Nostr Web Client

I assume this is a good reason to always use signing extensions yes? That would avert issues like this, unless the extension itself was somehow compromised or had a bug, is that right?

banjo 1y ago

Your last sentence is important--what you're really asking (or assuming) is that we can "trust" the code more in signing extensions (and frankly that may not be the case).

This is one of the weaknesses in the open source community. We all assume that because the code is available to all, it's "good".

But what really happens (in more cases that we might want to admit) is the only "audit" the code receives is from the original developer--I'd even dare to say that most projects out on git hub probably receive very little (if any) code review prior to being released.

Reply to this note

Please Login to reply.

Discussion

Keysa - Simplest Bitcoin Edu 1y ago

Yes, I guess I am hoping (!) that the code for a signing extension would be rigorously reviewed.. and even then, I am aware it could have a vulnerability (but any code could have that, so at some point we (esp us non-coders) have to *trust* the code 😅)

banjo 1y ago

Well, there's the rub...unless you go in and review the code yourself, you must end up trusting others...

And when someone like nostr:npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn posts "hey, we have an issue" I automatically trust that developer even more.

What I *really* worry about is dishonest projects / developers, and you see it all the time. Someone releases an app on the Play Store that does something nefarious...happens more often that most realize.

And look at all the data breaches out there--those are code mistakes that ARE audited (heavily) and still they happen...

Keysa - Simplest Bitcoin Edu 1y ago

I hear you. What do you see as the solution?

I don’t have one, though I do see it is probably a good idea to let new users know that this issue has not been solved, and that they need to be aware that there is a chance their nsec could be compromised.

Of course, that would cause friction too, but my approach with onboarding people to both #bitcoin and #nostr is to remind them that this is all a big experiment, and we are part of it, part of creating the potential for freedom, even as we move into a digital age.

Judge Hardcase 1y ago

Agreed. Unless you've diligently ensured your nsec has continuously remained isolated from the Internet (which might be nobody), it's prudent to operate as if your nsec has already been compromised.