Avatar
Garbage nsec
b90c3cb71d66343e01104d5c9adf7db05d36653b17601ff9b2eebaa81be67823
Trying to spice things up here by being contrarian in threads where everyone just agrees with each other in an online yawn fest for the ages. Pure sport. High chance I don't really care about what I'm arguing for.

Ah okay, fair enough, though I'm not sure that's so much of a value add. The real issue is that normies will never accept a network where if you lose control of your account the best you can do is let everyone know you're starting again completely from scratch at some new account.

the expectation that you can somehow sort things out after a hack and not lose all of your history is far too engrained.

Replying to Avatar Derek Ross

That's a fair point that some people are already used to interacting with a secondary app for sign-in. Though, many people still get their MFA codes via SMS and for those that have migrated to other methods, copying some numbers and pasting them from an app that has all of your accounts is still very much different and much easier than a dedicated app for Nostr for signing a wide variety of transfers transactions. If it were as simple as MFA codes, you and I wouldn't be having this conversation.

It's very similar to Bitcoin except people rarely send or sign a Bitcoin transaction. Most people just HODL. We're asking people to do this potentially 1000 times a day unless they go with the fully trusted method. While similar, it's still something most don't do. Remember, we're always preaching for people to remove their coins from exchanges because that's where many people keep them.

I'm not saying I know best when it comes to users and what they want, I'm just speaking from experience onboarding and educating them over the last 3 years. I may not know best, but I have a good idea on their pain points and struggles and I have a good idea on what needs to be fixed and improved to alleviate those.

My goal is to take these experiences and issues and turn them into people that are able to do what they do best. Solve complex problems. Then the feedback loop should continue and these solutions should be discussed to make sure that they're still not too complicated or going to cause more problems or not solve anything at all by pushing the issue into the next bottleneck.

Using App A to sign into App B doesn't scale on iOS. It's all hacks that fall apart once Apple takes a look.

And if the goal is to help out normies but it doesn't scale on iOS then consider that goal thwarted.

If you want the attestation to be technically meaningful here are few things that have to happen (and that do happen on Farcaster and elsewhere):

Everyone who followed your old key before timestamp x (time of theft) now follows your new key, automatic.

DMs sent to your old key can be read using your new key (and no longer read using your old key)

Posts from your old key show with your new avatar and handle to anyone browsing.

And 50 other things.

How are these things to happen Nostr? If what you’re suggesting is just a nostr-native alternative to an adding your NIP05 to your new key then we already know what a non-solution that is. And if you want those things above to happen then you don't need a blockchain per se but you need a hard fork.

"you precisely can have your most trusted people attest to your new key"

that's what you said, and that's exactly where the fork is buried.

Assuming of course that you want this attestation to have some technical bearing. If just for warmth and funsies then no fork is needed.

None of this changes the fact that what you are suggesting requires a hard fork. It can be done in a "nostr-like" way, but it requires a hard fork.

There's always an ultimate source. In nostr the nsec is the ultimate source of identity. The nsec is a smart contract too, just a very tiny one.

Point being, WoT will not do anything to help people bridge a lost or stolen nsec to a new nsec in a nostr context.

And if you don't like blockchains you can achieve this without a blockchian (instead various forms of old fashioned key pair voodoo) but, again, breaking changes to nostr and a hard fork.

I'm not proposing anything for nostr. The only thing for nostr is a fork.

In the Farcaster case, the core identity (the FID) doesn't change. If you lose the highest thing you can possibly lose (your main key, as it were) and then your trusted friends vouch for a new main key, once done that takes control of your FID (as per the smart contract) and you're back on the SAME identity. So you have an old-to-new bridge in the form of the blockchain. nostr has no such bridge, and can never have one.

You don't need a chain, but you do need some help from somewhere and that help does not and cannot exist in nostr unless you fork it.

I mean it's close enough to impossible to do that you'll give up trying. Think through what clients would have to *actually do* in the case of someone having their nsec taken by an attacker and creating a new one that friends validate. It's like subkeys and Vitor's response here, sounds great in theory but when you think through what clients would have to *actually do* to reconcile the subkeys you realise it's a non starter. There's a different such list for this main key respawn scenario, but it's equally off-putting.

right but nostr, unlike Farcaster, cannot swallow that. Farcaster your FID belongs to the chain and your main key is control over it, so such a thing can work. Nostr the buck stops at your main key, which means you'd be asking clients to do something that clients cannot physically do in terms of stitching old you and new you together.

This is very well written. I looked at the comments, a lot of them understandably based on people's experience of Nostr as a network with something like 7k daily active users, give or take.

There is just no comparison between that size and a network of even just 1m daily actives. The article nods to this and so thumbs up.

How? It's not like Farcaster where you can have your trusted people sign off on a new main key. For nostr there can only ever be one main key per human. Best you can do is keep it very secure (not easy) and rely on bunkers, signers, etc. we all know the drill .

Dunno but I think he means rotation of the main key, hence the to-fork-or-not-to-fork internal debate.

As in some fork where a majority of the guardians can sign a transaction to replace the lost main key with a new one and the protocol respects that. Farcaster sort of does this.

This is all getting farther and father from what normies can stomach. I'd say nostr has crossed the line and is now anti-normie .

Frostr isn't key rotation in the base sense he seems to be talking about though. It's still a single forever-key, just one with several minions.

A single key per person and for life is too core to how the protocol works. Everything is built on top of that. It's the core of the core of the core. Rotate-able subkeys are a non-starter.

All you've got is a bunker-esque solution or a protocol fork.

>the largest circular bitcoin economy

This underscores the fact that Bitcoin's medium of exchange chances are gone. Around $1k in transactions per day is what you might call "performative MoE".

Stablecoins are the future for the lightning network, and for those that care about nostr more than bitcoin USDT zaps are what will really help growth.

For Bitcoin, it's all about store of value from here on in, as well as providing transport rails for other assets. (And a little bit of performative MoE.)

With you there.

But can you see the note this is replying to? It didn't hit my outbox relays so I tried to delete the relays that it did hit to post again to all my outbox relays but the delete only half worked and I gave up.

Also are you setup for outbox? I guess to be pure outbox you have to just use Jumble, Amethyst and I dunno what for iOS, Nostur? Primal seems to be sort of half-outbox, I can't quite parse it yet.

Yes, well put. I'd love to see a deep financial analysis of the Nostr ecosystem, all the grant funds going in, and the investments, the estimated combined earnings of developers, revenue estimates for the major players in each area like Alby, Primal, Nostr.wine and, so on. It's hard to picture just where Nostr is financially right now and how big the gaps are that need to be filled. (Big of course, but just how big?)

On the grant and investment finding side I'd not be surprised if upwards of $2m was flowing in each month, but that's just finger in the air.

Far as I can see ATProto's ethos seems to be that relatively few people in the grand scheme are going to put up with this fragmentation stuff and therefore fragmented social networks are never going to get past the size of, say, Mastodon. And if they never get past that size then what’s the point?

Thing is nobody seems to have a useful scorecard for decentralisation. For ATProto, Pubky, Nostr, Farcaster, ActivityPub, Keet, etc., each has certain "decentralisation categories" where it's the winner, and each has certain decentralisation categories where it's the loser.

nostr:npub1h0uj825jgcr9lzxyp37ehasuenq070707pj63je07n8mkcsg3u0qnsrwx8 curious that you put 6 as the recommended max group size for Signal groups. What are the performance downsides to having a Signal group of say 20 members versus an MLS group also of 20 members?

nostr:npub1h0uj825jgcr9lzxyp37ehasuenq070707pj63je07n8mkcsg3u0qnsrwx8 is the reason keychat doesn't support custom avatars for people and groups more of a backend efficiency issue or is it more about preserving anonymity?

What is the name of that nostr healthcare initiative? I can't seem to surface it in search, anyone help me out here?

Involved storing medical records on Nostr relays or something along those lines. I'm curious to check back and see how it's going.

#asknostr

For HTTP, SSH, etc. sure. These are for building things that run in relative isolation. But for social protocols, which are the opposite of isolation (hence social) it's different. You can't disentangle the protocol from the vibe. Every such protocol develops a vibe that becomes self-reinforcing.

Except for B2B and other such relatively isolated deployments.

You can ask the same thing about chewing gum in Singapore or graffiti in Zurich or anything else. Law enforcement will always take scale, motivation and other things into account. These are silly what ifs.

Yes but again this isn't really about freedom of speech, just as it isn't really about due process.

The State of Mississippi made a law that says children cannot access certain platforms online. That's what happened here (and incidently limiting children's access to things was far more common in the time of the founders). Many people are happy with the law, many people are not. Those unhappy can talk about it all they like and make an effort to vote in new lawmakers who will repeal it. They might succeed, they might fail. Depends on public opinion. Pretty sure that's how the founders would see this one, as a simple case of split public opinion and the legislative process running itself through, nothing to do with some kind of due process or freedom of speech emergency.

Taking a dig at Bluesky for following the law is ... I dunno. What are they supposed to do?

That's actually is the best way in this case.