It looks like Nostr is being organically discovered and slowly adopted by some non-Bitcoiner Brazilian personalities with a huge number of followers that see the dangers of centralized media.

Wen nostr notes with javascript

Who is using Amber?

When I click this option, there is a field for "Connect URI"

and a greyed hint saying

bunker://?relay=wss://relay.example.co

and then the explanation "A bunker connect URI"

I want to create a tutorial so people can use this feature, but even I don't know how this works myself. Can you please teach me the step by step? Then I will gladly share the information. I believe today noStrudel is the best Nostr client.

Introducing 🛡️ RelayGuardian.com - a free #nostr relay uptime and performance monitor with DM and email notifications created by your friends at nostr.wine!

Yes, there was multiple on each video. You can see them under the profile picture if that's what you mean.

Relay operator using #cloudflare proxy, please do this to let people connect to your relay over #Tor.

Go to your site settings

Click in "security" -> "WAF" -> "Create Rule"

Fill the fields like this:

Field: Country

Operator: equals

Value: Tor

Action: Skip

Scroll a little and click in "more components to skip" and select "Security level".

So basic introduction for anyone interested: I am a gray hat hacker and cybersecurity awareness activist who likes to stir up privacy-centered networks. I have probably met some of you before.

I actually came here looking for a challenge. I've been lurking around here in some form or another for about 4 months now, playing with different clients and tools, even running my own testnet (3 stirfry relays on a VLAN). Mostly I have been focused on the community and how people use different clients. I've been playing with some good open source tools and getting an understanding of how to interact with relays.

Personally I'm not all that into Bitcoin, but I do have a whole BTC in cold storage so I guess I've got that going for me. This whole lightning thing is new to me, I don't really ever spend Bitcoin, and my actual business makes me plenty of fiat.

So far I am impressed with the community. A little too wild-west in some areas since there's hardly any moderation tools, and the community isn't quite interested in the same things that I am, but I do see a lot of advocacy for privacy and digital freedom, and I like that.

But the whole system here is, regrettably, broken. The promises made about Nostr don't live up to reality. A network like this has the potential to become so much more, but there is a lot to lose if it is done wrong.

I intend to help expose these problems. Expect me here for a while. There are a lot of vectors for attack, and I plan to give them all visibility.

Nostr devs, please pay attention. With no centralized network development, all of you are responsible for fixing these issues.

We come around a lot of people running Duress / device erasure killswitch apps like Wasted or an MDM solution to try and protect their device from seizure. They don't work.

A duress app can have the erasure process cancelled by holding down the volume button to move to Fastboot mode. This cancels the erasure, and worse, the reboot performed is a warm reboot meaning that sensitive data like device credentials remain in memory.

When we reported vulnerabilities used in forensic companies targeting Pixels, the evidence acquired was a video they used marketing their bypass of erasure apps. This company in particular advertises cold boot attacks, dumping RAM to brute force the credentials. This meant for people relying on those apps outside of GrapheneOS, they weren't just bypassed - their credentials would have been brute forced if not good enough.

Many scammers selling 'secure' mobile devices which are just phones running other operating systems with an MDM app on it for 'remote erasure' or duress features mislead customers. Their methods are not foolproof. They are the same level as EncroChat or ANOM.

GrapheneOS have been developing a duress PIN feature that works without an unsafe reboot, the reason it's took time because it had to be done with a new, unique method and not relying on insecure implementations like other apps or operating systems. It is in testing. We also have been suggesting fixes to these other problems by anti-reset attack mechanisms like zeroing sensitive memory or making MDM reboots safe.

Nunchuck, Green, Bluewallet