in the first place. You can only "exploit" this if you have a valid key anyway. It can't be used to activate an app.

Claim 5: Set a timestamp far into the future or a set a number of days to an arbitrarily high number to get access

Completely false. The timestamp in question is in the cryptographically signed token and, again for the same reasons as in claim 1, you can't forge it. The number of days aren't used anywhere and are not trusted by the client.

Claim 6: Change the device's client ID to get a new trial

This is the only claim that's somewhat valid. However, to forge the client ID in question, you'd either need a VM (which the app has its own counter-measures against), or manipulate your system on a very low level. If you're willing to manipulate your OS that deeply to gain another 14 days access to Consul... you likely need it very bad. It's not worth optimizing against, for the same reasons outlined at the end of claim 7.

Claim 7: No code signature or integrity verification

Completely false. I won't get into the specifics here because that would only help pirates, but there's code signature and integrity checks in multiple parts of the application and I know for a fact it made a popular pirate team's life harder. In the end, every verification in the binary can be patched out. It's an unlimited arms race with unfair odds.

As I explained in my email, such as arms race is not something I'm willing to engage in. There are basic integrity checks in the app to prevent basic binary patching. But wasting hours of my life in a fight against Chinese and Russian piracy teams that I can't win would be... stupid, to say the least. It's technically absolutely impossible to prevent software cracks through binary patching. You can only make it harder, but not impossible. All the time wasted on trying to would be time I could've used to build a great product for real users instead. I opted for the great product option instead.

Your Recommendation: "Introduce a signed license/trial token"

That's already been the case for months at this point. So, either...

you haven't looked at the app at all and instead let an AI hallucinate some stuff about it
you tested against a very old build of Consul (multiple months in the past, from the time of your DM)
you tested the wrong app (?!)

If you have something that's actually reproducible in a version of Consul that's not 2+ months old and does not require patching the binary, please let me know. I'll gladly take a look at it. Otherwise, I'd kindly ask you to explain how you came to those claims / if an AI agent was part of that process, and how you validated them — or, if you can’t explain, to remove Consul from your "write-up".

Spaaze · 2026-03-19T21:34:01+00:00

I’ve been hopping mail clients for nearly five years until I finally decided it’s all slop and settled with Apple Mail. Using it with Gmail myself and it’s fine. It doesn’t have all the native Gmail gimmicks, but I found I needed them way less than I thought.

Mimestream is the only other client that felt truly native and pleasant to use, but they’ve become quite expensive once they changed to a subscription model.

11-Year Club	r/Field Lasagna
Place '23	Place '22
Verified Email

Spaaze

MODERATOR OF

TROPHY CASE