Avatar
Average Ubuntu Enjoyer
21a6865f238f3867dfcef74b82d389f4b5bbddd7fafdb6d8443ecc9d151fc9c9
Linux enthusiast. Interpreter (Spanish/English). Interested in digital privacy.

Good day, nostriches, I'm back! Although I'm sorry to say I'm no longer ArchLizzard since I'm not #runningArchBtw, lol, got tired and decided to install good-ol "It Just Werks" Ubuntu.

Anyway, I guess this place is still the bitcoin eco-chamber that it was the last time I used it about a year ago.

I used Manjaro for years and decided to try something new. I like the idea of being able to say that my computer works exactly how I want it to, no less no more. But the truth I'm not smart enough and it ends up kind of half baked. It's still a lot of fun, though.

With absolute freedom comes absolute pain in the neck for having to configure every last tiny little detail you had always just taken for granted.

Anyway, yay #ArchLinux, am I right?

From what I've read (and I'm not a developer so I probably understand half of it, lol), the way the protocol is built makes it so metadata like that is always going to be in the open, and I guess there are ways to hide it like that, through layers, but I imagine it's always going to be a problem.

Honestly I think it would be a better solution -I read a suggestion somewhere- if they just eliminate direct messaging from the platform and people use some other E2EE messaging service.

All nostr data is public, instead of using closed doors to give a company special access to your information, nostr levels the playing field by making everything publicly accessible to all.

Regarding private messages, this has also always been known, it was a proof of concept feature that most clients adopted to show off what we could do. Messages are private but metadata is public.

When you make a DM on Amethyst, you have a choice to use the old DM system, or a more private one by clicking the incognito icon. This is a new spec that is not yet widely adopted by all clients as far as I know, I think there may be competing ideas that nostr needs to settle between.

Using this version of chat, the metadata is hidden, or at least more of the metadata is hidden, so who you are talking to is no longer public.

This means logging in with your npub does not reveal who you are talking to using this chat type.

Logging in with npub is still useful for some people. You may want to give employees read only access to your account for a company, but the most commonly used scenario is using the app with a remote signer.

You log in with no permissions with Amethyst, but when you want to publish a note, Amethyst sends the note to another app which shows you what it wants to publish and you have to approve it. It separates your identity from your application to ensure the app cannot do anything on your behalf behind your back.

This was inspired by watch only wallets in bitcoin which let you delegate the signing of transactions to a secure signing device so you can monitor your account, see your balance, give people new addresses to send money to, but you can't send money out without the secure signer.

Hey nostr:npub1sn0wdenkukak0d9dfczzeacvhkrgz92ak56egt7vdgzn8pv2wfqqhrjdv9, as a big privacy advocate, I have huge respect for you. Did you know people can see who you message with in #Nostr? Am I the only one who thinks this is a big design flaw?

Also would love to hear the opinion of the #Monero people I know:

nostr:npub1tr4dstaptd2sp98h7hlysp8qle6mw7wmauhfkgz3rmxdd8ndprusnw2y5g

nostr:npub16jh9ua9he3k0c0usx5kcn9kyg2prdcd3ds4f903cf4wfmmfkp7eqhyw5l3

I guess leave it to Bitcoin maxis to develop a new social media protocol, right? NGL, this is kind of a deal breaker for me, I just think it's stupid and there is zero benefit in that. But according to them it's good that everything is out in the open because... reasons?

I also don't know to what extent other metadata is public, like ip address and such.

#asknostr #privacy

Also more context:

nostr:nevent1qqs29k90rg88ef95ft9v92jzuza0scv4pmknswchj24c726fgf7gmxcpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsygqdj7l2u4nlemyuv460r3h0vynw495afxfvxxvw28q043fv2f62zspsgqqqqqqs8z7gw6

Nostr is completely public. It is up to you to protect yourself and protect your own data. Nostr isn't a license to put all of your information out with no care in the world, by contrast it merely takes power away from the snake oil salesmen.

Consider this. The snake oil salesmen tell you that you can put your personal information out in the world, don't worry, we'll protect it. In fact they own it. So now they know who you are, what you say, who you follow, when you log in, and they give you the sense of control by giving you tools to control who can see what, but there are no tools to hide anything from themselves.

Data leaks and you wonder why? The snake oil salesmen told me they'd look after it! That's when people start to pay attention.

It gets worse though. They own your messages. The only way to find out what you said is by logging into their platform and asking them. If they want to silence you, they have that ability, maybe just shadow ban you so you get less engagement than usual. This is terrible especially for businesses.

It gets worse though. They need to make sure that when they ban you, or when they decide to take any action, that they are dealing with the person behind the account, not the account itself. You need to give your phone number, address, date of birth, real name. Things that you can't fake. You can't use a custom email, no it must be from Google, Microsoft or some well known provider. Oh that number? It's been used before (even though phone providers often reallocate numbers to you from old inactive accounts when you buy a new SIM card)

As time goes by, you rely on their services more and more, you accept that they advertise to you, you accept that you need to pay $8 per month for a blue check to be anyone on that platform... I mean, what else can you do?

The only cardinal sin that they never do, but that maybe they will one day, who knows... Is they never write messages on your behalf. Either you sent a message, or you were hacked. This is why we use these platforms, they give everyone an anchor, somewhere to discover people, and once discovered, they know they are always talking to the same person.

Actually, even Elon took some accounts away from some users, I believe the owner of @music had their account taken from them with no recourse.

-------------------

Nostr: the data doesn't rely on a trusted third party. The problem we're solving isn't privacy, but we're also not taking steps to prevent privacy.

You can create an account at any time. No email, no phone number, create 100 accounts, who cares, each account is a persona and no one is there to police the accounts.

You own the messages you send. No one can send a message on your behalf (even though twitter doesn't do that) and no one can take over your account. Whenever there's freedom, there's responsibility. YOU protect your account. If you get hacked, it's not twitter's fault, it's yours. Fortunately the security model is based on the most basic and most secure system in the world: asymmetric key cryptography.

You control what you can see, if there's a persona online you don't like, tell your client to not show you their content and that's all there is to it. You cannot control what others see. Why should you have any power over others?

If you decide that you want to support a charity that is maybe controversial, create a new persona, don't mention one from the other. You can't be cancelled if no one knows you are the one sending the unpopular posts.

You don't need to have just one account. We never used to before, this one account thing was imposed upon us over time by those who wished to control the internet and we the people who use it.

There is no where for a government agency to go to when they want to suppress free speech. You have evidence about malpractice by big pharma, no one can stop it from spreading wide and far. The best anyone can do is attempt to tarnish your name, discredit you, try to find your identity and come for you directly, but by then you will have already gotten the message out, they'll need to come for you and everyone else who's spreading the message. They can't just tell twitter to block messages about the thing they don't like.

Finally, let's talk about relays and clients. Your data isn't on one server, it's on many. The data doesn't rely on twitter verifying which messages are from you, you self sign your messages. One of those servers can be yours. This way you can make sure none of your posts ever disappear. It's the only way to be 100% sure.

If a client tries to push ads onto you, you can switch clients. Your data isn't stuck to your client. The relays don't even hold your data hostage, that's just not how nostr works.

Hopefully you're starting to see the benefits. You're trading off the promises that you thought you had: the ability to say whatever to whoever with some guardian angel protecting you... For actual freedom and the hard truth... There is no Santa Claus.

I get it. This is 100% about censorship resistance, 0% about privacy.

Still think it's just common sense that people shouldn't be able to see who send private messages to, as well as the message itself.

#asknostr #nostr

Did you know that any client will let you login with someone else's public key as a read-only user, but you can still view all their notifications and messages? The message itself is encrypted but the sender isn't.

Seriously, why does it even let you login without a private key? What's the purpose of read-only accounts? Am I the only one who thinks this a huge design flaw? Not to mention creepy, wrong and kind of violates any argument for privacy?

nostr:npub18ams6ewn5aj2n3wt2qawzglx9mr4nzksxhvrdc4gzrecw7n5tvjqctp424 nostr:npub1l2vyh47mk2p0qlsku7hg0vn29faehy9hy34ygaclpn66ukqp3afqutajft nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z and if y'all can boost this to other people involved in either ecosystem or protocol development, would be awesome. Or maybe it's just me 🤔

#Introductions

Hey, I'm new here. I heard about the development of the protocol almost since the beginning, but then I took a break from the Bitcoin-verse for a while. Now I'm in a Linux/privacy trip and decided to join here. Seems nice.