Avatar
Nuh
930ccef12372dd2f16057cfc54f0dbd94335d8b51b4e2737236b00cab718fcd9
Working on https://mlkut.org, designer and maintener of https://pkarr.org. https://nuh.dev
Replying to Avatar Garbage nsec

Cross-company social that functions like email and can also be used by frontline workers and vendors on both sides (those with no basis for SSO). It competes with https://slack.com/intl/en-gb/connect and other offerings. It's cheaper, it's open source, no third party, it's easy for IT departments to understand and with relays on both sides of the fence it can be managed as each side likes. It mirrors email in many ways, and you sell it with email analogies.

Also competes with stuff like https://uintra.com/ but only for the cross-company case.

-Current nostr audience is irrelevant

-Zaps are irrelevant (unless the companies in the mix want them, but we never pitch them).

-The Nostr brand is irrelevant (nobody knows it anyway)

Event+relay architecture w redundancy, keyparis, and the open-source candy jar of client code are all very relevant. Overall lightness is relevant. Clients are custom-deployed from open source (each side has their own client and our team will service it). We plan to use one client codebase for all customers at the start.

Early days and just pitching for feedback but so far is good.

Course none of this is what Nostr was invented for. But if you were going to draft up an architecture from scratch for cross-company social in the vendor age then Nostr is kind of like the thing you'd end up with.

I think you are thinking of the Matrix Protocol... which plenty of governments already using for what you are saying instead of relying on American companies like Slack.

If I were you I would start playing with Matrix sdk before reinventing this wheel.

For anyone who cares, the reason I a argue for a sovereign e2ee filesystem, is because that is the only thing we can make interoperable between apps... just like POSIX and files in general are the only interoperability success story in history.

What I consider feasible is taking that and make it Web native without getting locked in platforms like Google Drive.

Once that is in place, let the best app developer win, and if one file format becomes very useful, we reverse engineer it like we always do, like interoperability always worked; forcefully.

And of course, the moment Bluesky decides to change their API a little this integration will break.

So what was the point? If you are not going to have stuff as stable and stupidly hard to change as web api, then why pretend you have interop?

Replying to Avatar Garbage nsec

Potentially unpopular opinion: Nostr should adopt ATProtocol-style lexicons.

ATProtocol lexicons are good because they encourage more detailed Kind schemas.

Let's take the example of NIP-29 chat groups and how the same group can look very different when viewed in 0xchat versus when viewed in Chachi. Want one thing to look right? Open the group in 0xchat. Want another thing to look right? Open the group in Chachi.

In ATProtocol it would be like this. Chachi comes into existence. When it does, 0xchat already has a hyper-detailed lexicon schema (com.0xchat.message) and this lexicon leaves little grey area—maybe some cosmetic grey area and that's about it.

On day one Chachi has to make a choice. Follow this hyper-detailed existing 0xchat lexicon or create a new Chachi lexicon. If going the first route, Chachi declares the 0xchat lexicon in each event that Chachi sends ("$type": "com.0xchat.message”) and by doing so Chachi is saying “I agree with everything in this very detailed schema of theirs and if something isn’t right then I’m the one that’s out of line, it’s me.”

If going the second route, Chachi will not be interoperable with 0xchat.

That's just the choice Chachi has to make. Is it worth it to forge a new path? Or is it better to piggy-back off 0xchat's success? Maybe there are other clients also using 0xchat's lexicon; does Chachi want to be on that bigger team? Or maybe Chachi has a super feature idea and it’s totally fine to go it alone, the users will come for that feature. Either way, Chachi has to make a choice, and it has to make that choice on day one.

You could say that the Nostr way is pretty much the same as the flow I just described above, with only minor semantic differences. Chachi has to choose to follow a NIP (and a Kind) on day one, or to go it alone. Like Flotilla went it alone at the start. But no. It’s not the same in substance. Of course Chachi does have to choose a NIP and a Kind on day one—but Nostr Kinds are like laws in countries where the authorities have left themselves a *lot* of room for interpretation. Singapore this is not. Rather this is more like [insert name of murky country here]. Did you break the law? Maybe you did, maybe you didn’t, depends on who’s asking who and why.

The current Nostr way allows devs to procrastinate, put off the “tidying up” until some undetermined point in the future. And the one who pays for that procrastination is always the user.

In short ATProtocol lexicons both allow for and encourage a significantly higher level of detail and expressiveness—and in doing so they tend to force tidiness from the start. If you take Nostr’s Kind1 schema and compare it to app.bsky.feed.post (their Kind1), and not only that but all the lexicons that app.bsky.feed.post references (such as app.bsky.richtext.facet and app.bsky.embed.images and app.bsky.embed.record ...) it's quite clear we’re looking at an order of magnitude difference in detail. And at the end of the day this is all about detail. That’s where the devil is. And the devil is having a lot of fun on Nostr these days.

If you're an ATProtocol developer and you've got a cool idea for, say, a VR client, and you decide you're going to re-use the app.bsky.feed.post lexicon and all its mandatory entourage—well there's very little wiggle room for you. Either you state outright that this is your lexicon in each event and you stick with the program—or you don't and you make a new lexicon and you declare that new lexicon explicitly in each event. And that’s good. Because over there devs can't just say to users "you know what guys, you figure it out". The devs have to figure it out themselves. And beforehand.

So why the lower level of detail for Nostr?

One reason Nostr Kinds are less opinionated is to increase the chance of being merged on Github. Meaning much of this is psychological (as opposed to technical, given that in theory there is no limit to how detailed a Nostr Kind can be, though there are also technical differences that give ATProtocol lexicons more expressive power). Nostr kinds are discussed—and discussed, and discussed some more. This has a watering down effect.

ATProtocol lexicons are discussed too, but in fewer situations, and the discussions end sooner. Part of this is because there is no two-tier system of “merged” and “un-merged”. (On Nostr an un-merged spec is a little like a second-class citizen, and devs feel a lot of pressure to get their specs merged and first-class-ified). ATProtocol lexicons also start off with devs and their unique ideas—but they aren’t ever merged. You can have a much-copied lexicon, one that say five or six other clients make use of. And you can have a solo lexicon, one used by your client alone. That’s where the difference is. This means that on ATProtocol it’s all about traction. Not traction in order to make the case that your PR should be merged. Just good old traction.

Of course the downside to lexicons is that devs with clients that have good traction gain a lot of lexicon power. If I make an ATProtocol client for publishing serialised fiction called CheeseRead, and my chapter publishing lexicon is com.cheeseread.chapter, and I get a lot of users, and a few other serialised fiction clients emerge (maybe for other operating systems), and they use my com.cheeseread.chapter lexicon too—then I’m in a pretty strong position. And bonus: I get to feel proud of myself because all these other clients have my brand showing up in their event json.

This doesn’t mean I can screw with the lexicon and break things on their end. Under the rules all old data must still be valid under an updated lexicon, and new data must be valid under the old lexicon, so new fields must be optional, non-optional fields cannot be removed, etc. (or a fresh lexicon is needed). But it does mean that it’s harder for other clients to pull users from me because my client is going to be very optimised for this lexicon. (Mind you this can also be a good thing because it means others in the space have to think beyond copy-paste.)

All in all though, there’s something to be learned here. ATProtocol lexicons are more decentralised—due to there being no “PR & merge” concept—and more practical—due to how much grey area they usually remove.

The lesson for Nostr: there is no point in getting everyone on the same page if that page doesn’t have enough words on it.

The ATProtocol lexicon concept is a smart concept that can be borrowed. It encourages what I call “fearless detail”. At any rate Nostr has to move off Github sooner or later, so why not dump both the platform and the flow at the same time? And jump on the lexicon train.

I actually adopted this for Pubky, but I still think it is useless... no one has any incentive in detailing their schemas just so their competitors can steal market share easier.

Interoperability will never work, because there is no incentive.

You should focus on Twitter and Facebook then, same centralised identity and much bigger market.

If did:plc became like ICANN, they would have spent too much time spewing bullshit just to become what they should have started with; registering a TLD and give people domains on signup, instead of this DID garbage.

And the 12 weirdos are not businesses by the way, businesses don't give a fuck, hell even presidents their didn't care enough to point their domain to the did:plc.

If you are in it for the business opportunity, make sure to not get high on this supply, if you have to sell it to business good for you, I am rooting for you, just don't confuse yourself.

Most importantly; don't ignore all the signs that Bluesky users don't give a shit about any of this, so if you build a business assuming there is a market for digital sovereignty enthusiasts... you are going to lose your shirt.

It is an asymmetrical key that can be associated with a web2.0 account to log in without passwords by signing a challenge.

The often not discussed aspect of it, is that it is meant to be device bound, so services may only accept keys that are themselves signed by a trusted party, to prove that it was generated in a secure environment where the key can't be extracted by scripts or extensions or what not.

It is not bad honestly, just doesn't work for sovereign identity as nicely.

Too obscure and cultural specific expression to translate, but it is a personal note anyways don't worry about it :)

أصلا عادي

Hello, the author of Pkarr that uses Mainline DHT here, you can go to app.pkarr.org and put your npub and relays and whatever you want to put in a DNS packet (because that is what it is).

The only problem that prevented Nostr from adopting Pkarr despite my constant advocacy for it for almost two years; the root identity HAS to be ed25519 key, this is not my decision this is what the biggest DHT in the world decided to use decade ago (see estimate of number of nodes here relay.pkarr.org).

So yeah I would love it if Nostr supports Pkarr as a root identity or at least as much as it supports ICANN with Nip05... but that is up to client developers.

Urbit was 100% designed with cloud in mind, listen to the inventory... he just hoped that "confidential computing" would solve the trust issue... which at least Signal agrees with, but if you want to be a purist, it doesn't help that much, you need to trust the chip designers and other assumptions.

Laptops get closed often, fighting the cloud is not viable, but we can make all data E2ee so that the compute happen on your machine but data availability is handled by the cloud.

Try to explore Peergos.net for now, it has the e2ee but not the sovereign identity yet, and it is written in Java and quite old, and never accepted VC money, so cut it some slack.

Peergos is an open alternative to Proton Drive offering end to end encrypted filesystem where the server is entirely a dumb host/storage. Put so far it relied on a centralised identity layer similar to Bluesky.

Mlkut.org is my personal effort to port that e2ee filesystem to Rust, simplify it, and replace the centralised identity with Pkarr.

As for why is that helpful, it is because Pkarr tells every client exactly who hosts your data at any moment in time giving you unbroken URLs and strong consistency, while the rest of Mlkut gives you full control over who can read and/or write to any folder or file in your filesystem.

That allows you to use wide variety of open source apps to author and share and publish, but it also allows for collaboration and you can compose these folders to build an emergent community, like forums or groups with moderation etc... there are things that you can't do with only these primitives, but for small world usecases, you can go so far with only this.

Let me put it this way; if you can imagine building it with Proton Drive / Google Drive, you should be able to build it with Mlkut, but also no vendor lock.

Meaning J O B, work for income, this way you won't be so anxious for adoption ... if it is a passion project, you can persist for decades AND enjoy your time with no pressure.

Let's start ove, and start small, from the minimum viable digital sovereignty and grow from there, worst case scenario we achieve something really good but not popular... Social media is an all or nothing, when it fails to take off, it crashes and burns, with absolutely nothing left standing.

Let's ratchet progress on digital sovereignty, we already have miraculous foundations (Bitcoin, Mainline, and Cryptrees) all of which was invented around the same time for some reason!

It is our turn to make the new wave of tech and products, and we should build them with soundness and care, that they can germinate and survive to be passed on to the next generation, even if this one simply never gave a fuck.