Nostr Web Client

I'm not well versed on relay coms, but I believe it's per session when the socket is opened. It would get expensive otherwise. However I think a relay can send an auth message whenever it feels like, but it's attached to a session id.

The only code I'm most familiar with is Grain, and he uses per kind limiting iirc. Strfy defers it to the handlers I believe, so it depends on the message kind. I would assume strfy also has per-req limiting as well.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

there is usually two triggers for sending auth, one is immediately upon connection, the other is in response to an auth-required request or event envelope

strfry is quite unopinionated, it has a "sprocket" thing that it feeds incoming events to and if you have code attached to that it can filter it and send back replies and/or interact with the relay event store... relay.tools guy nostr:npub10npj3gydmv40m70ehemmal6vsdyfl7tewgvz043g54p0x23y0s8qzztl5h got me to start doing some stuff writing scripts and tools for this and he's made it pretty fancy these days since back then (was december last year i did a little work on it)

the fiatjaf/mattn relayer nostr relay framework also has by default an option to enable a ratelimiter per-IP address also, and an easy thing to plug in your own filters and it is easy to enable auth with it as well (i'm in the last stages of completing a port of it to my fast, allocation avoiding, binary-focused nostr message codec right now)

Reply to this note

Please Login to reply.

Discussion

Silberengel 1y ago

I wish we could let people AUTH to read and just ignore the IP address and send the results to their npub.

cloud fodder 1y ago

well, thats what its doing.. i am still wondering what the concern is because i like the idea. its neat right? no dumb IPs, just pubkeys. i will not 'steel man' anti-auth for them because I'm still waiting to hear more reasons why. (hint: replyguy doesnt like auth either).

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

replyguy could auth just that usually relays that require it do so because only a whitelist of npubs are allowed to publish events

as it is, he is already making hundreds of new keys and publishing profile metadata to go with it, on top of it all

it's quite funny though, only spams replies and profile events, that is all

i'm sure whoever is doing it has an axe to grind with the relays its selecting to spam at also

cloud fodder 1y ago

yep

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

i am encountering it in my work too, i see it on a firehose feeder i made that pulls events from multiple relays concurrently and processes the unique ones it sees in a window of 2048 events (uses a map to implement a uniqueness invariant)

it's very easy to detect them, you literally would just look for the e, , reply tag in it, and go to the event named in the event id, and check that the content field has the same prefix data and ignore it after that

but it's quite funny, very often the reply events are showing up ahead of the replied to events in the feed

i'm sure that replyguy is just the tip of the iceberg of problems these free relays are having

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

i may have to write a filter like this at some point in the future, it won't be hard to do... hell, even just looking for the relay's own address at the end of the reply content field would flag them all

Silberengel 1y ago

"but it's quite funny, very often the reply events are showing up ahead of the replied to events in the feed"

LOL how the heck?

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

subscriptions often come ahead of req results... usually a req starts a subscription first, and then does the search and then sends the results

in the meantime, the subscription is there and if someone publishes a matching event it sends that out, and the database could still be working at that point

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

makes sense, when you think about it... subscription results can come in without a search, but reqs always need a search

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

basically subscriptions match on newly submitted events before they go to the database, so if the req is busy but the sub is open already a reply can come first because the req thread is busy saving it first

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

er, searching it lol

Silberengel 1y ago

Okay, that makes sense. Unexpected.

Silberengel 1y ago

I like AUTH. It's here to stay. I've decided and I'm the princess of Nostrworld, so that's an official ruling.

I just want to air out the alternatives to AUTH-to-read and watch them get slapped own in public. Or not.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 1y ago

ratelimiting... already being done by many relays