Dear devs,

I think how clients set the default relays is a very important key topic to ensure future decentralization of the nostr protocol. The non-tech masses won't care about relays, they just want it to work. Max performance/connectivity and max decentralization are not the same route. We have to find the right balance.

We should develop a best pratice how to set default relays on clients.

Some form of randomness is vital to not fall for the centralization trap. It should be combined with some important metrics (eg traffic, reputation, ping, uptime, location ...). Defining these metrics and combine it with randomness is the key from my perspective.

Example for 12 default relays:

1. Connect to random ~3 relays with high user count, reputation score > 90 and uptime >99

2. Connect to random ~4 relay with mid user count, reputation score > 80, ping < 500 and uptime >95

3. Connect to random ~5 relays with low user count, reputation score > 70, ping < 100 and uptime >90

Let me know your thoughts on this.

The issue with web apps is that they usually put the private key into local storage. From there it can potentially be stolen with an XSS attack

Since it's a native app on your phone, the private key would only be stored on your phone. It's web clients where the risk can be, because the private key can be intercepted if it's stored on their servers.

So the scenario to be cautious is a web client asking for your private key without an option to use the nos2x or other extension to authenticate.