mfoster.io
mfostr

The key idea is understanding when and how to attach data in a provenance chain. A Sony camera produces a hardware‑rooted C2PA signature at capture time, signing the EXIF and proprietary metadata inside a secure element. This proves the image was taken on a real Sony device and not generated by AI.Additional manifests such as location, organizational identity, workflow metadata, or edit history can be added later as separate signed assertions. Each added layer must be intentional, privacy‑aware, and auditable, because it expands the legal and trust surface. The result is not a blockchain, but a hardware anchored, append only provenance chain that carries legal weight similar to other cryptographically signed declarations, such as NIP‑62’s “Request to Vanish,” though the mechanisms and goals are different.
https://nips.nostr.com/62

2026-03-10 19:39:17 UTC

I miss my Lycos homepage and MySpace!
https://blossom.primal.net/aa0a28139f7890db9a00ebed536551adfef59fe0b99f483b615f697458eb52e6.png
https://blossom.primal.net/f82a7d8bdde0df5bb3ef78862753606d55f4e82b0deacdcf7e0086f86d07061d.jpg

2026-03-09 05:18:25 UTC

∅ ⇄ ◌⁻ · ◌⁺ ⇄ ∅

2026-02-26 23:27:24 UTC

- reply

What phone is this?

2026-01-27 19:57:00 UTC

https://blossom.primal.net/d629e3f06fa6c991e36f5bbe15796e5b169b672a7d88a48e7cd475b9f7012a22.mp4

2026-01-27 19:13:58 UTC

- reply

It’s time to take a Napp. 😴

2026-01-14 22:41:41 UTC

- reply

Must be Android unless I am missing something on iOS?

2026-01-14 20:10:20 UTC

- reply

What App is this?

2026-01-14 20:09:42 UTC

- reply

What App is this?

2026-01-09 02:47:46 UTC

- reply

Thank you, great work!

2026-01-08 04:45:51 UTC

- reply

This is great, is it in the this repository? https://github.com/PrimalHQ/primal-ios-app

2026-01-07 02:58:14 UTC

- reply

Is the iOS remote signer going to be open source?

2026-01-03 19:25:38 UTC

https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-13

2026-01-03 15:31:56 UTC

Immutable Democracy! 🗳️🔏
https://youtu.be/g0nnM5_Z90E

2026-01-02 07:32:14 UTC

https://blossom.primal.net/b28903af828b13bf054a8a533d7f0c3617a56346b711bd87cbbcd00d0c4b0c1a.mov

2025-12-31 20:07:05 UTC

C2PA https://C2PA.org uses CAWG https://cawg.io/ for identity, I am moving towards building prototypes that map context with JSON-LD to CAWG Context https://cawg.io/identity/1.1/ica/context/ for Nostr and bridging it to ProofMode https://ProofMode.org for interoperability.
https://proof-chain.pages.dev/

2025-12-19 21:14:58 UTC

- reply

This is the way!
https://youtu.be/LaiN63o_BxA
https://blossom.primal.net/c65e7493758624770ff6c5539cd070fb8fe6018dd19bd71c02a36edc33ad62e4.jpg

2025-12-19 21:09:40 UTC

- reply

Correct, postMessage is the way to keep the contexts separate. You can do the same with OPFS, it’s got some added features with a hidden context by default and is highly performant. You can also back up your signed nostr event notes in an SQLite DB and pin other SHA256 addressable notes via local cache.
https://primal.net/e/1cb0612ff42762b7639e64b641319229d4e7848a4228331f6f27f27fa6c248cd
client.com (page)
│
│ postMessage (cross‑origin, sandbox‑safe)
▼
vault.com (iframe)
│
│ postMessage (same‑origin, internal)
▼
vault Worker (isolated agent)
│
├── OPFS (Origin Private File System)
└── IndexedDB

2025-12-19 20:49:25 UTC

- reply

🙌 Absolutely, I agree 1000% percent, context is everything!

2025-12-18 07:54:25 UTC

- reply

Greed.

2025-12-18 06:11:37 UTC

- reply

I have been pushing the noble curves as well. Both indexDB and OPFS are origin specific so the solution is definitely in handling the keys. One advantage of OPFS is you can’t view it via inspecting the web app in the browser without an extension. It’s sandboxed just like indexDB, but isolated out of the default tools which helps hide some of the attributes of the data structure.

2025-12-18 05:50:07 UTC

- reply

I’m trying to wrap my head around the differences between using IndexedDB, OPFS, and SQLite in your scenario. I’ve been researching the idea of running an isolated iFrame on client.com for vault.com and passing data between the two origins via postMessage. In that setup, is there anything in NostrPass that prevents rogue extension <script> injections from compromising the page context?

2025-12-18 04:09:45 UTC

- reply

I created this demo writing to an SQLite DB in OPFS and using postMessage via the Baseline Broadcast Channel API.
https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API
https://blossom.primal.net/7a87d85972b4e49ca8c8579e24821345c464e4acd05756b41a7409c841128af0.mov

2025-12-17 23:35:55 UTC

- reply

I like to think of it a side load private file system bound to a domain based identity i.e., my origin vault could be mfostr.me.

2025-12-17 23:29:41 UTC

- reply

That is a good question, It is bound to the origin binding: OPFS storage is origin-private. Even if an extension injects code, the storage it accesses is scoped to that origin. It cannot cross into another site’s OPFS. So if you’re on NostrVault.tld, injected code can only touch NostrVault.tld OPFS, not NostrClient.com’s or a rogue extension.
The rogue extension would have to have host permission to access the Origin Private File System (OPFS) and eventually our goal goal is to encrypt the data at rest with OPFS with an OpenPGP cert from the NFC card so a rogue extension wouldn’t know how to interpret it or what to do with it, if it got access to it.

2025-12-17 18:49:19 UTC

- reply

#AskNostr #Nostr 👀 WebWorkers and iFrame isolation with window.nostr.signEvent(), as if it were using any NIP-07 extension, represent a great move in the right direction. I recommend that Nostr developers pay attention to OPFS capabilities versus IndexedDB where possible. OPFS avoids metadata leakage and is now part of the Baseline in all browsers. 🔏
https://primal.net/e/nevent1qqs8tqf99ddes0jh4lngxaaxjm3r39kc3xvqeh2xjxg7pjmwd87q68qnrcn50
#naddr1qq…t8qe

2025-12-17 18:43:38 UTC

- reply

I’m focusing on origin iFrame isolation combined with OPFS (Origin Private File System), which is now a baseline capability in modern browsers: https://developer.mozilla.org/en-US/docs/Web/API/File_System_API/Origin_private_file_system. OPFS is gated behind Secure Contexts https://www.w3.org/TR/secure-contexts/, ensuring that these APIs are only available in environments served over HTTPS or equivalent.
Unlike IndexedDB, OPFS avoids metadata leakage. With IndexedDB, even if the stored data itself is protected, attackers can sometimes infer information from exposed metadata such as database names, schema details, or object store structures. This can reveal sensitive application logic or usage patterns. OPFS, by contrast, provides a simpler, file-like interface that doesn’t expose this kind of structural metadata, reducing the attack surface.
OPFS is also faster because it operates a layer closer to the file system, making it more efficient for handling large binary data and streaming workloads. This performance advantage is particularly useful for applications that need to persist signed content. For example, SQLite can be used on top of OPFS to capture signed posts in a vault for backup. Since these posts are addressable by their SHA‑256 hash, they can be stored and retrieved deterministically, ensuring both integrity and verifiability. Here is some research on how notion use SQLite and WASM to speed up their project. https://www.notion.com/blog/how-we-sped-up-notion-in-the-browser-with-wasm-sqlite
Here is also some documentation from Google for origin policy related info https://developer.chrome.com/blog/sqlite-wasm-in-the-browser-backed-by-the-origin-private-file-system
Coming from the SolidProject.org ecosystem, I began this research before discovering Nostr: https://mfosterio.github.io/ldux-local/ . It was intended for research only. I shifted gears when I discovered Nostr and have been focusing on wrapping my head around NFC, ISO 7812, NDEF, NTAG424 DNA, OpenPGP, GnuPG KeyGrips, and related technologies. WebWorkers and iFrame isolation provide secure, origin-bound contexts that enforce browser-level security boundaries, aligning with the Secure Contexts standard, but when you add OPFS, it’s like putting that model on steroids.
I look forward to watching your project. Great design kick off and this is heading in the right direction.

2025-12-17 14:47:18 UTC

- reply

I agree with this 💯, I just got off the phone with someone trying to login to their meta business account. Centralized systems are siloed into servers by domain law. Pay attention to how facebook structured the profile to be a route i.e., facebook.com/username vs username.facebook.com this was done by design so they can lock you into a system where your data is ultimately theirs.
#nevent1q…edc3

2025-12-15 04:24:14 UTC

- reply

🎶🎼🎵♾️
#nevent1q…0ypz

2025-12-15 03:33:42 UTC

https://fountain.fm/episode/lCEWRNdRinE54fTwipVr
https://nips.nostr.com/EE

2025-12-15 03:14:23 UTC

- reply

lol

2025-12-15 01:43:45 UTC

Content is king 👑! The more we lift each other up by following, sharing, and celebrating one another’s posts the stronger the signal we send. Every like, every share, every connection becomes a ripple that reaches our friends and family, inspiring them to join in and engage with our invitations. Together, we’re not just building momentum we’re building a movement. ✊
#AskNostr #Nostr

2025-12-14 18:07:10 UTC

- reply

Nostr Notes Everywhere!
https://blossom.primal.net/f8f609b740f15d46ece504a92d3ee44347617e48dde3cf5c45edab05819814ec.gif

2025-12-14 16:46:41 UTC

- reply

Amen 🙏

2025-12-13 15:19:22 UTC

- reply

We are doing it for sure.

2025-12-13 14:18:11 UTC

- reply

It will be our year! The world will be better with open protocols. We all win, when we tear down the walled gardens.

2025-12-13 14:05:58 UTC

https://blossom.primal.net/38f2f1c8b8052022d1c1f55a4c8020c5e71c4903bb2f70e7fe9a8c7ef1149aa8.mp4

2025-12-13 05:04:02 UTC

We need a verifiable SHA256 WebComponents marketplace. ☑️🔏 #askNostr
https://youtu.be/n-cHJ6tNOKk
https://blossom.primal.net/46b9dc15c10e81c48999ee96f61f2c77125a780853c73e437096efcb93f8906a.jpg

2025-12-13 04:18:49 UTC

- reply

Yes! I am digging the THANK MY BITAXE Zap! ⚡️

2025-12-13 02:34:06 UTC

This is a vector! 🏹
https://blossom.primal.net/381bcafe1c4cbfe9d7ff7016482a95926f638dcfac7aa43dc7487fbc0a153a2b.mov

2025-12-12 03:45:14 UTC

Bittersweet This Life!
https://blossom.primal.net/634172ce675098ab964b2ee38426852144e17a3cb4f16473c1f7c8e8270d90e4.mp4

2025-12-11 03:31:10 UTC

WoT!
https://freakoverse.github.io/wotonnostr/

2025-12-07 03:20:14 UTC

https://blossom.primal.net/b2a2b71602606a7a40681327d2ec20bd07f39d5e7b29c7a7a708a2ac69c300de.jpg

2025-12-06 23:01:43 UTC

- reply

It’s been out for a while now. It’s all over the place, but you can share the blossom url by removing the quotes and spaces. https://v.nostr.build/ “GBcUfYYjdODcTnF0” .mp4

2025-12-06 21:55:32 UTC

With the help of #Nostr the #Bitcoin block will be the native currency and settlement layer of the internet.
https://v.nostr.build/GBcUfYYjdODcTnF0.mp4

2025-12-06 19:37:59 UTC

- reply

#askNostr Is this how you feel about #nostr? I know I do! 🙋🏻‍♂️ We will not give up until mainstream adoption.
#nevent1q…2ear

2025-12-05 01:48:36 UTC

- reply

Gotcha, it gets confusing because of the number ordering. Thanks for pointing that out.

2025-12-05 01:40:21 UTC

- reply

Any goals towards Gift Wraps?

2025-12-03 18:22:31 UTC

#Nostr in a nut shell.
👀 https://link.springer.com/content/pdf/10.1007/BF00196791.pdf
🤳🔏🚥🛜
https://blossom.primal.net/ea44bacb537b0e4cdac122892e86b2431916df90f812387c229b396f145b56c4.jpg

2025-12-03 15:58:20 UTC

- reply

This is the most valid point there could ever be. The right to privacy is stronger than any argument out there.

2025-12-03 02:45:47 UTC

- reply

I’m with you over here in Louisiana.

2025-12-02 05:11:41 UTC

https://os.ryo.lu

2025-12-02 03:40:55 UTC

#nostr watches will outperform both Apple and Android smartwatches by a wide margin.
https://blossom.primal.net/3f8a26c0a759ee7c400618c8eb8fd6b5edc89a996957dc2f5bf9ac82c78e8b17.mp4

2025-11-30 08:38:06 UTC

Some may say, we’re wishing our days away. No way, and if it's the price we pay. Some say, tomorrow's another day. You stay, we may as well play. Walking on the moon.🚶🏻🚶🌒🌜🌙
https://blossom.primal.net/7e6f5507c5ebc6a95b27c74c5d9f1ab2e7676fe28efe57e3fe25d65feb84e528.mp4

2025-11-30 00:33:15 UTC

- reply

Makes sense!

2025-11-28 00:00:02 UTC

https://github.com/markqvist/Reticulum/discussions/1002

2025-11-27 23:18:49 UTC

- reply

This! 💯
#nevent1q…zuf6

2025-11-26 13:55:05 UTC

Engineers should be honored more. GE Euclid Lamp would make lamps like this sometimes when people retired.
https://blossom.primal.net/43677c5d328904c521462b2046c7005d08512ff315fc5bbfc9a5ac64cea43e92.jpg

2025-11-24 00:29:05 UTC

- reply

Yes, the more developers the better! We need to keep spreading the word!

2025-11-24 00:24:16 UTC

- reply

X client? Most of the clients are open source.
https://github.com/PrimalHQ

2025-11-24 00:19:29 UTC

- reply

Play around with https://nostrdebug.com it’s helpful.

2025-11-23 23:44:05 UTC

- reply

Wouldn’t it be nice if they just joined the nostr effort.
#nevent1q…y0gh

2025-11-23 22:26:45 UTC

- reply

Nice! I look forward to checking it out! Great work! 🙌

2025-11-23 22:05:43 UTC

- reply

Do you have a demo?

2025-11-22 20:46:23 UTC

AI driven plaforms that aren’t transparent and remain outside your control don’t serve your best interests. They shape your choices in ways you can’t see and that’s not healthy for individual autonomy.
This dynamic is visible in many centralized platforms, including Meta/Facebook. Facebook was one of the first commercialized social media platforms to endure, and its design choices like structuring identity around “facebook.com/username/” were intentional ways to keep people tied to their ecosystem.
But technology doesn’t have to work this way. Decentralized, self‑sovereign protocols offer a different path:
🔑 What they mean for you:
- You control your identity instead
- You decide what to share and with whom
- Trust is verified in the protocols
- Communities thrive without surveillance‑driven business models
🚀 The future of social connection isn’t about being locked into platforms it’s about freedom, portability, and sovereignty.
Moving toward open, decentralized protocols means reclaiming control and building healthier digital spaces.

2025-11-21 04:17:59 UTC

The sky glowed above the Ark Encounter with the beautiful colors of the aurora borealis last week during the intense geomagnetic storm.
“The heavens declare the glory of God, and the sky above proclaims his handiwork” (Psalm 19:1 ESV).
https://blossom.primal.net/590d92f316fe5a06f8db5adeaed9e14f43b0c5bd35cd59c88059f973c44eb9b5.mp4

2025-11-21 02:32:47 UTC

https://youtu.be/0XVCc5zwPlU

2025-11-21 02:06:01 UTC

Louisiana 🐊🎣☀️
https://blossom.primal.net/70a210b05fefad0e513eb8b6d713961ddbc1d9cc04593840d8a515d873d3166f.jpg

2025-11-21 02:00:42 UTC

ProofMode! 🔏
https://divine.video/proofmode-spec

2025-11-21 00:30:22 UTC

Prime numbers in a synchronized flow create an interesting visual experience.
https://blossom.primal.net/dc38c05759be29be2559154b89b56b02af2bae51ea7fea6ea8097f1fc80c7fdc.mov

2025-11-19 06:17:55 UTC

- reply

Don’t go chasing HTLC waterfalls!
#nevent1q…ld0m

2025-11-19 05:55:23 UTC

The first Nostr transistor!⚡️
https://blossom.primal.net/c01c61e4bc2cc9472142b47a045a5b42f89fed92fdb80c44aaad03632fe3a0d0.jpg

2025-11-19 02:28:17 UTC

Never Ever!
https://blossom.primal.net/44ea4ca2d69d06a991a102cacd30652312266b212f942a6bdc877294513da32b.mp4

2025-11-19 00:25:58 UTC

- reply

💯 It goes deeper than that. i.e., CloudFlare tunnels and Umbrel Nostr nodes were still running, but this is only for backing up your Notes, not for relaying them. The clients, NIP-05s, and LNURLs that were CloudFlared through the tunnels remained 🆙 This is 🔑!
@nprofile…6rp8
@nprofile…zgsu
@nprofile…j2ae
@nprofile…w9q6
@nprofile…stca
@nprofile…ag5n
@nprofile…65xx
@nprofile…ecsr
@npub1avy…lw72
@nprofile…hhcx
https://apps.umbrel.com/app/cloudflared
https://apps.umbrel.com/app/nostr-relay

2025-11-18 14:18:07 UTC

- reply

This is why LNURL and NIP-05 is flawed. Centralized HTTP DNS servers are not the way.
I ran across this last night from @nprofile…cxxj and it’s an interesting approach to the issue. We should look into BitTorrent Mainline DHT as well.
🤳🔏🚥🛜🚥🛜
https://github.com/trbouma/dnspub
The primal.net http service is down because the data is in CloudFlare. The funny think is that CloudFlare tunnels to physical infrastructure would work.
https://blossom.primal.net/8d3a8eb475114412a600ed909cad71ac6e99b0a7615b15d36f226adf433d1916.jpg
#nevent1q…s27z

2025-11-18 13:51:17 UTC

- reply

💯 Percent! This is why everyone needs to run their own node in their home and the future of the internet needs to be decentralized.

2025-11-18 13:49:37 UTC

- reply

CloudFlare tunnels to your own nostr relay. Let’s decentralize the internet.
#nevent1q…4nzc

2025-11-18 13:39:06 UTC

With the CloudFlare outage it’s more and more of a sign that running decentralized nodes in our homes is important.
Everyone is so busy posting their selfies, watching reels, and wishing everyone a happy birthday on Facebook they don’t realize how unstable we are with centralized internet.

2025-11-18 06:23:45 UTC

- reply

https://blossom.primal.net/49672e5da6d68757ea0e569911b06f3d8384744aacfa4f6376cb51781bfd2ab0.jpg

2025-11-18 06:22:49 UTC

- reply

https://github.com/wujifoo/nostr-bip-85-prototype
Not sure if this is what you had in mind, but the concept is similar.

2025-11-17 03:08:09 UTC

- reply

FYI: I logged in with my nsec and all the accounts I follow got removed. I was able to restore them but I wanted to give you a heads up.

2025-11-17 02:12:39 UTC

GnuPG https://gnupg.org/ Content Credentials in ProofMode https://proofmode.org/verify.html change the game from centralized X.509 certificates to utilizing OpenPGP and https://opentimestamps.org OTS.
Here is the C2PA specification. Let’s continue to decentralize proof of personhood! 🤳🔏🚥🛜
https://spec.c2pa.org/specifications/specifications/2.2/index.html
Thank you @nprofile…udwt for bringing this concept to Nostr.
We have been working with GnuPGP on keygrips computed internally as a hash over the canonical S‑expression of the public key parameters for ISO-7816 NFC cards in NeoPGP via JCOP. These would work as good notary keys for decentralized privacy based OTS attestations.
GnuPG KeyGrips! 🔑🔑🔑

2025-11-16 20:10:07 UTC

- reply

The desire for Vine and non AI content broke Nostr.com 🤣 Humans will win!
@nprofile…qljc I am inspecting your vine post
https://divine.video/video/794e4b16a040e773efedd6af23b47fca411e0b6fa274a9180e5043faaacde1ba
I am seeing kind of 34236 in Nostr Debug Tool and found it in NostrHub
https://nostrhub.io/naddr1qvzqqqrcvypzp4mt8lnqzkn3tap6g00r5ps045fvvd84m0x0ql78q9g0plc8gsxuqyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqqp9hxjupdxucj6mm8qe2f66
How is this going to be supported in other native clients. I have been showing all my Normie friends that use Instagram and TickTock Olas but it is so buggy.
It looks like Nostur is recommending Olas and I can’t find the sha on Primal.
I did see where you posted about the Android app. I am using an iPhone but also downloaded the apk on my Android as well that @nprofile…udwt shared but all it showed was a divine logo. Is there an APK I am missing?
I also found the blossom video and it is in this post. I am just wondering how it can span across the media of primal and other already built native apps for more interactive content.
This will be a huge win to get not tech folks into Nostr and dominate open provable social media. 🙌
I am wanting to join the efforts and have some ideas around https://NationLocal.com as well.
https://blossom.primal.net/3d161372f05d3c9a60f6ef6f63fcfaa70aeee46370dd9b2a53cf8a3169f3b0a8.jpg
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
https://cdn.divine.video/cdb1ffa4c946dab07ae27629719e315e1875ce49b19d6f61efd93561c85d66ae.mp4
#nevent1q…p7pf

2025-11-16 04:01:48 UTC

- reply

https://youtu.be/IguMXrgfrg8

2025-11-16 01:37:21 UTC

I am wanting to build a Nostr app for https://NationLocal.com I was thinking about verifiable businesses, events, and in person offers via BLE and Bitchat. We need local marketing for businesses and maps besides Google and Facebook. Any other ideas? I want to have NFC attestations to verify the location based signed events.

2025-11-16 00:20:12 UTC

- reply

Dedication

2025-11-15 23:53:11 UTC

- reply

This is what I am seeing.
https://blossom.primal.net/af9821d5c6eab8a6b6bbf40041cff7692b9ea04cf0c76a03534070ebe1b774b7.jpg