Nostr Web Client

Web clients. You’ll notice that this has near zero browser compatibility. And I don’t think it can even do DNSSEC.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/dns/resolve

Web browsers are still heavily sandboxed today.

OpenAlias does it just fine and is capable of fetching arbitrary data (including Bitcoin addresses) from DNSSEC records right now and has for years.

Electrum has supported it since version 2.0.

https://openalias.org

The centralisation and privacy issues are solved by using a network of DNSCrypt resolvers. Anyone with a VPS can fire up one of those. If configured correctly they don't log DNS requests.

To go a step further you can even use ODoH which proxies your DNS requests though multiple servers in an onion routing type design so the server resolving the name doesn't know your IP, and such a setup is by nature decentralised.

You can even go a step further and run all your DNS requests through a Tor hidden service. Not hypothetical, this already exists, Cloudflare does it.

There's plenty of ways that already exist to overcome the centralisation and privacy concerns of DNS resolution so dismissing the idea offhand seems premature.

Reply to this note

Please Login to reply.

Discussion

Blake 2y ago

I forgot about DoH existing 🙃

By all means write up a NIP and see how far it’s possible to get. Key signing is likely the next major issue. A less stateful lookup approach would be interesting.

I’m already wondering if NIP-05 is the best approach for people long term. Likely not. Businesses maybe. I think something else can replace it in future.

Pablo Xannybar 2y ago

Yeah I think NIP-05 works for now, but for mass adoption it will confuse newbies. And obviously the same goes for the DNS approach.

Like you say it's useful for businesses, or really any individual who has a well known presence under a certain domain, but for most people they just want some kind of username.

I'm not sure what better implementation exists that could actually be implemented in the near term through.

I personally like the .btc domains and they have their own TXT records so shouldn't be hard to implement, but they don't solve the core issues of domain based authentication, just move them to a different platform, and arguably make things even more difficult for the new joiners.

No easy answers here but I suspect what'll end up happening is basically this...