Something also worth mentioning on the encryption side is: you can't put the toothpaste back in the tube. Once someone, or governments go hoovering up encrypted anything, if the encryption is ever found to be weak, your keys have now been compromised. We saw it happen with early SSL and the NSA, and is likely still happening. But that was just passive attacking, this allows for unrecoverable active attacks.

To my knowledge no other system functions with this much risk. I can't think of another scenario where a user doesn't have the ability to counteract and active attack.

Certificate authorities can issue revocations to limit damage

Bitcoiners can move funds if they get nervous or have many wallets

SSH can issue new certs

PGP can regen or issue revocations

Passwords can be changed

Bank accounts can be closed and reopened

TLS connections are generally short lived

nostr keys have no countermeasure whatsoever.

Something also worth mentioning on the encryption side is: you can't put the toothpaste back in the tube. Once someone, or governments go hoovering up encrypted anything, if the encryption is ever found to be weak, your keys have now been compromised. We saw it happen with early SSL and the NSA, and is likely still happening. But that was just passive attacking, this allows for unrecoverable active attacks.

To my knowledge no other system functions with this much risk. I can't think of another scenario where a user doesn't have the ability to counteract and active attack.

Certificate authorities can issue revocations to limit damage

Bitcoiners can move funds if they get nervous or have many wallets

SSH can issue new certs

PGP can regen or issue revocations

Passwords can be changed

Bank accounts can be closed and reopened

TLS connections are generally short lived

nostr keys have no countermeasure whatsoever.

Maybe I'm too much on the extreme ends here, but since we have no proper cryptographic mechanism for keypairs, if an nsec is ever stolen, you permanently lose your identity and every account that used it for authentication. Because of this, I don't think we should be building any tools that can pose risk to key theft SOLEY for the sake of convenience or on-boarding.

Great the UX is easy, and tons of people sign up, go transferring their keys all over the place and many of them will get their identities stolen.

Yes I understand the argument: well it's probably better than users copy-pasting nsecs everywhere, yeah it probably could be. Still think that's a different argument though. Nostr is different than traditional app UX, I think we need to stop pretending we can make it work how people are "used to it" and educate.

I'm not sure where we need to take these actions, but I will still advocate for less key attack surface area. My signing app doesn't even have the code to extract private keys and likely never will.

there are some issues with the release apk, so i removed it, and will re-upload it once ready

I don't know. They all say they check for this, but it doesn't seem to work.

You usually can't see the busiest threads on trendlists. They're just some never-ending discussion some small account started and more more people strolled into.

This is why we need a Nostr logo

Good morning ✌️🧡

I found the place I buy raw milk from by searching Raw Milk on Google maps. Your mileage may vary, and you can ask around at farmers markets or local farms.

But you can make a thick cream from it by boiling the milk and storing it in the fridge. Malai has the highest fat content of cream you can get from milk.

When you don't know where to put the notifications tab... 💡

Enter, free market of notification bots.

The act of subscribing to someone else's notes is inherently one-sided and creates a publisher and a subscriber. If both sides subscribe to each other's notes, then the connection is mutual.

Followers, follows, and mutuals are fine words ruined by mainstream influencer culture, but that's no reason not to use them.

that's "gophers" to you ser 😛

Raw cream, egg yolks, raw honey and mango

Yeah, I just had the same thought, since the Wiki has a composite page for each topic, that could serve as a jumping-off point.

Nostr allows for complex workflows because you can have a gazillion views and constellations of the same data set.

yeah I wasn't a fan of it either.