dtonon
daniele

Working on https://fevela.me, https://nstart.me, https://njump.me, https://oracolo.me and other inspiring nostr projects. I love to build helpful things that people are pleased to use, mixing tech, design, usability and accessibility.

Public Key

npub10000003zmk89narqpczy4ff6rnuht2wu05na7kpnh3mak7z2tqzsv8vwqk

NIP-05 Address

dtonon.com

Profile Code

nprofile1qqs8hhhhhc3dmrje73squpz255ape7t448w86f7ltqemca7m0p99spgpqqq35amnwvaz7tmrdpex7mnfvdkx2tnyw3hkummw9e3k7mgml2m8w

Publishing to

Author Public Key

npub10000003zmk89narqpczy4ff6rnuht2wu05na7kpnh3mak7z2tqzsv8vwqk

Show more details

Last Notes

2026-09-02 14:16:11 CEST

- reply

This is a slippery slope.

2026-08-31 18:38:44 CEST

Listening to Kudsi Erguner.
Beautiful.

2026-08-31 15:25:14 CEST

https://chronicle.dtonon.com/32732d4338a676d1526a5a0d82535c29ad11ea927ac155d57979923f63848a1e.jpg

2026-08-25 14:30:57 CEST

Not bad:
#nevent1q…whrh

2026-08-22 11:23:35 CEST

- reply

I can relate, I feel extremely tired and fogged when I have to read long documents written by LLMs. I find myself jumping around the document searching for "anchors" from which I can build some sense.
I noticed that this behavior is stronger on my native language.

2026-08-22 10:32:38 CEST

- reply

Facebook already shipped its MCP time sgo.
I hope agents will definitely kill the ads model.

2026-08-22 10:26:09 CEST

- reply

Beautiful, and the small format is intriguing.

2026-08-20 11:17:44 CEST

- reply

I was expecting at least a gif

2026-08-19 19:46:14 CEST

GPG's UX is a total mess, unfortunately.
I'm not surprised that password protected zip files won.
(I know, unfair comparison)

2026-08-19 17:13:04 CEST

This is what blocks me from publishing #Manent for iOS to the App Store.
I hate these walled gardens that decide how users should "safely" use their devices.
#nevent1q…p95j

2026-08-18 15:13:14 CEST

- reply

I cancelled my subscription a couple of years ago, the apps have good features, but the whole ecosystem you are forced to install is basically a malware that phone home perpetually. And yes, Adobe is shit.
Now I use the Affinity suite, but now it also was bought by Canva, and I fear it will degrade faster.

2026-08-18 10:38:15 CEST

Ask HN: Alternatives to GitHub
https://news.ycombinator.com/item?id=49331033
@nprofile…psy5, always on the front lines, has already pointed out Nostr and gitworksop.dev

2026-08-17 17:31:24 CEST

https://declaude.org/watermarking/

2026-08-14 16:03:07 CEST

- reply

Maybe https://github.com/fiatjaf/nocomment by @npub180c…h6w6 is what you are asking for? Or https://github.com/carlitoplatanito/disgus
It could maybe be achieved with Squalk too, but you should open a discussion for every page you post on your website, it's not exactly the best user experience ever.
Let me know if you have any thought about that, I'm interested to expand Squalk.

2026-08-13 20:35:42 CEST

I just discovered that https://forum.basspistol.org by @nprofile…60sr uses #Squalk, love it

2026-08-13 20:20:54 CEST

- reply

It uses NIP-29, so it's a single relay based forum.

2026-08-13 20:07:17 CEST

#Squalk now supports NIP-50 search:
https://chronicle.dtonon.com/f5804695734e2689e4405f471edcf6cacaff7b8bf3394a97561dc9407bdf6cd3.jpg
Test it at https://squalk-test.dtonon.com
To grab the code and contribute: https://github.com/dtonon/squalk

2026-08-13 20:05:42 CEST

- reply

Yes, it's disturbing.

2026-08-13 09:47:39 CEST

- reply

N name space is narrowing quickly!
https://github.com/dtonon/npanel

2026-08-12 10:00:37 CEST

Mind the void.
https://chronicle.dtonon.com/81f9d398a6d8a33d2194d2d60e6789e449b3a6943be2a4a24ddd2ec771bd94e4.jpg

2026-08-10 17:05:42 CEST

- reply

In what unit of measurement? The time taken?
(just kidding)

2026-08-10 15:30:06 CEST

- reply

PS: Still unreleased, hopefully next days, after ironing some ugly code.

2026-08-10 15:03:31 CEST

- reply

Cryptography is interesting because it's often counterintuitive. I'll try to explore this further.
In the meantime, we've opened up a new rabbit hole: dice :)

2026-08-10 14:41:49 CEST

nostr-ruby meets #Manent
Manage your private notes programmatically.
Maybe a CLI? We'll see.
https://chronicle.dtonon.com/e05a5ece2256432760eb9e33adc2630110a3097f89a1003f970e77bcbcdbdbb5.jpg

2026-08-07 16:34:52 CEST

- reply

Fair, you gated "not extreme" and I argued against an extreme die anyway. I was going off a similar discussion I read a long time ago, which is where the extreme framing came from, not from what you actually wrote.
Still, I don't think "nobody knows the bias" is the part keeping you safe. "Not extreme" is. Obscurity buys less than it looks like, and the search isn't targeted at you personally, it runs against every funded address at once.
Which leaves only: how extreme is it? That's my actual objection to handmade dice. Not that they're definitely bad, but that you have no way to check before the key exists.
I don't want to state numbers I can't derive myself, so, AI says:
"Not knowing the bias isn't a barrier, it's a cost. An attacker searches over the space of plausible d6 distributions rather than guessing one, and the penalty for that is roughly (k-1)/2 * log2(n) bits, about 16 at 100 rolls, plus a handful for unknown roll count and mapping. Call it 30 bits of obscurity. Each candidate is one pubkey derivation checked against a filter of funded addresses, so no dictionary or dedicated tool is needed and the work amortizes across everyone who used the same method."

2026-08-07 15:06:26 CEST

- reply

The fact that nobody knows the bias doesn't help in any way.
Think about an extreme situation: a die that lands on the same side 80% of the time because that side has specific dimensions or weight. You're killing the entropy, of course, and the derived key is weak against bruteforcing.
The dice in the photo could easily have a similar important bias that impact the entropy, and that bias is certainly more compared to a casual, not intentionally altered, dice that you can bought around.

2026-08-07 08:35:09 CEST

- reply

It's really not a good idea! Probably they produce lower entropy than random toy dice.

2026-08-06 15:30:01 CEST

- reply

Ci mancherà un sacco, avrei voluto vederlo molte più volte live, mannaggia!

2026-08-06 14:59:22 CEST

RIP Immenso Guccini.
https://chronicle.dtonon.com/c57790330cce222b1004951ad1fe6fd4ce40a01fdad3fe8263b86ee6d0f6dc2e.jpg

2026-08-05 17:59:49 CEST

- reply

Cool.
If you will add a relay to the deploy, ping me.
I'm going to borrow the approach for Squalk.

2026-08-05 17:37:37 CEST

That's really cool!
Long live the small communities on Nostr.
#nevent1q…cjq6

2026-08-05 10:54:51 CEST

- reply

> The repo also lists NIP-33, so it might be compatible after all.
My fault, I reused the number of a discontinued NIP replaceable events:
https://github.com/nostr-protocol/nips/blob/master/33.md
I will eventually rename it.
Ask noornote's author what NIP is using, and propose to follow Manent's one ;)

2026-08-04 09:12:07 CEST

- reply

I don't see in NoorNote any private notes, can you elaborate?
Anyway, Manent uses this NIP: https://github.com/nostr-protocol/nips/pull/2271

2026-08-03 16:16:27 CEST

#Manent for Windows is out!
The notes stay private. Whatever Recall screenshotted while you typed them is between you and Redmond.
Grab it from https://github.com/dtonon/manent/releases/tag/v2.0.0
https://chronicle.dtonon.com/60d8c5d142eb5faea26274ebb6d543379c7b524af089e73ced3c6fa4292b6904.jpg
Building it was fine. Testing it on Windows is why I'm taking the rest of the week off.
#nevent1q…xyyy

2026-08-03 15:24:30 CEST

- reply

Any source?
SS takes 50 preview frames AND the final pic, it is a lot of entropy.
Also in "full" blackness the sensor registers very different levels, you cannot have two similar entropy patterns.

2026-08-03 12:33:01 CEST

- reply

Yes, encryption is often counterintuitive and is subject to various misconceptions.
Probably the first goal of a good onboarding should be to achieve absolute security, then instill good habits by providing a progressive learning path.

2026-08-03 12:21:11 CEST

- reply

Examples of "obvious and easy"?

2026-08-03 12:20:31 CEST

I've been thinking about reviewing the onboarding process of CC and similar devices, to see how seed generation is handled.
My suspicion is that developers, being hardcore tech people, take dice as the obvious solution, so 1) they don't guard the workflow enough, and 2) they pay little attention to the alternative paths (and their code) that use automatic generation. The whole thing may come down to a bias/UX issue.
Anyway: putting a few dice in the box, presenting a nice UI, telling a story about PoW, and asking users to take a real, physical action to secure their wallet doesn't seem too hard to pull off, and it could be quite effective. An advanced feature reframed as a cool setup ritual.
For hot wallets, a similar gamification could be achieved using the camera to generate entropy, @npub17ty…3mgl style.
#nevent1q…er59

2026-08-02 10:53:42 CEST

- reply

No, sensors always register differently even in blackness. And anyway SS entropy calculation also takes in consideration 50 live preview frames.

2026-08-02 09:53:29 CEST

I needed a moment of relief.
The fevela.me filter was helpful.
https://chronicle.dtonon.com/c3d3986c2ebea17eb9fdf480fc5533cbbe7ca1ae79995bcbf5c8369f6f142f96.png

2026-08-02 01:46:11 CEST

- reply

Why deprecated?

2026-08-02 01:42:49 CEST

- reply

No yet, I'm evaluating how to improve distribution.

2026-08-01 17:40:17 CEST

- reply

Great! :)

2026-08-01 15:43:33 CEST

- reply

I see you are on 1.5.0, probably it's the certificate issue. It's expected, from v1.6.0 I had to change the certificate, so you need to uninstall and reinstall.
Do a logout first, so you are sure everything is in sync (you would receive an alert otherwise).

2026-07-31 23:30:26 CEST

- reply

Found it. It's weird that they don't add the option on the main product page, above the buy button, like for the two previous models.

2026-07-31 23:20:10 CEST

- reply

Oh, thanks. Where this page is linked from?

2026-07-31 23:18:51 CEST

- reply

Sorry for your loss, Gigi.
Life is still largely a mystery, we need to learn to appreciate it more.

2026-07-31 23:15:03 CEST

- reply

I find it out: Safe 3 and Safe 5 have the Bitcoin only edition, Safe 7 don't. Not a wonderful news for their flagship product.
I'm not questioning their technical expertise, although I don't think it's directly related to the fact that they invented hardware wallets.

2026-07-31 17:33:03 CEST

- reply

> Get a Trezor Safe 7. It's a Bitcoin only version from the company that literally invented hardware wallets
I don't mean to complicate an already difficult situation by questioning your generally helpful advice, but a few hours ago I went to check out their website specifically to verify this.
On https://trezor.io/trezor-safe-7 "bitcoin" is mentioned only one time, near "Ethereum and Solana". "Crypto" instead is mentioned 18 times.
Maybe they also ship a Bitcoin version, like other hw brands, but we can safely says that Trezor is _not_ a "Bitcoin only" company, they happily take advantage of the crypto/shitcoin market. Aside from the ethical aspect, their technology stack is certainly more complex, with all the associated consequences in terms of attack surface.
Anyway, their devices are sexy af.

2026-07-31 14:34:52 CEST

- reply

When quoting a note on Nostr use nostr:nevent1xxxxx, please.
Links to specific clients should be discouraged.

2026-07-31 12:49:35 CEST

Just added linux appimage to the release:
https://github.com/dtonon/manent/releases/tag/v2.0.0
#nevent1q…xyyy

2026-07-30 20:52:58 CEST

- reply

Great.
Can you evaluate to add https://github.com/dtonon/chronicle ?

2026-07-30 20:51:02 CEST

Absolutely cool and needed:
#nevent1q…cxtc

2026-07-30 20:48:42 CEST

#Manent 2.0 is here!
After using Manent heavily for a few months and piling up a lot of notes, the next step made itself obvious: tag and search!
https://chronicle.dtonon.com/5aa37e4cc015a557c184314aa882608df35aabe876f970b1918bbe0e62b7141f.jpg
The search and tagging features gave me a bit of a hard time, it wasn't easy to find a good interface, tailored to both mobile and desktop, for exposing them while keeping the user experience simple and intuitive... I hope I pulled it off.
Have fun, feedback is appreciated!
Install Manent from @npub10r8…t2p8 or download it from https://github.com/dtonon/manent/releases/tag/v2.0.0

2026-07-29 19:07:19 CEST

Today I discovered that many public blossom servers filter uploads guessing the mine type from the magic bytes. So they're not very #Manent friendly, since it produces encrypted blobs with random headers.
One more reason to have a personal relay+blossom server.
Shameless suggestion, try:
https://github.com/dtonon/chronicle

2026-07-29 13:30:56 CEST

- reply

I bet it's impossible in iOS.

2026-07-28 19:14:31 CEST

Take note: guanciale, not ham or speck. And no cream, for heaven's sake!
#nevent1q…qah0

2026-07-28 19:09:02 CEST

- reply

This is super cool!
It's a really fast and useful way to onboard people, and could be applied to a lot of apps.

2026-07-28 18:33:58 CEST

I just fixed a certificate related issue in #Manent that was preventing the update via @npub10r8…t2p8 (it was not their fault!), so a new v1.6.0 release has been shipped only for Android.
Warning: ⚠ Reinstall required
No new features or fixes in this release, it only changes the signing certificate. Android can't update over your current install when the certificate changes, so you have to uninstall Manent first, then install this version. Future updates will work normally.
Before uninstalling, try to Log out: it warns you if any notes haven't synced yet. If it does, cancel, wait for the sync, and check again. Make sure you can log back in too (nsec, bunker, or Amber).
The "Certificate mismatch" message you find on Zapstore is normal, just Uninstall and reinstall.
Sorry for the mess! :)
https://chronicle.dtonon.com/7cf064ec4bebb8957ee4c33040e8435f0c2e4970076c8ce1fa2bba588058a23d.jpg
https://chronicle.dtonon.com/5e2f8681fcc86980d47283e2c75a0e9a4455b4988b815299403d711289dba70f.jpg
FYI @npub1der…xzpc @npub17lm…c60g @npub1nck…g73k

2026-07-28 16:34:46 CEST

- reply

@npub10r8…t2p8 I updated zsp and not it shows an error related to the identity verification:
----
⚠ Existing identity proof does not verify against the APK certificate — re-linking is required
Link your APK signing certificate to your Nostr identity to prove ownership.
To skip: use --skip-certificate-linking or run later with: zsp identity --link-key <key>
Path to your keystore (.jks / .keystore): /xxxxxxxx...xxxx/keystore
Key alias (leave blank to use first alias):
Keystore password:
Error: failed to load keystore: load JKS keystore: load JKS: got invalid magic
----
Should I reset the config and start over?

2026-07-28 11:31:11 CEST

- reply

@npub10r8…t2p8 I doubled check the hashes and they match. I forced a new publish but the problem is the same, I also get the error.
Can you verify what's the problem, please?

2026-07-28 10:20:56 CEST

- reply

Ooffff let me check, probably some oddity with the build.

2026-07-28 09:28:35 CEST

Android #Manent users, you can finally update smoothly from @nprofile…gsu4, have fun!
#nevent1q…8vfk

2026-07-28 09:27:26 CEST

- reply

It works!
https://chronicle.dtonon.com/cb136d70a5e6751e81c41aee9b43d2eb1bf33251632c0a5be7bcdb4597cf0061.jpg

2026-07-28 08:22:58 CEST

- reply

Found it! Actually the versionCode part was missing in the version string. With no +, Flutter sets FLUTTER_BUILD_NUMBER to the whole version string, and Android falls back to "1".
I will release a fix, thank you for pointing me on the right direction!

2026-07-28 08:16:11 CEST

- reply

I update the version in pubspec and flutter should pick it correctly. In fact Obtainium offers the upgrade. I will check

2026-07-27 13:48:36 CEST

Remember:
> If you want privacy, use a relay you trust for some reason, which is probably the least of your worries anyway because you also need to trust every participant not to leak stuff.
#nevent1q…ess2

2026-07-26 13:00:46 CEST

- reply

> Any ideas for the folding pattern?
Aak to people from #japan, they are pro.

2026-07-25 08:35:53 CEST

- reply

@nprofile…gsu4 the app is also present in the "last releases" in the home view, but with v1.4.1
Weird.

2026-07-24 19:07:00 CEST

I've been told some users won't even consider an app if it doesn't have dark mode. Well, here you go: #Manent v1.5.0 is out with dark mode support (+ minor fixes).
So now you're a new Manent fan?
https://chronicle.dtonon.com/994e7a75090087469525c00d38cf5b08d72304f3bbdcdb65b29e66d54ca28721.jpg
Install it via @npub10r8…t2p8 or download from https://github.com/dtonon/manent/releases/tag/v1.5.0
PS: You don't know what Manet is? A private, encrypted space for your notes and files, built on Nostr.

2026-07-22 21:33:47 CEST

- reply

Evil is able to be fucking creative, damn.

2026-07-19 17:04:16 CEST

- reply

From the graphics I doubt it's a Kodak product. Are they (ab)using the brand?

2026-07-19 17:01:18 CEST

- reply

What NIP are you following for private notes? Phrase check https://github.com/dtonon/manent

2026-07-18 17:07:37 CEST

Do you want to help Nostr grow?
Be creative (and just a little evil):
https://chronicle.dtonon.com/ebdd537eab14e78e38269922258a9189518921ccaa0f5b161aa9a5a521f18503.png
#grownostr

2026-07-18 15:53:17 CEST

- reply

End the war.

2026-07-17 10:19:36 CEST

- reply

Where this point about Europeans' smartness come from?
Same question about Europe's shithole.

2026-07-15 17:10:34 CEST

More cool stuff to try and have fun with.
#nevent1q…vj3x

2026-07-15 14:05:14 CEST

- reply

Esatto, quod erat demonstrandum (ciò che si doveva dimostrare).

2026-07-15 14:04:19 CEST

- reply

Damn, I forgot to collect the data, I will do it today

2026-07-15 14:01:52 CEST

- reply

@nprofile…nj27 QED hahahaha

2026-07-14 14:37:12 CEST

https://chronicle.dtonon.com/6469539884021a207fd59ebb44cbe7699f0bb17c12071aa25c2b75a2c5ff0818.jpg
Today I learned about Yobitsugi. It is the counterpart to the more famous Kintsugi technique, in which cracks are filled with gold. But in Kintsugi, the pieces are all from the same bowl: they are put back together, and the gold marks the lines of the break. Yobitsugi begins where Kintsugi ends: when a fragment has been lost. It’s gone, and it won’t return.
So the potter doesn’t make a fake replacement: he looks for a shard from another piece of pottery, a color that doesn’t quite match, a pattern that clashes, and grafts it right in, leaving it visible.
The result is bowls made up of two stories.

2026-07-14 11:58:56 CEST

- reply

You're making life pretty difficult for thread clients.

2026-07-13 18:45:54 CEST

- reply

Yes, it's an app. Cool website!

2026-07-13 18:22:25 CEST

- reply

I agree.

2026-07-13 18:20:43 CEST

- reply

Love the... vibe :)
Is there a demo, that doesn't require logging in?

2026-07-13 18:17:29 CEST

- reply

Thanks!

2026-07-13 18:06:24 CEST

- reply

I don't need it right now, I'm studying how relay SaaS service are evolving.

2026-07-13 18:05:35 CEST

- reply

Different solutions for different people :)

2026-07-13 18:03:42 CEST

- reply

Oh, that's cool.
Does it use zooid?

2026-07-13 18:01:43 CEST

- reply

Thanks, but it's not what I asked, I know how to run a relay.
I'm interested in learning more about the SaaS ecosystem.

2026-07-13 17:59:49 CEST

- reply

Thanks, but it's not what I asked.
I'm interested in SaaS services.

2026-07-13 17:53:10 CEST

Which services, besides https://relay.tools, offer personal relays?

2026-07-13 08:32:45 CEST

- reply

Ah ok!

2026-07-12 12:03:58 CEST

- reply

> And if you have an antenna on you, how easily you could be tracked.
Wait. GPS usually is only a receiver, never sends anything; you need additional, bulk and energy-intensive hardware to transmit something. Right?

2026-07-10 13:55:24 CEST

- reply

To me it seems a rant against Strike, not Bitcoin.

2026-07-09 15:52:44 CEST

- reply

@npub10r8…t2p8 I just reproduced the problem: I released v1.4.1 and on Zapstore I see the installed v1.4.0 with the open button, no CTA to update. Scrolling I can find the v1.4.1, but also here there is no way to update.

2026-07-09 15:49:50 CEST

Just released #Manent v1.4.1 with some fixes, the most important one resolves a compatibility issue with Amber.
As usual, you can update it via @npub10r8…t2p8 or https://github.com/dtonon/manent/releases/tag/v1.4.1
#nevent1q…qzr6

2026-07-09 15:44:47 CEST

- reply

@npub10r8…t2p8 is there any problem with the comparison of the versions?

2026-07-09 10:00:00 CEST

- reply

Updating the zap store app solved the issue.
Now I can see Manent's card with the correct V1.4.0

2026-07-09 00:02:22 CEST

- reply

Did you test it?
What NIP is it based on?
I just released a new version of Manent:
#nevent1q…ed09