Hmm. That doesn't look right on Snort.

Another great quality of life improvement for new Nostriches. Thanks! 🎉

If you ever wondered whether or not the Twitter algorithm was actually affecting your mood or influencing your behavior, just look at Nostr.

I see numerous posts daily saying how much more calm it is here or that they chose a peaceful reply to something annoying or not to reply at all.

I also see many posts expressing relief that there are few posts about politics and how nice it is to not see invasive advertisements.

Some time ago I posted on Twitter that once a viable alternative arrived, that I would move. Mastodon never really caught on and it’s structure is actually very centralized with instance operators banning others deemed unacceptable.

Nostr feels like home and it is the only thing since Bitcoin that has gotten me really excited for what is possible and gives me hope that we can build a future together worth living in.

I was wondering when a client would implement this. It's inevitable. The more people you follow and the longer you're away from Nostr, you're going to miss more content. People might not like algorithms but they are beneficial if used properly.

Perhaps the question is no longer whether to have a main feature, but what kind of choices you could give. What are the options beyond what you have ready…following hashtags, follows of my follows…

**What the fuck is going on with Derek's private key - A recap**

TL;DR - This is long so I wrote a short summary at the top in hopes to help new Nostriches and noob Nostriches alike. Please share. Thanks.

1) Read what events you are signing with your private key. Do not just authorize the event because you initiated it. The client may be doing something that you are not expecting.

2) Do not allow websites to use your signing extension forever. You don’t know what they’re doing in the background.

3) Maybe don’t use Nostr.com as it will overwrite your LUD06 Lighting address on your profile.

—

Yesterday, one of my followers DMed me, saying that they bought me some drinks for my upcoming trip to Costa Rica! Awesome! I checked my Lighting node and I saw that 50 sats came in an hour ago. That didn’t seem right to me, so I asked some questions. We ended up determining that they sent sats to the wrong Lightning invoice address somehow. I noticed that my profile on Astral.ninja and metadata.nostr.com both had an incorrect LUD06 LNURL address. It was an LNBits address. I do not use LNBits. Something was definitely wrong.

I had been careful with my private key, at least I thought. After my first day on Nostr, I started using the nos2x extension and used it for everything. I didn’t authorize sites “forever” as I wanted to see when they would request read/write data with my keys. I used burner keys when testing various Android clients. I was very confused how this happened. I doubt my private keys were burned. I kept telling myself that this has to be a misbehaving client!

I started tracing my steps back. I had just used a brand new client, Ananostr, yesterday morning. I thought, could this client have done something accidentally? I signed in with nos2x and authorized the transactions as normal. The developer was super helpful here. He offered to take down his site and retrace his tool set that he used, to make sure nothing fishy was being utilized in his application. Thank you for your help <3

Today, using the nostr.band search tool, I saw that I had numerous events from January 16th to January 27th that updated my profile and changed my LUD06 address to a different LNURL. Something or someone was changing my Lightning tips address on my profile and I had no clue what was doing it.

I started looking at my Nostr post history and file download history. I had first tried Amethyst on January 16th. I had very little doubt in my mind that Amethyst could be causing the issue here, but you honestly just do not know. It’s scary entering your private key into brand new Android applications. Because of this fear, I used Amethyst originally with a burner account. Once I felt comfortable, I switched to my private key.

**After talking with numerous developers and plenty of Nostriches, I believe I have figured out what has been happening with my profile metadata and specifically, my Lighting LUD06 address. I also believe several mistakes were made on my part.**

About 10 days ago or so, I visited nostr.com and signed in with nos2x. I authorized the transactions and played around with the site for 10 minutes. I saw at the bottom that the site was built on Anigma. That freaked me out because Anigma was a site that was vulnerable to XSS attacks around December 20th. I immediately went into my local storage and nuked the storage for that site, deleted cookies and did not return to that site again.

Apparently, nostr.com automatically sets your LUD06 Lightning LNURL to an automatically generated lnbits.com Lighting wallet for you when you sign into this client. I did not know this. This overwrites any existing Lighting configuration on your profile.

**My first mistake was not reading the kind 0 event that popped up by nos2x**. I never read them. I always felt that if I was the one that clicked a button and generated the event, then it was safe to authorize it. If I had taken the time to read what was actually happening, then I would have seen that this client was making changes to my profile!

**My second mistake was then keeping nostr.com as an authorized forever entity inside the options of nos2x**. I remember adding it as authorize forever, because it kept popping up and annoying the fuck out of me and I wanted to get it off of my screen so that I could check out the client. I should have 1) not done this and 2) removed it after I cleared local storage for nostr.com.

One thing I do not understand though. How was this able to continue to happen over the last 10 days? Are relays just that slow to process events? Were these events re-broadcasted to new relays and that’s why this kept happening? If that’s the case, could someone go and re-broadcast an older profile metadata change event and change my LUD06 address back to this unwanted address?

I truly believe this is what happened and my private key is safe, I just do not understand how it continued after I stopped using that client. For now, I’m not abandoning this key pair. I think this is a large lesson for all of us.

A super special thank you to #[0] and #[1] <3

THANK YOU FOR HELPING ME FIGURE THIS OUT!

Alternatively, you could have changed the domain name to Grindstr.

YouTube, Streamable, direct links to MP4 files, all play in-line on Astral, Snort, and I believe Damus too and probably others.

Did you also see that gourcetools tested his follower bot? Added 3000+ fake accounts to pump his account, exactly as he described in my Sapces that one night.

Big week.

Thanks sent you some sats

Is there a way to get this information for a pleb like myself?

Everyone is iterating and improving at an incredible rate.

The energy and the excitement is BACK! You just love to see it. We are winning.

It's a nice wave that's for sure. Things were slow for two days and people were calling it dead. 😂😂😂

👍

#[5] and #[6] are talking right now about hashing the uploaded files in order to detect duplicates, or even using bech32.

Maybe you can collaborate on following the same 'standard'?

Which platform?

Iris has just integrated uploading to #[2] .