Avatar
Dr. Hax
d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511
Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code. :-) Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle. XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

I'd zap this note, but Alby seems to be blocking zaps over Tor again.

I raised this to them in the past and after a few days they fixed it after a few days. Apparently only temporarially though.

Yes. Yes it does.

It's not exactly what I want, but it produces a list of relays as a side effect, which is good enough for me.

Thanks for sharing

The kind 0 post is signed, already verifying that the key owner is claiming to be bob@example.com and looking at example.com to see if it matches verifies that the domain owner agrees and prevents anyone from claiming they are Bob.

If we say this isn't really validating anything, then I feel like by this same logic, no TLS cert would verify anything (unless it's a private CA who signed a cert for its own domain). Just because the assertion is being made by a 3rd party doesn't mean it's not valid.

At the end of the day it seems like it's just semantics. ๐Ÿคทโ€โ™‚๏ธ

Cool, then we agree that I've done NIP-05 verification. ๐Ÿ‘

I am using my own domain

Yeah? Is this some pedantic argument that a mapping of Nostr keys to DNS-based internet identifiers is not verification?

Because people have a word for being able to verify someone's npub really is associated with the domain they claim it's associated with, and that word is verification.

I give you exhibit A:

https://nostr.how/en/guides/get-verified

And if you don't like that source, there are exhibits B through G. ๐Ÿคฃ

https://verified-nostr.com/

https://orangepill.dev/nostr-guides/guide-to-verify-nostr-profile-nip05-identifier-with-your-domain/

https://thebitcoinmanual.com/articles/nostr-account-nip-05-verified/

https://medium.com/moonbeme/nip-05-verification-in-nostr-and-how-to-do-it-e4918cb950d9

https://no.str.cr/verify.html

https://www.checkstr.org/

FWIW, I know people who know the creators of Carbon Black, and I am familiar with the skill level and mindset that they come from.

If the founders are still involved with the company, I expect the security to be top notch and the privacy to be at least respectable or better (depending on how much business forces forced them to collect some telemetry to better market their product).

I haven't used it personally, but I'd say they should be on your list of things to look into.

I see where a comparison table would be useful here. Unfortunately, that's something no LLM is going to give you.

I looked for independent reviews on action1 and found this: https://community.spiceworks.com/topic/2186911-action1-anyone-using-it

It does suffer from being rather long, so maybe it's not going to be helpful.

It's hard to find someone who is willing to review or try out multiple options and then write a concise, unbiased comparison guide of even just the features, let alone specific to privacy and security.

This is one of those places where I expect many people would be willing to pay some small for such a guide, and there are even micropayment paywall systems that could facilitate that, but there's the huge marketing burden if getting the word out about said guides. So maybe this wonderful review writeup already exists but we don't know about it.

If there's something like this out there, I'd totally write up a guide on any of the privacy/security topics that I know well, such as secure messaging services. If it sells, I'd be willing to do more thsn just one. But I'm not willing to do the marketing around such a platform. I'm already stretched kinda thin.

Replying to Avatar Dr. Hax

For any #SelfHosters looking to get NIP-05 verified, it's literally just dropping a single text file in the right place (.well-known/nostr.json to be exact).

https://nostr.how/en/guides/get-verified goes through the details and shows how to get your pubkey in hex format instead of npub format.

The hardest part was figuring out which relays I post to (which I could have omitted from the json file). I'm connected to more than a dozen relays, but it looks like #Amethyst only posts to a subset of them (based on the icons to the left of each post).

Furthermore, Amethyst doesn't seem to indicate which relays you will post to, nor allow exporting all the relays in your list. So if you have customized your list of relays, I hope you manually typed them into a text file somewhere so you have a backup.

To make things even wise, clicking on the relay icon to the left of a post does not show the URL of that relay, just the name, description and icon.

I worked around all of these limitations by clicking on each relay icon, and memorizing the nsme for long enough to switch to my Relays view and then looking for a URL that probably matches.

For the ones that didn't have a name that helped me out, I looked very closely at the tiny icon and then quickly switched to the relays view again and looked for a matching robot icon.

With that, I was able to identify every relay that I post to and type them into the JSON file. If I spin up my own relay, I'll be glad to have examples when I go to add the relay to my list.

nostr:nevent1qqsxx5a5y0gkxksnxgm5cccsyv68s0f29s4c8vy2nl4kqz25wngvdfqpr3mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmqzyz8mzs95arw7l97wfwpp6frj0zs6gdfnvf3r7eqzzjztxuhefqqqcqcyqqqqqqgdwp9uu

Now that I've typed it all out, I guess it wasn't quite as easy as I had thought, but I was able to piece it all together from just a single, short page of instructions.

For any #SelfHosters looking to get NIP-05 verified, it's literally just dropping a single text file in the right place (.well-known/nostr.json to be exact).

https://nostr.how/en/guides/get-verified goes through the details and shows how to get your pubkey in hex format instead of npub format.

The hardest part was figuring out which relays I post to (which I could have omitted from the json file). I'm connected to more than a dozen relays, but it looks like #Amethyst only posts to a subset of them (based on the icons to the left of each post).

Furthermore, Amethyst doesn't seem to indicate which relays you will post to, nor allow exporting all the relays in your list. So if you have customized your list of relays, I hope you manually typed them into a text file somewhere so you have a backup.

To make things even wise, clicking on the relay icon to the left of a post does not show the URL of that relay, just the name, description and icon.

I worked around all of these limitations by clicking on each relay icon, and memorizing the nsme for long enough to switch to my Relays view and then looking for a URL that probably matches.

For the ones that didn't have a name that helped me out, I looked very closely at the tiny icon and then quickly switched to the relays view again and looked for a matching robot icon.

With that, I was able to identify every relay that I post to and type them into the JSON file. If I spin up my own relay, I'll be glad to have examples when I go to add the relay to my list.

nostr:nevent1qqsxx5a5y0gkxksnxgm5cccsyv68s0f29s4c8vy2nl4kqz25wngvdfqpr3mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmqzyz8mzs95arw7l97wfwpp6frj0zs6gdfnvf3r7eqzzjztxuhefqqqcqcyqqqqqqgdwp9uu

Yay, I am now NIP-05 verified. ๐ŸŽŠ

Thanks, I didn't see anything about being able to send/receive SMS on the project website, but I'll download it and give it a spin.

I've added the buy/donate buttons to the nav bar, added a screenshot of the client, removed the link to buy on eBay, made the page more accessible for people with screen readers, and fixed a typo.

Thanks again for the suggestions. It's not a flashy corporate looking site, but it's better than it was, and it still loads #lightning fast, without any tracking, javascript, CDNs or other such nonsense.

Replying to Avatar jimmysong

# Fiat Games on Bitcoin

There's a saying about standing armies in peacetime, it's generally not a good idea. Wartime emergencies are one thing, but when you have a standing army during peacetime, they generally just get in the way because, like most armies, they crave action.

If you have a perfectly virtuous military, perhaps having a standing army is fine, but given the flaws of the human condition, there's bound to be some trouble. Many a revolution started with standing armies that felt disrespected and seized power when they could.

I mention this because this dynamic is at play in the Bitcoin ecosystem, where a bunch of bored holders are starting to make trouble. They identified as Bitcoin Maximalist even as recently as a few years ago, yet got off the rails, pushing all sorts of idiocy like this ordinals/brc-20 stuff.

The problem with these people is that they crave action. They can't just sit back and enjoy the ride. They're the type that needs to always be doing something, good or bad. And let's face it, once you get that Bitcoin is sound money and have given your pitch to your friends and relatives, it's a matter of waiting things out and watching your fiat enemies float by the proverbial river. I've been in those conversations, they go around the same topics over and over again.

As a result, these people feast on news. Wow, Michael Saylor did something, or there's an ETF coming, or X or Y or Z is happening. They're all addicted to talking and rallying the troops and once you're bored of talking about the things that matter, there's a natural tendency to talk about the things that don't matter as if they were.

I blame the BUIDL movement that emphasized building something, anything. It's an understandable attitude. Surely, doing *something* is better than doing *nothing*, right?

This is the error that every politician makes and it's high time preference behavior. X just happened and so you have to do something to react, *right now*. Or Y is a problem so you do something to "solve" it. The problem with these actions is that they're usually not well thought out and good actions, the ones that provide value, require some planning and research. But for the people with the BUIDL mindset, they just go and make something regardless of whether there's a need in the market or not. And the people addicted to action love this stuff because it's new.

I'm old enough to remember the 2008 crisis and the $800B TARP bailout that came along with it. The idea was that there would be lots of "economic activity" in the form of "shovel-ready projects." 16 years later, there's very little in terms of real, useful stuff that got built from the program. Most of that money ended up in slush funds and the coffers of the Cantillon winners who magically doubled or tripled their billions in the decade or so since.

That mindset of "build whatever" is a fiat mentality. It's not "if you build it, they will come." There has to be value being added to real people and not just a good story about what's possible. And that's what we're seeing in the Bitcoin community. There's a lot of VC money floating around still and they'll put money into anything with a good story, even if it makes little sense.

The fact is, VC investment is a fiat vestige that's horribly inefficient. And the incentives around it are deeply misaligned. The VCs, even the good ones, will pump their bags. And once invested, it's very hard for them to be objective about anything and takes superhuman amounts of virtue to do what's good for Bitcoin and not for your fund. You'd hope those things are aligned, but every VC inevitably gets into the situation where they have to invest in something questionable.

And invest in questionable things they have. This has been going on since 2013 or so with "investments" on "blockchain technology" and "ICOs" and "DAOs" and "DeFi" and "NFTs" and on and on and on. They may not even be explicitly looking to scam, but that is what they inevitably do. The pump and dump nature of tokens is such that they benefit the early pre-sale investors at the cost of the public, though to a large degree, this no longer has the returns it once had.

The flavor of the day is ordinals/brc-20 and unsurprisingly, a lot of VCs, even "Bitcoin-only" VCs, are invested in one or two already. That's because this is their model. They have to invest in a lot of stuff because their hit rate is so low. And diversification necessarily means you let the foxes into your henhouse. The "investment" ends up enriching scammers like the TARP bailouts did and the stuff that gets built ends up being largely useless.

And really, that's who is addicted to action the most. It's the VCs. Unsatisfied with Bitcoin's insane returns (or lacking justification for their fund in lieu of Bitcoin's existence), they talk and talk and talk on clubhouse and twitter spaces and whatnot to pump their bags. Even if they don't have bags to push, they're always talking openly to people about what investments they should make. And because they are looking for places to put money, they become much less objective and will fall for anything with a good story.

Investing in a good story is not a bad strategy in the fiat world. The narrative wins over things that provide value as long as there's an overwhelming amount of money put in on the narrative side. And the money printer is ultimately run by humans who will put resources toward good stories because there's no hard reality of the market to deal with. In other words, you often don't have to win the market. You can win it later with some money-printer-induced advantages.

But in Bitcoin, things are a little different. We have to be a lot more choosy about what gets built because what fails is a lot of wasted time and resources. Worse, that which gets built which ends up scamming wastes even more time and resources and sets Bitcoin further back. The entire altcoin industrial complex and the billions wasted on them since 2011 are the vestiges of this build-anything mindset.

Building has been very inefficient in the fiat world and unfortunately, we're having to re-learn what it means to build something that provides value.

Back during the gold standard, Standard Oil once paid 33% in dividends in a single year. That's not price appreciation or profits, that's dividends, as in money that went straight to the shareholders in a single year. And that's not a huge outlier. Most years, they paid over 10% in dividends.

Nothing like that exists now because all profitable stuff has been arbed to death. Anything that profitable gets "investment" (read: debt) which ultimately scales the business but reduces profitability. Most businesses these days are zombies, living out a dead existence while sucking value out from everyone else through inflationary theft. And unsurprisingly, that is the state in which most altcoins currently continue.

Which brings me back to the issue of Bitcoin culture. The problem right now is that too many people build on Bitcoin the same way they build on fiat. They play by the same rules and systems which have caused the stagnation we see all around us. But as we're progressing toward a sound money world, these processes and the fiat games that they run on won't work. The building that people do will have to run on a different set of *values*, not the fiat ones like satisfying venture capital with good stories.

The sad thing is that most people would rather do something rather than nothing. The lesson of the last 11 years in Bitcoin is that building something that is hurtful is worse than useless, it's better to do nothing.

Jimmy is really an excellent communicator. I usually get bored about 1/4 the way through long posts like this, but Jimmy manages to keep my attention and get me thinking.

Investing in long term gains is something that is so rarely done these days. The idea of "investing" has just become synonymous with "short term investments".

And it feels good to see a quick reward, but the things that get built are just incremental improvements on what we already have. Building something boldly innovative is a lot riskier, and being too early will result in punishment from the market.

nostr:nevent1qqsr29fntuty7hyhe03jgzlltejrhj98h9wqy0crqknczxzgdju3qhcpp4mhxue69uhkummn9ekx7mqzypan77qrw5r5daz4gyazy8uqje0wed577vy096k3m2yuctyfzt5ksqcyqqqqqqggjepu2

I wonder how long it will be before I get kicked out of the local blockchain meetup for asking difficult questions.

Tomorrow's topic is DAOs and I plan on asking about hostile takeovers, discussion and debate before votes, spam votes, attack proposals (which have been successful in the real world, what problem DAOs are solving (counterfeit votes?), and the idea that every person needs to be informed and vote of every thing is inefficient, exhausting and unsustainable.

This isn't the first time I've shown up with a bunch of pointed questions either. So if they don't get sick of me at some point, I guess I'll have to conclude that my [largely critical] input is valued.

I managed to get it updated even before my computer is back up and running. Thanks again for letting me know about the typo. โœŒ๏ธ