Yes, but all the implementations I've seen start from the seed (whether generated or mnemonic). I want to start from an already existing keypair (like a nostr keypair) and then derive from there. I'm wondering if there is an agreed upon want to get the chaincode needed to start deriving.


Anyone know if there is a safe (and better yet, agreed upon) way to do derived keys starting from a keypair instead of a master seed value?


Exactly.


I think it is important. Less for relays and more for clients. Using gift wraps means that you're open to the possibility of getting DDOS'ed which messages that you have to decrypt to see if you're even interested in the content.

Having to send messages to many users (fanout) defeats one of the main reasons for using MLS in the first place. We want big groups to scale really well and be easy and fast for clients to update. In this way, they pull down only the events that they care about (for the groups that they're in) and only have to do a single decryption to get all the data they need to properly process the message content.


They can't see anything if they can't read out of the relay. So as long as you trust that the relay isn't trying to do metadata gathering and it's implemented AUTH, then you're covered.


nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z ☝ Thoughts?


It's ok Doug. Remember, both sides of the curve win. While I think I'm on the same side as you, I'm sure neither of us are in the middle. 🫂


It really is shocking just how patronizing the EU is towards it's citizens isn't it.


Personal responsibility maximalism. I love it.

nostr:note18zh35cfna035k0z4emwl0r4vlu2jhz5hn33ql5ldg9rzws07p7js09af36


what the fuck?!


New life goal.


nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft  nostr:npub1klkk3vrzme455yh9rl2jshq7rc8dpegj3ndf82c3ks2sk40dxt7qulx3vt  nostr:npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn would love you guys thoughts on this.


It must be so much fun to get these letters and know that you're rich enough that you don't have to give a shit.

The EU is completely delusional and powerless, they just haven't quite copped it yet.


Welcome Rudy! LFG! Looking forward to zapping you generational wealth.


GM Nostr 🌞

🆘 I need feedback on an idea related to private group messages.

I'm working on the format for sending group messages via relays and had an idea on how to encrypt messages in a way that saves a lot of work for both relays and clients. But it has some tradeoffs. Here's how it works:

1. Imagine you have a group of n people. The group has an ID value (random string) and each group has shared context that means they will know how to decrypt messages but if you're not in the group, you won't be able to decrypt. This shared context rotates regularly, ensuring forward and PCS security.
2. To avoid having to send each participant a gift-wrapped message, we encrypt the message content using shared group secrets and put that in the content of a Nostr event. This is an encrypted blob that is NOT using NIP-04 or NIP-44 encryption, instead it will be using MLS native encryption which has information about the sender as well as the message content itself. This event is published to group relays using a disposable identity, not the user's main nostr identity.
3. We put the Group ID value in cleartext in an indexable tag on the Nostr event.

This last point is important. Let's break it down:

– Clients only have to publish a single event to send a message to all participants (nice) ,
– It's trivial for members of a group to watch for messages they care about via a tag filter (very nice) and ;
– (the tradeoff) Observers can see how many messages are being sent within a group and when they're being sent but they can't tell who is in the group or who is sending the messages.

I think that this is a fairly reasonable tradeoff. I'd love to hear thoughts or — even better — suggestions on how to improve this.


Unsurprising.

https://x.com/carnage4life/status/1823041518925705564?s=46&t=rSFxvEDLdNDybA8mlE7YJQ


👀

nostr:note1cn5uyyvnw4snpss80tthsmnk8c9vjllqg2ekxm9nza2a6n0znk8sn7s69r


💯 They're still in the shade and moving fast though.

Everyone is executing well today. 😉


Does the UN actually do anything good? My impression of them is the blue helmets trying to keep the peace. But lately it sounds like they're spending time trying to strip people's rights rather than protect them...

Case in point, why are they listening to Russia and China about how to combat financial crimes?

https://www.ccc.de/en/updates/2024/stopp-cybercrime-convention


GM Nostr! 🌞 It's savagely hot. I've workers doing demolition on the floor just above me. And yet, I'm so excited to be back in front of the keys. LFG!


👇👇

nostr:note15ktrj0sf3uccc70dy0g0e957u2z6vgjy4nl9mdmz2f8jt94kkvts3074wf


Hey – NDK does support NIP-46 remote signing and Outbox.


Tongue in cheek but not that much...

✅ Multiple ways to achieve the same result
✅ Super simple structure and lexicon
✅ Runs on all web standards
✅ Strangely flexible allowing you to achieve insane results


Feeling incredibly grateful right now. Just arrived home to a valley that I love after a few weeks holiday with my wonderful family in the place I grew up (which I also love).

Other than the 26 hours without sleep, this is a great feeling.


Pseudoscience? No problem.

Circumstantial evidence? No problem.

They’re just going to do whatever they want. No matter the truth.

Rule of law is the most critical part of a functioning society. If you can’t be sure that the courts at least try to treat everyone the same then what’s the point? nostr:note1rs0r8dlggamrtaxq44xh8kxgqzy9p7pvvtmc0vgdpm4r3w4gdjgq445pzy


Waiting on my flight home. So pumped to get back to work. 🤩


Can’t wait to read it!


CSS is infinite.


Getting closer to V for Vendetta each passing month...


yeah, soooo hard.


Yeah most clients give you a global feed


Nearing the end of my holiday.

This one has been more nourishing than most.

Please, if you haven’t had a break from saving the world to simply savor the moment, do it, soon.

It doesn’t need to be fancy. It doesn’t need to be far from home. It just needs to be focused on enjoying the present moment.

You might have to fight the guilt most days; just reading and playing and enjoying the people around you, but I promise it is worth it. Life is short.

nostr:note1ltrcgm4sz6std8wle46mxwl860qxgzyrn4lsr9l32l3p0ml89l8swr0fnt


Welcome to the beautiful chaos!


Such a great reprise to stack more before we never the 60s again.


Loving seeing so much art up for auction for bitcoin.

https://auction.2140.army/home/34-satoshi-a-self-portrait.html


The mountains. Definitely.


Wrong question.

The conception of the idea is art. The "making it work" is the application of craft.

Science is concerned with the search for truth.


So much work to be done. But it will be done.

nostr:note1te09hh85v6sa7wcfd0pgwv4h0qtnyh6j8kqvmlp09gthl6awwtlqprfjdn


That’ll do. 👌


Found this post by  nostr:npub190dy7q6yd0qudlcqt98r2zs70mzhlwwdcjnm2f55yg74dns9n85sja09r3 on Xitter today and it just shows how much noise there is out there.

Bitcoin transactions per attendee tell us about the quality of the crowd that attends these conferences. Sometimes we get blinded by the shiny lights and big names but forget that NGU is not what matters.

We need to live by our words and beliefs.

I am also beyond proud to see how one of the smallest conferences in Europe, Baltic Honeybadger by  nostr:npub1yul83qxn35u607er3m7039t6rddj06qezfagfqlfw4qk5z5slrfqu8ncdu, has the highest number of transactions per attendee.

Even prouder to work with and call my best friend, the mastermind behind this conference,   nostr:npub1zu5tdnq7w63fgmsfz85te7e6zeg7y2lt8q8r9jp5zcg68jfy73jqraqtgz and to have done the same set up for  nostr:npub1h493d0qgwhu95s82zd9sxrt3ckn3ttgvaf04z02neckadxw5fkvqte4cwz with her.

All of these conferences are organized by bitcoiners who do this because they clearly see the importance of leading by example.

Like Anna,  nostr:npub1tdc9um9kqfp9cqvjqtwswzsvqzdsgzkpn9swamed3286kfwpaljsrr8r0y,  nostr:npub1f40egu9fymsz0qmg9cyqgtl0u7vznxsyr3czse6x66jp3d9723uszajn7l, and  nostr:npub137x48n3c7wzyaawmeydkwdxdkvg3gd2mvpp6phrjft9y5xrxqa9q9kz69c are good people who put in the PoW to ensure their cities learn about and use #bitcoin.

Great job, guys 👏! I want to be like all of you when I grow up!

Number of Transactions per Attendee
Bitcoin Atlantis vs Bitcoin
2.917 > 0.03835

 nostr:npub167n5w6cj2wseqtmk26zllc7n28uv9c4vw28k2kht206vnghe5a7stgzu3r vs. Bitcoin 2024
0.728 > 0.03835

Baltic Honeybadger vs. Bitcoin 2024
4.907 > 0.03835

https://m.primal.net/JkLK.png


100% accurate 🤣


The most one way door I’ve experienced so far in my life.


Go follow this account.

What’s happening in Venezuela right now will barely make the news in the west given the Olympics.

This is important. And heartbreaking. nostr:note1cgphmz3z2yqc30vxvn4w5a50xhk8x4z62tq5ej227l4ylx3fk02sfc2jd3


No. Just reiterating my feelings.


wtf. nostr:note1cvws02uathhz9qvgpdszr8ge24rldzp6yy9wy0ufz02uvprjydnspyj28h


Fuck Nicolás Maduro.


The chapters are all short and super focused. Wisdom dense and written in an elegant and concise way.

A joy to read. You want to have a highlighter handy for sure.
https://m.primal.net/Jhzu.jpg


GM Nostr. 🌞

Highly highly recommended reading.
https://m.primal.net/JhyM.jpg


It's just an added protection against an attacker being able to observe traffic and understand message lengths. Like  nostr:npub1fjqqy4a93z5zsjwsfxqhc2764kvykfdyttvldkkkdera8dr78vhsmmleku said, it's not a block cipher so it doesn't need to always be of a specific length (to match the block).


Yeah. Actually that might be a good way to think about it


☠

nostr:note1a8xyne6d6zrcsr0yucvc4un8e4sp57cjnl62mwk30ragjxdzrmvqxznhjv


Got mine recently too. It's actually SUPER nice. Very easy. Not a device for people looking to do anything complicated or custom but it's great for less technical folks and gives a lot of piece of mind (basically the perfect device for family members, which is what I got them for).


yeah - we're so close to the swiss border that I get most of those benefits here without the high cost of living. Unfortunately, the lower taxes and less bullshit regulation are the parts we don't get 🫠


Gorgeous.


🤢 all politicians are crooks and liars.


Exactly. It's likely great for low-bandwidth / focused use-cases.


GM Nostr 🌳🌧🌳

I'm sitting here listening to the rain and the forest, drinking a cup coffee, and thinking about Europe and the direction it's headed.

On one hand. I LOVE where I live. The quality of life is off the charts; I've got great friends, good food, and insanely good access to all the outdoor activities that makes me happy.

On the other hand. It's becoming more dystopian every month with the continuous stream of AML/KYC/Taxation/Prohibition laws being proposed and/or coming into force.

The continual gaslighting and incompetence that goes on at every level of government about the causes for rising cost of living and deteriorating economic conditions is also beyond absurd.

It's not the continent for running a business. It's not the continent for building wealth. It's not the continent for being free and having agency over your life and your finances.

I don't want to leave my valley. But I don't want to be subject to the EU bullshit either.

I know I'm mostly complaining here, and I'm certainly not expecting anyone to have any answers for me, but it's something I think about often and I wonder how many others are in similar situations.

I'd love to hear from folks that have left Europe (or other crumbling empire states) about their experiences.

Also – where have you all found to be the most free & open jurisdictions in the world?


I could have told you this without the expensive study 😂


Thanks for all the great episodes, I'm going to miss the show.


They all know who is talking to who. I also love it, but can’t follow anything.


Someone woke up and chose violence this morning.


Let me know how it goes. Sounds like a good business idea. 🤣


I’d take that run any day.


Amen


Looks nice! Check out nostr:npub149p5act9a5qm9p47elp8w8h3wpwn2d7s2xecw2ygnrxqp4wgsklq9g722q feed. He’s been posting some cool videos recently of UI prototypes I think you would dig.


Guys, did you know there is an immortal jellyfish?! 🪼

Nature is batshit crazy.
https://m.primal.net/Jaby.jpg


Feels accurate.

nostr:note18v63jjdmqjeh8sal40mf6rxd7cy38h2xd47tux4387wmmt5tk58sw0cxlg


This would be so dope


it’s always easy to convince ourselves the work is more important. And it is important. But so are other things. 🫂


Let me know if you want to chat. Happy to catch you up on things in more detail if you want.


LOL, good point.


Yes, but it doesn't work consistently. Way too complex for most users.


Yup. I saw it. I've been trying to talk with them about the details for months. The app still isn't released and isn't open source yet. 🤷♂


fucking legend.


Yeah, my three have been on holiday the last month and a half. The distraction, even at home, is real. 😅


Those forearms! 💪


GM Nostr. 🌞

Holiday with the family starting tomorrow.

I've always had a lot of trouble taking time off. I'm sure many of you can relate. I love what I get to call "work". It's intellectually stimulating, aligned to my values, and feels generally important in the "build the future you want to live" sort of way.

But, I've found that if I'm not careful, that satisfaction and feeling of doing something meaningful can quickly become a crutch that I use to avoid doing other things that are as meaningful (or more!) but that don't quite give me the same types of satisfaction.

Don't get me wrong, I love spending time with my family, but it's easy to convince yourself that other stuff is more important or more urgent. I mean, your family is always going to be there right?! (p.s. - this is obviously not true)

It's something I've been consciously working on the last few years. It's so hard for me but I've been forcing myself to nearly entirely switch off the work stuff for a few weeks a year. And you know what? I always come back with new ideas and more clarity about what I'm working on and why. Sounds trite and cliche, I know. But it's true.

So, here's to normalizing taking some time off and not constantly hustling.


Ok – so Signal is great. Good encryption, etc. Obviously, the main thing that we want to improve there is the centralized coordinator in the middle.

My original proposal was an adaptation of the Signal protocol for Nostr. https://github.com/nostr-protocol/nips/blob/2169fab971591d0b4a450ef08aeb6301c5d2a0da/104.md

But I got lots of feedback on that one that 1) group messaging needs to be first class and 2) multiple device support needs to be first class. Both of these are actually the same thing - supporting groups.

With the signal protocol, the way that the symmetric encryption works, when you're in a group, you're effectively creating a DM to every member of the group, encrypting it separately, and sending it out. Signal makes this feel like less of a big deal because they do some tricks on the server side to make it less heavy for the client.

In the nostr version of the signal protocol, you have no server to do work for you, so your device has to do all that work itself.

With MLS, because it's using a different data structure (binary trees) for managing encryption keys and users in a group, you go from a situation where group scaling is a linear problem (each new user in a group adds the same amount of work for all clients) to a log problem (where each new user in a group adds wayyyy less work for all clients).

There are also other benefits of MLS.

1) it's about to be an internet standard (like TLS, etc) so we conceivably get interoperability with other networks/clients
2) it's built to allow for the use of multiple ciphersuites and the graceful change/upgrade of the ciphersuites over time.

The only drawback is that it's very complex and very new. My work so far on getting MLS to Nostr has been focused on updating dependency libraries to allow for support of schnorr signatures over the secp256k1 curve (what nostr - and bitcoin - uses). I'm very convinced this is the right long-term solution for private messaging on Nostr but it's going to take a bit longer to get it probably ready for implementation.

If you haven't see it already, you can follow along with what I'm doing in my weekly posts. Also, if you're interested in working with me on all this, that'd be awesome.

nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxy6rzwf5xvmnwveh25uk9n


The rest of the world...

There, fixed it for you. America is the only country obsessed with grids and lights every block.


I think the main reason is that these services are targeting the entire internet of customers vs nostr, which has the more difficult price of entry, using public/private keys and bitcoin for payments. There is also too much of a focus in nostr on "what is possible" vs "what problems do people need solving". This is actually fine IMO, for now we're frontier tech, we need to experiment and try wacky stuff without too much of a focus on business dev.

Also, @levelsio is a special case. He's been at it a LONG time and has an incredible distribution network (his following) built up for all his products. Not many indie builders come close to his success.


Signal is great (it was the first to really bring forward and post-compromise security to a major app - and to other major apps). BUT Signal doesn't scale well for large groups. You're basically having a 1:1 DM conversation with each participant in the group. MLS solves this by using binary ratchet trees and makes groups much more efficient. It's also semi-agnostic about the ciphersuites used so it's built to be interoperable across different clients.


They would need to have some overlapping relays, otherwise they wouldn't see each other's messages. It would be up to clients that implement this but I would imagine that they would try and default to a set of overlapping relays between the users. Or use the user's inbox relays if it's a DM conversation instead of a larger group conversation.


No. I’m assuming that groups will use whatever relays they want and a combination of multiple relays for censorship resistance. That’s why the ordering might end up being tricky. But the hashing solution is actually fairly elegant. Only issue is if a specific note never arrives to some subset of the group. In that case recovery is very hard.


Thank you. I really appreciate the support! 🙏


I’m not 100% sure the range. I’ve been testing only with small groups so far and there fairly small in that case.


OFAC (Office of Foreign Asset Control)

They should just rename themselves to Office of Meddling in other People’s Business.

Pricks.


The main thing though is I would be bypassing the built in serialization and deserialization if I decided to use CBOR instead.


What he said!


Fourth turning moment if ever there was one.


Because the library already serializes and I want to keep things as light as possible. No extra steps or dependencies, if possible.


GN Nostr. 🌙


Super super cool!


This week's update on MLS is up. Specifically, if you're a dev, there is a question in there for you about your squeamishness about stuffing big serialized data blobs into content field of events. It'll be encrypted but the data that comes out the other side is meant to simple be passed into an MLS implementation.

In any case, always happy to hear feedback on anything in there.

nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxy6rzwf5xvmnwveh25uk9n


This is the fourth in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

## Previous Updates

- [June 28th 2024](https://habla.news/u/jeffg.fyi/1719562889267)
- [July 6th 2024](https://habla.news/u/jeffg.fyi/1720256910765)
- [July 12th 2024](https://habla.news/u/jeffg.fyi/1720778880538)

## Progress this week

The dependency train continues to roll. This week I was in touch with the maintainers of both OpenMLS and the hkpe-rs library and have pushed my changes forward in both areas. I've also gotten closer to understanding the wire format and relay requirements for the NIP I'm working on.

To be honest, the progress feels pretty slow at the moment but I've seen this story often enough to know that I'm on the right track. To be clear, my goal here is do this right _and_ make it as easy as possible for Nostr devs to implement MLS based messaging across all of Nostr. That necessarily requires ensuring that all the implementation libraries support the right pieces and that our NIP is clean and well thought through (no one likes a shed full of bikes).

### HPKE-RS

My [PR](https://github.com/franziskuskiefer/hpke-rs/pull/66) to add support for secp256k1 is moving. I've been adding tests this week and fixing a few issues. Once this is merged, I'll update my `secp256k1`-based library as well. One unfortunate roadblock has been a lack of solid test vectors - this has eaten some time.

### OpenMLS Nostr Crypto

I had a short call with the OpenMLS maintainer team this week and was able to clarify what I'm trying to do and how they see it fitting in best. I was also able to get a better idea about how clients will need to process incoming messages. One interesting highlight: **Messages have to be processed in the right order.** Otherwise it's impossible to keep the ratchet tree in the correct state. My left-curve solution to this for now is to use both created at (as a dumb first pass at sorting) + a hash of the previous message content. This will give Nostr clients a simple way to double check that they have the messages in the correct order before they attempt to process them. Unfortunatley, this doesn't do a good job accounting for messages that are missing. My guess is that this isn't going to be a major issue, but I won't have a clear idea until there is a working Nostr relay based demo.

The next steps in my code for OpenMLS is to refactor the ciphersuites trait to make it easier to use custom ciphersuites. My initial PR hardcoded our secp256k1 based suite into the library but the clearly better solution is to refactor a few things to make sure that there isn't any hardcoding in the main OpenMLS library, the ciphersuite, or the credentials (which hold your identity information and make prekey bundles possible). The library's maintainers are open to this, so I've started on that this week.

### Request for feedback

I'd love to hear from devs on one point. The OpenMLS library currently makes it very easy to serialize messages (both group control messages and actual messages between users). These messages have a lot of data in them about the current structure of the ratchet tree and whatever message or control event they're trying to communicate. My current plan is to simply NIP-44 encrypt those serialized messages into the content field of a new event kind. The messages themselves are deserialized and processed in two simple calls by the OpenMLS library so I don't see any reason to keep destructured or deserialized data in the nostr events that are heading over the wire. This also makes it easier to keep metadata about messages hidden to observers.

## Goals Recap

It's been a few weeks since I've talked about why this is important so, it's time to recap what we're aiming for:

1. Private and Confidential DMs and Group messages
   1. **Private** means that an observer cannot tell that Alice and Bob are talking to one another, or that Alice is part of a specific group. This necessarily requires protecting metadata.
   2. **Confidential** means that the contents of conversations can only be viewed by the intended recipients.
2. Forward secrecy and Post-compromise security (PCS) in the case of any key material being leaked, whether that's your main Nostr identity key (your nsec) or any of the keys used in the MLS ratchet trees.
   1. **Forward secrecy** means that encrypted content in the past remains encrypted even if key material is leaked.
   2. **Post compromise security** means that leaking key material doesn't allow an attacker to continue to read messages indefinitely into the future.
3. Scales well for large groups. MLS provides this from a computational standpoint, but we need to make sure this works in a scalable way when multiple relays are involved.
4. Allows for the use of multiple device/clients in a single conversation/group. Importantly, we're _not_ aiming to enable a device/client to be able to reconstruct the full history of a conversation at any point.

## Onward and Upward

Grind, grind, grind. Touch grass & hug family. I'm visiting family starting next week for a few weeks. I'm going to be taking some time off in there so expect a few light updates in the coming weeks.

The fourth in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxy6rzwf5xvmnwveh25uk9n


Yeah. This has always killed me. It’s been a long time since I’ve done much photography tho so I just tried to ignore it. Going to have to bite the bullet soon though I think.


What are the cool kids using for photo management/editing these days?

I've still got Lightroom Classic installed and haven't used it for a while but just tried and it's absolutely unusably slow.


nprofiles have relay pointers encoded into them.


Nope. I’ve been trying to talk to them more about the details for months though. Still waiting to see the code. 🤷♂


You can repay me by getting more dancers and artists on Nostr! 😅

We need more diversity of content.

Seriously though, hope the move goes well!


You’ve always been really good at opsec. 🥸


Stop sucking up to politicians and bankers.

Where we’re going, we don’t need ‘em.


Hey Canada-strichs 👇

nostr:note1w38ndh7defqdd3deyh0wsw79lnltf2832kq3s3djvrtwva6p63uqlkjc29


🫂 Next time.


Ser, wen lightning wallet?


🤣 Karma...


"The worst mistake is doing nothing because you can only do a little"


GM Nostr! 🌞

Build. Touch grass. Talk to other interesting humans. Repeat.

It really is that simple.


Fully agree with the over-diagnosis response.

I don't think the reality is much different than it was in the past.


Had been planning on it. Now not going - going to be on family holiday instead. 😉


Getting so pumped to be back in Riga soon!

Can’t wait to see you all there.

nostr:note18af2cfg73tekxp9wsnj8ks3nepq62pa6san4yp0e2wp4tqzy4z4qzzx354


1000% agree.


Setup a wallet and you'll really understand the meaning of that phrase. 🤯⚡


8/10 - missing duct tape. 😅


You are still missing the point and trying to argue about implementation details.

It's ok, I'm going back to the code editor now.


I wasn't being sarcastic. I actually LOVE thunderstorms. Always have.


The summer has been a bit non-standard - for sure. Though regular thunderstorms in the mountains are very normal. It's supposed to be 33º a bit later today 🥵 Honestly, I prefer the rain.


Yeah, I tend to agree on most of those points.

The Iain M Banks culture books come to mind here though. Most of the society is post-money / post-work because AI has reached the level of being basically sentient. The concept of "a job" doesn't exist.

Again, I'm not having a "how can we make this work now" discussion, which everyone keeps wanting to bring this back to. I'm simply thinking aloud about what it would mean to have a world where humans didn't "work" but rather did things they were good at and enjoyed and created value for the world.

UBI, in an odd twist, is one of the first times this discussion has reached mainstream in any meaningful way. Yes, right now, it's unimplementable BUT the question of how we can get to a world where human flourishing is more important than "work" or "being rich" or "being famous" is, to me at least, the only real question that matters.


GM Nostr 🌩 Enjoying the morning thunder today.


Exactly. This is more of a thought experiment to me rather than a discussion on the implementation details.

Say they could pay for it... would it be net positive or negative?


I agree with that 100%. If it's only fundable via theft, I'm not interested at all.


Yes, it now supports the same ciphersuites. The MLS spec doesn't specifically mention the secp256k1 curve or schnorr signatures but does leave open the idea of "private" ciphersuites.

My changes added a private identifier for schnorr signatures over secp256k1 and then I added support to the main library via their default crypto library RustCrypto and I also created a new library to use the secp256k1 library instead of RustCrypto (secp256k1 is the library that all Bitcoin and most nostr projects already use).


Yeah - look, I didn't say that it was an easy, one and done solution. It would be a major shift in how society thinks about what the meaning of "work" actually is.

What I said is that I am bullish on humans being productive and wanting to do meaningful things with their time.

Like everything, the devil is in the details, you can't just apply some new law and expect things to work. There would need to be cultural change and there would be lots and lots of 2nd and 3rd order consequences that would be unpredictable, especially with something as big as UBI (if you even could find a way to make it function monetarily).

All I'm saying is, I'm bullish on human creativity and I don't think about society leaves much room for it anymore.


I'm actually pretty bullish on humans being more useful under UBI schemes. My question has always been, where's the money going to come from. It's telling that the article doesn't even attempt to confront that question. Everyone has gotten so comfortable with the idea that the government can just do whatever it wants (without thinking about the consequences) that they don't even stop to wonder about it any more.


💜

nostr:note1tqsmw5fchtj27ydvzkemczyj9azqre65dn9sqz34fh5xs9x5gl8swv3d3z


Can wait to see it!


Like  nostr:npub1rw7hlhmgat6ur9zxcw40vweem49guv6530yk767j8xjpynv0y20q6qsl3w said, it's an open source implementation of the MLS protocol.


It's always exciting when you're working on a really complicated project and you get to the first working demo. Even if it only does something simple, it's still a thrill.

OpenMLS can now use Bitcoin & Nostr cryptography. LFG.


Maybe go look up the details before commenting.


🫂 thanks man


It actually got a super interesting story. It’s a fuck you on so many levels. Absolutely brilliant.


Best statue in Milano.

Right in front of the stock market building. 🖕
https://m.primal.net/JQeK.jpg


Today is a good day to touch grass and think about the big picture.

https://youtu.be/GO5FwsblpT8?si=SskOOraDVd9Qdv2i


https://nak.nostr.com maybe.


The relay list is saved as an event on your relays. There are actually a few different kinds of events for storing different sets of relays.

And yea, the differences are usually because one relay has an out of date event or a client handles it badly and overwrites a previous event.


Good thing we got that net up over the garden right?! 😅


Savagely good time yesterday with nostr:npub1qy2tkywa36ufh76qv62snv4953eayufxufav4evz2le06lxe2amqpxavna and nostr:npub13vepw9xdhjzhp87lv5h7z2jgzteltmzqe4scjsn9dtwwncz6ekms5p489d

The mid aperitivo hail storm was also exciting! 😅
https://m.primal.net/JPIC.mov


Nice. Love it.


Shill me the best art / music / dance / human movement folks you follow.

nostr:note16v3rgx5let6dwzf45cy457vkxtytmy87flfha9jlw4954rk3ju9qlmytvz


👀 link to the project?


🙏 thank you.


Agree. There are two separate things here right? One is businesses not being held liable, which whether they do a good or bad job at the “curation”, I think is a good thing.

I would love to see protocols like nostr really recognizes more as public goods or utilities like you say.


I’ve just dropped my weekly update on the MLS messaging progress. It’s a short one this week but don’t let that fool you, I’m feeling very bullish about the progress. 🤙

Huge thanks to nostr:npub1klkk3vrzme455yh9rl2jshq7rc8dpegj3ndf82c3ks2sk40dxt7qulx3vt and nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft who spent multiple hours each with me on calls talking through ideas. 🙏

nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxqmnwwpc8qcr2vectx9xjf


More dance and art and music on Nostr please!

nostr:note1u7req4fql29s4hrm54dyhwuqsqr4m3yeyec87m3zrfx2se30q9jqtdqd9h


Beautiful!


This is the third in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

## Previous Updates

- [June 28th 2024](https://habla.news/u/jeffg.fyi/1719562889267)
- [July 6th 2024](https://habla.news/u/jeffg.fyi/1720256910765)

## Progress this week

Short update post this week but I made solid progress updating several OpenMLS dependencies and building a new library that implements all the OpenMLS crypto requirements for Nostr.

### HPKE-RS

I mentioned a PR last week on the `rust-hpke` library, that PR is still waiting on review. However, in the meantime, the OpenMLS library depends on a slightly different hpke library, the `hpke-rs` library.

This library didn't support the secp256k1 curve either so I've [opened a PR](https://github.com/franziskuskiefer/hpke-rs/pull/66) to add support for secp256k1. That PR uses the `RustCrypto` library that is the default in the the `hpke-rs` library. However, because this library is built to allow for swapping out the underlying crypto library (using traits), I was also able to create a new library that uses the `secp256k1` library instead of the `RustCrypto` library. This is the main crypto library that almost all Bitcoin and Nostr apps use so it's important we use that instead of `RustCrypto`.

### OpenMLS Nostr Crypto

The library that I've created ([openmls-nostr-crypto](https://github.com/erskingardner/openmls_nostr_crypto)) does a few things via separate sub-libraries (crates). The entire library tries to do as little as possible; only implementing the one required ciphersuite for all MLS implementations and the `secp256k1` schnorr signatures ciphersuite I've created for Nostr. It's also using the right `secp256k1` library to do it.

**openmls-nostr-crypto:** implementes the crypto traits that the OpenMLS library expects to find for a given provider and removes all the ciphersuites that we don't care about supporting.

**hpke-rs-nostr-crypto:** This implements the crypto traits that the hpke-rs library expects to find. Again removing all the ciphersuites we don't care about supporting.

I've not yet written any tests for these libraries (which needs to be done) but I've gotten some very simple demos working with OpenMLS using this new set of libraries to handle the crypto.

I've been really impressed with the simplicity of the OpenMLS interface as well. While there is A LOT going on under the hood, the public interface that client developers have to use is clean and simple.

## Onward and Upward

Next week I'll continue working on these libraries; adding tests and continuing to build out my small demo app. I've been in touch with the maintainers of the OpenMLS library and I'm hoping to get a review done with them on my PRs and on my new library.

One thing I'll call out here: The review of my library and getting them to review the direction of the project overall will be paid consulting so I'm making sure that I've got as much done as possible before scheduling that time and paying their rates. I'm a strong believer that the right conversation can save you months of wasted time, but I'm also a believer in making sure you're prepared if you're going to drop money on that conversation. 😅

The third in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxqmnwwpc8qcr2vectx9xjf


Welcome! 🤙


I missed this last week but this is a HUGE deal!

https://www.eff.org/deeplinks/2024/07/effs-statement-netchoice-decisions


I agree, I couldn't live anywhere that didn't have thunderstorms. I grew up watching them approach over the Blue Ridge Mountains and now I get to watch them build over the Alps. Pretty special.


GM Nostr ⛈

After three days of scorching heat, woke up to a beautiful thunderstorm that’s been going for the last 3 hours.

Every window and door in the house is open, gulping in that cool breeze.


Looks incredible! 🤩


And not feel bad about it. Plenty of us are type A and actually have trouble taking time to do things that feel self indulgent, even if we really enjoy them.


Yeah – but I was more wondering about whether it was under active development anymore or if it's abandoned.


Anyone know if the Noise Protocol is still being used? Last updates to anything I can find are months to years ago...


I missed my GM this morning 😭 so GA everyone.


Good friends and good conversations are the best.

GN Nostr 🌙


“Your time”. Just fat fingered it.


The amount of tour time that you control and feel no guilt or shame about how you’re using it.


Nice!


I want to know this too!


IYKYK.
https://m.primal.net/JLVx.jpg


Italian alps. Near Chiavenna.


If you missed it, I posted a second update on how the MLS stuff is going over the weekend.

nostr:note1uu6x4vyzmr7sugw8dx93pg2up4k6at47x0uvfq0gs8mhle69mdaqkjf4a3


Yesterday I went on a long walk in the mountains.

Today. Back to building.
https://m.primal.net/JLRE.jpg
https://m.primal.net/JLRF.jpg
https://m.primal.net/JLRG.jpg


Saw that and signed up. Very cool feature.


💯

I keep hearing people wondering if Nostr is doomed or dead already because use growth isn't an up and right exponential trend.

The web was invented in 1989! Let that sink in for a moment. It was a full 10 years before the first major internet bubble made "the web" mainstream.

Be patient. Keep building.

nostr:note1dn9avg7qwdjwdyfxsxrqwpgeh2etrkawvq7ldcvvlk8ckzcr0e3stdhrr2


Fucking legends. 👏


Glad to know our conversation helped you break through. 😅


Sure. Happy to.


Just dropped the second weekly update on MLS messaging progress.

There's a draft of part of the spec in this update that talks about how to publish prekey bundles. If you're interested in the technical weeds on how this will work, please have a look and leave thoughts.

nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxqer2d3exycrwd342u5qhf


This is the second in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

## Previous Updates

- [June 28th 2024](nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzde38y6nvv3c8qunyd3hakfln0)

## Progress this week

This week was mostly spent on the topic of how to properly publish prekey bundles and what would be needed in the bundle itself to make it workable. I've included an early version of the spec below for prekeys, and would love thoughts on it. Treat this as an alpha version, very subject to change.

The other thing I spent time on was making changes to the OpenMLS library to add support for our custom ciphersuite. One issue that I've run into is that the IETF standard for HPKE doesn't include the secp256k1 curve. Because of this, the library being used in the OpenMLS library doesn't implement the necessary methods using our curve. Thankfully, there is another library with [an open PR](https://github.com/rozbb/rust-hpke/pull/59) (shout out to nostr:npub1yevrvtp3xl42sq06usztudhleq8pdfsugw5frgaqg6lvfdewfx9q6zqrkl for that!) that would fix this. Additionally, there's an [expired proposal](https://www.ietf.org/archive/id/draft-wahby-cfrg-hpke-kem-secp256k1-01.html) to add secp256k1 to the HPKE spec itself. I've bumped both of these and will continue to follow up. Even without the formal addition to the spec, if we have a working library, I can add that to the OpenMLS library.

## Spec Draft for Prekeys

### Initial keying material (Prekey Event)

Each user that wishes to be reachable via MLS-based messaging MUST first publish a prekey event. Prekeys are used to authenticate and add members to groups (one-to-one DMs or groups with more than two participants) in an asynchronous way. The prekey event is a simple replaceable event and contains all the information needed to add a user to a group.

Prekeys SHOULD be used only once. Resuse of prekeys can lead to replay attacks.

In most cases, clients that implement this NIP will manage the creation and rotation of the prekey event. It's recommended that clients do so interactively with user consent in order to avoid overwriting prekeys created by other clients.

#### Derived vs Ephemeral Prekeys

Since prekeys are generated on a single device/client pair, the private key of the prekey must be either stored or generated in a way that can be deterministically recovered.

The recommended approach is to use derived keys, generated in the manner described in [NIP-06](https://github.com/nostr-protocol/nips/blob/master/06.md). In this way, the user can respond to a new group request from any device/client pair, not just from the same device/client pair that created the initial prekey event. If using derived keys;

* Clients MUST use `104` as the `account` level value and `0` at the `change` level value (e.g. `m/44'/1237'/104'/0/0`).
* Keys are then generated using public derivation by incrementing the `address_index` level value.
* Clients MUST include the full derivation path corresponding to the key used in the `content` field on the prekey event.
* The `content` field MUST be encrypted using standard [NIP-44](https://github.com/nostr-protocol/nips/blob/master/44.md) encryption (encrypted to themselves).

However, for added security (and consequently a more restrictive user experience), clients can chose to generate an ephemeral key and store the private key locally. This means that users will only be able to respond to new group requests from the same device/client pair and won't be able to respond at all if the prekey's private key is lost. Ephemeral keys can also be used with minimal degredation of UX if you're using a remote signer that can manage these keys.

If using an ephemeral key;

* The `content` field on the prekey event MUST be filled in with `EPHEMERAL` and then encrypted using standard [NIP-44](https://github.com/nostr-protocol/nips/blob/master/44.md) encryption (encrypted to themselves). This ensures that anyone looking at prekey events cannot tell whether it's a derived or an ephemeral prekey.

#### Example Prekey Event

```json
  {
    "id": <id>,
    "kind": 10443,
    "created_at": <unix timestamp in seconds>,
    "pubkey": <main identity pubkey>,
    "content": <encrypted derivation path | EPHEMERAL>,
    "tags": [
        ["mls_protocol_version", "1.0"],
        ["ciphersuite", "MLS_256_DHKEMK256_CHACHA20POLY1305_SHA256_K256"],
        ["pubkey", <prekey pubkey>],
        ["prekey_sig", <signature generated from hex encoded pubkey of the prekey>],
        ["r", "wss://nos.lol"],
        ["r", "wss://relay.primal.net"]
    ],
    "sig": <signed with main identity key>
}
```

#### Tags
* The `mls_protocol_version` tag identifies the MLS protocol version being used. For now, this MUST be `1.0`
* The `ciphersuite` tag identifies the ciphersuite supported. For now on Nostr, we're using a custom ciphersuite, `MLS_256_DHKEMK256_CHACHA20POLY1305_SHA256_K256`. [Read more about ciphersuites in MLS](https://www.rfc-editor.org/rfc/rfc9420.html#name-mls-cipher-suites).
* `pubkey` is the derived or ephemeral prekey pubkey.
* The `prekey_sig` tag value is a Schnorr signature (over the secp256k1 curve) of the SHA-256 hashed value of the prekey's pubkey, signed with the prekey's private key.

```js
const privKey = schnorr.utils.randomPrivateKey();
const pubKey = schnorr.getPublicKey(privKey);

const prekeySig = bytesToHex(
  schnorr.sign(bytesToHex(sha256(pubKey)), privKey)
);

const prekeyTag = ["prekey_sig", prekeySig];
```

Finally, clients SHOULD include `r` tags to identify each of the relays that they will attempt to publish this prekey event to. This allows for more complete replacement of prekey events at a later date.

### Replacing Prekey Events

Clients MUST replace the prekey event on all the listed relays any time they successfully process a group welcome event. If the prekey was a derived prekey, clients SHOULD increment the derivation path by 1 for the next key.

## Onward and Upward

This next week I'll continue to work on getting the right curves and code added to the OpenMLS library and start work on a simple demo app. The focus is on better understanding what we need from the control and message events and how we can make those as simple as possible for Nostr clients and relays while also preserving as much privacy as possible.

The second in a series of weekly updates detailing progress on bringing MLS protocol DMs and group messaging to Nostr.

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzdejxqer2d3exycrwd342u5qhf


Most feel like flavors of the others...


Intelligent beyond her years.


Tunes.
https://m.primal.net/JIvk.jpg


Going to read up on it. I wonder how painful/expensive it is to run those relays.

Do you know who is running  nostr:npub1dd9znw7585wsam4d8p84ztdmtywwjsrayld6fzk4fvqdn5hpju4st5xe7p? Looks super interesting.


It's Apple only though?


🤙 👨💻 The same!


GM Nostr! 🌞

What are you up to today?
https://m.primal.net/JIYb.jpg


Good to hear Uncle!

Can't wait to hang in Riga. 🤙


"Open" source.


Yes, would love a very good client for this.


😂 Can't say that'd be a bad thing!


💜

nostr:note1eppuucmjkrux55k9gmtta9kxfua56tfrfy8sankwmlf34aach6zqggurwa


Working on it! https://habla.news/u/jeffg.fyi/1719562889267


What's your use case for it? To have a single seed that secures a master key and then create lots of different accounts that you'd use side-by-side?


This exists. NIP-06

It's just that no client really uses/supports them yet.


There is only one choice. Coldcard.


I think this is accurate. Frameworks can help but usually add SOOOO much more complexity than needed for most projects.


This is one thing that they still mostly do well in Italy. The level of quality on tradeswork is usually very good. Especially around bathrooms and tiling.


I agree, the current implementation of communities is very naive.


So many amazing ideas and thoughtfulness coming out of this thread! Please repost it so we can keep the feedback flowing.

nostr:note1f8m88el5uwp7q49tjc5qqs2kpvygs72qdae2rygvev0ltrfda5hq3fdhan


Public communities exist. But there isn't a strongly secure version of communities (group chats) yet. I'm working on it.


I'd thought about that some but then thought that it'd be better to leave it for now but you're right, as long as we had good encryption that was based on more than just your private key (additional password perhaps) and we had relays that wouldn't allow others to query for these backup blobs then yes, we could store those on relays and other clients could use those to backfill conversation data and other state.

Sounds like a NIP for another day though. It's more general than DMs and Group messages, for sure.


Control over where your data goes. That's different from state.


Ahh, might be web only for now.


Ah ok - we're focusing on different things here. I think GWs are useful for wrapping messages in a disposable cover that allows you to obfuscate the message metadata over the wire. This is actually very valuable but isn't a solution to everything.

Proper encryption of DMs and Group messages is going to require clients to store the actual decrypted message contents (in an encrypted way locally).

It fundamentally isn't possible to build a messaging system that provides strong forward and post-compromise security, allows for asynchronous messaging via decentralized data stores, and also allows any client application to rebuild the full conversation history at any point. They are just incompatible goals. This is why, when you connect a new device on signal, the new device doesn't get the history of the conversation it's in. Just new messages from that point forward.

From your point of view, would you rather give up something on the other side in order to have that rebuildable conversation history?


It doesn't need to.


Storing state in Nostr is a recipe for disaster. You'll never be able to keep that state synced properly across relays.


Explain why this is an issue? Of course the recipient has to show up in the tags of the GW event. But that's the only data in the clear.


When you cancel while writing a note it asks if you want to save it as a draft.


Primal does.


Yup. Very hard to execute on this one.


I think he means that relays would auth you before they would respond to any request for DM or gift-wrap event kinds.


Yes! Can't wait to get this out there and widely implemented.


You can in most clients... I'm guessing you mean actually having a guarantee of sorts that the event is deleted on EVERY relay?


I guess any client could require this (or require PoW on notes to show them). I think it would come down to having an exceptional UX for people to actually move over to using that client though.


Yeah - this is a good one. I'd love to see this as well.


This doesn't exist in software. Never has, never will.


Absolutely! Can't wait to have this as well.


GM Nostr 🌞

What's the ONE thing you most wish we had on Nostr but doesn't yet exist?


Jan 5 2023


Archipelago. More islands better than one island.


🖐 Me!

What country would sell us land AND allow us sovereignty, though?


This is true. 😅


Mountains. 🏔


F-it. I'm going on a run.


Did that get removed as a dependency?


Ideally commenting & reactions on the whole doc. But also being able to highlight sections and leave comments too for just that section.

I think the entire UI needs a rethink. When I click on a topic and get a list of articles from different folks, it's sort of unclear why I should pick one or another (other than just simple recommends).


😭 shit, sorry to hear! Definitely worse.


Please god no.  nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft I love you but, it has to be said, Wikifreedia is so painful to read on.


GM Nostr 🌞

Playing sys admin this morning. Not enjoying it... but, it beats digging ditches. 😂


Works fine for me.  nostr:npub1m3xdppkd0njmrqe2ma8a6ys39zvgp5k8u22mev8xsnqp4nh80srqhqa5sf can you try to make sure you've updated to the latest NDK?

cc/  nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft

https://m.primal.net/JFYa.png


Let me help you.

You're going. 😁


I probably didn't wait for the user selector to pop up when I was replying so it just treated it as text instead of replacing it with his nostr:npub value.


Really worth a watch for anyone building (code, community, a following, a business) around Nostr.

nostr:note1vpsuc8k07ftvt455p9064guymc06ldzp2slznu8vxru5z5smnqqsh3wk62


@fiatjaf put nostr.com together


Sign me up.


I can imagine. I’m old enough to remember when that was just life. 😅

We should all do it regularly. Changes the speed of things.


Just spent 2 days completely out of phone and internet coverage.

Highly recommend.


Ah no. Molto meno. 😂 troppe conferenze.


Dai, quasi un anno. 😅😅


No. I was including that. All major clients implemented in less than a year. And I think that’s conservative.


somewhere between 6 months and a year before we have a bunch of clients implementing MLS based messaging and/or NIP-17.

I'd love to see clients completely drop support for NIP-04 messages sometime in that same period.


Already done ✅


I've just dropped the first weekly update on the MLS over Nostr project to bring secure DM and group messaging to Nostr with the MLS protocol.

I'd love to hear questions or feedback!

Also, I'm going camping later so I might not be back to you until tomorrow or sunday 😅 Touch grass and all that. 😉

nostr:naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzde38y6nvv3c8qunyd3hakfln0


This is the first in a series of weekly updates I'm publishing on my process around secure messaging. Since it's the first, let's start with a bit of historical context.

## How this started

On April 29th I published [a PR](https://github.com/nostr-protocol/nips/pull/1206) on the NIPs repo detailing how we could achieve "Double Ratchet" DMs on Nostr. There was also a [video](https://share.cleanshot.com/nMKk6cn0) and [demo app](https://drdm-demo.vercel.app/) that went along with the PR. The basic premise was to use an adapted version of the Signal protocol. This would result in DMs that were truly private and confidential, even in the case where you leaked your main private key (your nsec).

I got a lot of great feedback from folks on that PR. Interestingly, nearly all of it focused on two points, both of which I'd deliberately scoped out. Group messaging and multi-device/client support. While I knew these were important, and I'd figured out how these might be accomplished, I'd scoped them out to try and keep the footprint of the spec as small as possible But, the more I talked to people, the more it became clear that this was one problem to be solved and given the complexity, it'd be better to do it in one shot.

At the same time, I'd seen that Messaging Layer Security (MLS) had recently made a lot of progress on becoming an internet standard with their RFC proposal and, goaded on by Vitor, decided to take a closer look.

## Enter MLS

[Messaging Layer Security](https://www.rfc-editor.org/rfc/rfc9420.html) (MLS) is a new protocal that is basically a modern extension of the Signal protocol that makes group messaging way more efficient (log vs linear) and was built to be used in centralized or federated environments. I'd heard other Nostr devs talk about it in the past but it was always overlooked as being too complicated or too early.

After spending a couple weeks reading hundreds of pages of RFC docs and reading through a few implementations of the MLS spec, I believe it's the best solution for secure direct and group messaging in Nostr. It also has the added benefit that we can upgrade the underlying crypto primitives over time in a sane way.

The MLS protocol specifies "a key establishment protocol that provides efficient asynchronous group key establishment with forward secrecy (FS) and post-compromise security (PCS) for groups in size ranging from two to thousands."

The spec I'm working on will detail the ways that we implement this protocol into the Nostr environment (namely, how do we use our crypto primitives, use events as control mechanisms, and use relays for storage, while obfuscating metadata).

## Goals

It's important to be clear about what we're aiming for here. Engineering is all about tradeoffs, always.

- Private and Confidential DMs and Group messages
   - **Private** means that an observer cannot tell that Alice and Bob are talking to one another, or that Alice is part of a specific group. This necessarily requires protecting metadata.
   - **Confidential** means that the contents of conversations can only be viewed by the intended recipients.
- Forward secrecy and Post-compromise security (PCS) in the case of any key material being leaked, whether that's your main Nostr identity key (your nsec) or any of the keys used in the MLS ratchet trees.
   - **Forward secrecy** means that encrypted content in the past remains encrypted even if key material is leaked.
   - **Post compromise security** means that leaking key material doesn't allow an attacker to continue to read messages indefinitely into the future.
- Scales well for large groups. MLS provides this from a computational standpoint, but we need to make sure this works in a scalable way when multiple relays are involved.
- Allows for the use of multiple device/clients in a single conversation/group. Importantly, we're _not_ aiming to enable a device/client to be able to reconstruct the full history of a conversation at any point.

## Progress this week

Ok, finally, what what I been up to?

### Reading
I've spent most of the last few weeks reading the [MLS spec](https://www.rfc-editor.org/rfc/rfc9420.html) and [architectural doc](https://www.ietf.org/archive/id/draft-ietf-mls-architecture-13.html) (multiple times), learning some Rust, and beefing up my knowledge of cryptography (which was, if I'm being generous, paltry before starting this project).

### Ciphersuites

Nostr is built around the same crypto primitives that Bitcoin is, namely Schnorr signatures over the secp256k1 curve and SHA-256 hashes. This curve isn't currently supported officially in the MLS spec. I've been in touch with the MLS working group to better understand the process of adding a new ciphersuite to the set of ciphersuites in the MLS spec. The outcome here is that we're going to start out using our custom ciphersuite that isn't part of the formal spec. The only drawback being that Nostr's MLS implementation won't be immediately interoperable with other MLS implementations. We can always add it later via the formal channels if we want.

### MLS Implementations

Given the complexity of the MLS spec itself (the RFC is 132 pages long), having a well vetted, well tested implementation is going to be key to adoption in the Nostr ecosystem. [OpenMLS](https://github.com/openmls/openmls) is an implementation created by several of the RFC authors and written in Rust with bindings for nearly all the major languages we would want to support.

I've been in touch with the maintainers to talk about adding support to their library for our new ciphersuite and to better understand the bindings that are there. Some (WASM) are very barebones and still need a lot of work. They are generally open to the idea of working with me on adding the missing pieces we'd need.

### Double Ratchet NIP 2.0

I've also started to write up the new version of the NIP that will detail how all of this will work when plugged into Nostr. It's not yet ready to share but it's getting closer.

### Onward & Upward

Hopefully that's a helpful recap. I'll keep doing these weekly and welcome any questions, feedback, or support. In particular, if you're keen on working on this with me, please reach out. More eyes and more brains can only make this better. 🤙

MLS over Nostr progress update for 28 June 2024

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzq9eemymaerqvwdc25f6ctyuvzx0zt3qld3zp5hf5cmfc2qlrzdh0qqxnzde38y6nvv3c8qunyd3hakfln0


I'd been reading a book about feudal Japan (Shogun, highly recommend) and for whatever reason I was thinking about the early post-war years when the US seemed to be fairly cohesive and well organized (at least comparatively).

I didn't have any conviction in that statement, it was just a curious musing.


A friend spotted this in Dublin.

The Irish have the best sense of humor! 🤣
https://m.primal.net/JAgq.jpg


Very good point.


Random out loud thinking...

Do you think that there is a correlation between the rate of military service and the level of standards (in everything, work, cleanliness, etc.) in a country?


You're such a legend and you don't even know it!

That warm fuzzy feeling you get when you support freedom


Support my work on an ongoing basis.


💯  It's always fun to look through and see new and unrecognized apps.

nostr:note1cd4a4ep77ad32s0ct8x0s0tlr5fz5cnjznnfff3tnm3luxykmlxsepwktz


Yessir! Thanks for that!


I may have spoken too early about the lack of distractions. 🤣

Absolutely worth a watch for a morning laugh though.

nostr:note17rx56sklwzjkk3wjc4p3yqg93cupvkhxdy5syzfyx2vnx4cl8eas2ckh7p


GM Nostr! 🌞

What a time to be alive. Bull market pause for summer so we can concentrate and build without distraction.

#BuildFreedom


Someone has to do it. 😂


Other stuff maximalism. 🤙 nostr:note1hyngmr6k63vknxmw9rtrl03naty68wee2vlj38kuq8krpaw4hajq8cqxpm


The question is... can he beat his record on the number of talks he participated in from Nostrasia!?


What's ngit?


GM Nostr 🌞  Bitcoiners really are the best of us.

nostr:note125a9gjcwv2n6px5py8zxnc926hyn0ppwenapkfecrm0q3wctrqesrw5p6d


Still gives me chills 30 years later…

https://tidal.com/track/1765478?u


Thanks nostr:npub1yuecs6yza8sj0pvp8cuhjw085wn4rrkzxkfrkk4jvm9jvjggs4wqd89pua, https://nostr.how is now available in Ukrainian! 🇺🇦

Thanks Dima! 👏


We will fix that. 😉


This is insane. I can’t believe the AUS government would require something like that and then demand he pay for it.

As if he’s not already paid enough.

nostr:note1esu59x34lxuh50r0xlrjfpjlguacx9cvsa95a5wqaa8cl59rqe9qv80ryp


Gradually, then suddenly.

https://m.primal.net/IxZP.png


GM 🌞

What a day. Julian Assange is free. https://www.bbc.com/news/live/world-69145409


Yup. it's going to be a bit longer, no one has implemented anything double ratchet yet. But hopefully we'll move to MLS as the standard.


What's wrong with the old account?


Thanks. I've been flatpak and apt so far. Trying to keep things as stock as possible so I'm actually using Linux instead of trying to emulate anything (so emulators are definitely out). Thanks for the tips!

And no, after many failed attempts VIM is still dark magic I'll never understand. 😆


On a lark, I installed Linux Mint on an hold tower I had lying around and I'm giving linux desktop a go after more than 15 years using Apple products exclusively.

So far I'm pretty damn impressed. I'm having a lot of trouble learning keyboard shortcuts and things like that but install apps has been insanely easy and there are high quality free versions for pretty much everything I was using on my Macbook Pro.

Any tips from you Linux maxis out there?

Also, what's the best privacy-focused browser these days? Sounds like firefox is going down the ad path... Brave touts itself but I hate all the shitcoinery in their browser.


I think you're overthinking things.

Yes, it's possible to see that a user is receiving kind: 1059 GW events but what those events are is completely hidden. As long as users that are sending the GW events to the relays are using a VPN, they're hiding their IP addresses (there are also some other ways we can improve that but let's leave it at that for now).

The state is maintained with a specific set of control messages that users in a given group send between themselves. Those will be GW'ed as well.

I imagine that in the near future there will be many many GW messages that are being sent to every user on the network, it'll be like trying to watch encrypted TLS traffic. Sure, people are using the network, but you don't know how or why.


Can you explain that a bit more? I think we can easily obfuscate metadata via gift wraps.


GM Nostr! 🌞

Life is great. We are winning.

#BuildFreedom


I was originally referring to the group implementation from MLS.  nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z is right though, the MLS authors definitely were more concerned with efficient large groups that rotate keys correctly than they were about metadata leaks.

This makes sense when you think that they were really designing for a situation with a centralized "delivery service". They do mention that MLS is built to work in federated environments (e.g. Nostr) but call out that the transport protocol for federation would need to be figured out.

That's precisely what I'm working on now. How do you use MLS with multiple servers (relays) with no guarantees that messages arrive in order or from the right people or at all. And how do you do so without leaking metadata.

It's going to be a combo of giftwraps and a few new event kinds for the control messages that need to be sent for managing groups. (remember that a DM is just a group of 2 participants).


Don’t think so. It’s always for a different type of request to sign.

Now sweat. Happy to be an odd edge case. It’s mostly stopped now that I’ve accepted most of the standard requests.


Yes. Many. 😅


It’s per device/client pair. In other words if I have damus and primal on my phone each counts as a separate participant in the chat.

This is why group support in the protocol really matters. Smart clients will be make sure that you show up as a single participant in the conversation and there are ways to back fill chat history but there are some tradeoffs inherent.


They’re two different things to me. Clients shouldn’t wait to implement NiP-17 imo.


Aka no forward secrecy. Or post compromise secrecy.


Wow. Interesting.


Legend!! Congrats!


sweet! I agree. would love to have blossom and satellite running locally and on my home server so that I could drop google drive/dropbox/etc.

Not just a big deal for social media but absolutely massive when we get it right!


It's been for every site I've gone to. I have to manually change to "don't ask for this type of request" each time.


LFG!


🤣 Dying

nostr:note14pzepzw34rtzg2du9646vzx5andxxtfdz5k3eu6s4mnsz8lhr3psp8xj90


 nostr:npub1getal6ykt05fsz5nqu4uld09nfj3y3qxmv8crys4aeut53unfvlqr80nfm I "updated" to get off the old LNDhub and now every Nostr app is asking for my individual permission on every signing request. Even though I've said to "be reasonable" when I first hit the site.

Known issue or do you want more details?


I think there have been several attempts to make it easy to deploy things via docker but I'd love to see a full nostr infra stack deployable via StartOS, Umbrel, Nix, brew, and apt.

To be honest, I think getting nsecbunker (or something like it) into a much better state is the linchpin here. We need really good, stable, and easy to use remote signing with access controls to make all the rest of it work seamlessly.


Finally arrived here in Italy only this week. Hot, lots of thunderstorms. 🌩


I never knew I'd have so much fun reading IETF RFCs.

Their datatracker for each RFC is actually a really cool way to visualize changes over time as well. https://datatracker.ietf.org/doc/rfc9420/

Would love to see something like this for NIPs.

https://i.nostr.build/lLqMn.png


GM Nostr! 🌞

I hope you all had a wonderful longest day of the year.

It's all downhill into darkness from here.

At least, until it's not again.


🤯 🙏 Thanks!


💯 That entire video series (even though the other topics aren't necessarily related) is really well done.


I have realized this now 😅


Ahh, interesting. I thought it was out of a 100 - I guess not....

In any case, I have this friend, he's a nigerian prince.... do you want to meet him?


If you hover over it, it gives you the calculation he's using which is fairly benign. I think it's just overclocked on how it treats mutes.


💯 Great write up and matches my experience of the Freedom Forum. Best event I've been to so far.

nostr:note1kaqg6mmxrnjcp27h6xrk284emw56cjxxk6wn0kyynrlgudeg6f4shqa8fk


Coracle's web of trust scoring is brutal... apparently I should only trust myself 64% of the time.

https://m.primal.net/IrZT.png


Just dropped a big comment on the PR for NIP-104 (Double ratchet DMs).

Quick tl;dr
- Closing the PR in favor of pursuing MLS based messaging spec.
- MLS is more much more complicated but has huge benefits, especially for group messaging.
- Want feedback and collaborators (I'm committed to making this work but it's a BIG lift so all help is welcome).

https://github.com/nostr-protocol/nips/pull/1206#issuecomment-2180291416


As the manager of this account, I hereby declare this note as a request for you to share your best #NOSTRiga t-shirt ideas!

Also, if you haven't signed up yet, what are you waiting for?

https://tally.so/r/wbdMlL


I think that’s definitely going to be the way WoT ends up being used. It’s a tool for specific features. Not an end all be all way of fetching or organizing content.


Want! But… https://i.nostr.build/xE3vl.jpg


I haven't used it before (I use Reflect - which is a paid app that's very similar).... looks really cool though.


Yeah, like I said, nearly all. There are some areas where stating the rules of the game is important.

That said, "well-understood" regulation is nearly non-existent right now. Politicians and bureaucrats race to show that they're doing something (but almost always not the right something). We need to significantly rethink who and how regulation gets set.


Why I'm against nearly all forms of regulation.

The idea that we can precisely control one behavior without causing unintended consequences betrays a deep conceit about how much power/control we actually have over reality.

nostr:note15m3cxt352ggldsr5u323e0qjg2zx7ra034hz8ahmgpx4adfnlv9sry2sl3


Let's go!

/me Two Weeks™ isn't going to be enough ever again...


Still such a banger.

https://tidal.com/browse/track/3821704?u


It should be, if it's not already.


What. A. Surprise.

nostr:note1yttd44ge2a4vjnrzwr4kjred3hn0rf7kx6nt8qwqvrm0g3sf5lvsmeygqq


Tried to pay it but doesn't seem to have worked...


One of the very few newsletters I read every time it arrives.

Funding freedom isn't just about developer grants, it's about making sure those in power know, deep down, that we know the truth and that we have alternatives.

👇 I wonder how fast we can fund this ₿0.25?

nostr:note1gkqz07has2w3jl5u5hedf7xwj8qu8y94z4wfk8muea9qzvj583jq7l8qj7


 nostr:npub12vkcxr0luzwp8e673v29eqjhrr7p9vqq8asav85swaepclllj09sylpugg I'd love to have a switch I could toggle here to only see the set of people that another user follows that I don't follow already.

https://m.primal.net/IqLa.png


That last one is confusing. Do they mean banking indigenous peoples who still use shells as money? Or operating shell corporations for banks? Or banking the global oil conglomerate.... 🤔

Alas, bitcoin fixes all those things too.


https://m.primal.net/IqLO.jpg

via @rothmus on X.


Don’t sleep on this Europeans. Call and harass your reps in Brussels.

I would too, but I’m still not allowed to vote here after more than 14 years of legal residence. 🙄

nostr:note1vgyf9fkttrr48vym6zp2vxerkmt5ass45gwqp0nvm65qyug63t0qfdchk4


GM Nostr. 🌞

There’s always hope and there’s always something you can do to help. ✊

nostr:note1695j0czewtkfwy7h4ne7k2ug706uwc7lendsq50prsfp8vwq8nfszdx4z7


Yes.


Yes. https://lightning.store/


Been on holiday for the last week and actually did a good job staying away from screens.

😌 It was sooooooo nice to take some time away to just chill.

😖 It's been soooooooo painful to come back and get my face smashed against a wall of life admin and catch up that I need to get through in order to actually work on the stuff I really want to be working on.


😂 close enough.


Congrats!!!


Par for the course, unfortunately. nostr:note1n6c5hskksa0pfs4nkh7nt6m0tsj73rc8lsp5savyz3m72thsfpes4jm53j


Love this list. Really captures the essence of Nostr at the moment. nostr:note160xqfne0q7k69nh9xt5d8yea287q5y666dkxedmvfl4wlrz759cssuvkq6


If only you spoke Italian.  🤌


LFG!!


Ok. The satoshi rockamoto tonight pushed it over. I’m finally feeling the fomo for not being in Prague. 😭


Hold off. NIP 104 was a good first stab and was great for getting lots of feedback. Ultimately though, we need something a bit different (and better). MLS.

Happy to chat about it if you want.


Always.


Good eye!!! Rough seas today so it was nearly empty


Checks notes… yup, that’s about right.
https://m.primal.net/IkVD.jpg


All the better when the only way in is a hike. 😎
https://m.primal.net/IkSj.jpg


Zero. I was trying too hard not to puke.  😅


Karate years ago. I would really like to find something good but it’s hard locally.


Just did 10 sets of burpees with my kids, AMA.


I don't like it. It adds some obfuscation but doesn't really fix the problem because you have to start the conversation in the normal way (addressing the GW messages to the real pubkey) OR the receiver needs to create lists of alias' for each and every contact that they might one day receive a message from.

Or am I missing something?


😂😂😂 nostr:npub1arkn0xxxll4llgy9qxkrncn3vc4l69s0dz8ef3zadykcwe7ax3dqrrh43w talk about things you won’t soon live down.


Is the image you shared in the note high resolution?


Such a great tune...


100% better with the upper case O.

Where do I buy the shirt?


nostr:npub16c0nh3dnadzqpm76uctf5hqhe2lny344zsmpm6feee9p5rdxaa9q586nvr - looks like a bunch of clients already do this really well but  nostr:npub12vkcxr0luzwp8e673v29eqjhrr7p9vqq8asav85swaepclllj09sylpugg doesn't yet. 🙏


Nope.

nostr:note1097yquj93fj8y8f6saug40as9zmcr840ruw8smcjq7zue2s4d8xsuh28df


Beautiful.


#grateful
https://m.primal.net/IiAS.jpg


Well, at least you know what to do if you can’t sleep.


🌎🔫

https://www.forbes.com/sites/digital-assets/2024/06/11/oslo-freedom-forum-why-bitcoin-matters-more-than-its-price/


Yup. I think all our sites are just super naive still. I know mine are. We’ll get there.


What?! No way. Client side all the way. We’ve barely started to optimize all that we could on the client. Server rendering is a relic of the past.


Did you see my workshop from Baltic honey badger last August?

Can’t find the recording now but did basically that. Built an app in 15 minutes from scratch.


Nope. Healthy appendix here. 😂


Is that the original source?

Been a long time since I listened to Ani…


Yessir. Wondered how long it would take for someone to recognize it. 😅

Anyone know the source of the quote?


Build, freedom. nostr:note1jfmwvxzmp4vwrwjshcuqgsfmmjsumalr3nuhsvmmz0zwt5n85r0sj4kqdn


Any tool is a weapon if you point it in the right direction.


It’s a travesty how small nuclear still is on that graph.


I stand behind my decision. nostr:npub1key55ax33gkl50uqemvl4khrtqrhzm7wzpc7fhseutt5ddkcwcrqgxlt3h was worth it.


looking to bring your three letter friends, I see. 😂


Hahaha. Fair point. 😂


Who else won’t be at nostr:npub167n5w6cj2wseqtmk26zllc7n28uv9c4vw28k2kht206vnghe5a7stgzu3r this year?

I feel like all 5 of us should have a party or something. 😅


When they go out of their way to reiterate that the elections are democratic, it’s usually a sign…


Do it!! It’s a great place to share the spicy stuff or test ideas with a highly engaged audience.


I keep saying I want to but then don’t do it. It’s hard to find the time.

Any specific topic you’d like to see?


What I am about to write has a strong conflict of interest, but I say it with extreme sincerity.

I know that there are much more important things in one's life, but I believe that buying works of art is a beautiful thing that should not be underestimated.

Not just for visual pleasure, but as an investment of one's cultural and emotional well-being.

Buying art is an act of love towards beauty and daily inspiration, a gift that continues over time.

It means supporting artists, fostering creativity.

Choose, buy and support art, you will never regret it. 🎨

#ArtistsUnited #art #artstr #creatr


My main point was just that it was good but unfortunately you didn’t have full control over its context.


Got to the end of the article and Forbes’ site was suggesting the tokenization stuff…


I think it will be by next week. Right now I feel like I need to just let it wash over me and process.


Since leaving the Oslo Freedom Forum last week I keep having these strange experiences where something seemingly trivial triggers this upwell of strong emotions.

It’s like something has been recalibrated in my mind/body and is still settling in. Very grateful to have most of this week off from the normal bustle. Feel like I’ve got lots to integrate.


It’s going to be a laugh when Europe tries this. 🙄🤡


It’s a shame the article shows up next to articles about shitcoin asset tokenization nonsense.

It’s sort of a perfect juxtaposition of western ultra financialization and the rest of the world getting slowly bled dry by scams and dictators. 😢


Collecting pennies in front of a rocket ship. 😂


Sure. When you put on a trade in the future’s markets, the way that they keep the price in line with spot markets is that either the longs or the shorts have to pay the other side which keeps the price in line. So you can imagine if everybody in the futures market wants to go long, then every couple of hours the longs have to pay the shorts money, that’s the premium. This means that if you go short in the futures market you’re getting paid that premium every few hours. You then cover that bet by buying in the spot market. This makes your position risk neutral. You don’t have any risk because you already have the Bitcoin in the spot market that you can use to cover your short position in the future market when needed. So you just sit there earning the premium without any risk.


Welcome to the future!


Welcome!


Very possible. Probable one might even say. 😅

Do you have new “list relays” on amethyst or are they going to the default set still?


I’d be surprised if she can even properly define what fascist even means.


I wouldn’t advocate for the article being taken down. I think it’s important to try and make it more socially unacceptable to dox people though.


The first thing that comes to mind is the list types. I don’t know if nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z is looking for the same list kinds that nostr:npub1lstr2kmdthkgfuzne8e4cn2nhr646x8jt25szdj7t4wr6xemtuuq3lczsj is producing.

I think he would be but not sure.


I also responded publicly.


I publicly messaged her and her shit publication as well.

I do think it makes a difference. Getting buried in messages that aren’t personal attacks but are clear that you think they are way out of line absolutely makes a difference.


They’re probably also long spot. This is a very common trade when there is premium to be collected on the futures funding rate.


She wrote an article doxxing nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6


I strongly recommend that everyone take a few minutes today to let Katherine Long know what you think of her doxing nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6
https://m.primal.net/IbhN.png


🙄 just needs to put more time in to learn it.


What might a client made for publishers (organizations) look like?

- branded profiles
- revocable publishing permissions
- designed for long form consumption
- subscriptions or some bulk dm capability
- customizable widgets / addons
- good draft management
- Kanban style editing flow
- ai integrated

What else am I missing?


The two parties are the same. They both only want more control. And they’ll tell you whatever you need to hear to get it.
https://m.primal.net/IaYU.jpg


Tried to watch it. Absolutely garbage. Only made it 15 minutes.


Thank you Oslo for the hospitality and the lovely weather. 🌞

Thank you Human Rights Foundation for everything you do. 🌱

Thank you nostr:npub1cf3zeytdnwgwzz5pk2ax0vvmmlzad03xcft4d50ejrfhsh8pxcdsefx7gk nostr:npub1szpa7cypmyd59083qs3pte9lez22lzfu6pl2guhgqx7q09x68y6qquh3td nostr:npub1rscuek38p87xeawmpg9ssump8cjkgmz2j3rhnha4artvh0xjacwq9upeqk nostr:npub1trr5r2nrpsk6xkjk5a7p6pfcryyt6yzsflwjmz6r7uj7lfkjxxtq78hdpu @harsh and everyone else on the team who created such an incredible event. 💪

Thank you to all the activists I met this week for sharing your stories and reminding me of what my work is really for. 🫂

🙏


Oh don’t worry. I beamed with pride. 🤙


The night doorman at my hotel, who has been working every day this week, just commented as I walked in that I am a “good party man”. 🤣


Cool. 🤙


I’m not at all. Have had amazing discussions with folks all week.


Why?


Please intro me to whoever needs the basic intro or help getting setup.

Been trying catch as many folks here in Oslo as I can but I know there are more.


Momentum continues to build.

I’m very bullshit on e-cash.

nostr:note135k0hr4qf00r0n6hnugkevg7wuk4gga398jrr0u9d68xgnyxglhq06jh2h


So many. Have heard heartbreaking and inspiring stories from activists working under incredibly challenging & dangerous conditions under authoritarian regimes but they’re there, doing the work, and risking their lives to make things better.


Being so deep in Nostr and Bitcoin, it’s easy to get myopic and lose track of all the other people and groups that are out there fighting for privacy and human rights and a better world in general.

The Oslo Freedom Forum has been an incredible opportunity to meet those people and learn about their stories.

I’m bullish on freedom and humans.


How are you planning to implement it? Are you going to run an nsecbunker for users?


Imagine if every house was heated by bitcoin mining…

#heatbit
https://m.primal.net/IZZu.jpg


GN thought.

The most meaningful part of any conference is the small number of new people you meet that you have a genuine connection with.

So far, the Oslo Freedom Forum is blowing the ratio out of the water.


I think that means you’re buying drinks tonight!


Ahhh. This looks fun. 🤓


Give up the illusion. 😉


👇 the future

nostr:note13jvef0gnxjx9sud58rkwpmxn93yp93424d2e5utlw2mrwsje4zcqy9r8ew


From the “functional encryption” description it’s unclear what he means.


This is what nsec bunker already does.


Today we’re happy to announce another component to the TIDAL Open Platform with open sourcing our embed player - our first full app open sourced! Now with Nostr authentication and full-length playback capabilities. nostr:note19atyn34axzzcf2h5lfjwz6pys2ncjvgsd7vh4nmptmlmscdudq7spunmhm


nostr:npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m and nostr:npub1a2cww4kn9wqte4ry70vyfwqyqvpswksna27rtxd8vty6c74era8sdcw83a spending a lot of time talking about Nostr. 🤙 https://i.nostr.build/dw0WE.jpg


Still can’t get simplex to consistently work. Definitely has promise but needs to be way easier.


I really can’t wait until we can all stop using telegram.

https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/


💯 nostr:note16lmj8d5fw8a08h8z9mpz4lvzzm9rn3gxtqkd5l2n7p3r9sgcxryqqdrt6z


Never heard of it tbh.


GM Nostr.
https://m.primal.net/IWzP.jpg


#unstoppable

nostr:note14d548drt84awqvc697kdg6ccy4fzhwc3xc60fc9a9qtctm6kszmqpljp5v


Spent the whole day wandering around Oslo, enjoying the sun. 🌞

And wouldn’t you know it. I ran into some familiar faces.

https://m.primal.net/IWSc.jpg


It will happen. 🤙


Nostur Client is searching for a rename…

I will commit 50k sats to whoever nostr:npub1n0sturny6w9zn2wwexju3m6asu7zh7jnv2jt2kx6tlmfhs7thq0qnflahe awards the winning name.

Let’s get this trending to promote the contest.

Comment, Like, Boost

All zaps to this note will go to the winner!

nostr:note176ksk5teg6exadj03jaw0ywvxca7pydkxc9j97x4hx0f55wztaeqltgayu


First impression of Oslo…

The women’s fashion is unique.


Biggest thing that helps me is to do something active outside in the sun immediately after arriving.

The movement clears your head and gets your blood moving properly again and the light helps snap your body onto the new time zone.


That’s far too limiting. I’m a DM and small groups maxi.


Will do!


Yup. 100%. The addressability plus the layers of “how to find stuff related to me” that the protocol already does makes it like the universal join table for nostr data.

I’ve been digging in on double ratchets and syncing big groups across devices and, wouldn’t you know, I think npubs are going to solve problems there.


I didn’t know it mapped to an npub either. That’s super cool.


Hahaha! Exactly.


Whoa whoa. Let’s not over promise. 😅


Goodbye port tunnels and slow tor connections. Goodbye APIs, and webhooks. Goodbye platforms and middlemen.

nostr:note17pu8xzmrexhrwuunremvfl6hpvlcwua9flgaq3drtxp4zzsyhg9qq90dd2


Enjoy ✨✨


And free hosting! 😅


So hilariously short sighted.


On a scale of 1-10, how much do you think the state hates E2EE?


On a long enough timeline, the chances of a centralized database remaining secure trend to zero.

nostr:note1nnzc3dzshfvn3dunenhhnk5gnhwqawvefnw265djp73z8gu7creqcvtssr


Down deep in a JSDoc hole.  🕳

Refactoring is what purgatory would look like for coders.

And writing tests is the first circle of hell.


Being wealthy is actually just a measure of this. Money are freedom credits to help you not do more things that you don’t want to do.


Yeah. It was a nice one. Sunrise is always worth it. 🔥
https://m.primal.net/IToH.jpg


GM Nostr, and jetlag. 🌞 🌆

I guess I'm going on a very early run this morning.


interesting. any specific failures you're noticing?


Get ‘em while they’re hot! 🔥

nostr:note1ew3r60qvhszcwuxszt7h3a8gw3fhxtc3av4yh942wcegwvytlc2qvqyfhw


You guys do that too?! 🫂


#NostrVillage starting shortly.

Join us on the live stream.

https://zap.stream/naddr1qqjrxerp89jxgde3943kzwf4956rvvp495uk2ctr95mnsdpcxquxyde4xgmxgqg3waehxw309ahx7um5wgh8w6twv5hsygx0gknt5ymr44ldyyaq0rn3p5jpzkh8y8ymg773a06ytr4wldxz55psgqqqwens3qt03l


Steak frites at nostr:npub1key55ax33gkl50uqemvl4khrtqrhzm7wzpc7fhseutt5ddkcwcrqgxlt3h are excellent.
https://m.primal.net/ISvA.jpg


I miss nostr:npub1t3ggcd843pnwcu6p4tcsesd02t5jx2aelpvusypu5hk0925nhauqjjl5g4. Anyone else?


nostr:npub1ye5ptcxfyyxl5vjvdjar2ua3f0hynkjzpx552mu5snj3qmx5pzjscpknpr curious to know if you’re using NDK or only just nostr-tools directly?


🤣 I spent weeks getting NDK up to v2. It was painful.


Who am I going to see tomorrow at nostr:npub1key55ax33gkl50uqemvl4khrtqrhzm7wzpc7fhseutt5ddkcwcrqgxlt3h for #NostrVillage?


The new calculator is indeed super nice. Keyboard plus QR support makes a HUGE difference.

nostr:note1uy49wd5fuz3xprwuscksknuz3vpmxqj4mhyvt0henypv4y6ucd2smqd25m


Would love to see a doc, even if it’s a draft.


The latest episode of the Bitcoin Review with nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8 , nostr:npub16c0nh3dnadzqpm76uctf5hqhe2lny344zsmpm6feee9p5rdxaa9q586nvr , nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 , and nostr:npub1qny3tkh0acurzla8x3zy4nhrjz5zd8l9sy9jys09umwng00manysew95gx was one of the best/funniest in a long time.

More like that!


Why not help out on NIP-104?!


😬 not sure from that small console output.


Tomorrow I begin my pilgrimage to nostr:npub1key55ax33gkl50uqemvl4khrtqrhzm7wzpc7fhseutt5ddkcwcrqgxlt3h

Can. Not. Wait. 🤙


LOLOL! We're a pair of highly cultured humans.


You got it! Knock it out and move on.


Fancy single origin from a local roaster here in Chiavenna. https://sierranevadacaffe.com/en


GM Nostr! 🌞

#coffeechain
https://m.primal.net/IOhQ.jpg


Also on the regular rewatch list.

Margin call is the darker of the two for sure. But it’s great.


All 9 of you out there. 😅


“The truth is like poetry. And most people fucking hate poetry.”

The Big Short is such a good film.


This is huge!

nostr:note1pdrm8tl7yuelwrra9lmk7vvgmycj37hklk3vm3n0s9070zytaa4sehf8cj


Ahh! Damn. Sorry. I’ll have a look at it.


Turtles all the way down.


What asks you?


Better to not know. It’ll be minutes that you will never get back.


They call that the “soft delete” in the biz.


Thank you!


🙏

nostr:note1fphryav48fens0cc6qz6wskqsugw63xfm0wjlulx5ssvxe0knswsavjaw3


Miss those hills


Especially this week on bitcoin twitter. 🤦♂


#ungovernable 😅

nostr:note1y8x9j28z6u2rh8ygujtzqus8xkwe92nadny63qmd466zts96wxasautdz3


A well prepared station.


I just had a dance party in the house with mine and they crumpled and had to go to bed.


Wow. That’s insane.


Hell yeah. Appalachia?


Any surprising outcomes?


Hahaha. Fuck yeah.

I’m an ocean liner and horse cart maximalist.


💯 Yup. Full propaganda. Isn't that most of what JS is about anyway?


Currently experimenting with some radical changes to NDK...

 nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft get ready to be shocked.


Legend. Things are getting more and more wild.


10/10. Must mean I’m getting old.


Zero


I think it's a few things.

1. People in Europe generally do dress better, they care about looking well put together. This is just a cultural thing.
2. The demographics of Europe and NA are way older when compared to Asia. There are just fewer young people, in nice restaurants and everywhere else.
3. Yes, the economy is failing young people in both NA and Europe, much worse in Europe IMO. That said, the cost of a very nice meal out in Europe is still way way lower than it is in the US.


Given it's going to be a slow machine I'll probably set this up for the kids to play around with and learn on.


Someone already did! https://www.youtube.com/watch?v=ipJceL253Fo


Feel like this is every single day for me. 😂


not on Primal web.


GM Nostr! 🌞

I just bought a new battery for an old 2012 Macbook Air that I've had lying around for a while. The plan is to fix that and then flash it with Linux Mint. 🤓

https://m.primal.net/IKbs.gif


LFG! 🤙 I am so here for watching Nostr destroy traditional rent seeking middlemen and platforms.

If you’re a creator, I guarantee you’ll get a ton from this event. nostr:note1qyh26atth66c06yf5xrx90x3p28vh36eg4ytw9ctcwf4r66e9teq7jjrw7


Thanks - I think I'm good in the end. Designer helped and we ended up with a good mix of the two. Stickers are ordered!


Thanks for the help everyone!

In the end I went with....option number 3!

https://m.primal.net/IKBj.png


New  nostr:npub12vkcxr0luzwp8e673v29eqjhrr7p9vqq8asav85swaepclllj09sylpugg web design, who dis? 🤙


What do you mean?


Designs are willingly accepted if you want to redesign it. 😉


Yeah, I agree. I like the orange better personally but the recognizability is going to be way higher with the standard logo...


Yup. Comes from "Claven", old latin/romanch for key. It was a historically very important pass through the alps.


arancio?


Orange?


Getting stickers made for local merchants... which is better?

https://m.primal.net/IJyE.png
https://m.primal.net/IJyF.png


Chiavenna 🇮🇹


GM Nostr! 🌞
https://m.primal.net/IJsP.jpg


So excited about my new calculator. 🤙😅
https://m.primal.net/IJRD.jpg


🫂 just read.


🤯 I have been dreaming about this device for years.
https://m.primal.net/IIvS.jpg


Cherish this screenshot forever.


I also think there are different ways to deal with the mafia than is currently being tried.

The Mexican drug cartels in particular get almost all their power because of America’s war on drugs but also America’s endless thirst for said drugs.

All that said. I agree. Organized violent crime isn’t something anyone wants to or should have to live with.


Many years from now people are going to ask you what this period was like.

Make sure you can say you were actively supporting the community and resisting power. ✊

nostr:note1wkry6zzr0gvmhssm665gve7vf2g76cj0p9l3gt2gpdxrfs5c7n0shtt76c


People always cite the mafia as a reason that we need the state. TBH, I'd fucking take those guys over our current ruling class.


Very long article in french. Worth doing a translation on it and skimming through. It's impressive in the "I'm watching a supertanker crash into a pristine marine reserve" sort of a way.

https://medium.com/@AlexStach/les-d%C3%A9rives-de-la-surveillance-financi%C3%A8re-menacent-nos-d%C3%A9mocraties-323fbdc1ccbf


FATF is a terrorist organization.


Clearly AML/KYC is working. 🤣

These numbers are absolutely hilarious.  Like, how can anyone say that these preposterous policies are successful with a straight face?!

Absolute 🤡🌍

https://m.primal.net/IIcC.png


I expected it to be bad... but 200 to1?! That's way beyond what even I would have expected!

The only thing that makes this sort of garbage possible is the infinite spending enabled by fiat.

nostr:note1e0h4ysn5nlp0y0m58w5umux44qjqm23zz88pnykgh2tz85ku8htq90zwp3


Love this! I also cut my teeth running support at a high-growth startup (how I wish it'd been in Bitcoin 😅). It can be a grind but it's also so rewarding in so many ways.


That’s a good idea! nostr:npub149p5act9a5qm9p47elp8w8h3wpwn2d7s2xecw2ygnrxqp4wgsklq9g722q has this been something you’ve thought about too?


Who cares. 🤣


Single digit mempools. 👌


Love it! Nostriches IRL


Off ramps? Where we’re going, we won’t need off ramps. 🤣


As much as I love stacking sats. I love spending them with great businesses even more.
https://m.primal.net/IIEU.jpg


Agree. It's not always dev work that is a contribution. It's putting in the work that counts.


"It is tempting to make shortcuts. When writing or doing art or building software (or in any other way constructing paths for people to walk on), you can typically earn more if you cater to the marginal user, the one who is on the fence. But the marginal user is the least patient and least interested, so you have to simplify, reduce friction, make the path direct and unambiguous—and you end up working for the shortcut paving company."

I know, I know. I need to stop sharing so much stuff Henrik writes. But it's just so damn spot on, so much of the time.

https://www.henrikkarlsson.xyz/p/on-shortcuts-and-longcuts


Yes!!! 10000x yes.

So sad that crony capitalism is what most people think of when they hear free markets.


lol. Or Bluesky.


💯

Do the fucking work.

nostr:note13p4adyxhysd6ek6ahf9u90697j9fmsurm8yy76sa8r8u84753sqs00fhh2


Yeah, I agree. What I'm worried about is a potential situation where they can remain profitable (or even become more profitable) by cozying up with the state and making Bitcoin a custodial, non-private asset managed by Wall Street.


Skin in the game. Always.


Yeah, I agree. It's tough. Thinking for yourself and being free actually requires a lot of work. And actually, most people just don't want to do it. They'd rather give away their freedom to have a "nice enough" prison.


Curious to know if this is a controversial position to you all...

https://world.hey.com/dhh/open-source-is-neither-a-community-nor-a-democracy-606abdab


This is exactly why coinjoins are important.

KYC free sats helps you remain a nym (one aspect of privacy).

Coinjoins help you delink coins from specific people (you and others, whether they're nyms or known) which is another aspect of privacy and helps maintain Bitcoin's fungibility.


That's not the point. We're well beyond turning things off. Coopting is my main worry. We have too few economic nodes on the network, IMO.

That said, I'm optimistic that this will work itself out too.


💯 So common, so false.


A happy morning to you too, good sir.

https://m.primal.net/IHcq.gif


Well, see, there's this thing called the internet...

All jokes aside, I think we're already solving it. It's a big, hard problem that will take decades or centuries. Or maybe it's never "solved" and just requires constant vigilance.

In any case, fast access to high quality information (that is verifiable - thanks asym cryptography) is what keeps large entities from amassing too much power or control.


Maybe on the party's clock. I operate on UTC. 🔥


Having led teams of 100+ people in the past, I can tell you with certainty it's the second. (which you're obviously in agreement with).

There is also an immense sense of joy that comes from giving people the tools and then watching them figure things out and succeed on their own.


First, and most important.


Agree, with one caveat. We also need to drastically reduce information asymmetry.


China, Apple, and now Mastadon. You're racking up an impressive list  nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s 😅 Keep it going!


GM Nostr. 🌞

If you take the time to really think from first principles, you can only come to one conclusion.

All forms of government (and rule over others) are deeply and irreversibly flawed and the only rational thing to do is strive to minimize them as much as possible.


Really looking forward to following how this goes!! 🤙🤙

nostr:note13yn5de2klwedkkhqfzkxz2rrq8vk9wpvgnsh7ctxhr60323wa68sxlzavp


I’d feel a lot better about going into this fight over privacy with world governments if mining wasn’t so damn centralized. 😬


nostr:npub1xdtducdnjerex88gkg2qk2atsdlqsyxqaag4h05jmcpyspqt30wscmntxy any chance you’d open source the codebase that does the data collection & storage?

nostr:note1hw75f7dq792c2u2r0p9kntslxrsu3mh9usrh9h3te4d9q7q75feq52qzjy


GM Nostr! 🌞

I’d love to see more data gathered and made public about the size/state of the Nostr Network.

https://stats.nostr.band is good but we don’t know the methodology of collection or how complete it actually is.

More, and different, versions would be super helpful.


nostr:npub1xtscya34g58tk0z605fvr788k263gsu6cy9x0mhnm87echrgufzsevkk5s or is it Dylan LeClair?? 😂😂

X is such a shitty less. 95% of the people that follow me are clearly fake at this point.
https://m.primal.net/IHJi.jpg


🙏 Thank god!


The man in black. Fuck yea.


Lame Pablo. So lame.


🙏 Thanks Hong


Criminals are always going to criminal.


GM Nostr! ☔

Remember, the only game worth playing is the one that results in you having more freedom to decide where and with whom you spend your time and energy.

Everything else is a distraction.


Yup. Everything I Want to Do Is Illegal: War Stories from the Local Food Front https://amzn.eu/d/0hepBXC


Is this a real book?!


Can’t wait!


FUCK YEAH. Very solid lineup.


Ugh - I have not been looking after my body enough in the last week or two. Too much code to write...

Need to fix this.


Send me stuff, I'm happy to help. send me a voice note describing things and I'll try and write it out, I don't care, I just want to make sure we get this double ratchet DM stuff out there in a way where it's possible to implement it in a sane way.

The  nostr:npub1h0uj825jgcr9lzxyp37ehasuenq070707pj63je07n8mkcsg3u0qnsrwx8 folks are also working on an adaptation of the signal protocol for nostr but they're doing things slightly different to how I've outlined in NIP-104.

I want a single spec (which doesn't have to be mine) that we can all get implemented and make clients as cross compatible as possible.


Ok – it would be really cool if we could all work on a standardized version of how to do the signal protocol on Nostr. We want to have something that is as compatible as possible with as many clients as possible. Otherwise, you might as well just be building a centralized web2 client instead.

I've got no issues with changing some parts of the NIP-104 spec if it makes sense. Would you be open to trying to write out in more detail what you're doing in a github doc so we can collab on it a bit better?


Link?


Just use NIP-44. nostr-tools makes it trivial to use. NDK will also support.


But you said you're not using secp256k1 at all. How are you deriving new public keys (addresses) from the ratchet?


Did you ever update your spec like I asked you? Definitely keen to see how we can tick more boxes but so far what you've outlined doesn't cover nearly enough detail to actually implement it.


Yeah, I understand how the ratchets work and keep the keys moving forward but that doesn't help me understand how you're delivering the messages which are encrypted with the new message key to the other party. This is what gift-wrapping does. It explicitly hides all the metadata that proves Alice and Bob are speaking with each other, in addition to encrypting their message content.