Actually, this could be a problem for brand new npubs starting with zero known contacts, but it seems a quite rare case. I think the normality is to be onboarded at least by a friend, or discovering a new app/platform, where I interacted with legittimate users. I would not overcomplicate things. Btw, IRL connections win. 

 t-y daniele 

 This is the most difficult part. 

A brand new npub doesn't have a wot network from his pov, but that's not a big deal - onboarding client should ask them about their content preferences/hashtags and even if user doesn't choose to follow someone and get his wot seeded, client could use some popular accounts from the topics user has chosen to serve as temporary wot sources.

The bigger problem is that relays can't distinguish a brand new npub from spam. I.e. if someone big tweets about nostr and a wave of new people comes in short time, it's indistinguishable from a spam attack from a botnet. And pow doesn't help much - you'd need something like 100 seconds of mobile cpu to produce pow equivalent to 1 sat - and I bet reply-scammers earn way more than 1 sat per event they post. 

I keep getting back to this issue in my head from time to time, and still can't find a good general solution, only whack-a-mole. Users can be protected from spam by wot, but public relays designed to onboard new users can't. Unless we attach some extra signal to new users (pow? 1 sat? some version of your pow endorsement?) while keeping the friction low.

Any ideas how "pow endorsement" could be practically applied to onboarding users at scale with low friction? 

 PoW endorsements can be computed by specialized miners, because who computes them isn't important.

I am not talking about PoW on every note. PoW endorsements are like PoW keys, but better.

However, that's not necessarily useful for new users. But then the question is, how can someone enter nostr?

Maybe the answer is that they need a invite of some sort to surpass the "reputation threshold".

E.g. the user gets invited by someone and that someone automatically follows them.

Or, the user gets invited into a NIP29 (?) community, and so proof of membership in a reputable community can be used.

 

 cc @nielliesmons I am spreading your idea of communities as entry points. 

 > Maybe the answer is that they need a invite of some sort to surpass the "reputation threshold".

That's the only plausible idea to me too, but it doesn't solve someone hearing "nostr" on twitter and googling it and trying to get onboarded. 

 yep, it doesn't. Maybe, just maybe, that's a feature. U know, invite-only socials have a sense of exclusivity. 

 Unfortunately the applied solution will be "please type these letters from the image" unless we figure something out 

 yeah, but I am not that pessimistic.

It's an order of magnitude better to do chaptas ONLY ONCE and then rely on your acquired reputation, than solving them all the time 

 Captchas don't really solve anything either, they just make spam a bit more costly, but people will resort to them without anything better on the table. 

 because the values are computed from your position on the graph the fact they have weak links to the rest of the network will still diminish their ranks 

 Indeed. The problem arises only when a malicious client exclusively uses it's own malicious relays where the fake social network is totally detached. 

 ofc, but that's why I said "if u don't have a pov", meaning u are a new users that doesn't follow anyone. 

 that is probably a bad place to start, but also pretty uncommon, almost everyone knows someone who says "i'm on nostr" and they first follow them even if there is no onboarding procedure 

 not sure. That's true for our "community" of Bitcoiners, but that might not be true in general. 

 the thing that helps make sure of it is well known clients that have default logged out feeds of legit people

if people are dropping links to fake clients then yeah, but this is a general web phishing problem not anything special about nostr 

 Just look at Twitter. I would say 99% of bots haven't the blue check.

It's a matter of economic margin.
There are spamming methods that are economical at 5¢ that aren't at 10$.

And, this PoW stuff that I am talking about, is to be used to help a new user bootstrap his own web of not spam. 

 If you make them assigned to tasks it’s a protocol 

Like being an only-zaps person makes you cooler idc 

There should be a special only-zaps relay 

 Someone has to sign the badge; the protocol cannot do it alone. So this “someone” gives trust/value to the badge. 

 A certain amount of witnesses could sign? I’m sure enough thought could be given to it for a work around 

How does it work in the Scouts? 

 I understand, it is not easy. The good news is that these trusted parties can be collaborative and self-monitored: peer reviewed algo within peer reviewed platforms. But we must always keep an open eye on our verification attitude.