> In the outbox model you’re giving control of what relays you connect to other people. Until my client is hardened I don’t feel comfortable doing that.

As far as i understand it, it only tells your client what relays to fetch another users posts from, you’re not adding those relays as a permanent part of your own relay list. So what would be the dangers?

Reply to this note

Please Login to reply.

Discussion

You need to connect to fetch the notes, so yeah, you need to not be vulnerable to a relay giving you a payload that would compromise your client.

That said, you would still need to not be vulnerable to a malicious payload even if the user manually enters the relay URL