https://anandamide.substack.com/p/sv40-origin-of-replication-in-mammalian

nostr:nevent1qvzqqqqqqypzp978pfzrv6n9xhq5tvenl9e74pklmskh4xw6vxxyp3j8qkke3cezqyw8wumn8ghj76r0v3kxymmy9e3k7unpvdkx2tn5dahkcue0qy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qgmwaehxw309aex2mrp0yh8wetnw3jhymnzw33jucm0d5hsz9nhwden5te0v4jx2m3wdehhxarj9ekxzmny9uq3gamnwvaz7tmpd3nk7tn4w3ux7tn0dejj7qpqx953gmpz6nwhtm5ys6hadgtre90xx9t8984hdj5nkzud93rq36nsvj9r8a

First off, the offending line of code was incredibly stupid. It only took a glance to realize that something was incredibly wrong. I went back and git-blame'd the line, and discovered that it was the result of a refactor, where a local variable named `session` was replaced by an imported variable with the same name. The former was a random string (in keeping with my attempts to anonymize users). The second was a user session object, complete with private key.

This leads me to my first observation, which is that no one is auditing nostr apps (just as no one is auditing most software out there). In many cases, there isn't even a code review step, because many of us are solo devs. Just because something is open source doesn't mean you can trust it. Just because you wrote something doesn't mean you can trust it! My key was leaked right along with those of my users.

Code review aside, there were some mistakes I made that resulted in the incident being worse than it could have been:

1. I used analytics and error reporting.

2. I did not self-host my analytics and error reporting.

Because I was using a hosted error reporting service, their servers were implicated in my mistake. Had I been self-hosting, I could be more confident that the data I have deleted is actually gone (even if my users don't have the same assurance).

Action item number one: analytics and error reporting are important enough to being able to develop Coracle that I'm not planning on getting rid of them, but I am moving immediately to self-hosted options. If you want to opt-out of that data collection, there is a setting for that within Coracle.

Another mistake I made is that I trusted myself to safely handle my users' private keys. This is more than just my mistake; despite the growth in use of remote signers, it's still very common for nostr applications to offer private key login or generation. But after this incident I'm of the opinion that no one should be handling unencrypted private keys, except for signers.

Applications should not generate private keys or allow users to sign in with them. Period. In fact, I propose we sunset the term "nsec" entirely. There's no need to make a friendly encoding for something that users should never see. Instead, users should be asked to export their private keys in the password-protected ncryptsec format only. This prevents clipboard attacks or poor key management from compromising users.

This is action item number two: I've already removed private key login from Coracle, and will shortly be re-working my onboarding process to redirect users to set up a remote signer instead of generating a key.

This will have implications for UX, and might make things more difficult for new users in the short term. But as nostr:nprofile1qyt8wumn8ghj7etyv4hzumn0wd68ytnvv9hxgtcpz9mhxue69uhkummnw3ezuamfdejj7qgkwaehxw309ahx7um5wfjkc6t5v4ejummjvuhszxrhwden5te0wfjkccte9e38yctev3hkutnrdakj7qf9waehxw309askycmyv4nxwv3sxg6rqvfsxserqdf5xqczu7re0ghhvvf0waesqgqml8ernh9pvds5n0p08lpngpm6a9v749s8et8eghhclzajylw9uyzh4qru pointed out, the longer we allow users to treat keys like passwords, the longer they're forming poor habits for keeping their keys safe, because the two are categorically different. Removing support for private keys will cause pain in the short term, but will force us to improve our integrations with remote signers, improving security and UX in the long term.

That's all I've got for now. Thank you to everyone for your graciousness, I appreciate all the support. I'm honestly glad this happened, and I hope it will galvanize all of us into action to continue to improve nostr's security.

https://www.youtube.com/watch?v=8-zaQWAaPAg

https://ghostbsd.org/

https://www.nomadbsd.org/

https://madaidans-insecurities.github.io/linux.html

- Complete free tasks to earn free sats e.g here; https://bitcoiners.africa/earn-section/places-to-earn-sats/

- Find an old lost USB Bitcoin wallet from 2009 😅

- All of the above

nostr:nevent1qqs82vcfldd50ay8tu0vtzvjm5hyv7qkch3xx380rtrertfqtafa6rspz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsygqqrzm7uvlmy5uyxcuuvt3f9lk8qznf4yas3m3hf3da49cunvu4vspsgqqqqqqs5es3fc

https://youtu.be/HVpJAJjDI8U

https://nostpic.com/media/4f44ff626cb4761bcba7451261b8ff35b798d798e12474d5aaad8ce9516ae4ca/4ec76fd8f5a5b5b650e8cd7cba0266c9c895749cf93365edc9d0e765e1d216df.webp

[Re nostr:nprofile1qqstzt0wugc7sklvr8e7fcl7ukyn63ym3ns4nmf2mnk0vqnz4l9x65qpp4mhxue69uhkummn9ekx7mqpr4mhxue69uhkummnw3ezumtfv3jxc6twvuhx67tydeeju6nsqythwumn8ghj7mn0wd68ytn5dacx2arg9e5kuen0te28kw: current newbie nostrich onboarding strategy]

https://nostrcheck.me/media/0018b7ee33fb253843639c62e292fec700a69a93b08ee374c5bda971c9b39564/977a81538f80a3b8b1bf06fb019b6e1dd96788cfe5b6e91af89e3de24fe238c5.webp

For me, it depends on whether I'm there with them in person, or if we're chatting over the internet.

If I'm there to hold their hand, these are the steps I've been doing that work very well:

1) Give them the quick spiel on the client/relay model and why it's awesome

2) Get them setup with nostr:nprofile1qqs9xtvrphl7p8qnua0gk9zusft33lqjkqqr7cwkr6g8wusu0lle8jcpp3mhxue69uhkyunz9e5k7qg4waehxw309ajkgetw9ehx7um5wghxcctwvsqs6amnwvaz7tmwdaejumr0ds2g5zx8 on their phone (the built-in ⚡️ wallet is a major step-saver)

3) Have them make a killer #introductions post, with a couple pictures of themselves and a quality intro on why they're unique/awesome

4) Show them how their post appears on a completely different client on my phone, and send them some zaps

5) I have them download a second client on their phone and log in, so they get a feel for this multi-app dynamic ( nostr:nprofile1qqs24yz8xftq8kkdf7q5yzf4v7tn2ek78v0zp2y427mj3sa7f34ggjcpzamhxue69uhhv6t5daezumn0wd68yvfwvdhk6tcppemhxue69uhkummn9ekx7mp0qyg8wumn8ghj7mn0wd68ytnddakj703s8dt / nostr:nprofile1qqsraldwhvwcjgltmxwfu7kw8dqef2692yhzheuurd7k3kfy8cxjdqgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3samnwvaz7tmhv4kxxmmdv5hxummnw3ezuamfdejsz9thwden5te0v4jx2m3wdehhxarj9ekxzmnype9f6h depending on their phone)

6) I have them pull up their Primal wallet so they can see the zaps I sent them earlier, and by this point usually a few other friendly introducers have zapped as well

7) I show them my own wallet with six-figure sats in it, and describe to them the big-picture vision on how this is REAL MONEY earned by posting thoughts & memes, which can now be used in the real world.

After all of the above, I've seen a very high 🤯 rate.

NOW...if I'm DMing someone over the internet, I take a different approach. I usually focus on smaller steps, i.e. touchpoints and educational resources, since as they'll be going through the steps themselves, they'll need a stronger foundation on WHY #nostr is so powerful.

A few of my favorites:

- "The Power of Nostr" by nostr:nprofile1qqsw4v882mfjhq9u63j08kzyhqzqxqc8tgf740p4nxnk9jdv02u37ncpz4mhxue69uhhyetvv9uju6mpd4czuumfw3jsz9nhwden5te0wfjkccte9ec8y6tdv9kzumn9wsq3yamnwvaz7tmsw4e8qmr9wpskwtn9wvql3tqm

- "The NOSTR Protocol: Social Media 3.0" by nostr:nprofile1qqspnhx537zxue3r65nyucqug8wtuxzw4ndwd4k6rywvnwq6j728hngpzamhxue69uhhyetvv9ujucm4wfex2mn59en8j6gpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqgjwaehxw309ac82unsd3jhqct89ejhxzegc0t

- "How To Earn Bitcoin And Join The Creator Economy With Nostr" by nostr:nprofile1qqswmf5ytnpzdxl2zrcpqaz2672qnt9hz2wedptaf0ceuqnkjc5e9ysu7qx9d

- My podcasts with nostr:nprofile1qqsr7acdvhf6we9fch94qwhpy0nza36e3tgrtkpku25ppuu80f69kfqpramhxue69uhkummnw3ez6un9d3shjtnyv4ex26mjdaehxtndv5hsz9mhwden5te0wfjkccte9ehx7um5wghxyctwvshszxthwden5te0wfjkccte9ekk7mt0wd68ytnsd9hxktc79dllq, nostr:nprofile1qqsr9cvzwc652r4m83d86ykplrnm9dg5gwdvzzn8ameanlvut35wy3gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3qamnwvaz7tmwdaehgu3wwa5kuegpp4mhxue69uhkummn9ekx7mqcu9929, nostr:nprofile1qqs8d3c64cayj8canmky0jap0c3fekjpzwsthdhx4cthd4my8c5u47spz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qz9rhwden5te0wfjkccte9ejxzmt4wvhxjmcpzemhxue69uhhyetvv9ujumn0wvh8xmmrd9skchd02dz, nostr:nprofile1qqsxknkf3upwv3lqz3qtguammy48lt3puqdk4fkxtcedh99rvzfzwtspz9mhxue69uhkummnw3ezuamfdejj7qgwwaehxw309ahx7uewd3hkctcpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcy39xe5

- And for the real hardcore diggers: StudyNostr.com

From my knowledge, I haven't yet found a "perfect" onboarding experience yet where I can confidently send both of the above groups, and know they'll be in good hands to receive both the educational crash-course AND a smooth account + wallet signup, but I know client devs are working hard on building these ramps as we speak.

If there are any good ones out there I'm forgetting, please share! Now is the time to always be refining and adapting to new processes as this ecosystem continues to emerge 🌱⚡️

https://fountain.fm/episode/7uUd4oW3zAvIU2V42Q6O