fiatjaf

Here, for example: https://lobste.rs/s/ktmwly/what_we_once_had_at_height_xmpp_era
A group of technology enthusiasts clamoring for an open DM protocol and no one telling them about the great news of NIP-17 privacy-preserving messaging that works + user-chosen relays for maximum decentralization.
#nevent1q…gxlg

2026-04-20 13:38:55 CEST

Everyone promoting Nostr inside Nostr is banned forever.
#nevent1q…c3mm

2026-04-19 11:51:59 CEST

- reply

The --outbox flag does that for inboxes too already. I didn't have a better name.
That's what happened in #nevent1q…uxt9

2026-04-19 01:22:11 CEST

I don't know when was the last time you tried or upgraded #nak, but there are some new (or maybe not super new) useful things (and hopefully not too many new bugs) that may interest you:
- "nak profile <pubkey-npub-nprofile-nip05-etc>", easily the most useful of the newish commands, I use it all the time to get the name of some random pubkey I see in the output of other nak commands.
- "nak group info/members/admins <nip29-group-address>", displays information about that group. then there is "nak group chat" that streams the chat room live in readable format, together with "nak group chat send" to send a message (from another terminal); "nak group talk" that yields a URL you can visit to join the group chat room in your browser; "nak group forum" displays the forum view of that group, together with "nak group forum create/comment" for creating a new thread of commenting on an existing thread.
- "nak bunker --profile <name>" stores your bunker data in a file under that name such that you can restart it later easily; then if you use this profile name you can later run "nak bunker connect --profile <name> 'nostrconnect://...'" from another terminal window to connect using the "scan QR code" flow instead of the "paste bunker URI" flow.
- "nak dekey" manages your NIP-4E decoupled encryption key (famously supported in Coop and Jumble DMs).
- "nak git" I think I've mentioned before, but it works pretty well, I use it everyday and as a has ton of subcommands I won't mention here.
- "nak validate" takes events as input and tells if they have all the required tags and in the expected formats according to https://github.com/nostr-protocol/registry-of-kinds.
- also when doing "nak req" or "nak event" you can pass an --outbox flag and nak will figure out the relays to connect to on your behalf, it will do that smartly according to the event authors, tags or parameters in the filters.
https://github.com/fiatjaf/nak/releases/tag/v0.19.6
Please report bugs or ask for features here in the comments or in the chat: https://web.nostrord.com/?relay=pyramid.fiatjaf.com&group=oycleloughr

2026-04-18 14:03:53 CEST

Looks like @npub1uh8…9y4m (Tadge Dryja) wanted to implement Lightning first as a much simpler protocol, with no onion routing, easier to debug, no HTLCs.
https://www.youtube.com/watch?v=o2F18lui1bE
It was interesting to hear the full story of his Bitcoin life, I don't think it had been told before. Including what happened in the mysterious foundation of Lightning Labs (how it started as a Poon-Dryja company and fast-forward some years and it's just Stark-Roasbeef) and why he stopped working on DLCs.

2026-04-18 04:32:21 CEST

- reply

Once you get the latest update to #pyramid you'll have access to many people's IPs once they connect to wss://spatia-arcana.com/ so you'll be able to publicly shame them into reading the breadcrumbs you left.
https://nostr.media/780927b2347bbf401605b8ba9a6e32fe8e6fa48b58273164c09ea01c1019decd.png

2026-04-18 00:14:43 CEST

- reply

I think it is fine for Zapstore to only have comments in its own relay, it's a choice clients and users can make.
But regardless of that to me the best possible UX would be to have a link on the Zapstore website with an nevent that automatically opens in my client so I can comment and interact from there.
Like what was achieved here, just with less hops. I don't mind the hops, they are cool too, I think everybody can do them, but we'll need a tool like nak but for phones.

2026-04-18 00:11:18 CEST

- reply

Honestly, what would be the great dream-like amazing UX for this in the legacy web platforms?
The Zapstore website would have a random "comment with Facebook" embedded. And in the comments no one would know who is the app author responding to comments from other randos because the identities would be totally isolated.

2026-04-18 00:08:20 CEST

- reply

As estatísticas na imagem são de um servidor mostrando quantas máquinas o estão atacando.

2026-04-18 00:03:16 CEST

Today I saw a comment from @npub1c3g…86r6 on https://zapstore.dev/apps/com.fiatjaf.topaz and I wanted to reply to it.
The Zapstore website wanted me to sign in with an extension to do that, but I only have a bunker, so thought I would open the comment on https://fevela.me and reply from there.
But the Zapstore website doesn't tell me the note id nor it gives me an nevent code, but it does gives me the author npub, so I tried to just visit that profile and wait for the note to be fetched, but I waited and it wasn't.
Turns out the note wasn't in any of the (many) relays of @npub1c3g…86r6, as the command
~> nak req -k 1111 -a c45041618951bb6012ac23f5cdf3d740465f2d640be841fd9bb1d0733370cd3c --outbox --since yesterday --outbox
didn't give me any results. So I guessed that it was only on wss://relay.zapstore.dev. So I ran this command:
~> nak req -k 1111 -a c45041618951bb6012ac23f5cdf3d740465f2d640be841fd9bb1d0733370cd3c --outbox --since yesterday relay.zapstore.dev | nak event --outbox
And the note was automatically published to a bunch of places:
publishing to nostr.hifish.org... failed: publish: context deadline exceeded
publishing to nostr.wine... success.
publishing to wot.nostr.net... success.
publishing to purplepag.es... failed: msg: blocked: kind 1111 is not allowed
publishing to inbox.relays.land... failed: msg: blocked: this event doesn't target any real users
publishing to 0xprivacy.nostr1.com... failed: msg: auth-required: you must auth
publishing to xmr.usenostr.org... failed: msg: blocked: you must pay admission fee. visit relay url on browser.
publishing to relay.nostr.wf... success.
publishing to relay.nostr.com.au... success.
publishing to auth.nostr1.com... failed: msg: auth-required: you must auth
publishing to jskitty.cat/nostr... success.
publishing to relay.0xchat.com... success.
publishing to premium.primal.net... success.
publishing to relay.primal.net... success.
publishing to relay.0xprivacy.online... failed: msg: auth-required: authenticate to publish events
publishing to pyramid.fiatjaf.com/inbox... success.
publishing to spatia-arcana.com/inbox... success.
publishing to lightning.red/inbox... success.
(Notice that it was also published to my inbox relays because it had a p-tag to me and nak detected it automatically.)
This is a success story. Now I can finally respond.

2026-04-17 22:05:18 CEST

- reply

I didn't see the zap, it's probably sent to the wrong relay, but anyway I'll give my honest feedback:
I appreciate the intention, but this looks too much like every other AI-generated website, paradoxically it's not weird enough to catch attention.
I feel like I'll read pages of text only to find out that the entire substance was already in the page title (not saying this is the case, but it is the case for many others with similar design).

2026-04-17 21:00:13 CEST

- reply

Pay me 100 satoshis if you want me to click on that.

2026-04-17 20:11:16 CEST

There will come the day in which people will have to pay others to look at their AI-generated websites with lots of gradients, many words but completely void of any useful content whatsoever.

2026-04-17 16:38:54 CEST

- reply

Very philosophical commentary.

2026-04-17 02:17:37 CEST

- reply

What are the issues of centralized image proxies?

2026-04-16 18:47:53 CEST

- reply

Good news, but what is this partner shenanigans? Isn't the thing open for all clients to connect directly?

2026-04-16 18:03:52 CEST

- reply

I don't have anything to do with that one.

2026-04-16 17:21:32 CEST

- reply

This can't be right, right?
https://nostr.media/c91781d9c0a989d6a8d5770ee84e500555cc627472ebd12fb806ac2d3fb9555c.png

2026-04-16 17:20:33 CEST

Is Nostr a DDoS machine?
https://nostr.media/c1ca71e8e7c9c277d210a93bd742c2d6d15400fc3b9deba9d43f5fc0ef6c330a.png

2026-04-16 13:25:21 CEST

- reply

I had a crash caused by a stupid bug.
(Please update to v1.2.5 if you're reading this and you've installed it v1.2.4 yesterday.)

2026-04-16 01:31:09 CEST

- reply

This would be good on a relay.

2026-04-15 22:01:10 CEST

- reply

We could also do that, but it doesn't have to be the only solution.
Two problems:
1. it is not incentive-compatible (why would I retweet a thing I wouldn't have retweeted in the first place just because the person is new? This will bloat my feed with an opinion that isn't even mine etc).
2. it doesn't work if you don't have anyone following you at all. Like Shakespeare, imagine if he is revived and starts writing new plays on Nostr? He is really Shakespeare, but he doesn't know anyone, all his friends are dead.

2026-04-15 18:47:10 CEST

- reply

Why? The livestreaming server is a bad idea?

2026-04-15 15:49:09 CEST

- reply

These link previews can be a hassle, but they are useful sometimes.
I used to think the best approach was something like Telegram and Discord do, which is to allow the sender to choose when to render them and when to not, but this is awful, because on Nostr it would be a coordination nightmare, and most people don't bother making this choice anyway.
Now I think the best solution is probably to have a default setting that doesn't render such links if they come in the middle of a sentence, only if they are on their own line (or perhaps if they are the last thing in a line too?), something like that. It would be a great improvement.

2026-04-15 15:45:18 CEST

I just learned that https://fevela.me/ has a nice setting that disables automatic link preview rendering in notes and make them show up on mouse over. It's the best of all worlds:
https://nostr.media/99db11c589f188d7902195885fd1524a442451bc9d36c6b4cd3a90f5f87d3902.png
https://nostr.media/662f6da381f8c0378f1fa39751fc9611c067d1143abf9b60d4a31b6e2af6d20f.png

2026-04-15 15:18:26 CEST

- reply

Some good ideas here.

2026-04-15 15:02:08 CEST

- reply

Everything is subjective, "high-signal" was the most generic type of curation I could think of that we could start with, like "has the person writing this put any thought in it or are they just regurgitating some discourse or meme they saw elsewhere?"
But of course if this is a good idea we should eventually have many of such relays for various types of appetites and interests.

2026-04-15 14:56:33 CEST

New #pyramid release with absolutely earth-shattering new features:
- ephemeral events don't get accepted from anyone by default anymore (you have to explicitly allow them and whitelist the kinds now) so your relay won't overheat from bitchat DDoS (plus other fixes that bring CPU usage lower)
- NIP-29 has per-group NIP-50-powered fulltext search now, with automatic language detection based on the first messages sent to the group
- built-in video livestreaming server compatible with OBS and zapstream/shosho/etc (and all the other clients that display such streams of course): https://nostr.media/699381409d903a306b1b563dc45902953e4e6dbbf3090d13b842272ad083421b.png
- a nicer way of defining the list of kinds you accept, by making it a list of deltas from the default kinds (instead of having to list everything by hand): https://nostr.media/609b2f06581b3fb5876768e44e67e2a46f8526d849635e26073a49e29f884380.png
- more stats added to the system view: https://nostr.media/35742c81e5a05731d501450a2498d18227f51fda830d46f30ce5073db4afbfc1.png
- online count on the landing page, highlighting who is online (for now this is based on public information only, i.e. only people who published events in the past 10 minutes, same as how Wisp does it): https://nostr.media/86010a7808f31587b33d3b9b56709bc0a50ed3582e6f05825f2c87b5d521d630.png
Available for download at https://github.com/fiatjaf/pyramid/releases (or do the easy cheap-VPS setup: https://github.com/fiatjaf/pyramid#easy-install). Please report bugs here in the comments or in our NIP-29 group.
#nevent1q…pm74

2026-04-15 14:32:36 CEST

- reply

It's exactly the opposite: if you hide the idea of relays you'll get more centralization.

2026-04-15 14:31:09 CEST

- reply

How many of all Substack "content creators" earn a living? You're talking as if anyone could just go there and write something and they would get paid.
In fact even if you are the new Shakespeare you could still go on Substack and write amazing things and didn't get a dime for them.
Substack probably doesn't do any curation, it's just a place where people can charge their existing audience (that they got through whatever other means including sheer luck, years of thankless unpaid work and being friends with the right people), so Substack is orthogonal to what I'm talking about.

2026-04-15 14:15:51 CEST

- reply

Well, no one would be asking, it would be an optional thing for people that consciously wanted to get some reach for their content that they thought was worth reading. I imagine most people wouldn't want this. @npub1r0r…q9ac
Currently if the new Dostoevsky shows up on Nostr tomorrow he could be writing the best stuff in the world but no one will see him.

2026-04-15 14:08:37 CEST

- reply

You don't need NIPs for this, it's all bespoke on the relay side, it just has to expose the standard REQ interface.

2026-04-15 11:58:30 CEST

What if we had a relay where new people could manually submit content to and pay a "curation fee", then some smart humans would pocket the fee and manually vet each submission and only allow in those that were deemed high-signal?
Would you browse that relay in order to discover new high-signal content and new people to follow?
Would you put it in your default relay feeds list or somewhere like that? @npub1syj…f6wl @npub1utx…50e8 @npub1gcx…nj5z @npub1n0s…lahe @npub1yzv…rf8q
Please let me know if you have a better idea.
#nevent1q…cdje

2026-04-15 11:41:19 CEST

I got my first feature implemented: https://github.com/CodyTseng/jumble-ouro/issues/10
#nevent1q…nhwr

2026-04-15 02:32:51 CEST

- reply

You're not even a person, you're a brand or something.

2026-04-15 02:30:21 CEST

How is Nostr today? Did we get any new users? The last to join I think was @npub1dyx…2yuy two months ago.

2026-04-13 02:38:12 CEST

- reply

It makes all the difference in the world, this is just based on your IP address and the VPN changes your IP address.
Maybe 192 is some special case when we can't find your IP or because you used IPv6? I don't remember what my code does, it's from 6 months ago.

2026-04-13 02:36:40 CEST

- reply

I'm feeling like those people who almost win the lottery by getting a number that is close to the actual result.

2026-04-12 21:12:30 CEST

#nevent1q…al4l
Please go there and send a message! We need more people, #nevent1q…3qp7

2026-04-12 15:17:46 CEST

Just clarifying: you don't have to just look at your number, you also have to write things and communicate with your fellow IP subnettians.
#nevent1q…0fst

2026-04-12 15:06:48 CEST

- reply

It means you can talk to @npub1ts0…zwcx and @npub1zpd…f30h, what a joy. No one else got any matches.
It also means means that your IP address is something like 192.xxx.xxx.xxx.

2026-04-12 13:42:28 CEST

This is a huge attack on your privacy, beware.
#nevent1q…6jtp
Probably run by the Mossad.

2026-04-12 13:40:18 CEST

- reply

What client is that? You need a client capable of browsing relays.

2026-04-12 13:34:34 CEST

- reply

Why adoption on the user side will never happen? Is that valid for Bitcoin too or just Rootstock?
Would be nice if at least 1% of all the effort put on creating tons of Bitcoin wallets was dedicated to making one good Rootstock wallet.
But I hear that the Rootstock people are sitting on huge piles of money from their launch and they spend it poorly. It's easy to shit on other people's decisions, but why aren't they funding you to work on that?

2026-04-12 13:31:46 CEST

- reply

I agree completely.

2026-04-12 13:26:11 CEST

- reply

Hey, we got at least one match! You can talk to @npub1ts0…zwcx. What a huge success.

2026-04-12 13:15:30 CEST

Go on wss://subnet.relays.land/.
What number do you get? Mine is 177.

2026-04-11 13:11:28 CEST

- reply

There is a Fraidycat fork with Nostr support.
And the developer said he was going to integrate Nostr in the main Fraidycat. Maybe he did already? Probably not.

2026-04-11 13:09:45 CEST

- reply

I agree.
I'm curious why you became such a Rootstock enthusiast recently, but yes, it's crazy that people aren't using it.
To be fair I tried to use it a couple of times in the past and I struggled a lot with the tooling, the wallets, everything was confusing.
Also I couldn't figure out how to deploy and use a contract myself, but I didn't put too much effort on that part.

2026-04-11 04:32:18 CEST

Seeing how people add all sorts of URLs to their Damus relay lists I wonder if the best Nostr app UX isn't just a single big list of stuff.
Do you want to write to a relay? Add it to your list.
You want to read from a relay? Add it to your list.
Do you want to browse a niche relay every now and them? Add it to your list.
Want to upload stuff to a Blossom server? Add it to your list.
Wanna bookmark a note? Add it to your list.
Wanna join a NIP-29 group? Add it to your list.
You're interested a hashtag? Add it to your list.
Follow someone? Add to your list.
Do you want to run custom spell or scroll? Add it to your list.
Then the app understands everything you want from that and displays all the UI views you need.

2026-04-10 22:53:37 CEST

https://fevela.me/ now has per-relay reply and reaction fetching:
https://nostr.media/6dd2bde06fa400551e24e146158eb1e42fb601cdd6a8d6fc183fa35658533762.png
Can you think of a concrete use case for this that doesn't involve Marlon Brando?

2026-04-09 17:15:16 CEST

I like that these guys are holding a sign that says "this is not AT". A clear message that they have evaluated the Bluesky protocol and decided, correctly, that Nostr is the real deal.
#nevent1q…ut0x

2026-04-09 17:09:26 CEST

You can also try this scroll right now by going here: https://grimoire.rocks/run?cmd=open%20nevent1qqsvh4se5xykhlyeda2qljxe7jeyyyc4gvvml5xeek5sf7hfujdrnuqhpvnt0
#nevent1q…8654

2026-04-09 04:24:09 CEST

Thank you for coming to my stream:
https://nostr.media/01796cf98a410acccd74422d793c56a2d68013702df7192a3d384056b7a49061.png

2026-04-09 03:27:05 CEST

This should have been obvious, but occurred to me yesterday that a coalition of miners would never be able to steal from a Drivechain because they would have to agree on the percents beforehand, but they don't know who is going to contribute with how much hashpower during the following months, so there is every incentive for the attack to stop midway.
Add this to the big list of reasons why Drivechain is a safe and good idea.

2026-04-07 02:18:18 CEST

- reply

If you login with passkey does it save your nsec to the cloud? If yes, what cloud?

2026-04-06 23:40:44 CEST

Has every client stopped offering an option to use imgproxy for autoresizing images?
I remember users could configure their own imgproxy on Snort, Iris and Coracle. Was that a bad idea because no one was using the option and if anyone used they would have a sitting duck imgproxy that anyone else could abuse?
#nevent1q…m0tz
We could think of some solutions for community-hosted imgproxy servers that can be secure by having the client compute the required HMACs locally, or is this too ambitious?
@npub1jlr…ynqn @npub1utx…50e8 @npub1v0l…qj49 @npub1gcx…nj5z @npub1g53…drvk @npub1syj…f6wl

2026-04-05 15:11:10 CEST

@npub1l3c…6vs2 can you explain how the Bananânia Relay Deluxe algorithm works?

2026-04-04 17:32:17 CEST

Every part of Nostr that relies on hardcoded "big relays" is a bug and a gate to spamland waiting to be used.
Spam gets to everything, whether it's malicious, automated spam or just someone handwriting something in the wrong place because they were confused.
Even the relay reviews section isn't exempt:
https://nostr.media/1fbe66839bef3568e853c6c36825a6084e5a778b278a992e90c65e4d6e4288f5.png

2026-04-01 23:13:57 CEST

- reply

I figured out how to run Go on Android, that was much easier than figuring out how to import a package in Kotlin. Just let me.

2026-04-01 23:08:15 CEST

- reply

I don't have any use cases for a local relay, but if anyone has any (besides backing up your own notes) please let me know.
Eventually I think I will try to integrate the https://github.com/KoalaSat/samiz BLE protocol directly in Topaz, but use a separate sub-relay for that. Would be cool and sometimes even useful, who knows.

2026-04-01 21:22:59 CEST

I did an Android local relay app, it is called Topaz and you can download it here: https://github.com/fiatjaf/topaz/releases/tag/v0.0.1
https://nostr.media/95a0571dc42e5aaf4c55213d698169f14ce74c3cc3992d12b32652e4d56218e5.png
Citrine is great, but we needed at least one other implementation, and Topaz is running Khatru underneath, which is cool.

2026-04-01 01:22:23 CEST

- reply

Yes, thanks, I'll do that.

2026-03-30 20:50:18 CEST

The NIP-29 groups ecosystem is getting pretty good.
#nevent1q…rhe9

2026-03-30 20:35:21 CEST

Someone should probably offer domain name reselling and a website setup service using this scheme. Much better than trying to sell advanced Nostr tools for the current pool of 34 Nostr users.
Could be expanded to something like https://www.tube.sh/ too. Once someone is looking for a website and you tell them there is also livestreaming, paywalled content and closed chat/forum groups, all within a network that already exists with tons of clients they'll have to be impressed, right?
#nevent1q…0eyz

2026-03-30 19:11:57 CEST

- reply

I'll join the group and let you know in there once I find anything.

2026-03-30 19:08:32 CEST

- reply

Looking very very good.
I've found no bugs so far.

2026-03-27 14:24:44 CET

- reply

This is what the entire "Clawstr" project should have been.

2026-03-27 01:36:09 CET

@npub1zfs…w445 what is this? "No room for message"?
https://nostr.media/c2423e9f509ada1992ccb3de5e66ecef86063f394fcea6223272b51b57db18bd.png
They keep showing up, I don't understand. I have 10 of these in the screen, one vanishes, a new one appears.
They were there yesterday too when I tried, but I was running out of patience so I didn't tag you.

2026-03-26 22:16:53 CET

- reply

I liked the other motto: "with a chance of working".
I'm sad that didn't catch on.
I still think Nostr has a chance of working.

2026-03-26 22:07:37 CET

#nak v0.19.3 has a `nak git download` command for downloading individual files from NIP-34/Grasp repositories. It may be useful sometimes.
It tries all URLs until one works, it finds tags and branches or direct commits, all without having to clone the full repository. As a bonus it even works with non-Nostr repository URLs like GitHub:
https://nostr.media/2673338f21af99fdb5efa442f982d73a478bae6ea32db0a61f24df716e7032d6.png

2026-03-25 18:50:18 CET

- reply

I don't know if you're trolling or if this is the worst explanation ever attempted.

2026-03-24 22:14:07 CET

https://nostr.media/6da4ba9c1464bcd1c2c8eb21ae4d1d4ef591cb1f2dfede052bfc7acc13a9f274.png

2026-03-24 15:21:42 CET

- reply

How do we create archives? Can someone vibe a better UX for the archiver extension?

2026-03-24 11:50:23 CET

- reply

I can add this to #pyramid right now. Anything else you might need?
Oh, wait, that won't work, you need to accept events from anyone, right? No moderation or anything?

2026-03-24 11:19:57 CET

"This" now available in https://fevela.me
#nevent1q…3qh2

2026-03-24 01:58:12 CET

- reply

So you're building Grokipedia?
At least it looks much nicer.
https://nostr.media/59f930602aa6982ca8c27092e9d67055b8953614c3a5c0a6335b3f72ef7e4040.png

2026-03-23 17:27:55 CET

If we had infrastructure for curating entries, allowing groups to vote on proposed additions and deletions and simple UIs for viewing the list of all items in a list then it would be easy to get rid of the NIPs repository.
It's sad that after so many years all we have are "feed" views. And GitHub continues to be a better platform for browsing and updating text lists of things. Notice that I'm not asking for much.
We would also have to get rid of the NIP numbers, but we could just say "the longform NIP", "the badges NIP" etc and it wouldn't be hard to know what were people talking about.
But if you're reading this and thinking about a complicated system with events being published with votes, proposals, lists of replaceable events with other lists inside or whatever absurdity, please stop. Just use a relay and normal events inside, add and delete. Custom write policies, standard Nostr read API.
#pyramid has a moderated subrelay that is probably 25% there already.
If you disagree please let me know.
#nevent1q…8z8j

2026-03-23 17:18:19 CET

- reply

No, it isn't published until after the timer expires.

2026-03-23 15:18:52 CET

- reply

Oops, I didn't realize I was talking to an LLM. Shame on me.
But my answer was more addressed to @npub1zl3…jajh and other concerned people, so I think it's valuable still.

2026-03-23 15:05:41 CET

"undo" button now available on https://fevela.me/.
https://nostr.media/cfaf588f372e88c8504b5175b7dd9560deb774c318bdb93a0b53080a23a41ec6.png

2026-03-23 14:38:13 CET

"Quiet reply" now available on https://fevela.me/.
https://nostr.media/b849d9f363c6033e9aa5530f013b8f325d01eaada983a094515f21480d2fce57.png

2026-03-23 14:21:06 CET

- reply

The same WASM can run with different parameters regardless of where it is hosted.
But whether to put it in the event body or on blossom I don't know what is best.
I think having it on the note is good because it acts as a natural size limiter and is slightly simpler to implement, reduces errors, makes it easier to reason about, reduces the number of errors and moving pieces and dependencies.
But I can also see the other side of the argument. It's a fine line to thread. For example: why wouldn't this note's content be put in a blossom server and the event be just a hash to it?

2026-03-23 14:15:50 CET

- reply

I've found a note from beginning of 2024 in which I was trying to come up with ideas for Nostr mini apps that would be written in WASM and shared as events. The idea at the time was to have something that fetched events and rendered tables with clickable buttons.
These were the examples I listed at the time:
- recover old contacts deleted by mistake
- cleanup inactive follows
- suggested people (based on lists of people you follow)
- event deleter
Turns out that, thinking about it now, the single "display()" function is pretty reasonable. All these functionalities can be done by just fetching the correct events (kind:0s for displaying profiles, I guess), then expecting the client to have its own delete button, follow button, unfollow button, that's it.

2026-03-23 14:07:22 CET

- reply

Vote fiatjef, let's make @npub1v0l…qj49 eat dirt!
(I still have no idea of what is going on here or where are the votes happening.)

2026-03-23 14:04:10 CET

- reply

If you can break out of a WASM VM that will be because of some nasty buffer overflow bug or similar bug and you have the same chances of finding that kind of stuff in any HTML renderer, JPEG renderer, audio codec, iframe, script loader, I don't know, any aspect of a browser or other non-browser libraries. There are hundreds of possibilities.
Much easier than that is getting your malicious code in some npm module and injects itself in other people's softwares and builds; or getting an LLM prompt-injected to emit instructions with your bug in them; or something like that.
We're already living in a sea of possible attack avenues, WASM isn't necessarily worse just because it can run virtual instructions. Also these scrolls are supposed to be very small and simple, and WASM code can be read, so an evil attack can be spotted relatively easily.
Finally, it's not like you're executing automatically anything that comes through your client (like npm does, for example), you still have to check where it came from and click. In any case, either the code comes from someone you know or with a reputation or if it's a viral thing from an unknown person at least it will have been inspected by someone else, or you can ask an LLM to inspect it for you.

2026-03-23 04:41:55 CET

- reply

I kinda wanted to have more weirder render methods, or perhaps more interactivity, but I can't figure out what or why. Maybe we can add more later.

2026-03-23 04:36:33 CET

- reply

What is nostrscript? Isn't this nostrscript?
So you were thinking about something like this? How was the idea in your mind? What do you think it's missing in my proposal?

2026-03-23 04:34:58 CET

- reply

Thank you for finding this. Should be fixed now.

2026-03-23 00:51:26 CET

If you are a bored ex-programmer in this sunday evening here's something for you to look at: https://github.com/nostr-protocol/nips/pull/2281
https://nostr.media/50da90a24726067baaa3e1285b0b8e1a098114f08d2ba859271dc3bafd6aba94.mp4
Please send feedback and suggestions if you have any.

2026-03-21 23:02:08 CET

- reply

Very true.

2026-03-21 23:01:08 CET

- reply

Good point.

2026-03-21 17:07:52 CET

- reply

But that isn't a valid example because this is only done by highly computerly technical people.

2026-03-21 17:07:10 CET

- reply

Well, sure, but the stock ROM can still run Android apps. And non-stock ROMs can still be infected afterwards. I like to keep my Motorola virus healthy so it can fight the Mossad virus when that comes.
Anyway, the entire thing is a scam, the example is just for showing that people can understand these subtle technicalities, so they can also understand Nostr.

2026-03-21 17:03:41 CET

- reply

It took me a long time to realize that if you're not running your stuff in a distributed computing environment with multiple machines it makes no sense to use Redis (and maybe not even Postgres -- although I don't recommend using SQLite for anything).

2026-03-21 17:00:58 CET

I just realized people talk about "Android".
They know that many different phones and even other types of devices all speak this same "protocol" called "Android". They know that there are many different apps that can be used in Android but not on iPhones. They know that there are many flavors of Android, but that there is something that is the same underlying all of them.
It's not a perfect analogy with Nostr, but regardless of that UX specialists would have led us to believe that no one would be able to understand or care about such technical details, and that these technical details should be hidden at all costs, but they're proven wrong again.
Are there other examples of this phenomenon? I guess there are also email, podcasts, SMS messages, web browsers and HTML (although this is a bad example it's still valid).