I build an adversarial relay a while back which does bad things that clients maybe don't expect, fortunately most bad things can be detected by simply validating sigs, i encourage devs to add this relay so they can see and detect bad actors.

More bad features coming in the future: wss://r.v0l.io

Reply to this note

Please Login to reply.

Discussion

very useful thanks!

So far I’m seeing many of these, is this an example spam event or is there another reason why it shouldn’t be loaded?

I only see them when I turn off the Web of Trust spam filter so its handled like regular airdrop spam otherwise.

https://nostrcheck.me/media/public/5aa411b3019cf44c8c12ab45d0dc1960bc242f4a121fe4e7908e60c851440940.webp

Yea there isnt actually anything you can do about those in the context of a thread because you asked for replies it just generates random valid replies.

Web of trust is probably the only way to filter those

Great idea! 🙏

Great idea, thank you for this!

I’ll add to https://relay.guide for folks to explore it too

This is really helpful!

Some time ago, I was hypothesizing something similar, with these areas of action:

- Faked events (security)

- Wrong answers (consistency)

- Random timeouts (network)

- Complex content and interactions (design)

This could be a nice test suite.

nostr:npub1v0lxxxxutpvrelsksy8cdhgfux9l6a42hsj2qzquu2zk7vc9qnkszrqj49 feel free to pick up these ideas if they make sense to you.

Here is what i currently do:

1. REQ asks kind 1, generate a note saying GM nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 from a random key.

2. REQ asks kind 1 with #e tags, generate a fake reply from nostr:npub1sg6plzptd64u62a878hep2kev88swjh3tw00gjsfl8f237lmu63q0uf63m with an invalid sig for the first 2 #e.

3. REQ asks for kind 0, respond with fake profile metadata "Bad Relay" for every author

In all cases we generate events with the current timestamp so it should always be on top or "latest"

Privacy analysis could be good too

Interesting point. How?

It would be more difficult, but maybe you could request a digest of what the relay was able to infer about your pubkey. Client fingerprinting information would be interesting too.