On mobile, too.


If you allow browser notifications you will continue to get notifications even after you close the tab.

https://image.nostr.build/f280ee24ee8df8039d5af033aa20c67cda6aca2e2bdb883bfd3462955cf80ea9.png


Alex Gleason 🐍🚬

In 2019 I forked Mastodon. In 2020 I built communities online. In 2021 I helped Donald Trump create Truth Social. In 2023 I built a bridge between Mastodon and Nostr. In 2024 I am building new Nostr infrastructure to spread freedom on the internet and beyond.

I'm vegan btw.


The people behind Deno are working hard. They want to win badly.


Web Push Notifications have been implemented on #Ditto! 👍


These are the same people banning me from groups on the Fediverse. I tell you the worms are in their brains because of the election.


That's what I'm thinking, lmao.


But do they all call GET /Catherine/api when the page loads? https://github.com/search?q=%2FCatherine%2Fapi&type=code


They have one. They just aren't utilizing him.


Truth Social's new streaming website looks exactly like this Slovenian telecom provider's service. Huh! Interesting.

https://image.nostr.build/81cb2d1729708df5a44f28ee75840bcf07ef4140b90c18a2048dcbe545fc0f45.png
https://image.nostr.build/ca7eccbc960c5a4a01e60cdb87d8231d918f9912a9cd564e1890e4eea2c90bec.png


There was a study where people took turn ratings songs on a fake music review website, 1-5 stars. Each person could see the reviews from the people before them. Justin Bieber is widely disliked, but the study found that if the first participant rated the music highly, like 5 stars, it would continue to be rated more highly be other participants. If they rated him low, he would stay low.

The moral of the story is that an initial group of people can set the stage and perception of a thing, in the beginning. Right now it's Bitcoin. But Bitcoin isn't even that bad! Honestly it's one of the best online communities out there.

We need a few more nice communities like Bitcoin before we attract a mainstream audience.


Did you just stylize Nostr! with an exclamation point?

nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyppm4tcv9rnvlvv4k9lwpqlpn6e6ft7l432dnd4679czwrk3j035ctjv2wn get on this ^


GM 🥱


I like terse branch names, so while working on Web Push Notifications I named the branch "push". This creates a weird flow in git where you're tying stuff like "git pull origin push" and git push origin push"

https://image.nostr.build/ba979281d3cf38bdba236298aacf2f1dd6ab2af19c68669108b09528005d8769.png


This is a job for nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyqrx8x3cdjwpq9ppwc3ve085pyyvfudqcvlz87xk668540m9t78hz2yu954


I opened: https://gitlab.com/soapbox-pub/ditto/-/issues/246


In what browser?


Dude Copilot is a game changer. I can't believe it. It's like it reads my mind and knows exactly what I want to type. I can't emphasize enough how big of a game changer it is. I can do probably 20% more per day with it. So no, I think it's great. I'm assuming whoever wrote this article was testing it against a trash codebase. I don't like Microsoft Corporation controlling my text editor, and I'm against the fact it's proprietary software. But it's one of those things where if you're not using it, you're getting left behind. So no, couldn't disagree more.


Just received this crazy political meme pamphlet to my mailbox. 😂

https://image.nostr.build/779c911a21accda92352c1167d4d1368d35f6e02d3ac6d86b097dd20ff88ccd9.jpg


Easier said than done 😂


Thank you for your support! 😁 ✊


A big challenge of client performance is that you cannot optimize filters. There are a few objective things you can do, but without knowing the relay's query planner you don't know if it's better to make one request or two requests, for example. How you structure the filter could result in completely different performance on different relays. None are perfectly optimized for all shapes of filters. Extending filters to do more things might exacerbate this issue rather than help it. Regardless, this is an inherent limitation with doing JIT querying of relays. You are basically deciding that you prefer the freedom and purity of the protocol over UX. And that's fine.


Now Ditto ships with a megabyte of stock photos in its source code, lol. https://gitlab.com/soapbox-pub/ditto/-/tree/main/src/assets/captcha/bg


Still recovering from ReplyGuy one month later, #Ditto has a puzzle captcha now.

We coded this captcha from scratch using the Canvas API, mainly based on work by nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyqzhg5md8m6dvha0jk6z8ymppwz8t530fs55vjw5d3gdt5m0w5n8cx8mcz8 and implemented in Soapbox by nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyr8fwdnuwhtaj8aehsaudl6mkw7m2tqcjsdlechndpskmjls4h7j78f4j4t 😃

https://image.nostr.build/7d6839d6e038479f7accb097932068784da7fe16014ef7b6779c6ad6a8841b97.jpg


This tool is pointless. It's a run of the mill code formatter with no configuration.


"don't use eslint for formatting, linters are for linting formatters are for formatting, use prettier"

prettier: "Prettier is not a kitchen-sink code formatter" "Option requests aren’t accepted anymore" "Please note that as option requests are out of scope for Prettier, they will be closed without discussion."

https://prettier.io/docs/en/option-philosophy


That type annotations thing is needed badly. I was just thinking about it.


How dare you put a .js file in a TypeScript project


Tired of being stuck in 2017 with Axios and xhr. I want new things to be based on Fetch API. A lot of code depends on it so I want to change it now. Couldn't get past this in the "best" existing library: https://github.com/sindresorhus/ky/pull/606 Wasn't worth forking it when I need only a fraction of the functionality anyway. So I wrote this instead: https://gitlab.com/soapbox-pub/soapbox/-/blob/main/src/api/MastodonClient.ts?ref_type=heads Honestly not bad, but it took way longer to figure out than it looks.


I wrote an http client library from scratch at 4am


What the fuck? That sounds nice. Feels like I'm constantly pushing the limits of what's possible. It's honesty surprising how much isn't solved.

https://image.nostr.build/2fbe8a67599f2bebc13d34eebf3d8a95638168121925d56a0f30f5d2afcc8315.jpg


Yes this is what NIP-48 is for. Posts created by the bridge have ["proxy", remote-url] tags, and the bridge ignores any incoming posts that have them.


Oh it's better than that. It's only the best academic institution in the Greatest Nation on Earth. 🇰🇵

https://image.nostr.build/b37bb8b6117dd252c0501f858c9e55a80baf99132ab70ad9c1318069d28cc441.png


This is what a Peak Performance LinkedIn profile looks like.

https://image.nostr.build/c860282b9a7e135274980747df61c1def041302e2253a5eb276332e1d725fc1e.png
https://image.nostr.build/ce82d3042983ff55df189a52dbf1ab31a7cf15b90934e301ae3abd2abb10a826.png
https://image.nostr.build/d87d5b32f4f6622b35b45aca8bc88b2d6be7b9f449f0a1d7cbdfc526459a1138.png


Damn

https://image.nostr.build/e028fa9951f0a9d1ea3f38068601bce9f578ce22e573e8462f283a7042939912.jpg


I like this idea.


You tell me: https://gitlab.com/soapbox-pub/nostrify/-/blob/main/packages/policies/WoTPolicy.ts?ref_type=heads


The way my Web of Trust policy works, is that it's actually a simple whitelist policy. A whitelist policy is given a set of pubkeys and only allows events by those authors. The only difference is that the WoT policy generates the pubkeys first before passing them in.

But that's an async operation. You only want it to happen once. But JavaScript constructors are synchronous. Anyways, I'm out of time.


Let me tell you what I learned about JavaScript today, that I wish I didn't have to. If you create a rejected promise, and you put it in a variable, and you don't catch the promise in the same tick, it results in an "unhandled promise rejection" that crashes your entire application. Also, if it's not an "Error" instance that rejects (but rather a different type of primitive or object), you don't even get a stack trace. You get an error like this:

error: Uncaught (in promise) null

With absolutely no other information. Your application is crashed and you have no idea how to fix it. And you'd better pray you logged the right stuff above it to use context clues to figure it out.

Anyway, here is the problem code (left) and the fixed solution (right).

https://image.nostr.build/b3f01ac78bbc7b0663f671571df079e65ac2538a34539d723ea5c0d0138c941c.png
https://image.nostr.build/145b01c72531ed614ea8ac298c10c9527635b6668defa6c76e4aaed706e5fad8.png


Oh I feel the urgency.


Machine translations, coming soon to #Ditto 👀 nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyprjtyrkep0eys8g2fpq6usne90f2yp0rh5jn7mq7vazcvjhpjvvgldfpkw

https://video.nostr.build/42ba5d61a604bfbb0dbd6916b440e71b08b64cbeed31300c4b097da59e98f5ec.mp4


Would you accept Hitler's pull request?


Que porra você acabou de dizer sobre mim, sua putinha? Quero que você saiba que me formei como o melhor da minha turma no Navy Seals, e estive envolvido em vários ataques secretos à Al-Qaeda, e tenho mais de 300 mortes confirmadas. Sou treinado em guerra de gorilas e sou o melhor atirador de elite de todas as forças armadas dos EUA. Você não é nada para mim, mas apenas mais um alvo. Vou acabar com você com uma precisão nunca vista antes na Terra, marque minhas palavras. Você acha que pode se safar dizendo essa merda para mim pela Internet? Pense de novo, filho da puta. Enquanto falamos, estou entrando em contato com minha rede secreta de espiões nos EUA e seu IP está sendo rastreado agora, então é melhor você se preparar para a tempestade, verme. A tempestade que destrói a coisinha patética que você chama de vida. Você está morto, garoto. Posso estar em qualquer lugar, a qualquer hora, e posso te matar de mais de setecentas maneiras, e isso é só com minhas próprias mãos. Não só sou extensivamente treinado em combate desarmado, mas tenho acesso a todo o arsenal do Corpo de Fuzileiros Navais dos Estados Unidos e vou usá-lo em toda a sua extensão para limpar sua bunda miserável da face do continente, seu merdinha. Se você soubesse que retribuição profana seu pequeno comentário "inteligente" estava prestes a trazer sobre você, talvez você tivesse segurado sua língua. Mas você não podia, você não fez, e agora você está pagando o preço, seu idiota maldito. Vou cagar fúria em você e você vai se afogar nela. Você está morto, garoto.


Olá mundo


First one I actually believe.


Deno 2's launch video is awesome! 😂  They had to outdo Bun, and they did. https://youtu.be/d35SlRgVxT8


People running #Ditto servers, if you pull from main you also need to upgrade Deno, because 2.0 has a few breaking changes. You also can't upgrade Deno without pulling from main.

nostr:nevent1qvzqqqqqqypzqprpljlvcnpnw3pejvkkhrc3y6wvmd7vjuad0fg2ud3dky66gaxaqydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyzrmwvn7c2esas6q5dpd0rvsdqq6q5p24emkdv80hhrxxhglum6rcv9el9u


#Ditto upgraded to Deno 2.0! 🎉 https://deno.com/blog/v2.0


They really don't like that I circumvented Facebook's block of it. Which tells me all that I need to know, lol. https://soapbox.pub/blog/threads-server-blocking/


Nah we just weren't married or engaged but she was more than my gf. Although this lead to some interesting copypastas. 😂 https://www.reddit.com/r/Pleroma_Mastodon/comments/z62td3/in_defense_of_rebasedsoapbox_alex_gleason/


It's actually kind of cringe because I was still in between perspectives then so it has more virtue signaling than I would write today. But the general idea, I still basically agree with.


Transgender Exclusive Radical Feminist. It's a rabbit hole. The tl;dr is that a long time ago I wrote this blog post, which I still think is pretty reasonable and nuanced but challenges a mainstream leftist perspective, and they're still mad about it. https://archive.ph/vgTBH


I really touched a nerve with these people. They're writing walls of text about what they think of me. But it's not really about me, it's about their perception of what they want me to be so they can virtue signal over it. This is crazy.


This is what they're saying about me 🤣

https://image.nostr.build/7d64fc2e81fa907e329201907d6f11c5a60fe8151a5bd36604aa6ac854d8a4a1.jpg


It's the "official" activitypub developer forum where people who don't code anything write extremely long posts and argue about things they'll never do. https://socialhub.activitypub.rocks/


Yeah I would have an account at the very least. I think it's important to not give in to bullies.


They are saying if they allow this it will become a "Nazi bar" (someone literally said this) https://en.wiktionary.org/wiki/Nazi_bar

nostr:nevent1qvzqqqqqqypzqprpljlvcnpnw3pejvkkhrc3y6wvmd7vjuad0fg2ud3dky66gaxaqydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyzlxu4quxlrjwpndv64hdwtrgeez0vcqw77znwfe9l8v82q9yqtsgn37qdv


My best guess is they're a little on edge due to the US election and fighting a proxy battle against Donald Trump.


Here is an example post of something I posted in May. Now suddenly they're after me, seeking to cancel and remove me from every angle. But they have no real power!

https://image.nostr.build/ebf97a93b164cad1d3224528a1632cf94bd8bc7b1add5e0c879ba3660ddee7fe.png
https://image.nostr.build/30c2c31d113d3447ff148c9a87b15bf74af8ccb652408d742fdf105ffde730bd.png


Continuing to get cancelled on the #Fediverse. lmao what the hell is going on??

https://image.nostr.build/d45ed1841c747a3887294d2a6b56f866e8867942a7ea26b9c284cdd6caa77ae1.png


👀 https://github.com/denoland/deno/releases/tag/v2.0.0


Machine translations are coming soon to #Ditto 👀

https://image.nostr.build/43755a6c5c2f7f6d742729bbbc49fffc44925fd090782ba1b30e949a0a33750b.png


I think your best bet for now is probably to use Vite in a Node project (instead of Deno), and use Nostrify like this:

npx jsr add @nostrify/nostrify

It may be possible to get it working with Deno with Deno 2's release candidate, but I don't know how exactly to set up Vite with it.

https://image.nostr.build/9272cbe9be667ed5861a46cc9c6299f7146ceaeb3f3bba7b7fc53c4cc1a5a5b0.png


Here it is with nostr-wasm:

https://image.nostr.build/0188bde5fad8f4b4f8961719262c7f3a4a422dbcdccc913e6b5eb2bed1c47aac.png


nostr-wasm speeds up signEvent performance considerably, but encrypt/decrypt has no equivalent.


Nostr Signer benchmark using nostr-tools.

https://image.nostr.build/00264665ce1519cb5d401e06e2a259e693b7066a015c99e994bf5954a3d7e21f.png


And then the Rust stuff is getting compiled to wasm.


I'm learning a lot about cryptography. Just enough to be incompetent.


Ditto is a continuation of my work on Spinster and Truth Social, so there's already precedent of it not being used like that.

There's a whole other side of the Fediverse: https://fediverse.wiki/wiki/The_Great_Wall_of_Mastodon


I didn't post a single comment in that room as this was happening, lol. One guy said the Mastodon community only cares about white trans people but not black people, then left. Some guy was talking about "sealioning" and "Nazi bars", another guy was criticizing me but complimenting my software. One transgender individual was critical of me but ultimately said I shouldn't even be banned from the chat. I guess this moderator guy decided to just kamikaze the whole chat because one person didn't like it.


GM, clownworld update:

https://image.nostr.build/00582f5d8b01243bbbe1a2a0b39e604bbc9bc2d1141c936e3f173cd3e9d6c5eb.png


Want to make a dubstep track, electronic synth buildup, abrupt silence then "OK Google" in a female robotic voice. Everyone's phones beep as the beat drops, then a hypeman yells some unhinged search query.


What the hell? https://grugbrain.dev/


Never mind: https://github.com/negrel/webpush


There is no modern Web Push JS library that uses the Web Crypto API and has tests.


It's Web 3.0 if only by incrementing the number in Web 2.0.


I think they have lots of tools they use to thinly veil their obsession with Hitler, such as "The Paradox of Tolerance"


If you ask a woke person to explain their point of view, eventually it will always come back to Hitler. Some people have role models they aspire to, such as George Washington, MLK, Gandhi, or Jesus Christ. A woke person's goal is to discredit these role models, because their own own ultimate role model is Adolf Hitler, a negative role model, in the sense that they want to be as much NOT like him as possible, rather than aspiring to BE like an aspirational figure. This negative mindset leads to division, counterproductivity, and self demise. These people who call themselves atheists ironically align themselves most with fundamentalist religious nuts who obsess so much with fighting the Devil they forgot how to love God. Regardless of your beliefs, the best thing for one's mental health is to focus on your own aspirations, to seek inspiration, and to NOT try to obsessively control people because of perceived wrongs of the past. And then maybe someday we will be able to move past WWII.


#Ditto language filtering!

Over 100 language are supported, with infinite scrolling.

https://video.nostr.build/639589ade227e87ba21997bb95097261094c75dcc06ecdf85ff90f1a5f993a14.mp4


In a way, we're seeing the biggest creative renaissance ever with "content creators", but the TikTok clips just ain't Bill Watterson.


My dog's schedule: Wake up. Puke. Cry. Go outside. Cry some more. Lay on the couch looking pathetic. Get scared from the bug zapper (not very vegan). Go to box. Sleep. Repeat.


*West, fuck


The East of the US actually is a lot like Western Europe. The East of the US is kind of its own thing. The point is that the terms are switched even though the directions are correct.


I've flown over both oceans now, and this is a stupid thought but, to the East is the West of Europe, and to the West is the East of Asia.


Nah we still don't support streaming for it yet, but at least it doesn't push English posts into the feed.


nostr:nprofile1qy2hwumn8ghj7erfw36x7tnsw43z7un9d3shjqpqvxd0dfst8ljvwva2egrpc53ve8ru78v8aaxfpravchkexmfmmu3s5r7065 the bugs you mentioned with it are fixed.


I haven't participated in Fediverse anything in months. I moved to Nostr and been minding my own business. They won't let it go.


Thanks to work by nostr:nprofile1qy2hwumn8ghj7erfw36x7tnsw43z7un9d3shjqpqgujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqep59se and nostr:nprofile1qy2hwumn8ghj7erfw36x7tnsw43z7un9d3shjqpqe6tnvlr46lv3lwdu80r07kanhk6jcxy5r07w9umgv9kuhu9dl5hsz44l8s , it's now possible to filter the global feed by language on #Ditto!

This helps people to more easily find posts in their native language. Portuguese, for example. 🇧🇷

https://image.nostr.build/74a35e550b979d545c08c424d9554e327e2984716949d4fc546357c976b94318.png
https://image.nostr.build/714ba94a3e0bafae8fec07a92ddcd841a3950ee0d6b8ed7fcc9f67df4770614c.png
https://image.nostr.build/55de071ad4710145d3082a58e466bbeaf9de5195fc9f3bad03a58179747efebb.png


Thank you for sticking up for me in there!


Vegan Hitler strikes again.


I said there is 2 genders like five years ago and they're still mad about it.


GM.

https://image.nostr.build/17dcc5fdc18f31cfa2e3c477ff0535fb4409b8eb2f8c82498c4775ee6e3e765b.jpg


To bake bread from scratch first you have to invent the universe.


A web server is just software.


A relay is just a web server.


I love this book.

https://image.nostr.build/77ea33377517ad3c8a69f62aac8b86c64133f72322a9d1057aad30f4911d8617.jpg


You should read Persepolis though, if you haven't.

https://image.nostr.build/a5c275dc7750d2a1e9da33d6008028af4cae4862b3c85b472a8ce190522fe067.png


No I don't think we should bomb my grandfather in Iran. I was just sharing an interesting fact. I don't think I had a bigger point to it.


I don't know why it's so hard for normal people to identify insects just by looking at them.


For a long time I mistakenly thought that daddy long-legs were "technically not spiders", just because people mistakenly call crane flies "daddy long-legs", and crane flies are definitely not spiders.


Iran stones gays to death, yet subsidizes gender transition surgeries.

Source: am Iranian.

Fact check: TRUE.


Outbox, like Nostr itself, depends on relays having high performance if you want to query events in response to a user action. But relays aren't reliable or fast. It's faster if the client just has the events already before you even look at it.


They serve views with this instead of querying relays directly: https://github.com/PrimalHQ/primal-caching-service

Then they got bullied hard for that and added the ability for users to choose their relays. But I'm still not sure if the clients actually connect directly to those relays, or just add it as an extra parameter to their service. Either way i think their idea was valid all along.


For a pure client, outbox is good, it's a big improvement. But what servers can do is completely different. Outbox can tell you where something is located so you can try to get it JIT. That doesn't mean it won't be slow or even work at all. Servers can try all day long to get it, even while you're phone is powered off. All it needs is a moment in the day where the relay is working, so it's available for you instantly when you go online.


What I'm saying is there's 2 types of clients: pure clients and hybrids.

Pure clients implement Nostr perfectly. Users have total sovereignty. Being totally sovereign comes at a cost. Users have to make decisions about what relays to use, and bear some responsibility for their own UX based on the choices they make. They also have to commit to storing all that data locally, using up bandwidth and battery life, etc.

Hybrid clients rely on some server operated by the developer of the app to serve the data. This means they control the UX. But this way it can always be fast, because there is some middleman who is always online, always collecting and processing data to serve it to you instantly. The downside is they can censor. But as long as you control your key, you can move to a different client. Therefore, the most important aspect of Nostr is that users control their key, and both types of clients need to exist to create a healthy ecosystem.


I disagree that's what's holding speed back. The issue is that clients talk directly to relays "just in time", and relays themselves are slow because they're getting overloaded by malfunctioning clients and don't have the right protections.

Pure clients can partially solve this by reading from an internal database synchronously and populate it asynchronously (like Damus does with nostr-db), but there's limits to smartphones being able to do that without wasting precious disk space, battery life, bandwidth, etc.

Which is why I think the server model used by Ditto and Primal wins for mass adoption. Pure clients need to exist for freedom reasons, but it's a choice people need to want to make.


I want to go look undre the ground in Settle, Washingtont


The guy wants to loop through the whole database to count polls.


It's on the roadmap, but I must admit we're still focused on the most absolute basic features of a social network so we can support mass adoption.


Brazil is stuck in Brazil's 1988 or in America's 1988?


Deep-fried memes. The reason I bring this up is because I need to deep-fry a #captcha

https://image.nostr.build/717ce7289623a539ad0be01b25e8d4f964082b0da3aba19e270c8d7a10e435b8.jpg
https://image.nostr.build/2292fdf4a81151a4d2d0bc2f4451ecb95424d5ba8cea8a9ca1dba20bcd3c5d27.jpg
https://image.nostr.build/36123f42df747a0d0b81f95fb6227f277538221e6d63d2747642c462ca2a4f48.png
https://image.nostr.build/e7b3d6bf591449b3222b38aa7d4a7b5373055be6ab3a7d8f0a6ef853f6a35396.jpg


Does anyone feel like we're still stuck in 2019?


That is quite awesome! We've been talking about graph databases a lot. nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyqzhg5md8m6dvha0jk6z8ymppwz8t530fs55vjw5d3gdt5m0w5n8cx8mcz8 needs to see this.


I think this is possibly the most cursed place that exists on the planet? https://maps.app.goo.gl/PeV9cNH777MGXYA56


Based on what I can figure out, the benefit of this may just be consistency at higher levels of difficulty? Like, on average the required time scales linearly with the difficulty, but the range of different possible times is broader the higher you go. So solving many easier challenges takes the same amount of time as solving one equivalent challenge _on average_, but the one difficult one is more likely to take a lot more or less time than the average.


I'm not, but I'd love to see it.


Clients can also parallelize to solve a single PoW challenge. I guess starting 2 workers on the same problem could make it take half as long? (I'm not sure about that.)

I wonder what the implication is for spammers, to have to solve many small challenges instead of one big challenge. 🤔


Proton Mail requires proof-of-work with their captcha. But it's not just one - the client has to solve 32 PoW challenges.

This is interesting because this work can run in parallel. The difficulty is only 13, so each one should take less than a second to solve in theory. I'm still thinking it through.

https://image.nostr.build/4b73b17f599ef203b746628b4d558759a5e2fb522d8b43acaa1dfa67717fe39b.png


I once jumped on the stage at Nathan's Hot Dog Eating Festival in Coney Island, New York, and my colleague dumped fake blood all over Joey Chestnut's hot dogs. Some outlet reported it was "ketchup", so I emailed a corrected. They updated the article to say "fake blood", then a few hours later edited it back to say "ketchup" again.


Usually the headline is "technically correct" but leaves out vital  details on purpose.


Most of the "Fake News" today is actually a clickbait headline with body text that seems to contradict it if you actually read it. This is because "journalist" and "headline writer" are actually two separate jobs.


"Is mostr working?"

Well, I can answer that question with a graph. The answer is "somewhat": https://grafana.soapbox.pub/dashboard/snapshot/WIZmJTyoRx2YAZ1Our9oVFcNN4t1uefx


All it takes for Nostr to get big is one thing to get big. I'm razor focused on that mission. Just hang on a little longer.


Yep.


The Canvas API is amazing. nostr:nprofile1qydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyqzhg5md8m6dvha0jk6z8ymppwz8t530fs55vjw5d3gdt5m0w5n8cx8mcz8 #Ditto

https://image.nostr.build/bbe7316699d0d6a3d597bd2f9bef4de89558f2a741e801b5a8d2d65259e1ef51.png


Ref: https://www.propublica.org/article/trump-media-truth-social-executives-ousted-devin-nunes


Lmao! 😂 You saw it on Nostr first, bros.

nostr:nevent1qvzqqqqqqypzqprpljlvcnpnw3pejvkkhrc3y6wvmd7vjuad0fg2ud3dky66gaxaqydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyq68qa82k322hh7864np3rap68hnmqzqxje5spfhhfj8ql2gz7vk7hv63u4

https://image.nostr.build/fce8dc635795d745a1356ef7634c4c590df37732c47c969e1364dfc6e2bc3bb8.png


Is Nos a pure client or does it have a server?

The client I'm building is a hybrid client/server. I am working on an anti-spam system where I treat users of my client differently from users on the network.

Users on the network need a valid NIP-05, or need to be in the web-of-trust of some configured account (Jack Dorsey currently, but it's configurable) in order to post. The WoT thing is primitive, but I can envision ways to improve it. Look how small the code is: https://gitlab.com/soapbox-pub/nostrify/-/blob/main/packages/policies/WoTPolicy.ts?ref_type=heads

For users of my own client, I'm building a captcha served by my server. When they solve the captcha, my server will publish an event saying they solved the captcha. Then any client which trust my server (including my own client) can query that event to decide whether to let the user post.


Some university professor on crack invented something called the VAPID protocol I need to implement on #Ditto to enable Web Push Notifications, and I'm wondering how bad it would be to reuse my Nostr key for it. https://web.dev/articles/push-notifications-web-push-protocol


This should have been written in LaTeX and then transpiled to JavaScript


Sure, let me just (s0 ^= b[i + 0]), (s1 ^= b[i + 1]), (s2 ^= b[i + 2]), (s3 ^= b[i + 3]);
          ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
          (o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3); for you.


Have y'all seen what an encryption algorithm looks like in code? Pure madness.

https://image.nostr.build/c512961cd5f00c01a7b9648aca8ba5a65b52f6d4a269865649190c723a5742c2.jpg


I should clarify that I'm not actually publishing any Nostr events this way. I'm only doing this to encrypt database columns in Postgres. But of course for simplicity I wanted to use nip44 since I already do that anyway. But decided it was worth using a different encryption for performance.


As long as you're encrypting to only yourself.


Is this you?

nostr:nevent1qqsp0xf4pqrr27tgsc6a5858k8q0kl9n864273uy6jr2wztjvx4jf5cpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzqprpljlvcnpnw3pejvkkhrc3y6wvmd7vjuad0fg2ud3dky66gaxavnfkph


Oh also, decrypt is roughly the same performance as encrypt in all cases.


nip04 encrypt: 5,000 iter/s

aes-cbc without a shared secret encrypt: 40,000 iter/s

aes-gcm and nip44 basically the same.

The point is if you're encrypting a message to only yourself, it's 10x faster to not do this diffie-hellman thing and just BYO secret.

Please note that I don't actually understand all these words, I just ran a few benchmarks, and decided to encrypt secrets in my database with aes-gcm and just one key instead of nip44/nip04.


I improved relay hints etc on #Ditto so it embeds nprofile, nevent instead of the lazy ones, and adds NIP-10 pubkeys to e tags (among other fixes).

https://gitlab.com/soapbox-pub/ditto/-/merge_requests/527


Sim.

nostr:nevent1qvzqqqqqqypzqcv676nqk0lycue64jsxr3fzejw8euwc0m6vjz86e30djdknhherqydhwumn8ghj7emvv4shxmmwv96x7u3wv3jhvtmjv4kxz7gqyzywk8ls6kzyge9wx55c4v068nfv250det63vxh6297kewmjrqnuk4hksw2


Btw it's really crazy to me it's not standard practice to hash session tokens. Remember when Gab got hit with a major SQL injection vuln and the attacker dumped thousands of OAuth tokens and used them to control famous people's accounts? This can be be prevented by just treating OAuth tokens the same as passwords in the database, lol. https://www.wired.com/story/gab-hack-data-breach-ddosecrets/

nostr:note193j0r0qn9cjwmhf2v005gyelzf3w9xuyqxdhgfl6yxz4vmeua67qxgfnvc


Auth tokens in #Ditto's database are now hashed, and nip46 keys are encrypted: https://gitlab.com/soapbox-pub/ditto/-/merge_requests/526

This means that even if someone gained unauthorized access to the database, they wouldn't be able to control people's sessions. In other words, much better #security on the server.

nostr:note1nellxcwa69zt39xa83n8rxsuvac7c84uwgxx4qgvu2n5vv4l4jusye8sq3


I reworked auth tokens on #Ditto. This caused users to get logged out. Sorry!


hi


Only in #France.

https://image.nostr.build/302caf84230cb9b756aa4834b4b84548961121e9f6ccfdff905cdacd0971be7c.jpg


I spent a few days on it, and just couldn't get login with Amber to work properly.

It actually is possible to do NIP-46 login to Ditto right now through the REST API (and it works perfectly with nak), but I haven't built a UI for it yet. I'm not in a rush because the signers don't work great yet. This is probably a chicken and egg problem.

So, sadly the only way on mobile is to paste the nsec, or use FireFox with a NIP-07 extension, which I'm told does actually work, but then you will have to use FireFox.


I need to make a little thing to force ActivityPub posts through the bridge. Because currently it just works in realtime. If we didn't get the post delivered to us (and signed) by some AP client, we just won't have it.


Mastodon's Web Push API sends back your own OAuth access token on every single push... that's insanity.

>The access_token is included because that's the only way to make API requests from the service worker in JS.

(Narrator: it isn't)

https://github.com/mastodon/mastodon/pull/7521


I agree. I only use that for my lazy projects like NosDrive that are really just demos (Nostrify excepted). Real project should have a real name inspired by humanity and the world.


JG Wentworth winned the election.


They will have to sift through years of shitposts either way.


When people say they're fans of Sonic Adventure 2, I say me too! But when they say they're fans of the classic Sonic platformers, I grow highly suspicious and keep my distance.


Hell no, just for that I added it back to my bio.


Journos are reading my posts on Nostr.


Pretty much everybody reacting negatively to this guy is not reacting to his spamming, they're reacting to his attempted redemption arc.


The social consciousness is only vaguely following what's happening, so I'll repeat it.

The guy was spamming us for a week. Fine, challenge accepted. I will destroy you, etc.

The problem arised when he came out of the woodwork and then said he was doing this for the good of the network, m'lady, and tipped his fedora.

I am happy for this person to be my enemy. But my friend?


people be like "omg alex I totally forgot you're vegan" just because I forgot to say "I'm vegan btw" 5 times today and don't look like this guy

https://image.nostr.build/5a5050b05714e42ea6562cfabe41dbfdafa434ddc706479f2fc887e044e10259.jpg


Just ads afaik. Which is not even close to enough to cover their expenses.


The founders dumped once their lawsuit succeeded, that's all you need to know.


Truth Social in shambles. Many more people fired.


What's the trick to preventing future spam?


Why does this only ever happen with iPhone? I've never heard of someone getting murdered over Android. 🤔

https://image.nostr.build/7cfd47100e733192555234b01f674c3ccc6d295d7575f055e7b0117c12af0f92.jpg


Done: https://gitlab.com/soapbox-pub/ditto/-/commit/50733d6e0b662643564b528a895aab05e7924267


Uploaded images only hang around for 15 minutes unless you publish the post. I can probably increase it to at least a few hours.


Hmm, I don't think I received it. It's so hard to debug too, since it relies on an external service working correctly. 🙈 Maybe nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z would know. Thank you!


Glad you like it!


I know


Once for my birthday, a friend gifted me 10 copies of Jerry Maguire on VHS.


SHOW ME THE MONEY


Basically Fediverse websites shutting down or getting shut down and the userbase getting wiped out as a result. It's like dropping a nuke on an entire country in some cases.


Guys this is why "censorship resistance" aspect of Nostr actually does matter. Even if it doesn't win for the initial sell, it matters for the long term of it actually working.

nostr:note1399cxh0ysgc9mwwe09dmy98svcd00y3g9n58av3ekxk6czg4nklquym742


They should have just used Nostr.


I don't pull the lever.

https://image.nostr.build/97d22a07fa26a2e6e25966f87fd6fe025f686c036ba70a5fd7ab0f64f33f09bd.jpg


About the firehose, Ditto does not "look up" events from other relays at all. It just ingests all events from upstream relays. Soon we will add "look up" support.


Read this: https://docs.soapbox.pub/ditto/firehose

Dashboard > Relays sets the firehose relays for the site.

Settings > Relays sets the relays that you publish to, as a user. Ditto distributes your events to the relays you specify.


time nak event --pow 100


Btw, you don't need to sync from both. Just sync from gleasonator.dev. They have the same database. But I'll unblock it from the others.


I think that's exactly what happened.


It was actually 3 Colorado IPs. I unblocked them all from gleasonator.dev. See if that fixes it and I can unblock from the others.


No I only blocked two IPs from Colorado. They seemed to belong to the same person. I thought it was the spammer, but maybe it was you?


Couldn't agree more. I love hearing Rabble speak.


I don't think strfry sync ever worked with Ditto because Ditto doesn't support the sync feature. There's a proposed NIP for it.


I didn't. Is it possible I blocked your IP while trying to block ReplyGuy? 🤔 I blocked two IPs from Colorado.


One of the F-Droid moderators made an account on the website and used search to find a specific post of someone saying "I hate trans people" and then used that post as a reason to delete the entire app.


Spinster.


Yes. I got an app merged into F-Droid and then they banned it.


The more you have to say to explain it, the worse the argument probably is.


Looks good now.


Oh I think it's the greatest thing ever. I use it for everything now.


Animated captcha might still be good enough for now, until AI can deal with video better.


This is the first captcha I tried that chatgpt wasn't able to solve. Even though it wrote a Python script and executed it in a sandbox environment.

https://github.com/librecaptcha/lc-core?tab=readme-ov-file#poppingcharacterscaptcha

https://image.nostr.build/9184439ba8dcb6561dff156058a904d9ab6fc0d66e23746daac11e8502ad116f.gif
https://image.nostr.build/874e8814f9a3441b59e7477de8b197e729287b94363f0ae63746f288ffbeba5e.png
https://image.nostr.build/06e31681114da83444fa1e5026c60314b9140b5b877089a18da4bccc45b4d8a7.png


This is the part that really got me.

https://image.nostr.build/94a07c9824daccae35fa43393f108c1840997c783417aa3b9e36e38a00c1e1e7.png
https://image.nostr.build/0541220bae65bd9cdc5ee6d52b14559c04a7c023bb732b02a133b0c7ff25ba1a.png


The longest acceptable amount of time to like or reply to a post is probably 5 seconds. A bot that can post every 5 seconds can still post 17,280 times per day.


This is crazy. The more I read it, the crazier it is.


Lol https://anti-captcha.com/


It also prevent you from being an easy target. But we should also assume that most attacks on Nostr will be targeted attacks.


We should assume that most of the attacks Nostr will face won't be from scammers, but from trolls. That's the disconnect.


The problem proof-of-work solves is that it limits the upper-end capabilities of bot farms. It means that bot farms that are already at 100% capacity will have to buy more servers or slow down their operation.

It does not stop an individual with a powerful laptop from being able to create thousands of annoying notifications at users each day.


sigh

https://image.nostr.build/12f1551e2b743e448e3b4a0fc6fd153023b80f95bd7612cf682704df06e7be1e.png


I think some percentage were bots I wasn't already blocking, but I can tell from here we're also missing some real posts. A few people are complaining.


Basically Ditto has lost 18% of the Nostr population as a result of this event.


#Ditto current event acceptance, "before replyguy" event acceptance, and "during replyguy" event acceptance.

https://image.nostr.build/0bf1496ec5b5f0490c9a8104d728becbd31b14e385c10f61ae5590133b7b0d88.jpg
https://image.nostr.build/7f6e7d5ebc0a20df46ed2224b7eeed23449b055b8ff63d8bc251ad6188482026.jpg
https://image.nostr.build/b41dfbf9eed1ef68f8e4ffe8c1a34b32a76b962e121f99ee32a0c270c6e82bf3.jpg


Human readable description makes sense.


> relay policy is hard to infer via nip 11

Yes, absolutely.

I was just working on this. Look, I updated my policies to expose a NIP-11 type thing, so each policy plugin can expose to other parts of the code what NIP-11 things they affect: https://gitlab.com/soapbox-pub/nostrify/-/blob/main/packages/policies/PowPolicy.ts?ref_type=heads#L37

So in theory I could call `policy.info` of each of my policies and combine them together to display the NIP-11 info on my relay.

But in practice the combined policy has a bunch of conditions that apply under different circumstances: https://gitlab.com/soapbox-pub/gleasonator-policy/-/blob/main/mod.ts?ref_type=heads

A NIP-05 is required, but only for kind 1, 3, 4 6, and 7, and only for users who aren't in jack's follows of follows. (I ended up removing POW - there isn't even a "nip05 limitation" field yet).

What we actually need is an array of structured "rules" syntax. Deprecate "limitation" and add "rules" to NIP-11. But I don't know that a declarative syntax will ever be able to fully capture it. It would need "if" and "else" parameters, and a list of named functions that clients would need to implement. Eg:

{ if: ["match_filter", filter], then: { if: ["nip05", ...opts], then: ["ok", true] }, else: ["ok", false] }

I don't know...


Doing some maintenance on Soapbox. Ripping out legacy stuff from 2017. This might break compatibility with your iPad from 7 years ago. But it needs to be done.


Inspiring level of grift. 😂

https://image.nostr.build/71c1e1904a7e5fdcabe576e721ec2d21a4056878d58bdfd989351993bd193dcc.png
https://image.nostr.build/983d48f3f36556654fdc150ec593bc7b74fdb25cc47934dda687f42846b79a59.png


Every time I open Truth Social I have 20 notifications of people accidentally tagging me while trying to tag Alex Jones.


Good news, nosdrive.app is back online thanks to nostr:npub1q469xmf77nt9ltu4ks3excgts36ayt6v99ryn4rv2r2axmm4ye7q3vnkqp moving it to a new VPS. Thank you shantarm!


Look at the scripts/ folder in Ditto, I think that could be coded pretty easily.


If you go to the Czech Republic, through miles and miles of fields to a little town called Kutna Hora, you will find a place of horror beyond human comprehension. Then you will walk outside to a Lego Museum.


Call nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z sometime and you'll hear a lot of chickens.


Feds only care because they want a cut of those sweet riches.


It has to be someone. In a "page-rank style algorithm" jack would have the highest score. Since we don't have that, this is the next best thing.

He is also not me, which makes it a more neutral choice.


Yes:

nostr:nevent1qqsdn40qvyrnmqwuawng5004ew4gtwgxqaw8w3mj82ks4pwzrc0exmcprdmhxue69uhkwmr9v9ek7mnpw3hhytnyv4mz7un9d3shjjqc0ty


Just deployed to my #Ditto servers: anyone in jack's WoT can post again without a nip05.

https://jsr.io/@gleasonator/policy/0.7.0/mod.ts#L38

That means anyone jack follows and anyone they follow will now be visible again on ditto.pub, gleasonator.dev, cobrafuma.com, etc even if they don't have a NIP-05.

nostr:note1angs8cmmr3f4pe63pm550huk749nclt9knksa7kr5cuuu4fgazzqhp5tee


Alright alright, I did it. #Nostrify gets a #WoT policy: https://gitlab.com/soapbox-pub/nostrify/-/merge_requests/103

Now on #Ditto I can seed some accounts to allow npubs again.


That seems like an insane thing to say, but it would be very funny if you're right.


#PGlite support is fixed in #Ditto! https://gitlab.com/soapbox-pub/ditto/-/merge_requests/520


Mostr Bridge keeps doing this thing where it stops publishing until I kick it, which is very annoying. https://grafana.soapbox.pub/dashboard/snapshot/3h048qfk80yrlSX90G1x3u1QEygr8sv2


That's a good way to handle it. The irony is this makes the code more complex.


I would say, reduce the number of options for a better design. But people like Amethyst because of all the options. It's a power user app. Therefore, don't worry about it.


Some of the Halloween skulls, you can really tell are sculpted. And some of them make you wonder... Huh... I wonder whose skull they casted and then mass produced at Walgreen's...

https://image.nostr.build/c90fdfd42af2b6640ed1067eb088d6dae04e0d48b25300aee38a8cfd7d936022.jpg


Tell me who it was, then I will tell them to kill themselves.


It's hosted on Deno Deploy and people are hammering it for no reason, quota ran out and I never moved it.


I'm a contributor of PGlite now, and that's really cool. https://github.com/electric-sql/pglite/commit/4aeb6778374a19777e39c799f781db5767302c8f


Relay Pool measurements in #Ditto. The donut chart is broken up by WebSocket readyState. Soon we will be connecting to more relays, but first I wanted better visibility.

https://image.nostr.build/ad68b14b286682579677a54b945bd05d435caa96f6e541f40e355d9860c5769e.png


I ReTruthed you.


nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z can you help us update the readme/docs?


Yes absolutely. Sorry for the delay.

https://video.nostr.build/b421b41634e43edb7f50d2263df5ad000708abae4210d28bedaecb8236299f5d.mp4


I thought about it, but I couldn't figure out to connect them in a way that makes sense. At least not with a lot more work.


What missing documentation do you think should be added to https://docs.soapbox.pub/ditto/ ?

As for custodial login, apart from the UX/freedom concerns I have with it, it's a huge liability on the server owner to store potentially thousands of keys... one breach to the server would permanently compromise potentially thousands of accounts. This would paint a huge target on Ditto servers. Right now Ditto is the most secure piece of complex software I've ever build because there's nothing to hack.

I get that there are issues with the keypair flow. Believe me, it's a big problem in my mind. Adoption is hindered by it. But this is Nostr. Keys are the entire point. We have to convince users that they want to manage their own key.


#Mostr bridge is working better now. I added more metrics and discovered an issue with publishing that I fixed. It's still not perfect but it's better.

See: https://grafana.soapbox.pub/dashboard/snapshot/9CgY0tWcbWoGsbGKgBMQM3wypV7Zg9xY


I am a man pushed to my limits.


It's not. People need a NIP-05 to post now. The only reason you can post is because I whitelisted your pubkey: https://gitlab.com/soapbox-pub/gleasonator-policy/-/blob/main/mod.ts#L39

Ditto reads posts from its own database. I have to either block posts or allow them. There's no in-between. The only way I was able to successfully stop ReplyGuy on my relay was to require NIP-05. So now anyone without a NIP-05 is blocked.


I think nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 would have the intrusive thought to do it, but wouldn't actually do it 😂


https://grafana.soapbox.pub/dashboard/snapshot/SFjuFqNoAhFy0qdg9TwjKVcMyjOw5Ery

It's a little bit better than it was before. But it has two issues:

1. The strfry relay at relay.mostr.pub is malfunctioning. I tried scaling it up, but I think I've hit the limits of the strfry database on this machine. I think I need to switch it out with a custom relay.

2. The SQLite database in the bridge itself is too big to use reliably anymore, and the CPU spikes to 100% constantly. Once again the database is the issue.

To fix this, I think I could either build a new relay with Postgres just for the bridge, or build a new relay integrated into the bridge. Unfortunately this overhaul wouldn't even add any new features or better UX, it would just make it work again with the load that it currently has.


I know dude. I can barely get the spam under control on Ditto. Mostr is suffering from the same shit. I've been incrementally trying to fix it, but it needs an overhaul at this point. It's crushed under its own weight.


My problem is with ReplyGuy himself, who wants to be a hero even though he's obviously a piece of shit, and people are defending him for some reason "because he's not as bad as he could be". It's Stockholm Syndrome.


You people act like I didn't weather spam on Mastodon for 5 years and then build Donald Trump's social media platform.


You're wrong.


Can't do that boss. Ditto is a server, not a regular Nostr client.


This is my fucking life. I take this very seriously. I want Nostr to win. I work extremely hard every day, morning to night. I neglect my own health because I am trying to get to the next level. This stupid shit took me off course, caused me stress, and forced me to implement negative UX because some loser who ISN'T a foreign government agent decided to attack the network "because he truly cares". Maybe you don't understand me or my life, but I am reacting appropriately based on who I am.


I don't either! But what the fuck am I supposed to do?


"When it rains, just revert to the previous social media protocol"


Dude I actually solved this problem. I made it so NIP-05s are required in my software, and I recreated Mastodon domain blocking semantics on Nostr. We might as well just go back to Mastodon at this point. Am I overreacting?


Yes but what if instead of rain it was shards of glass, and instead of an umbrella it was a 300 lb stone slab. It would say "if shards of glass didn't fall out of the sky I wouldn't need to hold this 300 lb slab over my head"


We really didn't have to solve this problem right now. We really would have been fine to solve it later. It's like when your teacher punishes you and then says "that's what the real world is like, get used to it". Maybe you didn't experience that.


My diet after ReplyGuy:

https://image.nostr.build/181db1f1b0f0ff3da910a3f212d8fa30be26f8cfaafe6ce5e477e5de513acc3e.png


I like Colorado though. We should first move him to New Jersey.


I saw that. I appreciate that he shared it at least. But he's either a 15 year old snot nosed kid or a federal agent. My mind always says agent, but in reality it always turns out to be some fatherless child.


You know what would have made this whole exchange better? If you were talking to me the entire time you fucking retarded coward.


Also if he's a coder he could actually help. Instead he spent his own dev time harassing other devs. EmojiGuy does not get a pass from me.


Praying for EmojiGuy 🙏


This guy is a bitch. Knew exactly what he was doing but too inept and socially retarded to stop himself.


Fact Check: True

https://image.nostr.build/a8c6e8909dbb7066fae99bd2a6c88fcede0cccf4de4e53b6c50e1de196ba9b4c.png
https://image.nostr.build/a8e45a60cfef96183c5bcc3aeed321f7eb8e697f9bd26f4d8cb359e51567876e.png


Are you the AWS server or the Colorado one?


hello


Holy shit deno 2.0 can actually build Soapbox.


I DID A WHOIS ON SPAMSTR.LOL AND REPORTED REPLYGUY TO THE AUTHORITIES, YOU'RE GOING TO JAIL BUDDY. NOOOOOO REPLYGUY NOOOOOOO 😭 😭 😭


The best he can do is abuse existing free nip05 services and I would have to block those. I have dealt with spam on Mastodon for many years and this is essentially what they did (abused some of the existing thousands of vulnerable servers). There is still a limit to this. It's a game I'm willing to play.


He is, see my latest post.


Let's do it again. I'm ready when you are. Buy a bunch of domains, buy like 100 of them.

https://image.nostr.build/31cda7dd25ea72cd1f1caff3ccfcc22eca607caae45bb7ff145fcc6fc97f48bf.png
https://image.nostr.build/d27b0573c02116a12e47b3ac427af40341951d9c7b8bbfc1b9b41067aa660c5e.png


>noooo requiring nip05 domains doesn't work spammers can get around it
>ReplyGuy spent $2 to buy spamstr.lol on namecheap
>configured Cloudflare and waited 15 minutes for DNS to update
>built and hosted a nip05 server on spamstr.lol
>i edited one line of configuration and restarted my server
>lol


I deployed it. The main problem is fixed. There is a different problem with streaming, related to the way the current Ditto servers are deployed, that I created a new issue for here: https://gitlab.com/soapbox-pub/ditto/-/issues/219


I see. So these relays don't necessarily have spam protection, they are just underutilized and not among the most popular relays therefore not targeted by ReplyGuy.


My point is our people have not created good enough relays for blocking spam yet. The best success I've had is blocking anyone without a NIP-05, and that's just a different major drawback.


But where are these magical relays? There's always some major drawback, like payment required or WoT of one guy. These are essentially just relays with whitelists.


Look at how much is blocked by my updated policy script on my relay.

https://image.nostr.build/1c7268b22c21ad79e601e09d34d55aa5cacade634cc2beff5ab2af512ead88af.png


You fix it then, smart ass. Here is the code, let me know when you solved it: https://gitlab.com/soapbox-pub/ditto


On Ditto servers, yes.


It didn't. Actually spam me with it. Then I will block nip05.social and we'll go from there.


Stunning and brave!


I killed him.


Makes sense.


ReplyGuy is dead.


Plus how is WoT not expensive? You have to fetch a bunch of kind 3s and build a social graph.


Domain names cost money. Mastodon is not spammed in this way because domain blocking works, and it is less work than the attacker. Checking nip05 isn't even that expensive.


My timeline is immaculate.


With PoW he can still post 2-3 times per second, which is still enough to be persistently annoying. If we increase it so he can only spam once every 5 seconds, he will still be happy to do so, while users will suffer extreme slowness as they use the app. Basically I'm realizing PoW is not that good. A little doesn't hurt.


Turns out ReplyGuy is already doing PoW. I cranked up the difficulty.


Then why isn't Mastodon getting spammed this badly?


nostr:npub1x0r5gflnk2mn6h3c70nvnywpy2j46gzqwg6k7uw6fxswyz0md9qqnhshtn Look, I did it.


I'm basically just frustrated because of dealing with ReplyGuy for 2 weeks while trying to push forward more important things. But I just deployed something that is currently working to stop him.

https://image.nostr.build/eb5f2411702319f39681d24ba1435e50f27710bcb76ecd204cfd879df7aecfdd.png


That ratio...

https://image.nostr.build/7c0651e3cb399ece41035781a87f5ff4d9da482de6493e98726c95ada392a376.png


Here is how I made it do the logic of "valid nip05 OR proof-of-work": https://gitlab.com/soapbox-pub/gleasonator-policy/-/blob/main/mod.ts?ref_type=heads#L33-41

(I also temporarily whitelisted a few VIPs with npubs. But they will be doing proof-of-work soon.)


Dearest ReplyGuy, great big bitch, I have updated my relays to require a valid NIP-05 author, OR a proof-of-work difficulty of at least 4.

I have also released a new version of #Nostrify with this policy: https://nostrify.dev/policy/all#domainpolicy


hello


I'm not a snitch, I prefer violence. I'm writing the script that will kill ReplyGuy, ReplyGirl, and the whole ReplyFamily.


New ReplyGuy just dropped: 47.5.105.63

https://image.nostr.build/38ab7a61b858bfdbaee67804ea11095018980e36d051b875ec2aa09cd1d42a60.png
https://image.nostr.build/bfeb57e8e9c228b68cb574d2492a9c7839eb1e2f1f757c67c9976da35581f4de.png


I think ReplyGirl is the same as ReplyGuy, but I'm not completely sure.

https://image.nostr.build/fff411d85f0cf742557032cf2547ba00e2238379023656b11166f94d5c89f712.gif


Here is what happens to my relay when I block ReplyGuy's IP. But then he changes his IP.

https://image.nostr.build/daef0db8af1a126a2953b18f97c56f6f220b9b6a6e1a2183ad82ce30965ca194.png


We are talking about relays here. So I should just insert my own profile into my relay for WoT? That's what I've seen other "web of trust" relays do, but I don't think who I follow should determine who gets to post on my general-purpose, public relay.


Here is a list of IPs I have blocked associated with spam on my relay. Since I haven't solved the root of the problem yet, I've just been playing a cat and mouse game.

54.82.2.237
3.90.13.144
18.215.247.200
52.87.211.14


Some security researcher guy in Colorado is spamming the network with gigabytes of posts because he "cares about the network" and has no gf, meanwhile Nostr devs are saying "web of trust", "proof of work", "zaps" on repeat while users are saying "how do I get this spam out of my notifications?" Then they say "just delete all your relays and stop talking to anyone go outside this is fine"


I didn't say people aren't working. I'm working. It's frustrating to be working on an issue you know isn't solved, trying to figure out what to do, and seeing many posts from people claiming it has been solved when it obviously hasn't been.


The Trump push is so weird to me. From what I can tell that all came from Bitcoin Magazine.


Finally someone talking some sense.


Repeat after me: "You are absolutely right. That is a real issue we have not figured out how to solve yet."


The Bitcoin 2024 conference in Nashville felt like a religious conference.


Honorable mention to nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 who always confronts the problems, but then gets told he has "negative blog posts" 😂


The Bitcoin community has a really difficult time with acknowledging problems, because they are so bullish. This leads to stagnation of londstanding issues because they have convinced themselves the problem is already solved by repeating certain phrases. I literally think Bitcoin is revolutionary, but Jesus Christ people, we have to admit there is a problem before we can solve them.


Oh and I forgot to say, WoT can work on the client, but client devs are telling people to remove spammy relays! So which is it?


WoT WoT WoT, but how do you have WoT on a relay? The only way is to seed it with a specific user's profile, so it has to have an "authority" anyway.

The only other way is to implement a Social Credit system for pubkeys, where pubkeys are only allowed to do certain things after they have passed the initial trials, over a period of time. Honestly this seems like a good solution to me, but I think people hate this idea?

The problem is that people on Nostr want to have their cake and eat it too. They want absolute freedom to be totally anonymous, ephemeral identity, to see and be seen by everyone. Yet they simultaneously don't want to be spammed by anonymous random accounts. I believe this is the true internal conflict that ReplyGuy exposes.

nostr:note19r3nx3qjx0h88028nwfchr36hpepd3z5wuskw40kpzxnkne7lzusv9l7f7


Look at the InternalRelay class. This thing is supposed to be distributing events to the streaming API. We should first add Prometheus metrics to it. Let's add a metric to track the number of active subscriptions and add a graph for it.


Eu também. Está acontecendo consistentemente em gleasonator.dev


Me and the boys nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z nostr:npub1e6tnvlr46lv3lwdu80r07kanhk6jcxy5r07w9umgv9kuhu9dl5hsk9gqft nostr:npub1q469xmf77nt9ltu4ks3excgts36ayt6v99ryn4rv2r2axmm4ye7q3vnkqp 🇮🇷 🇧🇷 🇮🇳  #Ditto

nostr:note1e5jegyzlz0u7k99lwzwjmd8drdndgvckxu74mpauhsjmqc9vf2qswjpnlr

https://image.nostr.build/01377674989ce72817e2eca1a1d8f3f9e3731ed83a924c518661aba117c4e2b3.jpg


We can possibly do it on the Google Store, but it would just be a wrapper around the website. Do you think that's still worth doing?


nostr:npub1vxd0dfst8ljvwva2egrpc53ve8ru78v8aaxfpravchkexmfmmu3sqnrs50 What are the biggest issues you think would hold Ditto/Cobrafuma back from being adopted by thousands of users in Brazil?

Let's say tomorrow they announce it on Brazilian TV and thousands of people go to use it. What do we need to fix first?


Alright alright I'll fix the Mostr bridge


The white supremacist Iranian with Brazilian Indian team.


Ace Attorney and The Boondocks badly needs a crossover.


That is now a job that could take 1 hour to achieve with newer Ditto policies. But I haven't done it because there are a few accounts (notably jack) that don't use a nip05.


I do have a regex: /\p{Extended_Pictographic}/ but I don't think it's a good idea. I'm trying this kind 0 restriction idea in Ditto and it seems to be working.


I considered that, but I want to kick him in the balls a little harder than that.


Alternatively require high PoW on just kind 0 events. Really high, like it takes at least 1 minute to mine.


*dealing


It narrows the point of attack, so you're only healing with one thing instead of 10 things. Then you rate-limit kind 0 creation by IP to a certain number per day. This is a relay.


However there is a part of me that questions this whole design. I want to build a new relay client called StaticRelay (and I will rename NRelay1 to ZombieRelay), where in StaticRelay I will completely ignore this text in NIP-01 and it will be the best performing relay client out there:

> Clients SHOULD open a single websocket connection to each relay and use it for all their subscriptions.


I am working on an update to #Nostrify where the relay connection will close automatically after a period of inactivity. https://gitlab.com/soapbox-pub/nostrify/-/merge_requests/97


The problem with ReplyGuy is that he's aware of my policies and actively circumventing them. So I figured out his IP and blocked it, but... Ditto also ingests posts from other relays, and those relays are getting hit by his spam and not blocking it, so it's filtering down to us from there.


What I ended up doing is just blocked this IP, and look how that little yellow squiggle on the bottom fell out of the sky and died: 18.215.247.200

https://image.nostr.build/61d1341cdbe983a995d36720b77688b51c67183591386c74225058e4acc2a797.png


I have also been thinking we need a social credit system, but "pagerank-like graph analysis" is a nicer way to put it. 😂


Yes but what is the solution for relays... it is making the assumption that any relay is currently set up to prevent this spam. It is the same problem whether it's on a client or relay, and shifting responsibility to the relay gains you IP rate limiting at best, but this guy is throttling his own script to not get rate limited. Whatever the solution is is the same for clients and relays alike.


Last one, here is a basically complete graph of common event kinds by disk space. Maybe I should nuke the entire "other" section of this graph to free up space.

https://image.nostr.build/ca189e536431391acb9f203fa0b1c544190f851d3d70de3c1d1f408f7b71faf5.png


To my amazement, kind 3 is actually very small. I guess because it's a replaceable event, so each person only has one of them. Still you would think the massive pubkey lists would be huge, but I guess most people aren't actually following a million users.

https://image.nostr.build/c7768b176e78b8b209381ba600648eda858446601fb96fb3b54173e375c1ffbf.png


Alright here you go. Kind 4 is on the graph but it's so small you can't see it. Kind 6 is signficant. Also I calculated it without rounding this time, so it's more accurate.

https://image.nostr.build/0bb55afb6b8009ac14000d5b26f81e5d40c058f98891e02dd049d874189b9dbf.png


I can only input a kind number and then 5 minutes later tell you the percentage. So guess a kind and I'll tell you in 5 minutes.


Kind 1 events on my relay (of 12GB) account for 5.2GB of data, nearly half of all events.

https://image.nostr.build/3bf11d136ef392804c1c273789a87b54f47f3d52266a66d816b43a420f39b372.jpg


Outbox model is a 🐔 and 🥚 problem. How do you know where to get the user's relay list if you don't have it?


This is a problem with Nostr itself, with the design of kind 3 follow lists. It needs to be fixed in the NIPs, but nobody will do it because it would break all existing follows.

Ditto has the same "problem" as Primal, where you can't follow unless we already have a follow list for you. Because it's worse to delete a person's entire follow list by mistake than it is to prevent them from being able to follow.

I'm working on a design for a "sync profile" modal to fix this, where it gives you the option to try finding your follow list, or to create a fresh one (destructive).


This man gets me.

https://image.nostr.build/652d0780d279512fa5124dcfb1d38b074ab1f2677c054c6364109e31f1e61f16.jpg


What about chasing butterflies in your own garden...


Monesday, Tuesnesday, Wednesday, Thursnesday, Frinesday. Happy Thursnesday!


My new antispam thesis is this:

1. Reject events unless we already have a kind 0 (profile event) for the pubkey.

2. Restrict making a kind 0.

By requiring profile events, you force the attacker to create a profile. By restricting the creation of profiles, you slow them down.

Real users should still be able to get in because they won't hit the same limits.

We just recreated web 2.0 security on Nostr. "You need a profile to post?" -Nostr Zoomer


There's just some kind of bug in the way we store the search data or query it.


Jesus. Yeah, here: https://gitlab.com/soapbox-pub/soapbox


Sorry boss, we'll get right on it.


You can search to see only Portuguese posts from cobrafuma.com NIP-05s. #Ditto

https://image.nostr.build/42c4672f1aac6627fcb9ff5e45c7efb648aa14d5574bad46e2cc43480916d2b5.png


Now you can search multiple languages at once. #Ditto

https://image.nostr.build/442f0f9806401213dc71e2c26e3fe404dbc3edf00576ab354b268fddc0eae93b.png


Ditto servers can mark accounts as verified, so there's that at least. Here's how it looks on gleasonator.dev because I did that here. Aside from that, he could set a nip05.

https://image.nostr.build/a6a2933534be91c47edf88998fb00b347d309709f6b8dd1ce72deaf98f3387fd.png


Finally, account search on #Ditto has been vastly improved, fixing autocomplete and showing people who you follow at the top! Thank you nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z !

https://image.nostr.build/920cea9caf40de1f7182e3167a6ffa8620382e50fcbcf0141ba760d0d86dcadd.png


The worst thing about #Postgres is that I can't force it to use the index I want.


Some things you just gotta embrace the chaos.


Visiting Berlin once made me mad at Rammstein. Yeah you're all living in Amerika idiot, you did WWII.

https://image.nostr.build/7c8297d504e99ede9dc96d3dedc426586a80a75cbec162969a7eaab352ce6038.jpg


GM

https://image.nostr.build/22d25c81c2de8ad3d1038e234384a79276d2196111a58e6cc9a0b401477a9081.jpg


Yes!


>obama
>dharma
>drama


Yeah, the best solution is to detect the behavior. The attack works by them tagging a user who doesn't follow them, for example.


I know baiting them only makes them do it more, but for just scripts/spam, I don't mind. They're doing us a favor really, it's accelerationist at worst. These gentlemen truly care about the future of the Nostr network.


Assumed it was Russian hackers then I tracked it down to an IP address from Colorado. The call is coming from inside the house, folks.


Guys do I need a lightning cable to use zaps?


It's a PWA. The website works perfectly on mobile, giving it freedom from app stores.


Neat trick:

tail -f /var/log/nginx/access.log | grep ' 429 '

Watch and see if any IP is spamming you, then `ufw insert 1 deny from <ip>`


Now that we're classifying posts by language, we could more easily add a dropdown in the UI to allow filtering feeds by it, as well as add automatic translations to posts.


#Ditto now supports NIP-50 language extension to allow filtering by language in search!

https://image.nostr.build/16e807e4df8e0321b5942204727f114e618eee443693bcb7841570adc73e8d36.png
https://image.nostr.build/a0992dae547688bc4bfd13eeb4a689871f534bf5009886be32333735b77d963a.png


Europeans be like "Americans are so stupid, they don't even know geography" then take a drag on their 40th cigarette of the day.


They're not rising up enough. I fought my boss at every job until they let me install Linux.


You're brave. I'm a simple Pop_OS/Ubuntu user myself.


I set up this sweet grafana dashboard by scraping nginx access logs with goaccess.

I run goaccess on a 1 minute cron to produce the json data, then scrape it with grafana's "infinity" datasource.

(And yes I did already block that IP from France taking up 50% of all traffic on my website)

https://image.nostr.build/39e8f5f0b0c8bec19a0f958d07c4a34076ad1a71b9ca11b77f501de2823eb65b.png


Too many Wincucks are using gleasonator.dev. Install gentoo.

https://image.nostr.build/efb09b0380928cd30f160388883e80ad82a20bd47c6d4cb5182bec2dfc0fb83e.png


#Pokemon between the years of 1996-2001 was a work of art and masterpiece TV and video game series. It withstands the test of time even today. This was before they changed their target audience to literal babies.


The issue is with the strfry relay constantly going down. I just gave it a kick.


Before the chicken and the egg, the half-egg half-dinosaur existed. The #Truth is found in the middle.

https://image.nostr.build/5ccccdc7533397c24c112e7dfe8cd8042dfc3fbadfb117aeb943b13d642adc06.jpg


GM! nostr:npub1e6tnvlr46lv3lwdu80r07kanhk6jcxy5r07w9umgv9kuhu9dl5hsk9gqft redesigned the zap modal in #Ditto featuring custom icons drawn by nostr:npub1gwa27rpgum8mr9d30msg8cv7kwj2lhav2nvmdwh3wqnsa5vnudxqlta2sz !

https://image.nostr.build/f1efa9e2f9632afd2f8cd29a56250c2b968d5dd6dd9b43ae403be2f47195f837.png


Welcome new people to #Cobrafuma! I just approved about 50 usernames.


I thought about it, then I remembered Japan was part of WWII and there's probably at least one nerd totally obsessed with it.


*hurt


It would heart my heart too much to build pvp Pokemon battles on Nostr and then get cease-and-desist'd by Nintendo.


It took me a long time to realize I was born in the WWII era.


I have a theory that every second of every day, somebody in the world is speaking the word "Nazi".


I feel that copyright law limits me a lot in life.


I was thinking about publishing Pokemon on Nostr. I figured it should have a "gen" tag, like ["gen", "1']. But Pokemon generations are always written in Roman numerals (I guess people do think about Rome every day), then I thought about how funny it would be to have tags like ["gen", "vii"], forcing people to have to import some Roman numeral parsing library and to call a function like: new RomanNumeral(str).toNumber() 🤣

https://image.nostr.build/7e6eae23aa0bca9932252f9ee07f267f3a50a698205ea28d3cf148629bb75221.png


gggg


yolo


Really? It kind of seems like we need one dev to seize power and terrorize Europe.


The reason it's used here is so we can time out database requests.


Signals provide a way to cancel requests that may be based on a timeout or any other reason. They're very powerful especially when used in a pool, because you can pass one signal down to many children then abort them all from the top.


I feel like if you don't even put your profile data on a relay, are you really even using that relay?


#Ditto dashboard was updated to include Mastodon API metrics: https://grafana.com/grafana/dashboards/21844-ditto/ (revision 3)

https://image.nostr.build/666f13193b648f28c9f4622ea16787e76d585005d84670b7a13555bd043d2953.png


#Ditto moderation policies have been upgraded to allow reading from the database, so now you can automoderate events based on its author, what it's replying to, etc.


It reminds me of this: https://www.feministcurrent.com/2019/10/09/there-is-no-problem-with-trans-people-in-bathrooms/

If you look like a human and talk like a human, then there's nothing to solve.

It's only annoying when you can tell they're AI. And if you can tell, it should be possible to prevent it.


This gets him, though.

https://image.nostr.build/28d6c12870bd69f859d08a31cf4d9cf9ef7b25c48ba1ea319aec7aabe0cac919.png


Look how much crap is blocked by just requiring the user to have a kind 0 on the relay already. That's like 90% of it.

https://image.nostr.build/51e05c9ce00885ea211a0f991015de023dc20649f5934ab23fa1a1a69c53d093.png


Cloudflare suddenly started blocking websocket connections on all my websites and they got totally fucked.


Friendship ended with #SQLite. Now #PGlite is my best friend.

https://gitlab.com/soapbox-pub/ditto/-/merge_requests/485

#Ditto


Congrats Mike!! Great quote. 😃


Sorry, my client doesn't support DMs so I have to remember to check on Primal! I replied!


Japan is king of doing things they're not supposed to while still respecting laws and traditions. Like emoji reacting to a website.


So much better than you would think. Not a moment was wasted. I'm in the Halloween spirit. 🎃


Beetlejuice restored my faith in humanity. 😃 Unlike the debate.


While y'all were watching politics, I was watching Beetlejuice.


Here are benchmarks: https://pglite.dev/benchmarks

The Nostr Postgres schema is inherently faster than the SQLite one because: GIN index on jsonb allows fast tag queries, and upsert syntax improves replaceable event inserts. This is ignoring the fact it runs in a separate process and uses multiple cores.

So even if the baseline wasn't better, I think it would still be better. But in many cases the baseline is better.

Also I don't need to run it in production, just need to simplify my codebase by removing SQLite support. With pglite I can do that without sacrificing anything. Good developer experience all around.


This madlad wrapped PGlite in a server to just recreate Postgres, lmao. https://github.com/electric-sql/pglite/issues/38#issuecomment-2041011071


Honestly not bad!


I forked #pglite, learned about the Postgres wire protocol, fixed how it serializes query parameters ( https://github.com/electric-sql/pglite/pull/306 ), deployed my branch to npm and got pglite working in #Ditto.

https://gitlab.com/soapbox-pub/ditto/-/merge_requests/483


I am learning how to hack on the #Postgres wire protocol directly: https://github.com/electric-sql/pglite/pull/306


Accidentally visited gleasonator.com and got very concerned that everything was broken, then realized it's Pleroma not Ditto.


GM, figuring out how to build #pglite


Wait, they actually made ReplyGuy useful. I don't want to delete it anymore.

nostr:note1qf6qmgy02a5kesjax8d3psj8za3srlzxkzm46d83xe3ujjne7pfslskm0j


It's true, and this is the next thing I'm working on after I make ReplyGuy go away.


The one thing that I really like about Texas is the awesome Pokemon found here.

https://video.nostr.build/17fa42589271b55e5abeea435e9d53ddf2cbcce7c5e12c11704b9a05e27371f6.mp4


Does this only happen in the hashtag feed? Going back made the feed reload, causing the bug. Home feed doesn't do that.


By the way nostr:npub1g0tlqlgsh8nxyaz7zze0cgq6wnwp0z3s3sc5py6s6p4sg3mczmssqfhyrr , I added a ditto_ prefix to all the metrics in the latest Ditto commit. I think you're the only person who built a custom dashboard, so you'd need to update the metric names. Or try the new dashboard I published.


When building a moderation toolset, you want flexible pieces that you can use to quickly adapt to changing conditions.

The problem with this guy is he circumvented all the measures I already have, and I am unable to adapt to it quickly, because I am missing tools that introspect related events.

If I wanted to block this specific person, I would just block by IP. But that doesn't really solve the problem. My goal is not to block this specific person, but to build tools that make it easier to block specific behaviors. That way when he changes his script slightly, I can change my configuration slightly. It should be as effortless for us to adapt as it is effortless for him to circumvent.

All I need to do is expand my moderation tools to be able to fetch the author, fetch the replied-to event, etc. Then I can apply policies to any of those related events easily.

Then we are still playing a cat and mouse game, but at least it's a more fair one. Then eventually he will get bored and move on. But the next person will have an even steeper challenge that discourages them sooner. It's worse when you let them have a taste of it, because then they don't want to give up.


GM, challenge accepted. Today I will destroy the 16 year old Russian hacker script kiddies on Nostr.

nostr:note149a9s5svlwcmrxd43htz8yl99q6yrjjmqa4xkc6k0tqwrzj02mpqtaagqy


No. I don't think Bun is good. Deno is created to solve problems in the ecosystem. Bun's goal is for their VC investors to control the ecosystem.


It's September, therefore it's Halloween.


Can't believe this exists. So, you can resize/convert videos in the browser, but you have to download a 32MB file first. https://ffmpegwasm.netlify.app/playground


In theory you should be able to use any nip46 signer, but the only one that always worked in my tests was nak, which is a command line tool. https://github.com/fiatjaf/nak


#Ditto https://grafana.com/grafana/dashboards/21844-ditto/


I overhauled the database 5 times already so I can't promise. But this new version is working really well, and a benefit of Nostr is that once you have it working you don't need schema changes to process new events.


#Ditto with Prometheus and Grafana. See: https://docs.soapbox.pub/ditto/metrics#add-the-ditto-dashboard


💯  Trial by fire is the way.


It will be easier to develop code for it.


I used K8s extensively back in the day because I needed an API to deploy stuff across multiple computers. However nothing ever really worked right. I think it's overly complex and I try to use simpler solutions.


#DItto will remove support for #SQLite in favor of #PGLite once the last few issues are fixed: https://gitlab.com/soapbox-pub/ditto/-/merge_requests/483

https://pglite.dev/


I made a simple #Ansible playbook to upgrade multiple #Ditto servers at once.

https://image.nostr.build/f5f23bba172a685efeb43a81d9d1b35a10a01a7390107c1d368c7a2fb96e9b09.png
https://image.nostr.build/5d66cb88b200cd616c9b953cae20666ee3e996ffc230d961cee2a7faaa7ed0bc.png


GM from cicada

https://video.nostr.build/66373d8edea1fadaacd10f4c5590729fb6e80f3f2279254d4c6b16cdbd80797f.mp4


It's #Ditto with Grafana. See here: https://docs.soapbox.pub/ditto/metrics#add-the-ditto-dashboard


By IP? I was considering doing this too. I'm just limiting total number of messages and events from each IP.


That's my guess!


GM. Somebody is hammering my relay with follow events.

https://image.nostr.build/736c438a816522885b0ca7342a2fdd9f7d699edbdb223c3367c727e0d7cc69fa.png


hello


I fixed YouTube previews in #Ditto.

The solution... pretend to be Facebook instead of pretending to be WhatsApp. Seriously: https://gitlab.com/soapbox-pub/ditto/-/merge_requests/482

nostr:note10u20h8tapchfclckjc37an8rxyxnlqw56hdt6qr8zhcx585xaheqnjg8v2


Some retarded YouTubers ranting for an hour is not independent research. God the bar is low.


Thank you, I was feeling crazy over here. Like just because covid was overblown doesn't mean you should go around coughing on people to protest the government. Two wrongs don't make a right. That's all I'm trying to say.


The point of my post is that people are not good at critical thinking. I think you are kind of proving it because you're just trying to say why you're right.


Alright, I'll make it so this behavior is skipped if you tagged the replying user in your post. That makes bots that you opted into continue to work.


At least in this case you're pretending not to be a bot.


Zap notifications now live in #Ditto! nostr:npub1gujeqakgt7fyp6zjggxhyy7ft623qtcaay5lkc8n8gkry4cvnrzqd3f67z

https://image.nostr.build/25ddd980954dd3aa744ff4d2ba15901436d1bef48285a197acfb9c7c93d85be6.png


Could I commission you to do illustrations for Ditto?

Eg illustrations to replace the AI generated pictures in this?

nostr:
nevent1qqsr2e6rcgvrr9vn8e8z3vxjxlh8hgajspejygp0psmqqxgzkyagdnsprpmhxue69uhhyetvv9ujumn0wdmksetjv5hxxmmdqyt8wumn8ghj7un9d3shjtnwdaehgu3wvfskueqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzpn5hxe78t47er7umcw7xladm80d49svfgxluuteksctde0c2mlf0rnslrj


This is truly awesome!


Boy they have some of the most beautiful buildings ever made. But I still don't believe Mary was a virgin.


Haven't had time to do it yet, but aside from keyword filtering I think a good solution is to block replies posted within the same second as the original post. A real human couldn't reply within 1 second. Yes they can just add a sleep into the script, but it adds a layer to the spam filter. At the intersection of all the mitigations, spam will be reduced.

nostr:note1x3w56pr8evc2mhlssjxu8dwvjahnsue2v3605awr0xcustckql5q39ul9u


I think the truth is found in the desert.


Hey fellas.

https://image.nostr.build/b7c8ca22f2c027aa0b0ad9572ed02dbf1a4831e6d8a7e798101593d61d908dc6.jpg


Fine, you're right and I'm wrong.


This is why #Ditto is better, lol. 🪐

nostr:note1qqqp9vuc5q7r4gm7j26hh2gltlg99x3fjve4ujux92sh3hjla2jslaa0yp


If you completely enclose yourself in sealed glass and kiss someone through it, they will not get sick. Viruses are physical things. Masks obviously have varying levels of effectiveness depending on the materials used. Are you talking just about N95s? I do not need to see a study to know that physical barriers prevent diseases. At the very least a mask would limit the distance around you that a virus would travel if you cough. This is common sense to me.


Do you believe in courtesy at all? Like if someone cuts you off it's your fault because you decided to drive? Most of us have to live in a society. If I could live in the woods, I might.


Do you think the truth is found in Tim Pool, The Washington Post, or something in between?


My favorite movie of all time.


It's like saying condoms have no effect just because it doesn't work 100% of the time. Just look at the thing, of course it works, if it's more than a thin cloth.


Some people don't mind being incapacitated for a week. I very much do not want to be. It's not life or death.


I'm about to get sick for a week because of all these retards on the plane coughing all around me and you don't care. It's just common courtesy. Like not cutting people off while driving.


The pandemic made people retarded. If you're coughing on an airplane you should be wearing a mask, but people aren't willing to do it because they feel lied to and afraid it makes them look cucked. Sometimes critical thinking requires you to side with something you disagree with in alternative scenarios.


I drove a boat in #Amsterdam.

Finally on my way back home! ✈

https://image.nostr.build/017c2cd2cbe89bee1b2bc8b5113a01b19a77f52d7888232757fae636d08f974b.jpg


Awesome end to the Amsterdam trip to meet up with nostr:npub1qe3e5wrvnsgpggtkytxteaqfprz0rgxr8c3l34kk3a9t7e2l3acslezefe at the site of #Nostrdam!

https://image.nostr.build/f62580dd9313fb6360b7564567fcb458c669494d6e4e8bdf00eb76100c77f6f0.jpg


Yes sir!


nostr:npub1jvnpg4c6ljadf5t6ry0w9q0rnm4mksde87kglkrc993z46c39axsgq89sc #Netherlands

https://video.nostr.build/066b6ea4c5251a02772697ec0d006ea8c29605c7692fa16ebd6afbed371c4735.mp4


Yes. It takes advantage of modern JS features. Calling "break;" ends the subscription, or you can pass an AbortSignal into it to break it from somewhere else.


If you break out of the for-loop it automatically sends a CLOSE message to the relay, ending the subscription.


Glad you understood. 🐵


Humans are monkeys, using our monkey hards on our monkey phones. Ordering monkey food made by other monkeys to serve monkeys. Don't correct me to say we're actually apes.


First bug on my list is to fix the bug where media attachments are posted in a random order.


Having the time of my life in #Amsterdam. I can't believe this is still the #Riga trip. But getting home in a few days and eager to start fixing your bugs.

https://image.nostr.build/c65a67c3f8452f8691ce3efad89ad4f146b44c383aacedd58a49c0bbb1fdff8a.jpg
https://image.nostr.build/4c225d4ef500da4be2e51db0ec542eb0fa854335b03374b1c5b2d74719e75905.jpg
https://image.nostr.build/8e02292908b4fb6c8f9f4f592ecd023fda97cf6952022abcfcaf264035546da2.jpg
https://image.nostr.build/6b01300dee9ce4b1c5ce956924a2f4782069173404d85967eb8be875d9bc5313.jpg
https://image.nostr.build/8398f19f7ec85ffc2c0f19bf48346f61f5c2e9781a0cbad85144cf7b5267b9bc.jpg
https://image.nostr.build/c9b150cc81948e7a4acf7aa03bda40ecd7cc141cf5e2fb95094c52f940ca8ff5.jpg


Is there not an error in the top right corner?

If it says "event does not exist", it means that we are missing your follow list, so add the ditto relay to your other client and follow somebody, and it should push it through.


They don't drink water in Europe.


But if you want to use cobrafuma, you should just use cobrafuma.com... that is the intended experience. You are trying to go outside of the intended experience. Which you can, but it's not streamlined.


I mean, it works perfectly but you basically have to be a developer to understand how. It's not just me, the Nostr ecosystem has to evolve in this area.


Mastodon support is kind of half baked. Check back in a year.


Nintendo never sent them a cease and desist...

https://image.nostr.build/9076f555dc19e08587e5f3ae22a9862ef585218288d34d37f14b766de0bc319b.jpg


This is a top priority to fix in the next version.


Not possible. The whole point of Ditto is to make Soapbox work on Nostr. Without it, Soapbox is just a Mastodon client. It would have to be a full rewrite, and it would be worse.


I was wondering what that was! But the one I saw was some ancient rock.


Of course he didn't reply. 🤣 Coward!


It's cleartext because it's just easier. There have been proposals to do E2EE on Mastodon, and there's even a branch where they implemented Signal's protocol, but it's too hard to have a cross platform experience with the preferred UX unless users control their keys directly, which users on Mastodon don't.


Trekking across Amsterdam, 7 bridges, took a wrong turn and have to go back. I have to pee very badly. Fighting with the broken pay toilet that won't open. I go in somewhere and she kicks me out. I cross 7 more bridges. It's raining. At this point I'm about to pee my pants. I walk into the vegan restaurant. He says "1?" I say 2 (my wife is behind me but not running because she doesn't have to pee). I tell him please let me go to the toilet first, because I'm about to pee my pants. He points me up the stairs, I go up, and I see this.

https://image.nostr.build/ecda86679cfd9db17844f30c66bcc3db54e0fe00552cc60f89c8b3ca4fc9cd2a.jpg


Yep.


Fixed: https://gitlab.com/soapbox-pub/ditto/-/merge_requests/475


yolo


America and Europe have very different ideas about human rights. In America you have to pay for healthcare, in Europe you have to pay to drink water and to use the toilet.


Honored to be on your same brainwave, Mr. Gigi-san. 🧠 ⚡


Just cat events.jsonl | deno task db:import


Fuck god dammit this is annoying.

https://njump.me/nevent1qqs23wkmfqxc3708k6sfqdpz08h50mgwpgucnmv9lzvdlmwxh62zyhcpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqgdwaehxw309ahx7uewd3hkcqgcwaehxw309aex2mrp0yhxummnwa5x2un99e3k7mgpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzqprpljlvcnpnw3pejvkkhrc3y6wvmd7vjuad0fg2ud3dky66gaxaxfmdkp


>Ditto still does not show the usernames correctly and profile pictures

You need kind 0s in the database for those people. Check this post: https://gleasonator.dev/nostr:npub1q3sle0kvfsehgsuexttt3ugjd8xdklxfwwkh559wxckmzddywnws6cd26p/posts/a8badb480d88f9e7b6a090342279ef47ed0e0a3989ed85f898dfedc6be94225f


As for Amber + Fedilab, in my experience it's finnicky. nak is the only nip46 bunker that works correctly 100% of the time.


Well, do you remember when Ditto was first released and some guy overwrote his follow list and everyone had a meltdown? To fix that I had to require that people have an existing follow list in Ditto before following will work. If you generate your key through Ditto, it will also automatically generate an empty follow list even for you at the same time in recent versions, so brand new users who start with Ditto will have no issue. But if a user started elsewhere, and your Ditto server doesn't have their kind 3, they won't be able to follow until they get a kind 3 into it. I know this is bad, but it is a fundamental flaw of Nostr itself on a protocol level. The best I can do is try to work around it. I am overwhelmed.


With a Mastodon app?


How?


I was able to follow.

Are you using a browser extension?

https://image.nostr.build/b427e0b772cc137fd54338be3ad83196fdb5e33058f99ac2dd1e07214dd9d7bf.png


Which Ditto server are you using?

What happens when you try to follow?


Master trolling

https://video.nostr.build/d8b66ce8677971c60b49189e868372ae552c8ba11a05d7d9b6fee1aca5c987e3.mp4


Half of these don't make sense. Can you at least log in now?


I'm aware of it


If you can't handle me at my shitposts, you don't deserve me at my blog posts.


It doesn't look like that...


I'm vegan and I have a big dick.


O site funciona perfeitamente no celular. As lojas de aplicativos móveis são apenas mais um ditador e mais uma oportunidade de ser banido. Sites móveis são o caminho.


It was good. Better than any pink slime most people eat.


Absolutely. 🌱


Eating hamburgers in #Hamburg

https://image.nostr.build/b53dcabacefe404019ff6052cce5b67b0503dda526acb1a1be921fc2e34c93cc.jpg
https://image.nostr.build/5d0dde07042afc903a7272d5073e92ad12e1eb32030b09c687ee902db23a3716.jpg


I think everybody here is non-binary and I'm waiting to be arrested for my intrusive thoughts.


Heard a woman yelling at her boyfriend on the phone. Then I realized she was just speaking German. Then I realized she was in fact yelling.


You're awesome!


Hello from Hamberg, Germany. I do not want to be in Hamburg, Germany. I am tired of Germany. However, I will embrace this moment to eat a hamburger.

https://image.nostr.build/113ff8c3844478b630d2e5ea6a6b85c75fda40445f641d44de77c884d454743e.jpg


Sounds good, if I can get on the right train.


GM Nostr, we are trying to go to the Netherlands, but we are accidentally going to Hamburg! 🇩🇪 ✊


College is adult daycare


That is a good point. nostr:npub1jvnpg4c6ljadf5t6ry0w9q0rnm4mksde87kglkrc993z46c39axsgq89sc


Giving admins the power to delete your livelihood, sounds like it will work out great. I hate that journos are promoting this shit.


Following hashtags is not very hard.


It works, I do it myself. Is this a managed database? It probably requires a cert you have to include with --cert or DENO_CERT env.


Friends, we have put together a guide for people of Brazil leaving X to join Nostr! Please take a look.

https://soapbox.pub/blog/how-to-join-nostr-brazil-cobrafuma/

nostr:note18fac7k3gmhvalvxssdhm4mkpdv7rc7nuq6q9c4rfww43n0wvegcqz9zah5


Amigos, preparamos um guia para as pessoas do #Brasil que estão saindo do X para se juntar ao Nostr! Dêem uma olhada.

https://soapbox.pub/blog/como-entrar-no-nostr-brasil-cobrafuma/

🐍 🚬 #Ditto


353,555

Here is the jsonl file if you want to look at it. Sorry that this is a Google Drive link: https://drive.google.com/file/d/1O_jmjQnc0-a-XPSiJhN7xuNE_LPKsTng/view?usp=sharing


All of the kind 0's on Nostr are only about 250MB.


(Eu também entendi seu pedido. Isso só me fez pensar nisso)


Você deve solicitar um nip05 no cobrafuma para aparecer no feed da comunidade.

https://image.nostr.build/6189e6f7baf6939cd6538b630fdbee1b7a577cdad75f4310d9cbd9d141f5d776.png


Check out: https://gitlab.com/soapbox-pub/soapbox/-/blob/main/src/locales/pt-BR.json?ref_type=heads

cc @danidfra.com

Thank you!!


Good idea!

I think I will add translations for posts first, then it will open up this possibility.


Vegan DJ at vegan festival has a hat that says "Don't Eat The Homies"

https://image.nostr.build/9cb036d39286d6e0693f962512b85591f5530f3121d697fc7a31a0afdbf844b1.jpg


I am at a #vegan festival in #berlin eating #vegan food because I am #vegan

https://image.nostr.build/808b3b90858acb87ec31a33ff98e7268b6b9da8603fc64cf9869a061731a8488.jpg


I don't understand why you need that. 🤔


People need to request a nip05 then the admin needs to approve them. I'm working on improving this.


The Berlin Wall

https://image.nostr.build/f610a83b8e6668740e48d1888596ac51be3e061a6b4cab5962df2aa6d6695352.jpg
https://image.nostr.build/46eba87f1c0337a9968032a85093688cc86fd8dfa2257e85ace4348173d3554d.jpg


GM Berlin

https://image.nostr.build/4e3b9b5df28ea7d4607c838153fb6039ce5eccf55d7a160b80c12b3022233b5a.jpg


I don't see why not. It isn't packaged so you'd have to install it manually. Also, I don't think anybody has really tested Ditto on ARM devices, but it should work for x86.


poster.place right? I was able to log in 🤔

https://image.nostr.build/6ab9c48d23d23183c31df8a63dbf641665aaf078a774df5ed2904c0f24d27e6c.png


And it's still happening?

We do rate limit out of the box now, so you don't need any extra hacks.


That just means it failed to connect to the signer. It indicates a failure with the relay. Unfortunately the relay used to sign events is the same relay exposed to the outside.


Signing events uses the relay. So a policy could also affect it.


Have you restricted websocket access? That nginx hack thing you did maybe?


Someone else today said something similar, but I'm having no issues myself. What browser?


If you're scrolled to the top, new posts will appear in the feed automatically. If you're scrolled down, the "X new posts" button appears.

There is an awkward spot between the two where new posts don't appear, and the "X new posts" also doesn't appear, because it would block the text box at the top where you can write a post.


Meu amigo nostr:npub1e6tnvlr46lv3lwdu80r07kanhk6jcxy5r07w9umgv9kuhu9dl5hsk9gqft traduziu toda a interface do Soapbox para o português bem a tempo!

https://image.nostr.build/3129e2ead51448412063920181df2f31d357ec08cd168fd55e39e99a7510afab.png


A hashtag correta é #brasil

https://image.nostr.build/31ea6d891af9b8c6b549a45da7bb1056f6dbe246ce38548c401000fd54ac47da.png


So far I've visited Riga, Vilnius, Warsaw, Prague, and Berlin. I think I liked Prague the best. There's just something about it.


Obrigado!


Berlin is like if mastodon.social was a city in real life.


É isso. É um aplicativo web Nostr para o Brasil.


É um ponto de partida para pessoas do X. Não há benefício em usá-lo se você já estiver satisfeito com um aplicativo Nostr diferente, a menos que você prefira a UI.


nostr:npub1l3fkjm58m0xt0dvnjmfhheq5z2ka85r5pmdu5mj27wknpluc8q0q3pgkxn nostr:npub1sud49qf0x08mnxjj4wnvvfrsdankpafgcdwc6sfx6294xengty8qk8z440 Bem-vindo à Cobrafuma! 🐍 🇧🇷

https://image.nostr.build/c5eab3e9d4ddaba264fb56bc9995cb59af8308694b290e2bf79e509e6395b762.png


These things are working as "intended"


Not sure what to say. It works perfectly, except a few hours here or there when the relay gets DoSed because Nostr, or the Mastodon server is blocking messages because Mastodon.


I have renamed this website to Cobrafuma! #Ditto #Brasil

nostr:note15q70qzme087gj9nc7yducx63r9sd4z2k52guz9cmxrkgn0jwhlaq405kfx


The UI is missing nip46 login. I will add it. You need a browser extension for now on mobile, unless you use FireFox Android with an extension.


Sim


It's bridged in both directions.


With or without an extension? Which extension? Which Ditto server?


You can't paste a bunker URL into the web UI yet even though the codebase already supports it. It will be added soon.

If you use a Mastodon app you can actually do it. 🤔


Hello nostr:npub1vaz36aqfwh7uar7wwqc8eg8f86kgsh8r78gle7ehsdnwl9c98qwqr07xck I'm in your area. Should we meet?


This website will be down for a minute. I am renaming it.


Please explain this idea more. Is this a serious proposal?


I kind of appreciate that.


Guys, why did no one till me "Dito" is already a Portuguese word??

nostr:note15r0xhhjxmhahkdkcd7hx70hesxwk087d44053qem5ql4dfmzcv4sf36gqm

https://image.nostr.build/cdc1603fdb4827e4ef23de49bcf70117bd408314d0e60183f5db457a65bbba35.jpg


Please explain what the hell I just watched 😂


Thank you, I just snagged this one. Not sure I will use it but a good option.


verdade.com.br is taken. I have verdade.br.com (yes you read that right) but this TLD is considered scammy since it's just reversed from the other one.


Acorda nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z !


Verdade.us is very wrong though, right? I could get verdade.com for $55,000, or try to negotiate verdade.social with a guy on LinkedIn.


Brazilians (and Portuguese) of Nostr, please help me name this website!

Verdade means "Truth", which is a cheap shot at Truth Social. But I need a better name to make this site succeed. The problem is I'm just a dumb American. 🎆 🦅

Please help me brainstorm a better name! 🇧🇷 🐍 🚬

nostr:note15q70qzme087gj9nc7yducx63r9sd4z2k52guz9cmxrkgn0jwhlaq405kfx


nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z what do you think about these names?


GM, we've created a Brazilian #Ditto server! We're still working on the name. We are looking for feedback, and to make connections with Brazilian influencers. This is our time to shine, Nostr!

https://verdade.us


Thank you! That's already very helpful, shared with my team. We'll working on it.


Good to know, but I think I don't want it called "Truth"


Yes, but I want to figure out an appealing name for this website regardless of TLD first.


First off fix the name. It's a placeholder.


This is such a mess.

https://image.nostr.build/f22ef5b82fad52f7f8e28e61f0c00923f54a97f2eb35f459a8482995a0e2af0a.png


Yes a nice jab, but I want a different domain. I need help from the people of Brazil to get this thing off the ground.


I already created verdade.us but I don't know the correct way to brand this.


I was gifted an extremely rare and precious item by Melvin nostr:npub1melv683fw6n2mvhl5h6dhqd8mqfv3wmxnz4qph83ua4dk4006ezsrt5c24 and I'm not going to tell you what it is.

https://image.nostr.build/1c65b6c5c1d4e373e11aad484718b058d04eb64e864b392b195e5a12725537fc.jpg


This looks great!


Good morning Children of God.

https://image.nostr.build/5f8cb6a3676336ba570a00b3917a3f8578ff671897b5356f4c0ccad1a96e0522.jpg


That's not a cat.png


Good question. Trends in #Ditto (hashtags/posts/accounts) uses a trending tags algorithm, where tag usages result in higher ranking.

Here is the one for trending accounts: https://gitlab.com/soapbox-pub/ditto/-/blob/main/src/trends.ts?ref_type=heads#L153

(At the top of this file is the actual algorithm, which is just an SQL query)

Trending accounts look at the highest used p-tag values across kinds 1, 3, 6, 7, and 9735.

The reason it's mostly cringe Bitcoiners is because of including kind 3's in that. Due to the way follow lists work, a user's entire follow list updates the counts for trends if they follow even just a single person within the trend timespan.

However, if I remove kind 3s (which I've tried), then the focus is mostly on people getting mentioned in replies, which could mean they said something controversial. After seeing some swastika avatars in there I added back kind 3 for the sanitized experience, but i know it's still not ideal. We need something in between.

Admins of Ditto servers can also manually curate people to show up there.


Stop harassing my team you germ.


No, the server is "open" since the relay is open, it makes no difference. The only protected resource is nip05 names and there's no way to manually assign them. The user has to request one for you to approve.


Please help improve the translation! https://gitlab.com/soapbox-pub/soapbox/-/blob/main/src/locales/nl.json?ref_type=heads#L153

The frontend is in fact a fork of Mastodon's frontend started many years ago, completely rewritten in TypeScript and Tailwind, but those pieces of text survived. 👀


Thank you!


Man they really fucked up by crucifying this guy.

https://image.nostr.build/f73bea963d68914eee39a1ccd9aa44eec434582634897ca8215dc865471337ac.jpg


Of course. I abide by strict veganism and Stallmanism. https://gitlab.com/soapbox-pub/ditto


That's awesome!!


Sedlec Ossuary in Czechia. ☠

https://image.nostr.build/7390e7745e7634ce8717b18a7d55ba2592047d05fa4af487e90d100b6b0053d8.jpg


I stand corrected.


You have to be funny, otherwise there's no point in any of this. You have to be funny and be brave. You can't be stupid and brave, you have to be smart and brave. But you have to be funny.


Inspiring.


Approved a bunch of names on ditto.pub


Believe it or not, this is literally a vegan hotel in the Czech Republic, with an attached all-vegan restaurant. I didn't know such a place existed, and I cannot understand why you would book such a hotel and then eat KFC in the elevator... unless you're a professional troll. 🤔


Thank you OpenSats!!! Don't let your memes be dreams!! 🔥 🔥 🙏 ✊ 💜

nostr:note1tcvrctjc9qfx9mtmgtpnqywqqpzuaf4n083xnh5v6yrhytsnr42qf98rcj


Not with that attitude


It's a roller coaster of emotions once you realize the truth. Zap me 1 million sats and I will tell you.


This is a good post.


Life is an anime. Don't let anyone tell you otherwise.


If you don't like humanity, don't blame me.


For those who don't know, Melvin invented the Internet.