Avatar
Tom
2f5759825226f1d57ef1652ba66114b2f938f7f5c50dc505708e5d8b31e4f3c9

Verifying my Nostr Nests identity: N3Wf92-oCMSSMoGMSN8y7eMErgexXL1rzmMbQGHVnUY

https://nostrnests.com

Replying to Avatar Max

Federated ecash based lightning address server, quite a cool idea for resilient always online LN receive while storing sats in a bearer asset.

https://github.com/Kodylow/hermes

## Hermes: A Noncustodial Lightning Address Messenger w/Fedimint

Hermes is a non-custodial, asynchronous lightning address server that uses Fedimint Ecash on the backend. The protocol flow of Hermes is as follows:

### Registration

1. Users register their Nostr public key and username with the Hermes server. This registration process creates a lightning address for the user.

2. The registration requires a small fee in ecash or lightning.

### Receiving Payments

3. Sender follows normal lnurlp protocol hitting well-known and callback endpoints.

4. Hermes server creates a Fedimint Lightning Gateway transaction based off the receiver's public key, and returns the invoice to the sender via the callback endpoint.

5. Sender pays the lightning invoice, which the lightning gateway immediately completes by locking ecash to the receiver's public key.

6. Hermes server sends a notification to the receiver that they have received a payment.

7. When the receiver's Fedimint Client next connects to their federation, they scan for the payment and reissue the pubkey locked ecash.

Thanks for posting this site, I raise this topic with friends occasionally and I'd like to have this as some interactive evidence

The modern internet is totally corrupt. Let’s dive in to why…

Content Delivery Networks (CDN)

Content delivery networks are global servers spread out around the world that keep a copy of a website closer to you, to serve it to you. By being physically closer to the end user, it speeds up the website’s delivery. However, the negative of this is that it has a tendency to centralize power for the entire internet to a few large players and that has big privacy effects. Rather than have these separate sites and blogs around the world just see their site only, instead the big CDNs see all traffic on the entire internet. This enables the “tyranny of the modern web”, in which website owners have just a tiny 1 core VPS, and then all their real files are externally hosted. The heavy use of CDNs allows the website owner to save on money, while sacrificing their free speech, independence, and the end user’s privacy.

With larger files, such as a video, a CDN is likely required. But the heavy use of CDNs for literally everything on the website should be associated with poverty. The website owner is saying “I’m too poor to host files”. Additionally, website owners enable Big Tech third party JavaScript such as a “Facebook like widget” which does surveillance that then slows down the load speed. So then they need an even more centralized CDN to serve up this bullshit bloat. This creates a vicious cycle of more and more Big Tech surveillance, which then needs an ever larger CDN.

Because surveillance is so profitable, the firms doing it can hire the best creative talent, which then shapes the entire tech industry. Young web developers use the same toolkits and learn from these corrupt organizations where an erosion of end user liberty is the norm. The end result is that web developers don’t even realize that they are over-using JavaScript when it’s not required. This slows down the web and feeds into the vicious CDN cycle. The largest player in the game is Cloudflare.

Cloudflare sees ALL passwords

One type of CDN literally points the domain name to the CDN company, so:

User -> Cloudflare -> real website VPS (1 tiny core)

This is how Cloudflare works. Since this is literally directing all traffic to the CDN company, they can see all passwords and ALL data. The SSL connection or httpS encryption is stripped away by Cloudflare. Unfortunately, a VAST majority of the internet uses Cloudflare. You will be shocked at how many “privacy” websites use it, including Skiff.com email, KYCnot.me, Michael Bazzell’s OSINT, and even Monero’s official site at GetMonero.org. Finding out that Monero’s core team used Cloudflare to distribute binaries, was for me like finding out there is no Santa Clause. Even Handshake.org literally complained about Cloudflare while using it.

Supposedly Cloudflare helps to stop “distributed denial of service” DDoS attacks, which is the bullshit justification that websites owners will give, instead of just admitting that they are poor and willing to sacrifice their freedom of speech because they have nothing of value to say.

A DDoS is when lots of bots or bullshit traffic hits up a website to overload it and take it down. But Cloudflare isn’t doing anything unique to stop this and there are many other choices one could pick from. All Cloudflare is doing is having a ton of money and servers to absorb the traffic. Then because Cloudflare has scaled through business deals, they can deliver the CDN at a much lower cost than other providers.

There are many other CDNs, but unfortunately most website owners simply do not care about their (or your) privacy and freedom, and they are only mostly concerned with getting the absolute rock bottom lowest cost, which is typically bundled into “shared hosting” plans.

Then MORE CDNs?!

Many website owners don’t just use Cloudflare. Then on top of that, their website calls upon 3rd party images from even more CDNs via JavaScript. For example website-files.com is a popular “JavaScript CDN” of this type.

User -> Cloudflare -> real website VPS (1 tiny core) -> Website-Files.com

So everyone and their mother sees your data, and the website owner lost their autonomy of speech, by complying with more and more terms of service restrictions. This is why website owners don’t care about abusing unnecessary JavaScript, because they outsource the economic cost of being an idiot, at at the expense of both their and your liberty.

Conclusion

In conclusion, change does not come from politics, but comes from you. Your actions dictate how much freedom the world has. If you accept a world of surveillance, then let the entire internet be overseen by two or three companies. But I do not accept things for the way they are. It is only through your actions to pressure website owners will it ever matter. Seek out alternatives, they do exist.

PS, check out Ombello, it’s a Tor Browser Onion search engine that crosses out Cloudflare:

ombrelo.im5wixghmfmt7gf7wb4xrgdm6byx2gj26zn47da6nwo7xvybgxnqryid.onion

Pull logs from device via cli, useful when working with embedded devices:

curl --insecure --upload-file /path/to/my/file.log https://free.keep.sh

5 Android Apps to turn you into a Ghost

1. ClassyShark3xodus

ClassyShark3xodus is used to detect if another app you downloaded has spyware or trackers. ClassyShark3xodus scans the app for DNS requests or communication with Big Tech.

2. Fake Traveler

Some apps require GPS location, even when you don’t want to reveal it. Fake Traveler allows you to spoof your location to a place of your choosing to fool apps into thinking you’re there. Smaller community banks will fall for this, but for large ones, the bank’s app won’t load.

3. Scrambled Exif

Smartphones automatically tag pictures with GPS location metadata called “Exif.” So when you post a photo to Instagram or Facebook, the company knows where you live even though you’re using a VPN. Scrambled Exif allows you to remove this metadata conveniently before you post or send it.

4. Duress

Duress automatically wipes your phone when you enter a particular 2nd passphrase. Now, we discourage criminal activity, however some governments in some countries around the world may act illegally or against their own constitution to search devices they are not permitted to. Therefore, to honor and respect these human rights laws, as well as to protect whistleblowers globally, we recommend you tell corrupt police officers asking you to unlock your phone your 2nd Duress password.

5. andOTP

Two factor authentication is often a source of leaking your geolocation. AndOTP is way better than Google Authenticator because Google’s is proprietary and even though it works offline, may connect to Google accounts. Google is evil and locks you in where you can’t transfer to a different app because there’s no backup code. But andOTP works on any site that says “Google Auth” or TOTP.

(KeePass XC on Linux is better than both of these btw.)

All of these are in the open source F-Droid Store. Follow us on Nostr for more tips!