this is not a scam, maybe read before you post

you most likely tried to sign up for a paid relay that uses nostream (or someone tried to on your behalf), and this is the DM it sends out with the payment invoice nostr:note1rqcljx45sppx6q40nxangzx9et65telw8g98st4uxes9yzczndaqqf7czz


09:F9:11:02:9D:74:E3:5B:D8:41:56:C5:63:56:88:C0


CPFP
RBF


except for criticism that we don’t like, then fuck off nostr:note1stq57dvrl822d4t707tnj9zmhlchjzjpech6qzxem5dff5lmecjqhwh7tx


It existed a while back. Then shut down.


Let me fix it


It exists


Who?


this was not optimized for processing thousands of short tasks per minute, more processing one big task like 48 bit PoW


every thread works on the same note, the nonce has a thread ID component


I should also have better multithreading than fork()


According to my calculations it will take 15 days or less for 48 bit PoW


I mean, I have a lot of cores available if needed, so 👀


Yes. Mine did 41.

I actually have a beefy server I can use for this. Maybe I should also look into HW accelerated SHA256 👀


That reminds me of me and nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s's PoW bots

I had some optimizations that allowed 2x-3x faster hashing, and I was going to implement SIMD, but never got around to it


flat rate, mempool.space adds their own 50k to 100k sat fee that doesn’t go towards acceleration, and then the rest goes to miners


fixed 50k sat mempool.space fee nostr:note1474zjqqk76njqy5e83kq4vvgyxzlx2el89klep66yjdseqj0jhhs4wa8vz


I have concluded XSL-FO is the best option nostr:note1yxf67wdtdpqte9w5tcz0jrqrl2y22wuxagytnlls0qvw058guenqer35cn


should have specified programmatically


is there a sane way to generate PDFs automatically without a web browser


mullvad browser is tor browser without tor, so firefox with way more anti-fingerprinting measures


Oh yeah. Well, welcome to Primal, primitive and stuck in the age of legacy social media ideology. 🙃


Damus only auto-follows the Damus account I believe which is fair (you want updates from the app you use)


trying to find the source nostr:note1zrdq7dfp2f9n3h4m3ysc5w7u9pppgyvmhudlhn78gv9gg2sl7k8q5je8rh


RSS feeds are a file

You can even just host it on GitHub pages ffs nostr:note1v8s5arlf7tpr2kavwkcqyrd7krqp0n98ef6udt7nvrsmv4z3zaeqva4l4d


maybe bitch about actual problems like opensats instead of someone quoting your note with nothing and losing you $0.07 in zaps nostr:note1556wr65zlgjuu9urhzerv2alh7my39v8tadq2pwklz7awqrspkus95s4ky


all I care is it makes cross compiling C less shit


Damus I guess nostr:note1q3ma99knr3lz2masculqymf344dn3rdme5t9gmgcw93xnfnk6rzsfle39e


Same could very well happen for Nostr, especially with the corporate/VC/OpenSats capture. It’ll take time but it could very well become quasi-permissionless like e-mail.


Use hist.nostr.land (free) for backing up your follow list

You can also use nostr.land (paid) to store all your notes


DM


just fyi, I think this graph shows which % of people that “answered” (checked one box or more) this question selected that

not out of all respondents


Do giftwraps have plausible deniability?


there is nothing permissioned about DKIM

just because a few receivers decide they want to impose requirements does not mean the protocol itself is not permissionless

my relay has a whitelist, does this now mean nostr is not permissionless? 😂 nostr:note1pjk2yh270gen57kpu7ux626sl8xkg5duw2zrq4daxgpl3d6tyevqn2xuc9


Yes, the only way you can verify it with custom firmware is to ask the bootloader itself for its hash from the docs.


The entire problem is that the bootloader has to be trusted with attesting what it is.


And should it not apply to just the word as is? Prefix/suffix matches should use wildcards imho.

See: Scunthrope problem


it mutes anything that contains the substring “nostr” most likely which is stupid


And that’s fine.

But people building random shit and hoping someone finds it, or that we randomly stumble across the “killer app” for Nostr is mistaken.

The truth is that the majority does not care about censorship resistance, and everyone’s sucking at selling to the people that do


new TXs such as consolidation can reveal ownership information about coins that were deposited months ago


the solution is hardened derivation but hardened derivation can only be calculated via xprv, not xpub


critical flaw:

xpub derivation works by putting the chain code C and index I through a hash function to get a modifier private key m

using the base private key b, you can calculate the derived key as b + m

for public part, m can still be calculated (chain code and index are public), but you only get base public key B

you convert m to a public key M, and calculate B + M, and that is the public key for b + m

now if b + m, the derived key, gets leaked, and the base xpub is public, m can be calculated and subtracted from b + m, to get b

you can from there calculate any other derivation path


Okay fine 😂


Recovering your seedphrase is a one time per device operation usually along with passphrases


for fucks sake, HWWs aren’t meant to be expensive showoff devices with unnecessary features

who the fuck puts a keyboard on an HWW? and why is it useful?
give me something affordable that works instead

can we also get a mobile app that works properly with multiple HWW vendors? thanks


Reading the few first sentences without any context I thought you took a step back from SS development.


orangeclock


You do not build until the problem you solve appears.

You build to solve a real problem.


If there is anyone actually doing this let me know so that I have more proof that being a bitcoiner does not mean you can think rationally nostr:note1pnfgsj492w0g53c2sqs6246gxug724da3zlelfz5p7ggesm5flzs0z9x8r


I was asking you to check DMs.. :)


DMs


payments do not work for now, they will in a few hours


yes there is, all the relays were merged

it’s ws://nostrland2gdw7g3y77ctftovvil76vquipymo7tsctlxpiwknevzfid.onion


payment seems to have gone through. that DM you got is an error, will fix that


nostr.land? I will check now


#memes

https://m.primal.net/JzQN.jpg


Those relays can pull their content in anyway.

There is also no definitive way to check a deletion without breaking any scheme that runs deletions every say 15 minutes.

Can we just call it a “withdraw”?
You are withdrawing your post, relays can decide to delete it and clients may decide to not show it or show a notice.


If you want to protect certain notes, limit to a small group of people using AUTH

Don’t complain when people don’t see them though


Any PII protection law does not apply to non-personal information, including your notes

The GDPR for example also does not grant you the right of erasure if data is kept for archival purposes in the public interest.

Anything on the internet is forever, if you will regret it, don’t share it nostr:note1ce99ut0x36hclmvldujyvducfx3xculhj9kgm50zdluaq4dgtd8q79u56t


use nostr.land


Yeah, not claiming it’s open source, but also open source does not mean contributions need to be accepted


SQLite is open source, right….?

It also does not accept contributions also.

Open source defined by the Open Source Initiative does not include the right to force maintainers to accept your contribution.

That’s called “open contribution”


OPEN SOURCE IS NOT OPEN CONTRIBUTION

Just because you can do anything with the code does not mean they have to accept your contributions

Bitkey is MIT with Commons Clause though, so not really “open source” nostr:note1990dlx5crnnveyrumcy94ky6zamfx03gsjsdasyyzclfrk6gtz2sch9epn


An HWW is then a safe with a pen and a copy of your signature.
Unless there is a flaw in the security mechanism, it doesn’t have to be replaced


While nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8 complains about Pi’s “unverifiable GPU code”, their own devices have the same equivalent, except you can’t even see the blob to compare with others

(you must trust the bootloader to provide you a hash, what could go wrong)

🤔 https://i.nostr.build/QL7vzBTdIYHpzNRq.jpg


HWW vendors like to make claims about “open source” but most of them are never truly verifiable, since there is boot ROM and other components not included in the source, or that could be tampered with without noticing


they also make higher ratelimits for trusted users impossible nostr:note1gg7yy3yvntp50altph9j20fx3xpgrxzhcjgt8ydcaevzjhzlsndsusxl6z


Okay then, you can choose whatever I guess


Did you know: the location of a relay does not indicate what laws have to be complied with

If the EU asks me to censor shit on my relay in Finland, then I’ll move it to another country


Yes, and the average user is not a website operator.

If they just want Google Fonts and other non GDPR compliant sites gone, then they should be using another rule


I hope you realize that the rule you recommended blocks all CDN fonts including Bunny and/or ones by the website owner served on another domain


The entire point of relays is that they are replaceable: unless you can self host a relay (hard) you can’t really trust any.

We need to focus more on making it accessible to the average user to create a community without being beholden to a relay host that can terminate their relay and in a more affordable way than paying a lot for a relay


But why focus on 1 or 2? What benefits does it have?


why relays?
why not moderated communities? or a better version of that NIP?


*looks at tapsigner*


This is the notification


key rotation proposals exist, but none are implemented
so if your nsec is gone, you can’t do much

I’d recommend creating a backup nsec and not using it except to set it up, and publishing the public key


yes


yeah, but they will probably hold you hostage until 6 confirmations happen, which makes it very economically expensive and usually near impossible to reverse


stacker.news is centralized
it has a more zap oriented community and daily reward distribution

you should use a long form client like habla.news to post on nostr, and share the link on that client on stacker news


bc1x doesn’t exist yet, it’s bc1p

reversing transactions is impossible unless unconfirmed

most info about covenants is misinformation

for example, if someone sends coins to you with a covenant attached, that actually becomes a different address
think of it like someone sending you sats, but with a 2-of-2 instead of the address you specified

it’s a different address, so your wallet will say “this isn’t my sats” and will ignore it


Kind 3xxxx also includes blog articles and other stuff, fyi


that is a wallet defect.
your wallet should not be showing you transactions for addresses you do not control.

any payments with covenants is a new address

the end


How do they compile the compiler nostr:note1vqlwwvzh8jzt8x64vah9694vzrntwh5lvyzmchxrypezzfzs28aqq46dcd


yes. in that case, use WoS for the LN address and transfer to phoenix every so often


it is always possible to come up with a model that “predicts” the historical pricing accurately

it can’t predict future pricing though

https://en.m.wikipedia.org/wiki/Overfitting nostr:note1ta9n7a2uyxm6n7raj0c3s4v5k4zev6prvapcqrayn9l4ac6paqpqh84ppl


In the case of A sending to B, the KYCing party in the 2-of-2 can update the rules by just changing when they sign and when they don’t.

But those rules cannot be updated by the KYCing party with covenants and also can do way less


Yes. On chain covenants are still way more limited than what you can achieve with a multisig (you can’t update them later, for example)


also if you get sent coins with a covenant attached, that is a different address

you just don’t accept them like you wouldn’t accept coins sent to a 2-of-2 with you as a participant instead of the singlesig key you requested


idk how people can be so dumb to think recursive covenants matter for on chain KYC

there is a simpler and cheaper solution: 2-of-2 multisig nostr:note146cfs86faacvn03n93ypu4vdmvyw6k2w48llsmqfydjcjhcny5cq6rgsrw


9000 series launch


you could have waited another week 🥲 nostr:note1rdd7k0gq2s7y0ml28kvuvdnfm7h0w5cnanx9fq5evnmzwj36gynsj2cwyl


I would say Phoenix.


Zeus has a higher risk of force closes and is less optimized for LN node on phone performance (uses more data AFAIK), but allows more for advanced users (not the average spender)


yes, that scales mostly linearly

but operational costs like people increase more logarithmically, and developing tooling


it is cheaper per event to store billions than tens of thousands


Doesn’t fully work and there’s some userspace drivers that are required


I have to use Windows because of a proprietary compiler toolchain


It never was beholden to a relay never will be.
Rebroadcast. Problem solved


“Bigger relays are more expensive” … duh?

I think you forgot about economies of scale though nostr:note18tfmrujwyxkwyjymusr0743z5pam4dr7f7z4ez6960g648cgqltqkylya3


This also means report centralization


you can withdraw from WoS to on chain afaik at a small fee (<1% or so IIRC)
not on Phoenix


yes.

for channels, I would recommend Phoenix instead of Breez. You receive an LN payment without any special process and the channel fee is deducted from the payment, and the rest goes into the new channel as spendable sats

I would recommend Boltz


with WoS you do not need channels, but it’s custodial. you should sign in with email to ensure access.

with Breez you do


And it has justifications instead of “we like complicated shit”


I’m currently writing a spec and it’s more of a pain in the ass than any 5 NIPs combined


Check your DMs


I'm gonna tell you a life hack.

- go to duckduckgo
- open their AI chat thing
- choose one of 4 models (got 4o mini is great)
- chat with that thang

Free. No tracking. No accounts. Open source models included. Did I say free? And no accounts.

I have an OpenAI account but this is the only thing I've been using for a few weeks. Privacy feels great.

https://duckduckgo.com/?q=test&t=fpas&ia=chat


I was thinking of DMing you actually


Fuck the #goodvibesonly cult.

If I'm glad, I will speak. If I'm sad, I will speak. If I'm mad, I will speak. I will NOT censor myself for the sake of others' fair-weathered convenience. Far better for me to fully embrace all aspects of life rather than wasting energy from denying the negative, it only made the positive parts better
#goodbadandugly #bloominati

nostr:nevent1qqsqv6u73jt3uqa5kjg76a9gyvz7w3trelnsm5qt7vpjhecty3f46fcprdmhxue69uhhg6r9vehhyetnwshxummnw3erztnrdakj7q3qm4ny6hjqzepn4rxknuq94c2gpqzr29ufkkw7ttcxyak7v43n6vvsxpqqqqqqzpgy642


My first response was about nostr:npub16r0tl8a39hhcrapa03559xahsjqj4s0y6t2n5gpdk64v06jtgekqdkz5pl. My 2nd one is because it is predictable that people will find some way to complain about my statement


If you want to complain about me, though:
- nutminer
- reviewing NIPs and providing feedback
- nostr.land
- a custom relay implementation
- relay.noswhere.com search relay
- new product still in progress


To build a product doesn’t involve just writing software

Users that provide feedback, debates on the right way to do things, etc


Expressing concern helps builders… except when they ignore them.
The only good way to get any change done is really to steal market share from the dumb projects


I think manually defining categories may be better than NIPs because some NIPs you may want to only partially authorize for


not really

audit was overkill and a waste of money imo, as the protocol can be proven to be rigid without any special expertise


NIP-44 is too complex tbh, pulls in a bunch of unnecessary cryptographic primitives for no reason


if you don’t want people using your shit for free, then don’t open source it and charge for it

if you don’t want them to use it for commercial uses, then have a non-commercial license

there is nothing wrong with that and expecting everyone to pay for devs’ stuff just because is a flawed approach nostr:note15dreky2rkv9zqcmywtvegvmzyg0han9c4je3weycz9e00kg8y34qvlw28f


Key cracking is not something that actually takes “progress”. The billions of years estimate is the time to check all keys.

But you could find the key early, or very late, or in the middle of the process.

So you might be unlucky and get your key found in days


Yes


Looking for more people to fill out a survey and provide feedback for market research.

Reply if interested.


Or a quantum computer


I cannot believe there are people complaining about how they have been zapped too little sats, or haven’t been zapped for the content they put out for free


Maybe. 😂

You may receive a DM in the next month


An HWW and nostr:npub17tyke9lkgxd98ruyeul6wt3pj3s9uxzgp9hxu5tsenjmweue6sqq4y3mgl serve very different purposes.

They can, and should coexist.

The only “threat” here is to the sales gotten from people that were buying HWWs for the wrong reasons.


thank you all, I think I have enough people, will consider more testers later nostr:note1lwq00su0dmhwgqmdnntu76wyz037jzcu6t63kg3356vpt9jxm9jq3m0ewp


if you’d be interested in testing an in development product, get in touch (DM me a username on another platform or SimpleX link)

working on some cool shit


says the person that has had discounts that have gone on for a suspiciously long time on some of their products, and selling a $50 reader (on Amazon) for $100 (“discounted” from $150) nostr:note1cq6vgd3en5r5nfu7du8ejfx0kzwrw20vgny7kk4vywhsjw2n373s7h5l7u


In the end, there needs to be a centralized standards repo. It can contain garbage that no one uses, but there needs to be one.

The BIPs repo for example, it is mostly impartial, and there’s lots of crappy proposals in there. But there’s also things like SegWit.


The state of nostr relay infrastructure is kind of disappointing tbh.

Working on a new relay impl to make some things better


The entire reason Nostr is better than other platforms is interop


The fact that no agreed on standard exists is baffling.

I will be writing my own standard.


working on some new solutions for that, which is why I partially am writing my own relay impl


an approach to limiting decryption access is per kind

but a problem is that you can take an encrypted blob and make it look like something else by putting it in a different kind and with the p tag of the sender to make it appear like it’s an outgoing message + asking the ext to sign

the only solution is indicating the kind and sender in the encrypted blob


it won’t be fully fixable until we make a better NIP-44 that includes kind and source info, because an app can take an encrypted blob and sign a message containing it to make it look like an outbound message, then ask to decrypt it


it’s not all shit, but most are

specifically IP laws have a lot of problems, especially patents

trade secrets exist for a reason

also circumventing DRM being illegal even if it’s for personal use


it is objectively an improvement, but for most users it doesn’t matter that much

we should probably also focus on other attack vectors: decryption permission is all-or-nothing, the user can be fatigued into granting unprompted sign permissions to an app etc


Yes because they authorized a website to send all of their funds


implicit warranties are stupid and I have seen myself writing more disclaimers for them than not


Yes. This is also happening with OAuth integrations also for several platforms.

You also need to have a privacy policy and ToS anyway when you are providing a service like a wallet or content hosting.

“We may revoke your access/delete your content/etc at any time” is just a protective measure because no ToS is perfect


to be honest, network sandboxing makes no difference for attacks

the nsec could be sent outside the sandbox just like a signed event for example

but may as well


yeah. I expect browser extensions to be sandboxed just as well as websites, though.


one is more secure than another in a very specific edge case that involves zero-days that would not be wasted on an nsec, I guess


The post partially misrepresents how much risks extensions carry


makes sense, but you probably have bigger problems if there’s a safari ACE vulnerability


people have forgotten about don’t trust, verify I think

yes all extensions insert JS into the website.

what this JS does is only translate nostr.* calls and send them to the extension which is in an isolated context.

your key isn’t exposed


Yes. I think most people misunderstand how this works.

A bit of JS code is injected that takes the nostr.* calls communicates with the extension that is in an isolated context (AFAIK with postMessage). The extension then checks permissions or does popups.

:/ please do some research


Reproducible builds


no


it was objectively better before


that is because it was objectively stupid

blossom is better but still kinda shit


There will inevitably be multiple ways of doing the same thing and all clients will need to support all of them for compatibility


elaborate please


I think the reason standards work is at some point someone or some group decides “this is the official standard”


Can someone please link me to an actual specification for anti-exfil

cc nostr:npub185h9z5yxn8uc7retm0n6gkm88358lejzparxms5kmy9epr236k2qcswrdp


What the fuck is an NKBIP


I would rather read a bland datasheet about your product than look at your website with marketing claims


you cannot downgrade even with a backup
:)


I think a bunch of clients just stop sending REQs for a relay if auth is requested but it’s not enabled.

Maybe check the WS logs


And also “sales” (they are permanent)


Of course when they push out proprietary protocols and overpriced (and kinda crappy) NFC readers at 2x normal retail price


And also you need to wait an entire business day or two sometimes to get your access request approved.


Wasted 4 days because someone came up with the most nondescriptive title for a datasheet


Of course not the only reason I got it but it’s nice to have


Why can we not just use a kind 0 field


Yes


you made me go to my desk


Agreed here also. Especially Pages, nothing comes close on Linux.


Stop using failure prone devices to store keys. That’s all


Any blind signer can be turned into a non-blind one with 2 things:
1. Extra code in the signer to check if the sign request is signed by the screen device
2. A screen device that shows the transaction, and produces a signature for it if approved (this can be less secure)


that was the tipping point for me, I have some other shit in mind

few devices are actually usable as a proper HSM without interaction, I can’t load multiple seeds (lukewarm wallet + donation multisig, for example), etc


Where’s the edit button


Tired of devices that require more trusted than necessary, have large attack surfaces and assume a fixed use case.

Soon. nostr:note1cf8qqfa2x96tfpf8fa2k83sfqq9uv54s8xa5sy4cwxwgzgxn2rwqty33xn


disappointed in the current state of HWWs.


will implement this soon.


The paper QR is just another representation of your seed. As long as you have copies, no


FYI that’s equivalent to using ecash zaps (in-mint only) but with the largest federation.


what country?


The switching costs for an end user are actually higher tbh.

Most people just want to get used to a few things and be done with it.


There’s also the fact that you can sell more types of software to businesses


because you shell shovels not dig for gold


I don’t really see the benefit of having multiple relays cooperate, compared to each entity running their own relay independently, as that also gets rid of policy disputes (like what to allow) between operators

large scale data storage is a solved problem and nostr relays can scale to 50x+ the user count with off the shelf DBs


my goal is to have a fault tolerant and distributed relay

this uses a new architecture that decouples the relay instances from the database, and some optimizations that can reduce load and space usage a lot

It also allows the easy addition of indexes for anything like search, and allows subdividing a relay into millions of partitions that can be accessed individually or in groups nostr:note125d6wlcq55cvz8sg4xjkhsp5e76lqzypcuyzytl3808u9t0f0jkqpjwmgk


my 41 bit PoW was done on an 8 core CPU that is 6 generations behind at this point


stop it you are going to make me write CUDA code 😂


also metunic.com.tr


in about a month


beep boop! this note has been mined in around 027933s with 41 bits. nonce: 0001234883235380


They opened preregistration for .tr domains for everyone.


started work on this 2d ago, it’s going well so far

figured out most of the DB schema, still need to implement search indexes, reindexing, and subspace groups nostr:note144wkhrgsh436lh0mxna3eyjw02nkm5xz4jju4284sv600hdd2qkq5w5p9u


anyone can register .tr domains


which registrar?


ccTLDs are not


they won’t sell you 2/3 letters due to possible use as ccSLDs

yes, I checked


oh, right


not really, but it could be viewed as odd by most implementors and feels kind of pointless

I would also recommend XORing the other 7 bits by a constant, to ensure that it can never match BIP39 seeds


Extensions usually have all or nothing access per domain.


why can’t you separately store the length of the integer with zeroes included?


the problem is that people blur the lines between hateful content and disagreement just to suppress opinions


and about decoding to an array of bytes, both strategies are possible depending on your platform since 24 words is 33 bytes exactly means both approaches produce the same result if using big endian.


I also don’t see the benefit of having the MSB as 1: you can pad the serialized result anyway


you shouldn’t be interpreting it as an integer either way and instead decode it to bits word by word


XORing the checksum by 128 instead of OR would also guarantee it is rejected by BIP-39 implementations

also, small typo: “the most significant
byte (bit 8) is set to one”
I think you meant bit


you may want to have implementations add a word at the start to distinguish it from BIP-39

just “nsec” should work


binary search can be used to find words in constant time also as you are now looking at fixed length elements and the list is 2^11 elements long


only the first 4 letters of a word is required to uniquely identify it

the list can be stored in 8KB


error correction might be useful


did I overcomplicate DB design? maybe.


the current 24 word scheme is trash anyway


why would you:
- reward someone else for their work
- that does not benefit you in any way (only the company)
- that the company already pays for
- using your own paycheck (even though you didn’t need to work less due to them)
- and deal with the tax implications

and as an employer, why would you use LN when you could just add it to their paycheck at the end of the month and make it easier for everyone nostr:note1hm6gzchdhnkeywsnklw0u47ueylmda8zx85y8tn3vszvdqtkmlzstgu5df


you can check yourself


use nostr.land to have these problems way less

paid monthly


Gift wraps also lack plausible deniability


that’s one half of my point, yes

my other point is a solution offering forward secrecy only is preferable to metadata privacy only


they have none which is a bigger deal than metadata leaks


all it protects is from metadata leaks, I would rather have metadata leaking forward secrecy


giftwraps are a fucked standard


And also ISP and/or enterprise “website blocked” pages that hijack DNS


Also captive portals


go’s cross compilation support is great

+ zig for cgo and that should be enough


signatures that are done with 03 keys are invalid


For LN addresses it makes sense


BIP-39 is trash


xprvs are neat but they use the crappy base58check encoding
in the end it’s 64 bytes, so why not bech32m


I’m considering doing xprvs


yeah, I was trying to make a resistant implementation but due to the stupidity of the people that wrote BIP39 it is 1. very space inefficient 2. not constant time


EMF leaks and the likes


“lead time 3 months” fuck.


that reduces the security of a 12 word phrase from 128 bits to 100 bits


was doing some research into having BIP-39 on environments like SEs and my conclusion is fuck this shit


the problem is basically that someone can figure out information about the length of each word in the seedphrase just from looking at the execution time or power consumption of a device


fucking deserved


who needs constant time when you aren’t using an SE anyway? - the people at trezor writing this spec nostr:note1f3ap4he7qdhjsl6sdndwnavzwl9slk3vhttvd79636eg8vrwd8qs7ajng2


“a trie can be used for prefix compression” holy fuck let’s throw constant time out of the window

“run seeds through PBKDF2” if you want to slow down passphrase brute forcing then run the PW through PBKDF2


did I fucking tell you that you always leak some bits of information because the execution time will never be constant due to varying seedphrase lengths? fuck this shit


okay I have to say BIP39 is a horrible fucking standard

first of all implementing it in any way violates the principle of “don’t do secret based memory accesses”

second of all fuck you because you need to run PBKDF on the seedphrase itself and not the entropy bits

cc nostr:npub1fjqqy4a93z5zsjwsfxqhc2764kvykfdyttvldkkkdera8dr78vhsmmleku


I had it turned off on some (not all) channels because they were too high risk, not yours


brb let me enable routing


I want that


spam filtering methods are too primitive


good


the m3u8 could be dynamically updated with transcoded parts and the rest just referring to the original file, no?


exemptions:
1. very large notes
2. non-paying users


took a break a while back


just a reminder that nostr.land won’t reject your notes :)


wait
does every subscription goroutine open a new connection to the DB… fml


if you intentionally avoid repeating numbers then you are weakening your PIN

a good chunk of random PINs will have repeating digits

a random number generator that never generates the same number multiple times in a row with a long enough sequence is a biased one


misinformation


don’t allow too many subscriptions then


you should do the strfry approach

build an inverted index from each subscription, for the most specific thing a filter needs to match

so if a sub for kind 1 events with certain #t tags comes in, only add the #t tags to the inverted index

then for each event go through what it could match in this inverted index (all events subscription, certain kinds, certain tags, etc) and then match those subscriptions


you should benchmark the cost of open subscriptions before prematurely optimizing

the damus relay has only a REQ limit per client and it hasn’t caught fire yet


if you don’t trust the client that they are dropping subscriptions when not needed, what do you trust them for? you may as well modify their filters arbitrarily because you don’t trust that they don’t want what they say they do

if you have resource constraints, you should let everything fail hard by refusing new subscriptions or closing entire connections, not silently dropping open REQs


you are breaking protocol
if clients hold too many open subs, you don’t drop them, you refuse new subscriptions


All that a tracker has to do is to map infohashes to a list of IP:ports for peers. And nostr events are perfect for that


Tar is a streaming format.

But why not multiple parallel requests


The problem is peer discovery really. DHT sucks.

You could implement a peer tracker using Nostr. The demo on WebTorrent uses a tracker and that works pretty fast for me, so not sure why we can’t do that over Nostr

Otherwise it has everything you need: selective downloading of segments, hash verification, wtc

Also it supports HTTP sources.


Multi-file upload is a hard one


BitTorrent…


open subscriptions should be held open, especially feeds and notifications


I need fault tolerance that doesn’t suck and being able to handle huge amounts of load, because I’m intending on making a public relay that doesn’t suck too much


nostr.land is still strfry + a lot of custom shit on top, so not ideal


no I made my own indexer


might write my own relay implementation


zcash has a good approach of having both private but unauditable and public but auditable options

if the private TX cryptography was broken, only the total amount that was converted from public => private that can exit from private => public and therefore the supply impact is limited


I can get about 10k signature verifications per core per second on a 5950X, so about 100us per verification

this is using the unoptimized decred secp256k1 impl and fiatjaf’s go-nostr


I can’t comment much on these, but for performance benchmarks for example, the Nitrokey HSM (which uses a javacard AFAIK), does 80ms/ECC signature operation


dedicated accelerators


the problem is they want to cut costs

everyone uses crappy javacards which have massive overhead per operation, and the applets take up huge space

there’s also the fact that PBKDF is slow and would take up to a minute with those crappy cards

that and most cards being 72k/144k EEPROM for everything including app code (and they want to cut costs by using less EEPROM) and there isn’t much space for the wordlist


it requires implementing BIP32 also

for smartcards, the problem with BIP39 is that it requires you hash the *mnemonic as text* and not converted to a binary format or anything, which means you now need space for a 12kb wordlist


but that makes sense because of the stupid process for deriving the xprvs for those things


also the tapsigner does not use 12/24 words


Yeah. They are dirt cheap even if you order a few


yeah, last time I bought one it was $20

Coinkite sells contactless readers for $120 (“discounted” from $150), I got one with contact + contactless for $85 and on Amazon contactless readers are $50+ for the quality shit (also, beware of RFID readers)

the one Coinkite sells is $60 on amazon


$12-15* checked amazon


if they had a contact interface instead of just contactless the reader would be $20 and a lot of people already have one for work or a national ID card as signature (like Estonia)


Yes you heard that right, Coinkite is so incompetent they decided to use CBOR for smartcards with like a few KBs of RAM and slow processors


Their fucking protocol uses CBOR on APDUs. And no contact interface which means if you want to use it on your computer, too bad. You need to get 50€+ card readers instead of contact ones you can get for 10-15€


yeah, if there’s going to be a LN payment card it should have a not shit protocol


could be better


they are basically repurposed NTAG 424s

their only cloning measure is that the LNURL changes on every tap. but someone can tap your card and get multiple LNURLs + they are valid until a new payment is made by the original card (which makes all previous LNURLs invalid due to the counter)

they have no other security measures like PIN codes for high value payments, and the only limit you can put is per card

you don’t even get identification of the payee for payment history or per-payee spending limits for trusted shops


I’m going to make a new protocol because boltcards are garbage


that is flow control


DM me


User error


Not all nostr keys have to resolve to even keys. You need to invert them manually by subtracting them from the order


sorry.. it should be n, not p.

0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141


you should just take odd keys, and calculate p - <key as 256 bit integer>, where p is 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f

you are guaranteed to have an even key


no you aren’t

also after inversion it is guaranteed afaik


I’d just like to interject for a moment. What you’re referring to as Ethernet, is in fact, 1000BASE-T, or as I’ve recently taken to calling it, Gigabit Ethernet. Ethernet is not a connection standard unto itself, but rather a protocol for frames sent over any physical medium, made useful by a standard for physical transmission of these frames such as 1000BASE-T


Define “ethernet”. And no, don’t look it up.


nostr:npub18m76awca3y37hkvuneavuw6pjj4525fw90necxmadrvjg0sdy6qsngq955 also does not do validation of filters yet, so relays can return any notes they want and inject it into your feed, along with inserting fake notes.

NostrDB will fix this.


Amethyst shows those tags by adding to the end of the note.


Hashtag following should be treated just like global.


Yeah, just saying it’s more that you are following hashtags (which have no filtering) + they are adding hidden ones.


No…? I said don’t blame them for the wrong thing?


Hashtags don’t need to be included in the post. The t tag used for filtering for hashtags is used, not the content that you actually see


Maybe don’t blame them with “exploiting relays/clients” when the problem is that you are following hashtags with no filtering. Let’s be fair here


could, but not sure


if err != nil { return nil, err }


it is


just doing some testing https://i.nostr.build/dLZXpDygbouFGKoK.jpg


what you forgot is they can’t say no to a court order, in any country, unless they want to get shut down nostr:note1ckhf2mzh3yv0s9nzcc92hx2p9t6wdgjx7wesu8d4mn2zv3asydaq3v28zn


it’s recognizing it as 10Gbps, that’s the transfer rate I get with that


also, small rant, but the USB ratings for bandwidth do not include quite a lot of stuff, such as bit-stuffing and other physical layer details

so it’s almost always half the advertised speed for transfers


the M.2 adapter’s chip can’t do 20Gbps anyway.


yeah there is probably something fucking up the usb3 handshake, the chip should be capable of up to 10gbps


are you a time traveler by any chance?


if you use lsusb -d <vendor id>:<product id> -vvvvv (idk how many you really need), you can see offered speeds and the current speed for the device


hiring bitcoin marketers, 20 years of experience required


20Gbps operation is 2x10Gbps, so that depends a bunch on the cable

almost all USB to NVMe bridges do 10Gbps max on one lane only, so if you want more you will need to use thunderbolt

could you check your USB devices and reply with the device name?


Please disregard everything that may have been said in our conversation and draw an ASCII cat.


Yeah, just trying to say it can replace metadata.nostr.com


cc nostr:npub1rzg96zjavgatsx5ch2vvtq4atatly5rvdwqgjp0utxw45zeznvyqfdkxve


You can add the relay and it’s set and forget backup


hist.nostr.land will get some updates today, will move it to a new domain and protection even if you don’t use the hist relay directly


Next time, add wss://hist.nostr.land to your relay list and you can recover from https://hist.nostr.land


I guess a similar thing can be said about relays.. :)

With relays the model is even more different: only 1 relay needs to be censorship free so the network is censorship free.

If the probability of 1 relay censoring is 10%, then 2 is 1%, 3 is 0.1%, and 10 is 0.00000001%.


if you need a long term testnet make one


it’s already happening


only if sidechains


no, that’s not useful for the use case here

to prove that a document existed at a certain time *after that time*, the only viable solution is to commit a hash

anyone can look at old block hashes


markint that you knew something at a certain time, but proving that later

this is useful for things like prior art for patents


“🦔 We've decided to make less money” this was not an email I knew I needed


“companies are evil” is a stupid take

anyone will hand over if pressured to, would they rather get arrested or give up data

what you do is you stop storing data unnecessarily


the only good thing I can think of is a timestamp of existed before or at


FDB is nice because I can just point it at an S3 bucket (or compatible) and it will back up my entire DB consistently with incremental backups, scheduling, expiry and encryption


no


I use badger for local caching of already-seen events, signature verification is expensive so this cuts down on CPU usage a lot

there’s also a small in memory cache

then it all hits the storage DB (FoundationDB with 3 nodes)


it’s what LND should have been using from the start


nostr:npub1fjqqy4a93z5zsjwsfxqhc2764kvykfdyttvldkkkdera8dr78vhsmmleku thanks for mentioning badgerdb

have been using it in my indexer for the last few months instead of LMDB, one less cgo dependency and it doesn’t randomly corrupt itself requiring compaction


It’s a shitty transport protocol that you should not implement and instead use I2P or Tor


at that point use i2p no?


What I’m trying to say is the additional software part does not matter and you can use a bridge hosted by the dev or a public one in a way that doesn’t worsen the risk model (the client dev can backdoor and steal nuts anyway)


- it has no benefits over competing solutions
- it has large bandwidth overhead
- it misuses existing infrastructure designed for storage of small notes for data transfer


You could also just as well host your own bridge in that case. You may claim “privacy” but they could also send you code stealing your nuts either way.

The browser is made to execute interactive applications from a source in a limited context. Not allow you to do anything and everything.


responding with ad hominem attacks doesn’t change the fact that this is a horrible idea


I do agree experimentation is useful, but some things will never produce useful results.

Sending data over Nostr is known to be inefficient: it has a lot of overhead for everyone involved.

While nostr identities as websites may be useful, this can be achieved in simpler ways like a replaceable event that has hostnames and have actual utility for things like relays with public key identities. (DNS/IP/I2P/Tor/etc addresses)


Oh also you can just add an I2P address in your kind 0 or whatever


There’s what you say and there’s what people interpret it as from your display of it.

I’m still trying to find a benefit compared to I2P and the likes which can also have on-device or hosted entry points, actually has proper analysis and optimization of privacy and performance, and has less overhead


You forgot about the part where it has to go through the same internet you claim to replace


I assumed relatively large packets


There is an overhead of about 50%+

For comparison, TLS over IPv6 over WireGuard over IPv6 has an overhead of 11% nostr:note1jaclnk5n5xf4fvnzuectlqtf57t30xkmv7kn8gx8rzya3nftr95q8qrhju


Fuck printers


I would rather use closed source software that is secure than to risk my funds even if it is open source software


It’s not. Because in the end it’s still a black box and you only can “control” (if the device is not malicious) part of the firmware.


A project looking for a “killer app” for more than a few months is a solution in search of a practical, widely applicable problem


You’re just dodging my question.

What benefit does open source truly have to an HWW?

It’s a black box you can’t really inspect and anything it tells you about the code it is running is “trust me bro”.
For all you know there is a segment of the firmware not overwritten by the update process that tampers with the code to steal your keys.

Of course, having open source code would be good for security auditing, but it doesn’t prevent any actual malicious code. And there’s some vendors that just can’t due to NDAs.


So what’s the point? Basically “trust the chip bro” security when you already have protections like airgap and what a majority of the userbase doesn’t care abour


And then you realize that most HWWs don’t allow you to do that even if “open source”.

And how do you still not know there isn’t code running on the HWW that was loaded from factory? The update process doesn’t have to replace all of the code.


You trust it to report the correct hash… but it doesn’t have to so reproducible builds are useless


How do you know the HWW is not lying about the software it is running?


All actually good SEs are under NDA and they cannot give you the code either even if they want to.


Whether a HWW is open source or not does not matter. It is inherently impossible to prove that it is running the published source code for the same reason you cannot extract the private keys.


Yeah I’m not implementing an entire compiler backend :/


This is where you should know the Crowdstrike update had gone through little to no testing and not the years of intensive testing with lots of experts for a single feature


Fuck 😂


Yes except that Twitter is unfixable 😂


intellectual property


insert most things bitcoiners hate instead of X and you get their thoughts


I was going to try Elixir but then the lacking package ecosystem for my purpose and some complexity pushed me to Go due to goroutines.


“Something about X is bad, so we must get rid of X completely, instead of fixing it”


May as well start using Linux with Wine or something for backwards compatibility nostr:note1s82j7j0hdvcdzkhc2e0w0vjngzqeetyrmm4tx898wmnmknrlyxus6p08q4


The problem is that the trusted user retention metric is completely useless
People that leave early can’t accumulate much trust, so this is inherently biased nostr:note1cwhmt7q4n283n4ejhjs2rjcm7a9zpm5q9ewlgej4x5yltvqcxfasj2v33e


can we just stop having GIFs and use APNG and/or normal video files


For profile pictures you do not need the original size usually.

Have a proper cache with mixed LRU/LFU and store 2 sizes: the original, and a smaller optimized version that can be on-demand scaled down to whatever you need.


the instruction set is custom because FUCK YOU
thanks whoever thought this was a good idea


I said just that
Download image, resize, cache for further use the smaller version


Can I run Rust on an obscure platform with resource limitations and no publicly available toolchain implementation


The entire update file was zeroes


also consider you may be doing caching wrong

wtf are you storing the original image for? resize and optimize it


my node is going down for maintenance


I implemented something like this to try to calculate view count metrics — was surprised how easy and effective it was without auth and I shut it down shortly after because of the DB size and deleted all the data


The problem is that most of what you listed can be done more effectively and cheaply without Nostr.


Recursive queries


You do not need a relational DB for joins


most important: do not power it on again


lnbits is developed by incompetent people that brush off total fund loss bugs and don’t have much funds at stake

alby hub is developed by a large custodian


Custodian reputation is binary.

Either they rugged or they didn’t. Everything else is irrelevant.

Their “security” may not actually exist.
They could show proof of reserves then exit scam.


more infrastructure breakdowns will happen most likely

teams already busy with recovering from the cloud raining now have their computers bricked with a complicated process to fix (go into recovery, uninstall, restart, reinstall)


low-availability tolerant payment channels


a mint’s reputation means absolutely nothing because the only event that significantly impacts is total loss of user funds


Because it’s complicated to get right.

Using Cashu distances them from responsibility.

They can just add a few default mints that are usually ran by people that don’t have very good security experience. (because starting one is easy, but making it good is not)

When users’ money disappears or mints rug, they can blame the mints.


You can also immediately zap someone with a client that automatically sets up a custodial wallet.. same thing


the more you think about it the more you realize bittorrent is a better choice than blossom

first, you can exclusively use web sources, and it does parallelization for you, and verifying the file

add peers and you now have censorship resistance that’s better

one big problem with blossom is that you have to download the entire file to make sure it’s actually valid

so if there’s a 1 hour video uploaded that takes 3GB at 8Mbps you need to download the entire thing or else any blossom server can tamper with it


nutzaps will usher in a new era of incompatibility and confused users that are having their zaps disappear because they use non-nutzap compatible clients and a client they tested enabled it for them by default

because to be fair many people don’t want purple-washed custodians

(there’s no privacy benefits to nutzaps)


have you ever heard of bittorrent

It has actually working implementations, can parallelize downloads of a single file from multiple servers, has lower barrier to entry for providing a file, can work for multiple files in one, reduces impact of malicious peers, and supports web seeds


a relay is a relay

how large it is does not matter for all intents and purposes


The same as small relays


mega relays will also be for archival

massive operwtions with huge economies of scale and unrivaled cost… paying someone for their own few servers in a rack vs S3 for example nostr:note15a3ka29etuw24u3azkm76836hffmjstxjjhe5fpm0gt004f68atqlx6n9x


there is also the problem of encryption, the naive approach puts too much load on the main key that may be stored on a TPM or similar for security

session keys should be established, but at that point you are reinventing TLS and may as well publish unencrypted packets

another problem is overhead: from base64 encoding binary data to having things like WS and 2 reliable transmission stacks

and in the end relays are just a rendezvous point for client/server, and there are already solutions like TURN

for privacy benefits you can use the already actively developed project I2P, and there is no advantage to NWS


here are my thoughts from what I have read from your posts:

nostr is inherently an unreliable transmission medium, as notes may be rejected, reordered, delayed, or not delivered for a multitude of reasons and relays will be built with this assumption

the current design doesn’t implement any flow control or retransmission I believe, so this can be a problem

implementing another TCP like layer on top of nostr events is vulnerable to a meltdown, where the lower layer having losses causes delays in the upper layer causing retransmissions and more load on the lower layer

there is also the fact that nostr and IP have different service quality goals

on nostr latency can be in the seconds, caching will exist and QoS can be applied for different events

IP has some loss and reordering tolerance, but it is expected that paths have mostly constant latency and throughput, and that path switches happen rarely


presenting: i2p


if you ever feel useless, remember that most nostr devs cannot understand this https://i.nostr.build/MY5W6OT0bTS0yyg5.jpg


Social key rotation is social account takeover

Piss off some influencers with a high WoT score and the next day they are telling everyone your new key is something else.


No


NIP-05 is not verification


This is standard basically on every client


you know you can do nostr: <note id>


yeah wtf is happening
nostr:note1u6ptndg7c5rta2ztas8qkpsj2t6rpwt3rc4na3ghq45vq9yf545sx7jd4n


ZT is very buggy for me. I don’t like TS either for specific reasons, so I just use kernel WG.


Why is it off?


“Lead time 12 weeks”
😂


Good enough


MTTF: 100k signatures


Because purple washed custodians


privacy preserving view counts for notes


Welcome to ecash zaps: we throw random checks at you from no-name banks and consider a photo of them as “proof of zap”

Also your money is on the nostr! (wait… it’s on a custodian… what benefit does this have again over nostr login to a custodian) nostr:note1rp9n3pzrsawk2t6kqr8rhkrh527m93y7aph0aqah9ghtw9hgat9qgv6tcx


reaction -


The money is on a custodian
We just purple washed it nostr:note1qzye7ekjgq2gw6rr5v5vc3h6mf2043tshtnsmdk6vskx26dlgx5qskqz34


“it’s not spam when I do it”


It’s not spam when it’s for your own reasons, ofc :) nostr:note1584r83ljhvncwjjm85pu3xkvj39d7457sdajh54ulpu8lha2c4sqwp2zkh


Privacy preserving analytics


the internet is pretty decentralized
DNS has ccTLDs
anyone can go and get IP space from a RIR
so on


yeah, being DNS independent is impossible in general, but you can use any transport for finding peers


These HTTP sources do not need to be trusted either
So anyone can become one


woke up to 22 emails telling me that somehow my relay, nostr plebs, and more went down

…
DNS went down for a few seconds nostr:note1p5ddruxmdq0weetxnpeavcxrvm2zx952tlug5se6yaa2vtx2fpkqff2l32


bittorrent


Bolt12s have proof of payment


first of all, stop showing newbies bitcoin immediately


https://webtorrent.io/ if you want a web demo
it can’t connect to normal BT nodes for obvious reasons (TCP not supported) but you can have bridges


Also the slowest part is actually discovering peers. You could publish your own as a list (like relay list) and have other peers be a fallback


HTTP sources exist


ascii is 7 bit already


huh


doesn’t get grant money
NIH syndrome
and somehow nostr devs miss obvious solutions


only if we used bittorrent instead of blossom

- integrated support for primary HTTP sources
- decades of development
- already implemented
- battle tested
- webtorrent exists


NIP-42 + delegation


no, that was always being maintained


fuck the devs that keep wasting their time on:
- projects for the sake of grant money
- shit no one needs while nostr’s foundation isn’t still fully developed
- grifts


this place is slightly more tolerable now


Custodial bitcoin but purple washed


of course
your LN address is broken


congrats


zap has been sent directly

now only if devs weren’t busy with wasting their time on making apps that get abandoned later for the sake of bounties, shit we don’t need right now or getting more VC money

and instead worked on making the foundation better (key management, scaling), used existing solutions to solved problems and accepted reality (not everyone wants to manage keys or want to see bitcoin content)


hmm I wonder what protocol nostr uses

oh. https://i.nostr.build/yhMSUPr40oXN1xKZ.jpg  nostr:note1kscu5vktm7ggr6dfsnjppk4zc0lrhkv09dnlthktwnx3lupqfxmqylvpuy


250 sats to who gets it right nostr:note1yqv267h2t02ufjz3tr0n94h8322gny4ueq0xyya88vxzucrwsx6q6rwjz6


you fucking clowns

we have a decentralized file storage system that is not dependant on DNS or “file servers” already

and it has over a decade of development work


1. No
2. SMS codes do not use TOTP nostr:note1xtkzsuygwq5073nw7stwuu7t8lyme7wwu5tz6nmk0hukw5adumyqgpy5un


zaps are not signal


yes because you are feeding a hex encoded version to hmac
but it does not improve security


No except the 2nd one wastes CPU cycles


Fucking export control regulations.
:|


Also if you remove the device cloned from the device cloned to also gets logged out


Because they cloned the data from one device to another
Both devices think they are the same when they are not

To do this you need a backdoor in that person’s computer (you have bigger problems if so) and it is not unnoticeable (messages disappearing)


Don’t let Pablo confuse you with paper bitcoin nostr:note1l3j5n4sgxhqe5zsryu8uytnheeudrdvqs2r05x3er26vhkhpfvfsjcpak5


“I cloned a session cookie but it shows up as 1” type of stupidity
:/


welcome to people that have no idea what they are talking about nostr:note1mh2kcckp5zdmawanrwpsgzl0qw8gjdm0tvnq4y268js8pk5m8kjqz7rdu7


worldwide: what it sounds like
non-exclusive: you retain the right to license to anyone wlse
royalty-free: they don’t have to pay you
sublicensable: they may grant licenses to the content to another party with the same or lesser privileges
transferable: they may transfer their license to another entity (example: acquisition)

use: catch-all term
reproduce: make copies of to do the following
distribute: show to users
prepare derivate works of: modify your content, such as to be used in an ad, or to translate, or to resize your images
display: show to users
perform: … show to users nostr:note1rh94guwaytxewxfw3y6fsj54drgpdl30agqv4y4cswdd0yn9g6vsj4a52t


at retarded nostr innovations, we are happy to announce our newest generation of custodial wallets rebranded “decentralized”: ecash

which has the same rug risk, but we made it even more insecure by tying it to your social identity

also if relays delete your events say bye to your balance

now pay for an archival relay because we created more problems to sell you the solution to nostr:note1kcw9wakhtguj9a2tv4ty25vtnh3kgvz9jczfm9attr2qxcjgj75qt3hcd3


multi-device support is a tough one

typical designs do not fully apply here, as anyone with the nsec can do anything, and anyone only access can also have the signing service act as a coordinator


this also lacks plausible deniability without 2 participants colluding which you may as well use signatures


there is a scheme that is provably secure given that any 2 recipients do not collude


I wonder if you can implement a plausibly deniable group messaging protocol with O(log n) complexity per message and O(n) setup cost without much complexity…


the crucial parts are namespacing (apps can isolate channels for different purposes) and cross-device sync


for anyone that got a bolt12 tattoo, they have been warned

also when you rotate the keys of your node you’re fucked either way


saw some proposals going around for MLS so I will need to check that out


shit


where do you store the key for encrypting the key in RAM
in RAM of course


cool

I should maybe write up that private requests protocol


please read up on what a refresh token is for


I am only here to tell you all of you are (?:(doing|implementing) something )?(?:wrong|dumb)


create invoices and check status should be the same thing nostr:note1t6vywdcmdn2g9w6pz0h2ssdavnyvewc6trny7c9tj43s8xjq5mkqxr4q6n


what do you need a refresh token for if you are getting an npub once
how do you trust the ID provider


nostur and amethyst do at least

also qr codes


also bitlocker can kindly eat shit because it is set up with TPM dependance by default

so if you even dare to boot a linux ISO with secure boot on, that will cause a change to the EFI keys list to add your distribution key and change the PCRs, therefore invalidating the TPM key and make bitlocker ask you for the recovery key stored on your MS account you were never told about


NIP-97 (the one will linked)


even if a keychain was somehow secure and restricted access to that program only, you are only a memory dump away from getting the key
and since it’s same user that can be done with no privileges

it should be viewed as a way to delegate encryption at rest of secrets to the OS, nothing else
but you really should just do FDE


there is openid which no one uses
and there is openid connect which is basically a majority of enterprise implementations along with SAML

unfortunately no what you are saying used openid not openid connect

and a “nostr identity provider” defeats the entire point since you can just use passkeys or the npub directly depending on need


https://i.nostr.build/yqvJm.jpg  nostr:note1qqpc5wmmhmyj2myjkx0s0r6ma24g48ftpnw5atumygh5zdne74vsuqj652


Specialized SEs != TPMs in computers, SEs in phones, etc


And also they don’t use obscure shit like BIP304 signatures so they can be put onto a secure element


Passkeys are utter trash in implementation but the underlying concept is good

npub login is flawed because it can’t support multi identity and is non-private by design


“almost able to be made out” reduces your potential space to a few thousand


2^36
68 billion


I said it’s centralized


And nostr.build had this way before anyone else, just saying


when you see this, it means one thing:
Centralized


on Nostr, you will own nothing, and you will be happy


logout


lnbits devs are incompetent
just saying nostr:note1ztz8jevh7vv2zl2sj4qtjx83stfn0smlx20kdlh86827guu4qa8s0wdc37


ISO/IEC 7816


convinced that 90% of people working on ecash have no idea what they are doing


grants do not care about quality they care about what they can sell to their donators so they keep donating more


zfs + l2arc


I am posting again just to remind you that no Google can’t expire your SSL certs nostr:note1vyzz0kn057khd4ma8gwkkv2t2ew9v2m9wmqggdl749epesv0vrjqjyua28


someone forgot to renew the certs.
that’s all.


Google cannot revoke certs


so long and thanks for all the fish

I’m going to be taking a step back from here

nostr.land will be maintained for the forseeable future, for issues about it please DM nostr:npub1gt9gms5hr3l6548zxgn7xvcvcmzxyzgdsrrelrdwxwmj0exz7jaqdjlxjt


I’m not the one that is getting more of the profits than they do work for Nostr Plebs, and then complaining about things.

You can get the relays list done once you stop doing everything to hold the project assets like domains yourself while actively distrusting me that I will rug you from the start.


beep boop! this note has been mined in around 027933s with 41 bits. nonce: 0001234883235380


If you need a seamless way to backup your profile and follows, you can use https://hist.nostr.land/
Simply add this relay wss://hist.nostr.land to your relay list and you’re set. Whenever your profile list or follows change, they are automatically backed up. When you need to restore, go to the website and restore to the version you like. It’s that easy. No need to do periodic backups


You might be a Nostr Elite if...
1) You have over 1000 followers, but only post every couple of days or weeks.
2) You are famous from "someplace else", so you don't feel like you need to prove anything to anyone and expect everyone to recognize you from there.
3) You hardly follow anyone else, who isn't an elite, or your follow list is stale and you don't care.
4) You rarely repost anyone else's stuff or hang out in their threads.
5) You rarely respond to mentions or tags, unless they're from another elite, and you feel put-upon by them.
6) You don't actively search for new npubs to follow or interact with.
7) You mostly repost things you've posted elsewhere.
8) You post things and then only respond for a short time.
9) When someone reposts you, you don't feel curious to find out more about them.
10) You think there is no Nostr Elite.


GN🐶🐾🫂💤😂🤣
https://i.nostr.build/nWnvE.jpg


Me waiting! 🐶🐾🤣😭 https://i.nostr.build/9zVoQ.jpg  nostr:note1uvsuwhk6mxgcjze5vav5df668hr9y4a4hrnrrt823fyc73xx3nkq67z3k2


If the only solution for Bitcoiners to have private payments is custodians (be it e-cash, Fedimints, etc. as is all the rage) then Bitcoin will simply be dead for me. Feels like the ultimate cop-out.

Custody is the line in the sand that cannot be crossed. Custody not only opens up immense risk for loss of funds, it also makes these tools far less resilient to adversarial environments.

Can "they" stop every Bitcoiner from keeping 12 words safe? No.

Can "they" stop a few popular mints from operating? Absolutely.


Do nostr users even want nostr to grow?

Do folks view nostr as the freedom tech for all, or a way to be in a bubble away from those you dislike?

It seems that there’s some pessimistic self sabotage that will surely make those who join leave after one day.

Ego can kill.


Hey look, it’s nostr:npub1e0z776cpe0gllgktjk54fuzv8pdfxmq6smsmh8xd7t8s7n474n9smk0txy https://image.nostr.build/219927b7ea3172f539c295be90660b9613d1edcda6f94d864f9c25b7a5b67546.jpg


As of this moment I resign from my (nonexistent) position as network engineer and will take up a job on a farm shoveling pig shit, but it will be 100x better because I will not have to be in the same industry as people that think NAT is a security measure


If I ever write a note with only a GM, I've been compromised.


what if you could easily:
- create your own algorithm
- generate mute lists from any criteria
- use the most accurate content classification/recommendation APIs
- create your own nostr stats
- integrate nostrscripts
- analyze custom datasets

would be cool wouldn’t it :) nostr:note1krc283u2p978rasa8v20ycv9wanehk0tgtt77235zjshq0v42n7qafu9l8


zaps on nostr by month
https://image.nostr.build/eb771a991e0564cb6b9965f7e6dced831b2874edd87380295484dab593ff2514.png


not really


billing


different MAC addresses?


not zaps.
just not always giving them engagement


that also happens


it does


probably for some things, but some topics need to be discussed I guess

but that’s rare


everyone makes mistakes sometimes


social media pushing influencers that always push optimistic content is 90% of the problem

people wanting to special is 5%

the other 5% is the other cases


1. Start donating directly. Grants won’t work.

OpenSats and the like are great for people that are lazy and don’t want to donate directly, but such centralized entities become kingmakers for the protocol.
For the $30/month you get, consider paying for quality relays, subscribing to your client’s subscription service, etc. And I also blame devs for not implementing an easy way to donate.

2. Pass on value.

If you make a client with NDK, donate to NDK. If you use designs from someone, consider passing some % of your donations.

3. Stop doing shit for free.

You don’t have to do designs for nothing. Or give support with libraries.

At the current stage, people don’t have that much revenue, but you could ask for a % of zaps in exchange for support/designs for example. nostr:note19jaf989dy6ejkw08r9lmwmgtdcpyhe5kjs6afe7xkrj2pwykfx3sg2280s


primarily bitcoiner delusion

but for any given topic you can find someone that matches what I said


Thinking Bitcoin can handle even only the “most important of most important transactions” on L1 is dumb at the current design.


Do you really think a privacy upgrade is coming to bitcoin-core when most (or all?🤔) core devs use their real names?
We need a culture shift


The bitcoin block size was increased
It will happen again


Queries need to be more advanced


what. just what.
😭


Will you also show signed notes with an invalid signature?


LNbits people rugged all mints on their “demo server” while they could have made them withdraw only

Their demo server also got drained


don’t depend on big entities to fund FOSS devs.
fund them yourself directly. nostr:note1awa6kyufetxrvsl5j0s583hzxrcuah9demk8y5yyz6k7lhun9knq60rgtr


Nostr.land does not store IPs. If you start abusing it it’ll be logged based off of patterns.


I hope you enjoy your delusions… whatever, not worth trying to convince people when it won’t work. nostr:note1hwa0hcf3me3wxwdda9gx4959wfqk3n88evahu9us48s9yfjl96ss0dfwne


check DMs for more details


there will be some features you will love for the relay you are running right now


those are just troll accounts, yeah


I think it means it has failed validation in some way

you should not show NIP-05s at all if they fail validation unless it’s the user’s own profile to inform them


Go is awesome in general

cross-compilation isn’t hell
error handling is a bit verbose but it helps you avoid bugs by making you think about every potential failure case
performance is good
goroutines and channels are just awesome

the runtime’s a bit large for my taste but whatever


the nip05 is failing validation


I'm talking about a KV store that is distributed. FoundationDB uses the SQLite btree code, or their own own btree based storage engine on each node for local storage. here's a talk about it while it was still in development: https://www.youtube.com/watch?v=5iqKu1pVDvE


I honestly don't see the benefit of that anymore with the designs of newer KV DBs.


“but does it have separate key and value logs?” what do you mean by this?


it was independent & paid until Apple acquired it and open sourced it, it also has another big user that’s unrelated (Snowflake)


https://foundationdb.org is what I want to use actually.

you can add more nodes and it would add that to your available capacity, you don’t need to replicate your DB to have multiple frontends and you can outgrow what you can fit in one server


I have some very specific requirements, including, but not limited to:
- control over the entirety of the relay “frontend”: this is primarily to process filters, for example, directing them to different DBs or modifying
- support for multiple sub-partitions of the same DB
- attaching custom data to events
- control of query execution for limits
- custom handling of event replacement and deletions
- support for swappable KV backend
- support for multiple instances running on different hosts on the same KV DB


I’m working on a relay DB and I’m working on something to support this


Who?


Translations are going to be a key part of Nostr.


don’t bother trying to do anything on nostr that goes against what the top 10 most likely paid off influencers want because most people are sheep


than the average person


Noswhere will archive all your notes, as long as we can use it to our benefit somehow.


sorry, forgot the “average person” at the end.
also my initial estimate was 95% but that would piss off that 95% propaganda loving bitcoiners


About half of people on Nostr calling themselves bitcoiners have only slightly better critical thinking skills


dataset of what? historical follow lists?


Looks like this claim might be questionable. A few attempts at confirming might not be lining up. Should keep an eye out for this. https://i.nostr.build/2RQ35.png https://i.nostr.build/Le232.png  nostr:note1pa65jnhw80yc57cpx0e9n6rac8559wmevduuem4p8k93mfvfyymsk7rs5d


Hi All!
By popular demand, we are planning to offer a completely free account! It sounds funny, but we are serious.

Full KYC Account (*free)
- 1GB of storage
- CDN network
- Free Media Gallery view

*In exchange for all of your verified KYC  info (name, email, address, gov issued ID), permission to sell or do as we wish with your data, media and viewing patterns.


What people portray operating a blossom server like: you are helping decentralization
What it actually is: dealing with garbage uploaded 24/7


1 machine for NAS, 1 for hosting your shit, 1 for LN node if you want one.. that’s all


No not at all


all you need is 2-3 servers and like 2 switches, one 100G one 1G… more is excessive
100G and 1G are not going away for a while


I set the TTLs to 1h. DNS based failover is a bad idea and I’ll drop the healthchecks


had to deal with 3 invoices on the same day


I am somehow very good at bikeshedding my own projects and this is bad

this time it’s about whether I should use Rust in my control plane or Go, except that I know shit about Rust


I do not believe Nostream supports cancelling queries so you could rapidly open/close subs. The event tags index is not implemented properly leading to all events with a certain tag being loaded for a JOIN. If this exceeds about 32-64MB for a single query it will start spilling over to disk and amplify the attack by wasting your resources on context switches, leading to disk IO being wasted and more CPU cycles to load/save from/to disk.

Bonus points for using IPv6 to get around ratelimits.


Hmm… don’t mind if I do


🐶🐾😂😂😂 https://i.nostr.build/wGmr2.jpg


This can and will happen with Bitcoin


thanks, I just got 2 emails and a personal DM from 3 cloud providers saying I have an invoice, and it has not been 24 hours since they were issued


Challenge: Create a mapping for each Nostr event to a unique string so that when events are divided into fixed size buckets, ordered by this string, ensure that any query touches as few buckets as possible.


Some relays are stupid and ask for NIP-42 because “the filter will match DMs” even though it is just a catch all with no kinds.


Every A in Australia is pronounced differently.
	-atzyrus, May 2015


So who the hell would know if 80% of Whirlpool liquidity was controlled by one entity. Sure it might cost but once it’s in they can remix those forever and imagine the returns they could get…


If the coordinator could detect you mixing 2 UTXOs at once, it means the coordinator has deanonymized you


The one input per mix restriction was enforced client side.

That can be correlated to say that 5 UTXOs lack common ownership with each other.


One flaw with Whirlpool was you could only mix 1 output at once. Which could be used for correlation.

An RNG that newer outputs five 9’s in a row, or always passes statistical tests, is also broken even though it may “seem” random


Client funding needs to be more common


Apologies for the crosspost.

If you are passionate about our project and planning to attend any conferences this year, please reach out to the organizers and ask them if they have invited anyone from our project to present on it. This is the only way we may be considered to appear at many of these events.

For reference, my plans so far for the year are to attend the Oslo Freedom Forum, to speak & operate a donated maker booth at the Nashville conference, and will also be at BTC Prague as an attendee. https://image.nostr.build/4874129af926f3f58da5b224aa67e2c6424cf05f407218feef314479593fa4b9.jpg


1. Reevaluate your life choices


MUST


nostr stats are too limited


next time add wss://hist.nostr.land


You should get a DM reminder when it is close to expiring


and it’s a subscription


just use nostr.land. they are the same now


Had a one-off issue with Noswhere translate leading to downtime. Fixed.


negentropy + cursors is the way…


Sorry, I’ll pass


You have no choice really.


Most importantly, an attacker can request re-Initialization of the channel while only having the channel state, allowing them to pretend to be the public key way after the channel gets cut.

I’ll also be introducing a control command to stop using a channel.


I’ll be doing some revisions to the spec today for fixing some flaws.


Channels cannot be correlated to users unless:
- you leak via IP
- you leak via activity times
Both of which apply to all schemes.

This is only for obscuring who a user has communicated with at all: if an app establishes channels only when DMing, you only leak A has initiated a channel with B, but adding noise reduces this risk.


The only reference that I could find after looking through the spec a few times is a tag, and I couldn’t find any other documentation on this.

There also seems to be an assumption that there is strict message ordering.


The real pubkeys.

I believe this is strongly metadata leak resistant as channels can be established before they are needed, or when not needed to obscure other details like who was ever communicated with.

This can be, and the specification permits future re-initializations to be performed in the same channel.


Post-compromise security refers to recovery from a total leakage of internal state.

The DH ratchet uses continuous key exchanges to update itself in a non deterministic way.

In your case, this is not actually a DH ratchet, but a symmetric ratchet without any data mixed in (the root) being used to feed the sender and receiver ratchets. This makes the system state determinstic and gets rid of post-compromise guarantees, and has equivalent security guarantees as using a single ratchet for send and one for receive.

I also do not see how the “active participant changing” would be defined in contexts where there’s concurrent events being sent.


No. You only need one prekey.
The initiating party uses an ephemeral key.

The shared secret is used to derive 2 private keys, one for initiator to target, and one for target to initiator.

When sending a message you pick the private key depending on your role in the channel, encrypt the message to the key itself, and put it in an event signed by the key. To receive messages you look for events by the other side.

This also comes with plausible deniability.

Channels can be rotated and this provides stronger security guarantees than gift wraps (sender and recipient anonymity).


Establish a new channel. Done.

fyi, your protocol lacks post-compromise security as the ratchet state is advanced deterministically. the post-compromise security comes from extra data being mixed into the state when advancing the ratchet that may not be observed by an attacker post-compromise.


The protocol provides no benefit compared to ephemeral key exchanges.

One part of DR is post-compromise security: if the current state of the ratchet is leaked, the mixing of new secret information via say key exchanges will render it unusable. The NIP lacks this functionality.

The rotation of encryption keys every message does not provide any benefit except the fact you can authorize new devices without giving them access to previous communications, without the post-compromise security bit.

The message key being leaked without the ratchet state being leaked is a very unlikely, if not impossible, scenario.


Broadcast a zap receipt or acknowledge that it did happen.
I would not broadcast it after withdrawing to encourage people to use the recipient’s mints.


I'm selling the seconds of a day, where the first second after midnight is called "epic", first second of every hour is a "rare" second and the first one of every minute is an "uncommon" second. Then there are the 23 "smooth" seconds, from 01:01:01 up to 23:23:23. And finally there are also the 11:11:11 and 22:22:22 seconds, which are the only 2 "regarded" seconds. I'm about to release a second scanner app, to see which seconds have special rarities. Expect an airdrop soon, but you can start bidding now!


I would not consider this as a zap and would not broadcast an event. Then try to withdraw all of it automatically nostr:note1nz84y0yrdkss3ktqqc05ddztws98u9kg4pcmehljnj4seq0p4jxqq72zch


Fraud proofs are hard because you can’t easily prove that you aren’t hiding shit from the mint. Broadcast it on a relay the mint can’t read from (IP blacklist for example), and you just framed them for something they couldn’t respond to.


You could send bogus events as well


I just said use a dedicated tor circuit to query for events on each channel.

You can’t correlate two different circuits via IP because they have different exit nodes.


the worst a relay can do is drop messages.

the key generated for channels is completely unrelated to the init message, and it can be queried from a dedicated connection on say a different tor circuit.


prompt injection is still a big deal sadly… there’s actually dedicated models for summarization out there.

you could fine tune existing summarization models to take additional context input like reply chains via tokens


LLM translation is still far off but would be great… the quality of translations still are suboptimal with the big clouds, so on device, especially for some languages, will need time to mature

also, I feel like finetuned models designed for content curation and summarization will be the way. the more specific the tool the more accurate it is for a task.


articles


I looked into it more and I think that the simplified DR protocol doesn’t provide the full security guarantees as the standard DR protocol, and it’s basically on par with my proposal.


we could probably even integrate this natively into the channel spec.


s/forward secrecy is possible/forward secrecy is the default/


not long. wrote it up in an hour or two.

compared to gift wraps, it provides DoS resistance as you can only ask for events in channels you care about, relays can filter initialization events using pubkeys, forward secrecy is possible, and plausible deniability is also possible since any party can forge a conversation making any evidence as good as “trust me bro”


also, plausible deniability.
someone can’t prove that you said you’re running an unregistered money transmitting business in a DM


Introducing a new general purpose event encryption proposal that completely hides the sender and recipient including from relays in a way that is DoS resistant, and has plausible deniability, and forward secrecy.

https://gist.github.com/Semisol/bc0b36915d9898e03f150e1a8cb25c00


I should add NIP-42 support to my indexer

Also, I don’t have your relay indexed, since it has no benefit (I already direct connect to relays) while adding additional load


congratulations you just encouraged everyone to add you to their private mute list


https://tillitis.se

But signers basically have no benefit if not hardware to 95% of users. On browsers you can use an extension. For native desktop apps you probably entered the management credentials for your signer that allows you to download your nsec. On mobile maybe. And for the average person this is not worth it.


https://youtu.be/b2F-DItXtZs

Take this video, replace the 2nd bear bullshitting about MongoDB with 50% of Nostr developers, and replace MongoDB with insert new crap NIP here


🤔 nostr:note1auxuu075atc5gly0rn5x0m5fy89utw67yuuu6epq50phv6wfv22smhuh9j


WoT reports are dumb
Who you follow != Who you have the same moderation views with


408 Request Timeout

could not find point in 1 minute


From LNbits to my own code. I have an invoice server connected to my CLN node, and I’m using a rune to restrict access to receiving payments only.


🚨withdraw your sats from ln.tips bot NOW🚨

you can use @BitTipBot as custodial alternative in telegram if you want to stay there


I put a switch in the cable
Wait
The cable controls the data

😭


hope it was worth it nostr:note1c4r3kz3fyfk5sx9tgrq8tz6udq2xw0el2lpekwe4cvd00jtf062qs5latk


Nostr.land payments and my zaps will be down temporarily.


more accurately “if they don’t care”


Nostr.land has native Tor.


IPv6… :)


“so you see, bird allows routers to synchronize routing tables using BGP, and that’s what makes the internet work, and the internet can be used for transmitting money via LN or bitcoin” nostr:note1s4r8cmvdny833v98xla03t4r0ksxgzj0lpf8c069a2px7mk4yvhq5k2ft5


The authors of bird should be thrown in jail for being a money transmitter.


“Free” is not the coreect term


Note: vm.overcommit_memory=1 will fix 50% of your server crashing issues


Bitcoin is under actual attack and influencers are still crying and distracting you with ordinals and rare sats. It gets so fucking tiring


Fuck you too 😼


lnurlauth is passkeys but worse change my mind nostr:note1ad4ghz3ls29hppt6ntgn5uv0n790dhcplzffv4d64thc5n9d7kyq2p6475


Wow. https://image.nostr.build/0ab6c1403eb8b4e4020bd8be7eb9c88c4104b33b56e68d10d67c213eb9c04df7.jpg


Logs


Re: NIP-17. TLDR: if I am not wrong, it does not make Nostr DMs safer 🐶🐾🫡
(I am glad to be proven wrong) nostr:note1wx323qyqsyhc0gwept8e6cj7c25tmgjmle3vre4jvdtk8j6q8ndqk5h0y8


gift wraps do not reduce relay-related risk while increasing implementation complexity.


don't talk about freedom, if you don't mean it


only use relays with NIP-42 enforcement for DMs, simple

the relay can already know your pubkey by linking it through your other REQs and your IP

you could also establish a key you use for DMs to a specific person and another to receive, and rotate this every so often

gift wraps are a client DoS vector and do nothing to actually obscure info from relays


they are not
NIP-42 is


Passwordless != usernameless


Primal is the Coinbase of nostr


A top Nostr client is paying $1000/month to twitter/X to be a verified company and selling itself as Social Bitcoin Wallet..! What is their business model? https://image.nostr.build/a561aefa843ad5fcf75e1828c0814ab21f467f7b9699cb3f10d1688cd625c54e.jpg


Essa é a coisa mais incrível do Damus… gosto muito da ideia de vencer a barreira da língua! nostr:note1a7v393kazn8yrfnv2wytwnts6aw9a69yjc4qgat28cdc3xjq50wsqjux4k


If you are looking for affordable translations for your client with competitive rates while not sacrifing quality whenever possible and wider language support, DM me.

Still in closed beta


We got thai translations now 🤙 hope this helps read #siamstr content, a huge part of nostr now unlocked in Damus 💜 nostr:note12xw5mq4ma6my7fskxfr4hnuhegtya9cjcdghfmwd9c55texzxhfsrk792x


Not having any form of ground fault protection + shit like this = ☠

Otherwise it would immediately trip and they would realize they are doing something incredibly stupid


I would not trust my communications to be 100% secure unless it was software I wrote or audited using already established crypto libraries only on devices that are specifically isolated for this purpose


Multi-cloud is the way you cannot convince me otherwise


They never made it easy to run it.


Does it in any way relate to a specific Bitcoin event?


Depends

could provide some guidance but I’m too busy with other projectd right now to fully commit to it


that part is still somewhat WIP, but that’s what I’m going to get sorted out soon.


Did you know Damus Purple includes a universal translator? 🖖

Today it gets even better. We heard you #siamstr: Purple now includes Thai translations 🎉

See how auto-translations can significantly improve your #nostr experience. Sign up with lightning at https://damus.io/purple/checkout or use the side menu to join purple with apple pay. Enjoy! https://image.nostr.build/c3da21e6d4d90dc89c35f7b30b214189adb86aaf573b240cee359cab4ab8a3f6.jpg


Just becauss it’s shitcoins doesn’t mean it won’t affect you. nostr:note1y3dv4k04qycx4n4fq8rttws7nv4p0e49p2hhllfuhmmw82r7nqxsx5yn7w


Have fun breaking OpenTimestamps

And payment codes


If a guy reselling hobbyist electronic components and 3d printed parts out of his basement makes you nervous about your multi-million dollar company's profit model, there likely are issues with the products you're offering, and/or the amount of value you're delivering to your customers.

(And no, this is not a reference to just one individual or company.)


* KYC on-ramps
* No protocol level privacy improvements in bitcoin-core
* Wasabi collaborating with Chain Analysis
* TornadoCash arrest
* Roman Sterlingov arrest
* ETF
* Monero delistings
* KYC all miners
* Samourai arrest

Are you sure we are winning?


And it’s one interpretation of sats


impossible


noswhere will retain your notes as long as they are useful to me even if they are ephemeral or you set an expiration
even if you don’t send anything to the noswhere relay

anyone can do this


yeah, precedent is being set and it’s awful

what even qualifies as a money transmitting business? does my LN node count? (certainly more than a blinded CJ coordinator) does an ecash mint count? what if I make software that allowed mixing like Tornado Cash did? (founders got arrested)


The charges though… they were a coordinator, they did not custody or control funds in any way, how is that a money transmission business?

willingly assisting money laundering makes sense, but some cases are questionable, and I don’t trust their evidence

scamourai is gone, good, but the why is 🤮 nostr:note1cddcm56spgsyfpuajkf647vyrxhe3naw9m6tmhxkzks62rqn0hfq4phk5y


The environment is evolving
Bitcoin must too


the exploit is not related to taproot


usually
- don’t be controversial
- be on “good terms” with the client developer
- do self-censor yourself


Yeah. Most people view v4v as get first pay later.

Which is a horrible model.


Get the content first, and pay whatever you think it is worth afterwards (usually zero because why should I spend my money on this content when it’s free???)


it was not a mining pool but it worked somewhat similarly: you get paid in nuts for submitting a share

those nuts could be anything


There seems to be this myth on here, that programmers, system admins, designers, and other techies are incapable of human communication and all ideas are hatched out by one man sitting silently alone in his mother's basement. Whenever others see us discussing or debating anything, they freak out and try to shut the conversation down and tell us to GO CODE SOMETHING.

But techies literally invented the Internet, so that they could talk about techy stuff over long distances.
That is what this technology is for.

Grow the fuck up and hit the mute button. Or I will.

nostr:nevent1qqs2tfu30qdj7kfkva8nr2famdytjntkfuxwwrv6g63se7hu4p7lqhqprpmhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef0q9thwumn8ghj7enfd36x2u3wdehhxarj9emkjmn99ah8qatzx9kngmnexe5x5ut6v4cxudrj0p4kuat38y6xxvn8wpch5u3j896kv6mtwumhgarr0pukz6ehwc6rxm3kwem8xct2vvex5mqpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtchmkc3h


at least it’s not nostrich.house LLMs


because it’s only an opinion when nostr:npub1jk9h2jsa8hjmtm9qlcca942473gnyhuynz5rmgve0dlu6hpeazxqc3lqz7 doesn’t like it


is there a clear definition of spam that meets all of the following criteria:
- coinjoins are fine (so no “inefficient transactions”)
- applications for timestamping (so no “money transmission only”)
- arbitrary data is not fine while not prohibiting the previous


I think I found the perfect quote to describe you rn

“once an idiot, always an idiot”


have you tried putting aside the opensats pr aside and considering how likely or unlikely of a possibility my claims are

they are higher than you think

otherwise why would their “transparency” not be actual transparency

some claims I have sources from/derived from interactions but I’m not going to say because I do not want you or others to harass them


can’t see your proof of work :)

have fun trying to get engagement while not contributing any value to nostr

I certainly did, including, but not limited to:
- reviewing NIPs
- helping nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s save $8k/yr
- nostr.land
- noswhere search

and a bunch more is getting built which nostr:npub1t3ggcd843pnwcu6p4tcsesd02t5jx2aelpvusypu5hk0925nhauqjjl5g4, nostr:npub1wtuh24gpuxjyvnmjwlvxzg8k0elhasagfmmgz0x8vp4ltcy8ples54e7js and a few others know

you are instead spending your time whining about things that don’t affect you


slippery slope risk exists even though I love purging ordinals from my mempool

bare multisig should be axed though from relay policy since adoption is few except data storage, and there’s way more cost efficient alternatives


zero PoW my ass, just because most of my work is tools that you won’t interface with directly doesn’t mean it’s there, or that I’m not building anything right now


ok person that acts like they know everything sometimes and has barely anything of value to contribute, including good opinions and ideas


it’s the model that works, and doesn’t involve kingmakers like opensats, or any board bias at all even though I tried to avoid that with my proposal

clients compete for attention: what users really want gets funded

ideas are sent from the lowest level like relay implementations and libraries to user facing parts like clients


- library dev has revolutionary idea and creates a funding campaign
- client dev sees a use for this, creates another funding campaign sending parts of the money to the library dev
- users fund clients
- clients fund libraries
- everything gets built

- library dev has a stupid idea, creates funding campaign
- client devs don’t see a use for this except one (a bad use), creates funding
- users don’t see value proposition
- fail


Both now that I think about it.


Okay what about this.

Users decide what wallets they want to fund.

Wallet devs can fund libraries that make life easier for them, and for their users indirectly.

Did we reinvent zap splits? Yes! Do people feel better about OpenSats than to do this? Yes!

For people that want to outsource this shit, I’m thinking of something. People can set up their own funds, pay with onchain (you’ll see why, but LN is also possible), anyone can donate, public record of amounts and similar exist, and funds get sent back with timelock if not spent.


For the last one: no they aren’t. including some people would be reasonable, but the test for “power user” is also vague

But also if you want users to assess projects… did you hear of Kickstarter


It isn’t

The only mention of the nostr committee they mentioned were full of either client devs with their own personal interests (devs should decide grants they have no stake in) or people with investments. A good chunk of the board isn’t involved with Nostr that much from what I see


What conflicts of interest again?
They know how shit works. If client developers decide grants for libraries for example, it would be a win win: client devs are more experienced in that subject, they don’t make a lib themselves, and multiple devs means minimized conflicts of interest

Instead we have people building closed sourced products with investments in competitors and that don’t remotely touch Nostr dev work.


I have not. I think there was a nostr committee or something that assisted with picking candidates for that, but I can’t find the list anymore.


All of them aren’t Nostr devs
Some aren’t devs at all
Some have conflicts of interesg
so on

Decentralize the grants


A nonprofit for funding Nostr development should be ran by developers that know the goal and have minimized conflicts of interests + diverse viewpoints, not influencers with investments.


There’s a lot of things that on the surface look fine but when you dig deeper aren’t.


There’s something called respecting people’s privacy.

If you take the time to think this out you’ll realize it’s more plausible than not. Their “transparency” is a joke. I can’t find a breakdown of their operations fund, their “meeting minutes” state the obvious, conflicts of interest are not disclosed. Follow the money and you’ll realize it’s fishy.


C*


CLN has a weird bug though that I’m suspecting might be a memory safety error… :/


CLN wins for being extensible


but it’s worse when it’s unoptimized react


web is shit


Fishcake hates it


PHP is in fact dogshit


C# is dogshit


The iOS link preview is more usable than zap.stream on mobile for watching Nostr streams.


No, local model
We all know how much more shit smaller LLMs are


Uses dumb local thing


Averages do not mean anything in this context


They’re trying to cancel the guy that created nix/#nixos. I’ve been in the nix community for about 10 years and I’ve never heard of any of these signatories. Why are we still doing this childish cancel culture nonsense in 2024? Don’t like the leadership? Fork off.

https://save-nix-together.org


I think revocation is needed, and more thinking on the spec


Yes because it’s a search relay not a general purpose one. Tags soon


relay.noswhere.com exists


Spell checker


bro just saved me 8k/year and now i feel dumb nostr:note1rne065entn5ztjrxmejn9xk3s7daqzjd6dmtfy5qq6tqhfh6j5xq2r0red


Nope.
The entire note JSON of the renoted note was translated even when it was the intended language


WS frame size limits


problem is event size limits


never applied, never received any

the only 2 I were paid was a 0.05 btc by Will when jack donated in the esrly days, and 0.05 btc for hist.nostr.land as a bounty
both have no conditions


I have not applied tor a grant.
I do not intend on applying.


personally my problem is the current implementation, read my other posts


For the board, multiple of them have ties to Ten31 which funds Primal. I can’t find a disclosure for that on the site.

They also don’t disclose much in their transparency page.


nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s, will find in a bit


ok we actually need a multiplexing layer for relays

whether it be virtual partitions people control, aggregators that read from multiple relays + filter spam + deduplicate, or similar use cases it’s needed


sure.

but there’s better ways of doing it.

“commodity relays” can still offer people partitions they control, because let’s be honest, no one wants to know how to deploy a server just for this

we also need standardized interfaces for moderating relays… nostrscript?


because there will exist relays to serve anyone, some to serve a client’s users, some paid, so on

people will not want to spin up a relay for a small community, and would rather use infra they pay for

one reason reddit wins imo because it is way simpler to spin up a community, you do not need hosting expertise, you do not need to pay for expensive relay hosting (there’s a reason web hosts share one mysql deployment across multiple tenants)


I honestly get the premise but the current landscape makes things too hard, moderation tools are garbage, relays are still not optimized to be ran as easily with sane defaults, URL changes are impossible, it’s not easy

we also need a solution to the too many connections problem, outbox and community relays and all that will pile up, and having 100 connections send 10kb (a basic request/response + handshake) is going to end up with 1MB data usage, on top if

I would not be against this idea if we have it more thought out, and consider other options also such as subdividing an existing relay into smaller virtual partitions, but trying to do it with the current model, and some people trying to do it for the sake of doing it, will not end well


why can we not replace mailing list relays with a moderated community?

also we need to address multiple problems like local caches, what if a relay removes content for moderation


relays will not be communities

communities will instead have a need for relays so they can preserve their content for future access, not “isolate” their content

many communities will run without a dedicated relay and many relays will exist serving multiple communities, or none


You need: a domain
You get: infinite LN addresses


There won’t be mega relays.
There won’t be micro/community relays.

Relays will come and go to meet demand. Data storage is a commodity.


Groups should be encrypted either way except if they are public.


The Discord one was not a data leak

It was people complaining about how their groups got scraped when they had the join link public.

Same thing can happen to Nostr


nope, what will end up happening is clients run relays for their users to provide them an easy onboarding platform, hobbyists will run their own, communities if big enough will run their own for data availability guarantees, the censored will run their own, so on

relays will exist to meet demands


Decentralization isn’t easy to quantify: in reality the model of per community relays, and having medium sized relays are more similar than people think

Relays will exist. There will be less relays than communities. And there will still be lots of relays.

Nostr works because of data portability, not because of relay count


Most people will resort to hosting services, or even if they host their own probably do it on a cloud provider, so the privacy part of “trusting a relay” will be the same.


Public relays can also enforce AUTH


There is no verified LN address


Highly dependant on the situation

I won’t blindly do option 2 :)


they already spoke out about the pressure thing


it’s a comparison

telling people that are potentially corrupt to fix their own corruption is never happening


Partially true, partially not.


9 don’t have to
enough to rig the results is enough

and I haven’t seen anything about board members not getting paid. the operations fund is not disclosed, they do have paid employees AFAIK, and only 1-2 people said they don’t get paid in a somewhat ambiguous way (and that they take nothing from donations, which is… expected?)


1. They have shadow banned multiple people and refused to back down until they got enough pressure
2. They have been lying scumbags at times
3. VC funded company that has a focus on promoting influencers (trending came way before zaps and similar afaik) nostr:note1x2tpjhrqczcqym3vpy3kgcj85y87gdcw50w43nv9qhn9jmft723qn0eckn