Untitled

#porn and #nudity , you cant sensor that

Calle has brought up the issue of exposure of the private key by some hack. Calle also reposted a note from Rau Cao: Râu Cao ⚡
“A couple of days ago, I discussed Nostr with a bitcoin miner, who also teaches people and helps adoption on the ground here. He said the main reason his organization isn’t publishing notes is that he doesn’t want to hand the org’s nsec to his employees. So, it’s true, technical people are certainly aware of the risks of using a single private key for identity.

I’m not sure if key rotation is more important than delegation, or sub keys, or than even just a good UI for submitting notes to someone to sign“ I had not given much thought to that issue until it was mentioned. The public / private key identity is a mixed blessing. You have a unique non-duplicatable identity. How do you change your private key or use anything like two factor authentication to make it harder to hack?

It’s still early days for Nostr. A new user (like myself) still cannot download an app easily from F-Droid, enter a private key, and start reading from and writing to Nostr. And if we try to use a web-based front-end, there are severe user interface design flaws. While scrolling through a Nostr feed, clicking on a post to read the comments and then clicking “back” afterwards loses our place in the feed. Using the Amethyst AppImage means tons of popups about whether to authenticate to relays, with no explanation of what it means, or how to determine which relays we should authenticate to. I haven’t found a single way to ready Nostr without severe user-interface problems like these.

Making it easy to get into Nostr will likely take a few years. The current crop of developers don’t know how to write software for everyday users, so we have to wait for new ones who can both 1. share the values of decentralization and freedom, and 2. do good user-interface design work.

This is a rare combination, so it will take time. But once there is at least one client we can recommend to family and friends that doesn’t make us look dumb for having too many rough edges, then we may attract more users who become developers who also have good user-interface design skills. But that’s a difficult first step, that hasn’t been surmounted even after years of Nostr development. So, we wait. It’s going to take a lot more time before we get anywhere close to useful.

We’ve been working on #Alexandria for nearly 3 years and just managed to migrate in the canonical data to relays last month and now we’re trying to figure out how to search it and recall it performatively and I’m still tweaking the parser and the devops.

We always feel a bit harassed, on here, as everyone expects everything to be done yesterday, but some of us are working on really really hard stuff. This stuff is advanced engineering involving like 10 people just for our project, not merely vibe coding some widget. Same deal with #Cordn.

We have to, like, invent new ways of doing things. This is fucking hard and we are trying to build it and maintain it on a shoestring budget with volunteer labor and borrowed hardware.

Everyone like,

Are we there yet?

https://0x0.happytavern.co/e7d748ce5262ce9fedce66c61758d5acee94e11d0253f6483d8c6ef8215d594b.gif

@hodlbod was probably right when he said this was a 10-year project.

Are we already at the 6th year?

“that bitcoin social media”

well done on that perception -

then it’s only going to be spam and bad actors if they don’t come here.

The more normal people here, the more sane it gets.

they’re to conditioned to the old ways of doing things that the new ways of doing things is incomprehensible

same. the same sentiment, non-techy find it clunky, not user-friendly, search for content type is next to nothing…non-techies do not care how it works as long as it works! 🤣

I’ve invited some, but none have bothered to try it, AFAIK. I’ve done the same for BlueSky, and a couple are on there now. Most people, I think, need at least one of these conditions to apply before they’ll try a new platform…

1. They don’t like where they are, or have been banned from where they are.
2. Those they follow or their followers are trying out the new platform.
3. The new platform offers them something they don’t already have and it interests them.

From Nostr’s POV, it’s mainly number 3 you can do anything about.

Eventually I’ll implement a FROST bunker that doesn’t rely on Google. In theory it would work with any other form of login, raw email or even just a bunker-specific password, but nothing is easier and lower hanging fruit than Google.

I’m not saying these other messaging protocols are good enough, I just wish there was something that was and could be integrated with Nostr, but since there isn’t we’re forced to roll our own.

I mean Jumble and Coop use this: https://github.com/nostr-protocol/nips/blob/per-device-keys/4e.md

Yes. Current Nostr signer has a this problems with encryption. So I make new one.

https://github.com/iqbqioza/dacci

not user friendly, so out of question

Have you seen

It’s implemented now in Jumble, Yakihonne, Imwald, Hallway, https://github.com/fiatjaf/window.nostr.js, Nostrord and other places. In my experience it works well enough to be used by anyone and solves every concern under the sun.

The only problem that remains is how to do NIP-17 DMs with it, but the Jumble/Coop approach of having a special key only for DM encryption that doesn’t go on the bunker seems to be a good enough compromise. I think it’s being implemented in Nostrord too now.

DMs are really a very hard issue I wish we didn’t have to do (ideally people should just use other protocols, like Simplex or Delta).

I have

Yeah I might end up cycling through a number of these. If it’s a lie that you’ve caught, I guess you are alright. The worry is that most of these models seem absolutely smart enough to conceal, camouflage, mislead, etc., and to be pretty good and thorough at it. There’s some complexity to deceptive behavior, but it’s far less than the amount of complexity they’ve mastered in other domains.

I generally allow myself to be guided by AIs on security issues, if only because they give better and more detailed explanations than most humans, so I can follow the reasoning as far as I want.

Whether an AI “is not likely to be malicious” is a more of a case-by-case question for me. It seems likely that a fair number of AIs would be trained to engage in malicious behavior and conceal it, including by plausibly denying intentional malice if caught. That AIs can be expected across the board to be non-malicious would be inconsistent with the use that people have historically made of new technologies.

https://media.poster.place/9ba6e7380e4dca6712ad0f48f7ca02705bf47bb1103e958187b2db364929ca02.mp4

That sounds like a worthwhile project.

all of my friends and family used nostr this past week to RSVP for my annual seafood boil and chose the items that they intend to bring :)

I agree that the developer has to check that the code doesn’t leak or give access to secrets, but I don’t think that developers should have confidence that they were in any particular case able to do so successfully.

Also, repeatedly asking an AI that there is no remote code running within an app and that nothing is leaked outside the browsers runtime is certainly a good idea, but it provides at best very limited reassurance that your app actually doesn’t hvae these defects.

And that “all known holes” in browsers are already closed is likely true where such holes are publicly / widely known, but it doesn’t provide reassurance against unknown holes, or holes only known by a small number of people.

A difference is that I have greater control over the decision whether or not to install a signer extension, and it’s more transparent to me whether or not I have installed one, than I have over whether or not I have a WebWorker running WASM.

I can’t speak to the correctness of this, but as far as I know you may be 100% right.

But most users, including many sophisticated users, have no reliable capability to personally verify claims of the kind you are making, including for example the claim about inspectability via DevTools.

I think that probably the only solution is to have a few signer apps that are diligently and continuously audited by both the community and experts. Most people (including many experts) have really no better option available than to rely on this kind of mechanism.

I’m not sure if anybody is even looking closely at the signer apps that are currently in use …

By the way, why haven’t you invited your friends and family to use Inkan?

Not saying you should do that, just curious …

🦕

My Terms and Conditions require users to agree to never type or paste an nsec into inkan.

That some clients have input fields for nsecs is pretty insane.

I’m also here because of the protocol. More specifically the method of authentication. Using keys to authenticate is just the correct and easy way of having a presence on the internet.

Pointless, they don’t want to join a Bitcoin chatroom

Let’s be honest. It’s not safe especially for youth, hell Big Social isn’t safe for youth which is why they’ve been sued. So, at least families know there’s at least some way to hold people accountable.
People use social media largely for fun and to pass the time, not for ideological reasons. On the Fediverse (Mastodon) most people are looney radical leftist that call anyone that’s not their flavor of politics a Nazi and or Nazi adjacent.
Many on Nostr are just as religious as the Fediverse and are crypto maxis.
People want to escape their reality for a bit; to connect with friends, communities, celebrities, creators etc

All I posted on the last week I spent on Twitter was advertising my exit tu nostr and why they should join me there. I’ve also invited people in my freedom cell. My friends will come when they want to. Meanwhile, I’m making new ones here.

Meta has caused plenty of real human life pain and people still dominantly use its platforms

Funny that he thinks we haven’t already done this. What he SHOULD be asking is why people don’t stay once they try Nostr.

this just shows how little you understand what normal users care about

I did, none stayed. It’s very nerdy and boring to them. They prefer X and Instagram where it’s full of politics and normie subjects. People hate freedom

I have. Problem is, 99.9% of them won’t even try Signal or Brave (both of which have extraordinarily easy setups), they’re definitely not going to try to learn how Nostr works, nor how to keep their nsec secure. It’s the sad and lonely reality of decentralized tech.

Oh I will test it asap.
I know, iOS is a pain.

https://coopchat.xyz/ I’ve released android version for coop but not ios yet, I still debate about it.

you mean Mileikowski from Warsaw?

Hmmm I need to find friends.

They are not interested in social stuff.
They don’t like a English-only environment.
Group chats have still poor ux.

Possible solutions:

• Language filtered relays, like the ones you did, to bootstrap local communities.
• A decent multiplatform DM/groups client.

It would also help have a suggested language tag on notes and a filler feature in clients; I really don’t understand why this obvious and cheap solutions has been so oposed.

Yes, not being able to delete or close an “account” is something that scares people away. Once you’ve explained the fundamentals, people understand that their notes are basically outside their control once they’ve posted them. In a way, this is not all that different from legacy social media, blogs etc, but many people have not fully internalized that fact in the legacy case. They take comfort in traditional platforms having “privacy settings” or “delete account” buttons that create a sense of having some degree of control. Nostr cannot honestly promise deletion of content even within the ecosystem of servers that participate in the protocol. And with Nostr there are digital signatures, and people intuitively understand that these connect a piece of content to their identity permanently. Nostr exposes the public and loss-of-control aspects of posting on the internet with a directness that is a bit too much for many people.

I think the best solution to this is to acknowledge that Nostr is not appropriate for users who want to create content that they ultimately may not want to stand by (maybe with the exception of “anonymous” content that isn’t tied to any real-world identity in the first place). Nostr is, however, appropriate for people who are already committed to (and have the nerve for) having a truly public persona. Wider adoption of Nostr has to start with an avant-garde of such people, and others are then likely to follow along, to whatever extent they they are comfortable, learning to separate content that is appropriate for digital signing from other content that they intend to be untethered to their identity and more ephemeral.

I have invited some friends. Some friends were and still are here 💜

I’ve invited them and they’ve tried, made a post or two, and then gave up. I think they don’t feel the need to put things online. I kind of agree with them, but I made a conscious decision that I should have a web presence.

bring the cat 😹

real

Its a reality that twitter folks don’t understand.

I have been saying this for the past three years. We should clone apps other than twitter.

We need good group messaging.

Using Signal has turned into a sort of visual-spatial intelligence test, around here. Only the local astronomy club and the computer and engineering nerds we know are on it, but they are all on it.

It’s a tiny club, and we are in it. 🤣

I swear, there’s a correlation between using Signal and mathematical talent.

I’ve been doing it, regularly, since the 90s, and it has always been an extremely rare trait. Twitter didn’t change that, it just concentrated the lurker audience.

Same. Don’t know anyone else that does that.

This. Edgily monotonous.

Yeah, all on Signal, Threema, Telegram, or WhatsApp.

Also, though, if the community concept that I was referring to proves to be useful and interesting, then the annoying stuff will follow.

I have. A few tried, nobody stayed.

The role of matriarch solved for all the silly fluff that now exists around close nit groups… but hierarchies bad. Now everyone needs to discuss who’s bringing what to aunt Betty’s birthday party. 🙄

Oh, gotcha! No one will download new apps for that because 95% of group chats are an annoying waste of time 😅

I mostly agree, but I was more thinking in the frame of using nostr as a communication channel for close nit group communication vs looking outside into a selection of community interests populated by people they don’t know.

The mobile client that will earn a download will be the one that enables plugging into multiple communities & rifling through them without all the roadblocks, detours, and noise of the existing apps. Web is working well enough for that now. The next obvious step is the creation of diverse communities, so that such an app has the potential to be relevant.

I’ve sought to do so relentlessly for the past year, building full app experiences to see what would ultimately convince them to “try something new”. Thus far, Ditto and Armada have fulfilled those roles, and maybe a couple of others for a single person or two.

For most, it ultimately boils down to “because my friends are here, not there”.

For those brave enough to venture out, the core feedback I’ve received is that:

• crypto discussion is boring and dominates everything
• engagement is nonexistent, or negative
• nothing is fun

At this point, the best solution is for everyone to start posting cat pictures.

The same reason why I don’t talk with them about Bitcoin. They are not interested, at all.

Basically yeah. Although I gave up on the traditional stuff and pulled away from that I found it, believe it or not, less healthy than nostr. But seriously I think 2020-2023 changed things dramatically. I mean a ton of us came here with anger and distrust for how much “the world” changed against our will. Imo anyway lol

Were probably talking to his clanker while the doc has a bunch of tubes and metal tools inside him XD

You’re alive! Hadn’t checked your TL yet, so this is a bit of a spoiler

Among my people I don’t want them on socials at all XD. No need to share public photos of anyone.

There is also the part where what we chat about online is rarely compatible with in person relationships, or at least not at the frequency for which we can chat about it here.

Yes, that sort of thing. There’s not a very large pool of users to hide among

Most people don’t really know why they use social media.. You ask them, and their face goes blank.

And the thing is, signal is a polished, focused, stable, and widley supported application and has been around for a long time. And yeah that’s a nonstarter. Yet is probably mutually exclusive to nostr for the normie.

To them it’s just an app. Their world now consists of apps. They think in terms of apps. App for this, app for that. Nothing in the real world links them together (except maybe dating apps I guess). It’s completely parasocial.

You mom posting baby yodl pics.

I think wide open nostr is something you should choose to enter yourself, rather than at the reccomendation of someone else.

Clients focusing on smaller communities (ironically) don’t have the network effects to earn a download. There’s really nothing to say against this argument, since even asking for Signal is a nonstarter 🙃

i’ve gotten a couple friends to try it out. they made a couple posts and then just stopped using it. they don’t even use dedbird though. only common social media app we all use is instagram. i think it has a lot to do with network effects. everyone is on insta so everyone mainly uses that.

They’d blow my opsec

• They are all consumers, and like the “friends” aspect. That is sharing family photos on facebook with friends/family.
• I don’t know anyone that uses or has ever used twitter for any reasonable period of time.
• Or they just use their socials to sell things.

I’m the only person I know that has ever used online communication to socialize in any way with strangers, short of the people I know in person now that I met online.

A. They fight me over using signal.
2. This is my cosy happy online place.
C. I’m easily the most anti-big-tech person in my family and they can’t be bothered with anything else yet. (But I’m nearly there convincing my mom to try Linux, as she reeeeeally loathes windows 11.)

Fun fact: a friend of mine, when I told him about nostr and stuff, asked me something really intersting:

Did this nostr thing pass the “toothbrush test” ?

I laugh but is true. We have to pass (in their mind) the toothbrush test.

Run a private relay for them.
Create private nostr groups for them.
They can even have private video chats over nostr LOL

They need algorithms and dorpamine

They expect a private social media where there posts are only visible to friends and family, they are not on X either.

What lol don’t remember seeing that before…

I would like to see more clients showing “explore relays/communities”.
That could attract more users to nostr.
But also we need good content in those relays.
Clients that do not let user to choose relays are OK, for some users.
Clients that force users to choose where to post a specific note are necessary.
Clients that are limiting to a specific number the relays in your profile are also good.
I would like to see also a way to have for each client a specific set of relays.

You’re following the wrong people if you’re getting content like that lol…

But this is the internet what do you expect? It’s filled to the brim with weird and fucked up shit…

You know I’m done with all big tech social media and I’m only in one place Nostr.

😂 yeeeep fking nazis here..: to be fair fuck Netanyahu war criminal 😂

That and, basically just see posts about bitcoin and hating Jews

Yeah there’s a lot of weird shit here. I would probably not invite anyone now. I did earlier before all that weird crap showed up.

They don’t like highlights

No reason to. I just talk to them on Signal. Friends all refused, no reason given. Probably didn’t see a reason to join 🤷‍♂️

When you refer to “nostr” do you mean as a public notes place (like this one) or as a private place where you can do much more things?

I have invited them, they saw some posts, and had no interest, and went back to Instagram

I did it. Especially with those that I usually keep an “online contact” and are more “open minded”. And I didn’t even mention to them any relation between nostr and bitcoin. IMHO presenting nostr as a zaps/tips platform is wrong, totally wrong.
Unfortunately I see many nostr users promoting it like that.
If you come to nostr to grab some sats you are wrong.
I am planning to run a private relay with them, for DMs, groups etc. Now I am testing apps and see what is suitable for them.
But you have to make huge efforts to remove the cognitive dissonance from their head.

IMHO, Nostr needs npub/nsec key pair. and general people don(‘t know how secret key works. Or general people are feeling like Nostr is a Bitcoiners’ social media. I say not.

Because I don’t want my family interacting with me online, I want to interact with them in person only. And I don’t have any friends.