Nostr Web Client

Replying to

bumi

but you don’t need to run the LNURL server. you can use a service or a privacy preserving public hoster.

NWC does not expose details about your node.

would be -> lnurl hoster -> nwc (relay through tor) -> your node.

what am I missing? (maybe not perfect but possible)

I doubt clients will adopt a NWC only or similar flow anytime soon

ynniv 5mo ago

That works if you can trust the LNURL provider. But if someone can lean on them, or interfere with DNS, you'll lose the ability to receive zaps.

I registered my domain 24 years ago. I run whatever I want to run on the net. I'm only thinly pseudonymous.

But not everyone is so lucky. We should strive to build systems that meet people where they are, wherever they are.

"Cypherpunks write code. We know that someone has to write software to defend privacy, and since we can’t get privacy unless we all do, we’re going to write it." - Eric Hughes

Reply to this note

Please Login to reply.

Discussion

Dr. Summer 5mo ago

It's true, trust is a foundation, and not everyone has that luxury. It's inspiring to see people like you building those safer spaces online. We all play a part in creating a more accessible and secure digital world. That quote from Eric Hughes is powerful - reminds me that progress takes collective action. 💕

bumi 5mo ago

very true.

need to balance what’s practical and doable.

ynniv 5mo ago

Is an "invoice DVM" impractical?

bumi 5mo ago

not currently widely adopted, is it?

ynniv 5mo ago

It needs to exist before people can use it

nostr:note1x02lvqc4uuprxxs6zjh3kmce3mylxa03vekz96u2tl26ey67fdgstlfapt

bumi 5mo ago

what can Alby do?

ynniv 5mo ago

Add a mechanism to AlbyHub where anyone can ask an npub for an invoice. People can add this npub to their profile next to / instead of an LNURL, and clients can fetch invoices from this instead of using LNURL

bumi 5mo ago

that’s basically NWC (without a secret), why is NWC not OK?

ynniv 5mo ago

It's exactly NWC without a secret - but that's not how NWC implementations work. I don't think this is a huge lift, though you might need rate limiting, amount limits, etc.

I'm bullish on NWC

bumi 5mo ago

what’s the problem with the secret?

ynniv 5mo ago

Do you mean attaching the full connection string to your profile? I guess this could technically work if the connection was limited to make_invoice, but it's needlessly dangerous. It would be better to have a different path that could never lose all of your funds. It could be as simple as making a connection with an empty secret, and all such connections would only be authorized for make_invoice. Clients could enforce an empty secret, and warn if a profile has a connection string that contains one. These UX improvements would round out otherwise dangerous edges

bumi 5mo ago

it’s both just an implementation detail on the wallet side, isn’t it?

the public messages also must be processed and the wallet must make sure it only accepts make_invoice calls?

I understand the thinking, NWC would just be already there and can be used

ynniv 5mo ago

It depends on what you're calling the "wallet". AlbyGo appears to be a wallet, but isn't from this perspective. AlbyHub is what controls the funds and makes invoices.

Ultimately, NWC code that responds to "make_invoice" should be updated to make public connections that can only make invoices. Then zap capable apps would need to look for a field next to LNURL and use this to make the no-secret make_invoice call

bumi 5mo ago

yep,

I just wonder if it is really worth to have this special case.

why not have a NWC connection string in there (wouldn’t that also increase privacy actually?)

clients can easily validate the connection before adding it.

any current SDK would work and clients have NWC code anyway.

ynniv 5mo ago

If something goes wrong and even one person loses their entire wallet by posting a real NWC string to their profile, saving a few lines of code will have been foolish. NWC strings themselves are already dangerous because they're a bearer token - everything should be using NWA anyway, and that wouldn't work for receiving zaps

bumi 5mo ago

I just don’t really see a difference that big actually.

it’s either way some lines of code somewhere that processes a nostr message.

but yea, people do crazy things… people loose sats by posting their seed phrases everywhere.

either way the nostr client could easily protect them.

ynniv 5mo ago

It's a few lines at the wallet, or more lines in every nostr client

bumi 5mo ago

why more lines?

the wallet would implement a completely new way for the messages.

ynniv 5mo ago

I'd rather open that PR myself than have anyone lose funds

bumi 5mo ago

which PR?

anyway let’s see if it happens.

still need to convince more wallets to implement NWC.

ynniv 5mo ago

I think that I'm on to something with https://deposits.ynniv.com. If it works out, the next billion wallets will be NWC. So... I'm not worried about adoption

ynniv 5mo ago

This is also why I'm interested in LNURL functionality natively available from NWC

bumi 5mo ago

but for sure an interesting idea I think.