Replying to Avatar Mike Dilger ☑️

If you send a DM to somebody that has advertised DM relays, it will use NIP-17. Otherwise it will use NIP-04 as a fallback. You can read DMs using both standards.

I'm not going to change this anytime soon. NIP-04 isn't "broken", it is just not as good as NIP-17.

People should understand that nostr and it's various NIP standards are new things that aren't perfect things and if you want state-of-the-art privacy or state-of-the-art security, we simply don't have it here. We only have state-of-the-art decentralization, which yields a less-than-state-of-the-art censorship resistance.

If all the big clients implement NIP-17, then I will remove NIP-04.
Avatar
Mike Dilger ☑️ 9mo ago

BTW: for users that use multiple clients, if any of them advertise DM relays, then gossip sends them NIP-17 DMs. If they then switch to the NIP-04-only client they won't see that DM, they will only see it on their NIP-17 supporting client. That fact alone should provide motivation for users to switch away from NIP-04-only clients, and thereby motivation for such client devs to implement NIP-17.

Reply to this note

Please Login to reply.

Discussion

Avatar
Coach Z 9mo ago

Can you please explain this to someone with basic experience in programming but not nearly as advanced? Asking for a friend 🥹

Avatar
Mike Dilger ☑️ 9mo ago

There are two standards for DMs over nostr. The original NIP-04 and the more secure newer NIP-17.

NIP-17 says that people need to advertise a kind-10050 event that advertises which relays they receive NIP-17 style DMs on.

So my client, gossip, when you want to send a DM to somebody, it first looks for a kind-10050 for that person. If it finds one, it knows that they are NIP-17 capable, so it chooses the more secure DM standard.

But the slight fly in the ointment is that if such a person goes back to a NIP-04 client (perhaps they use multiple nostr clients) on that NIP-04 client they won't see the NIP-17 DM.

It doesn't make much sense to send a NIP-04 DM in addition to the NIP-17 one for backwards compatibility because if we do, we will never achieve better security. And my client cannot tell that a user wants backwards compability because signalling such a desire wasn't in the NIP-17 standard.

So by no fault of my own, and no intention to "push" clients to upgrade to NIP-17, a bit of a push to do it has arisen nonetheless.