Oddbean new post about | logout
▲ ▼
Mazin | 11 months ago (raw) | root | parent | reply | flag +1 
 As you know, this is basically why we made inbox.nostr.wine. I really don’t think it works out of the box with a typical paid relay. 

It combines I think the best two properties of 1&2 in a way that works.

Anyone can write to inbox WITHOUT AUTH as long as the note tags an inbox subscriber. 

Then any inbox subscriber can query for their giftwraps only after AUTH so we never leak that event outside its intended recipients. 

Lastly, we address spam by letting kind 1984 reports from any subscribed user automatically delete any note they are tagged in.
▲ ▼
Vitor Pamplona | 11 months ago (raw) | root | parent | reply | flag 
 Agree. What I wrote is explicitly about testing the pubkey of the event against the allow list. The pubkey is the signer and that should not happen. The p-tag can be used like you guys do to run the allow list. That's fine. You don't even need auth in those cases. 

My answer to nostr:nprofile1qqs0kymx4027fjf2322s0yduwt23hh3fr2p42h9jcc56jtld67qx3tqpr9mhxue69uhhyetvv9ujuumwdae8gtnnda3kjctv9uq3jamnwvaz7tmvd9nksarwd9hxwun9d3shjtnrdakj7qgmwaehxw309aex2mrp0yhxummnw3exjcmgv4ejummjvuhsa6kd6c   was explicitly about the use of the pubkey and mixing signing and auth roles in one key.