Nostr Web Client

I put all this work into asynchronous batch handling of NIP-07 requests, and nostr clients just `await window.nostr.doSomething()` one request at a time.

It's actually pretty crazy that clients behave like this. This old and busted synchronous request paradigm needs to change, especially for:

* Primal, which requires signing of multiple events with each page refresh, all of them blocking.

* Nostrudel, which has a "decrypt all" button, but then decrypts events one at a time.

Does nos2x support asynchronous handling of requests? I didn't notice anything blocking, so I want to say yes (assuming you have permissions set).

If a client makes requests to a signing device, and those requests have a) permissions and b) no dependencies, then they shouldn't block other requests. Let the requests flow freely!

cmd 9mo ago

actually I spoke to soon about nostrudel, it may be doing async requests to decrypt all, but it's still one event at a time (which is the fault of NIP-07).

there still needs to be a better way of batching signer requests, but this may require extending the NIP-07 interface

Reply to this note

Please Login to reply.

Discussion

teatwo 9mo ago

Imagine you are visiting a phishing site. You are going to post a photo of your meal, but the app is asking a signer to sign for something new to identity usecase and something new to Bitcoin API.

cmd 9mo ago

this is covered by a) permissions, in your scenario the extension would delay the second request until the user responds to the first request

teatwo 9mo ago

All right.

Apart from checking the legitimacy of the URL, I don't also know of any other security defense other than a visual check by the user.

I know there are some that go a step further and validate and alert the sign message in Web3, but to do this, the attack case needs to be templated/specified.

cmd 9mo ago

The signPsbt prompt window is going to be very different from the signEvent window. Everything to know about each input and output will be displayed to the user, including the script.

The wallet (soon tm) will also have a `window.bitcoin.register_xpub` method for registering signed xpubs into an address book, which the signPsbt prompt will use to highlight addresses for simple verification.