Much easier, just take the hash and replace the domain of the blossom server, so I just did that. The way the Blossom protocol works is that if there is no file on your Blossom server, it will ask other Blossom servers for the file, and once it finds it, it will store it on yours, then your server will respond to others requesting the file, and so on.
Damn I didn't realise that's how it works. I was much more focussed on nostr-signed files linked to my npub 😄 But that's amazing!
I’ve seen the blossom spec on GitHub - is there a reference implementation of a managed server?
1. Best production ready implementation is probably: https://github.com/lovvtide/satellite-cdn
2. Reference implementation by hzrd194: https://github.com/hzrd149/blossom-server
3. My proof of concept that runs on CloudFlare Free tier for personal use: https://git.v0l.io/florian/cf-worker-blossom-server
Why is it based of Cloudflare? Can't a different S3 compatible provider/tool be used?
1 and 2 should run with any S3 compatible storage. It's not enough to just store the data though - there is also some logic (docker based server) and a database (for ownership, payments..) required. So you need a place to run those as well.
I wanted to build (3) this on serverless components without having to run a docker container and a database anywhere. That's why I implemented that Cloudflare based project and it's APIs are not directly compatible.
This could be done similiarly on AWS mit Lambda Functions, Dynamo DB and S3.
Yeah I understand that it is not just S3. I was just wondering about swapping the object storage layer for Minio or StorJ.
cloudflare is decentralised?
NO it's very much centralized but it is my personal server.
Having multiple different storage locations makes it decentralized.
And building tools to move / distribute your data.
So this would require no authentication from the Blossom server owner at all? I can indirectly transfer any temporarily saved files on cdn.satellite.earth to your Blossom server, and use your server to serve the files. There are considerable risks involved.
Yes, i was thinking about that too, it can be even worse if there is some way to do some remote code execution, and it would be very easy to infect a machine, so for example i can upload some malicious file to my blossom server and then make other server pull it from mine... But if im not mistaken the only way to deal with this would be to not set any relay or cdn for discovelability of files, but this will also limit/kill the usability of the server... Maybe @hzrd149 can enlighten us more
Discovering and downloading (or streaming) blobs from other servers isn't part of the blossom spec but its something I added to my blossom-server implementation
By default the example config has it setup to check cdn.satellite.earth and nostr 1063 events to find blobs, but if you want you can turn it off in the config https://github.com/hzrd149/blossom-server/blob/master/config.example.yml#L15-L30
I don't know if there are any security implications of downloading a blob. but its possible an attacker could flood a server by asking it to download everything from another server
This feature definitely makes sense, but requires more security. For example, a signed event would be required to allow files to be discovered and saved through other servers.
Aaa I see my bad, i was thinking that was part of the spec 😅
Oddbean new post about login | logout 
