The Reply Guy attacked helped clarify for me the two fundamental mechanisms for ‘permissionless’ systems to moderate themselves. The first is Proof of Work, where energy needs to be expended, the second is Web of Trust, where a relationship needs to exist between an existing ‘known’ npub and newly ‘unknown’ npub.

These two mechanisms counter spam: the first requires an energy cost, and the second requires a relationship cost.

Anyway, despite the annoyance of Reply Guy, it was a very valuable learning lesson.