121–130 of 171 posts
Earlier quoted context omitted.
Hopefully some day we will get state-managed PKI, and citizens will get used to handling their keys appropriately. It's crazy that some functionality on e.g. the IRS website requires me to verify my identity using a private company (ID.me).
european IDs already have a chip with your personal keys and you can use that to log into any state operated service
Activists, in this case, are people with a social mission that they deem it's more important than any other considerations: they think ideology K is dangerous and they are trying to prevent as many as possible recipients to be exposed to it. They will report you on Threads or Facebook to ban you, if you speak in favor of K. They will send e-mails to your employer. They will even send bomb threats to venues where you gather to celebrate K. If they are moderators, they will not only ban you if mention K in a positive light, but they will try to avoid other people from hearing K-speech as well. If they run a Mastodon instance, for example, they will have a ban list of other instances that are K-friendly, and they will make sure that, if you are using their instance, you can't see any posts about K. If you're curious about K, now you have to do the inconvenient dance of switching between two instances that in theory should be federated, but in practice are two different networks that don't speak with each other. This is good for activists, but bad for you, if you don't want to take sides on a culture war you don't really care about.
A relay-based architecture makes the work of activists a bit less relevant: they can still run their instance and ban every mention of K, of course, but now you can subscribe to their instance AND another instance that doesn't ban people who speak fondly of K, and they can't limit or control that in any way. In theory (and everything is a bit theoretical at the moment), relays that heavily censor certain topics are less preferable to a generic public than relays that don't do that, so activist moderators will pay their effort to shape discourse with less participation from users. Of course, if relays ban something universally considered bad, such as spam, they will have more success than if they ban some heavily divisive point of view that 50% of the public shares. In theory, these controversial actors can even advertise friendly relays without you knowing, and your client can decide to follow them transparently (the intent is "I want content from this user", the behaviour is "follow relays they advertise behind the scenes"). Of course they have to do that before they're banned, but the point is that, for every activist relay that tries to remove K from public discourse, there will always be one or more generalist or counter-activist relay that welcomes K, and you can choose to follow both at the same time, with the same client and the same identity, and nobody can do a damn thing about it.
Something that I feel is missing in this conversation is that IMO a multi relay architecture like Nostr is not trying to solve moderation or remove it altogether: it's trying to make activist moderators less relevant. Activists, in this case, are people with a social mission that they deem it's more important than any other considerations: they think ideology K is dangerous and they are trying to prevent as many as p…
Earlier quoted context omitted.
This exactly. Worth mentioning that "censoring" can occur in any of a number of ways; blocking select traffic, slowing select traffic, "forgetting" specific nodes, redirecting other nodes at will, performing MITM attacks (if the protocol isn't secure), etc etc. Also, beyond just no positive incentives, there are nontrivial negatives... they're hubs for an entire network, which can be a lot of traffic and bandwidth if…
Read up on the outbox model and zaps. Also check out Bitchat for a real world example of Nostr being effectively used without even requiring Internet connectivity. You cannot censor Nostr. Also, check out how zaps work, and relay authentication. You can charge for relays if you want.
Sure you can. A relay operator absolutely can censor what goes through their relay. More to the point, you cant even prove that such censorship has occurred.
Nostr is censorship resistant in that you can publish to multiple relays, but that is far from censorship-proof.
The problem is that (to use the comparisons given in the article) Nostr is a statically peered superpeer. All the "downsides" of a superpeer (as the article says - "centralisation with extra steps") but without the benefit of dynamic peering thereby resulting in incomplete routing. i.e. by its nature Nostr results in a fragmented network, which ends up looking very much like the federated network, albeit more interco…
Users you follow can also advertise relays behind the scenes, so it's more probable that, if you follow a coherent set of users, you will converge on a coherent subset of relays that doesn't really feel fragmented.
Every social media platform needs to a solution to: 1. Content discovery 2. Spam 3. Content moderation I can see relays offering unique solutions to each one. But now they are more than just dumb servers. You get to the point where you might as well just write posts locally then submit them to X, Facebook, etc. You get the same result. And if you include a cryptographic signature with each post, you can prove you are…
Something that I feel is missing in this conversation is that IMO a multi relay architecture like Nostr is not trying to solve moderation or remove it altogether: it's trying to make activist moderators less relevant. Activists, in this case, are people with a social mission that they deem it's more important than any other considerations: they think ideology K is dangerous and they are trying to prevent as many as p…
This is one of those statements that sounds reasonable because K is a variable, but it actually matters what the content of K is. You can start by inserting "CSAM" and work from there, until the police arrive.
> Of course, if relays ban something universally considered bad, such as spam, they will have more success than if they ban some heavily divisive point of view that 50% of the public shares.
You can add CSAM to that. Also, legality always trumps any other consideration: if you're doing something illegal in your country, you should expect your country's police force to come and get you, there's obviously no relay architecture that can prevent that.
My point applies more to situations where K is not illegal, but heavily divisive.
It is all wishful thinking and beside the point. Pubkey auth and normies do not mix. They lose their keys, their identity, their history, then back to zuck or elon’s plantation where things can be administratively resolved.
Same point as https://news.ycombinator.com/item?id=46282964 Disagree though, people manage keys just fine, or they can be thought. But even if there are people in the world that never get it, it could be outsourced to a central identity provider that manages your key and messages. For the end user they would have a user/password combo they can reset. If the network becomes more popular someone will definitely build s…
Earlier quoted context omitted.
Both signal and WhatsApp punt key revocation and recovery to phone number verification, so ultimately these keys belong to phone number provider.
Sure, there are costs involved in the trade off, but the benefit is a system that actually works for the average user.
Nostr's whole shtick is about "users owning their keys". If I can not change the keys used on WhatsApp or Signal, I do not own them. They are not in the same class, so the comparison is moot.
Earlier quoted context omitted.
Could this be run by, say, a public library or are there concerns about liability? It also seems like this is sort of reinventing email.
The concept of public library are the "super-relays", which are always available and basically accept any note you send their way. It is "kind of" like reinventing email with PGP. Main difference is that you can choose to send the message in plain text with a cryptographic signature that proves it was sent from you or full encrypted like PGP. There is still (in my opinion) a disadvantage when compared to PGP: key rot…
and yes, one of the hardest parts of this domain is the implementation of the web of trust (key management).