Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

291–300 of 347 posts

Re: Nostr

#291

Post by jazzyjackson »

Cameri wrote: post #285
BinaryIgor wrote: post #210

Earlier quoted context omitted.

Yes; and because your key is your identity, losing your key or having it stolen basically means that you have to start from scratch; there is no "I forgot my password" mechanism

For identities to be truly decentralized, there's no one you could run to to ask permission to change your password. Either you own your identity, or someone else does. Your identity, BinaryIgor only exists in ycombinator, and for as long as ycombinator allows it, and only ycombinator can allow you to change your password. I can't recall how accounts are created here, but likely it also depends on linking it to your…

Doesn't change the fact that Nostr doesn't have a key rotation mechanism

Re: Nostr

#292

Post by chwahoo »

I haven't closely followed distributed protocols like this in years so might just be just behind the times, but I can't recall ever seeing "Pro Censorship" as a badge on a technology.

Seems to fit with real-world trends that confuse and frustrate me. I'm not saying we need a censorship-proof world, just that I find this quite jarring. I suspect I might be missing some context.

Re: Nostr

#294

Post by yellowapple »

BinaryIgor wrote: post #210
jeroenhd wrote: post #142

Earlier quoted context omitted.

"Accounts" in this case are just a public/private key pair. You can host your own relay (and nobody will hear what you have to say unless they subscribe to it), but you can use the same public key ("account") on any nostr relay. You can broadcast your posts to all relays, or just some, or just your own, depending on how you feel. You can, in theory, generate a new key for every post if you want to. The relays don't c…

Yes; and because your key is your identity, losing your key or having it stolen basically means that you have to start from scratch; there is no "I forgot my password" mechanism

That's where I feel ATproto strikes the right balance: it's basically “What if Nostr but the identity lives on a potentially-self-hostable server instead of the client?”, avoiding that risk of “oh no I lost my private key” while still providing the means to control where one's identity lives and move elsewhere if necessary (even if the current server is uncooperative or no longer exists).

Re: Nostr

#295

Post by yellowapple »

cropcirclbureau wrote: post #198
nunobrito wrote: post #15

Earlier quoted context omitted.

https://yakihonne.com/ tends to be a good experience for browser and has apps, after that https://primal.net is also quite good as introduction since their UI is similar to what you are used in other platforms. Then there is https://www.amethyst.social/ which is excellent because it brings out more of the potential of the platform.

Word of warning: was blasted with NSFW on the first page of that link.

On the first page of which link? What are you defining as “NSFW”?

Re: Nostr

#296

Post by apitman »

keiferski wrote: post #26

Something I don’t quite get about these new social networks that are clearly aimed at technical people: my model of a truly decentralized social network is more like a network of privately hosted personal websites, à la the original web. Not yet another platform I need to make an account to interact on separately. Have there been any attempts to make more of a “network” that incentivizes operating personal websites b…

IndieWeb?

Re: Nostr

#297

Post by yellowapple »

throwaway290 wrote: post #98
nunobrito wrote: post #82

Earlier quoted context omitted.

Come on, so much effort writing and yet so vague. The easiest way to try NOSTR is using any of the common web platforms like https://primal.net or https://yakihonne.com/ Heck, you can even install NOSTR clients directly from the App and Play store since years. It is very unbelievable that you followed such a complicated process, even went to effort of deploying to a server (what?!?) and then somehow you see disturbin…

Do you really think somebody would try out a new platform 2 years ago, immediately drop it due to shady stuff and remember all the non trivial steps involved in this process? > you can even install NOSTR clients directly from the App and Play store since years Since feb 2023, apparently;)

That is indeed multiple years, technically speaking :)

Re: Nostr

#298

Post by yellowapple »

the_real_cher wrote: post #38
staticelf wrote: post #2

I like the idea of nostr but when I tried to use it it was a lot of CP which made me instantly stop using it. I guess the issue with this type of protocols is that there must be a way to prevent these very dark and illegal content. As a user I don't want to see it and the submitter should be found and jailed for distributing it. Right now, it's hard to know where it even comes from since it can come from any of the r…

Its horrible but that kind of content means theres no censorship. Its on the individual to block that kind of stuff.

The problem is that in many jurisdictions (including the ones to which the vast majority of HN users are likely subject), by the time you've received “that kind of stuff” you're already in legal hot water.

Re: Nostr

#299

Post by yellowapple »

jasonvorhe wrote: post #221
sak5sk wrote: post #114

Earlier quoted context omitted.

People do want alternatives. Bluesky is a clear example of that. Nostr is clearly not as big, but it's a protocol.

It's way too easy to get banned on Bluesky and to my knowledge their promises of being decentralized are comparable to Telegram being E2E encrypted.

> It's way too easy to get banned on Bluesky

Only if you're on a Bluesky-operated PDS. That's straightforward to fix, at which point the most Bluesky can do to “ban” you is stick a label on your account that non-Bluesky applications/clients are free to ignore.

> to my knowledge their promises of being decentralized are comparable to Telegram being E2E encrypted.

AFAICT your knowledge is about a year out of date.

Re: Nostr

#300

Post by vnuge »

duskwuff wrote: post #284
vnuge wrote: post #268

Earlier quoted context omitted.

nostr cryptographic developer here (author of libnoscrypt C library) Nip04 has been deprecated, and to be clear, in practice the nip04 payload is in a signed nip01 event wrapper. nip44 replaced nip04, which has been reviewed/audited. Does use authenticated encryption in the message payload with forward secrecy, again in practice wrapped in a nip01 event, singed by the author, usually by the same cryptographic softwar…

How robust is nostr against downgrade attacks - can an attacker induce users to use nip04, or are there safeguards against this? (I have no significant knowledge of the protocol; if this is a meaningless question just say so.)

Hard to say how relevant that is. DMs are simply a collection of events sitting on a relay. It's not really a mutual tunnel, most clients implement nip44 via nip19 (giftwrap DMs) so your ni04 message wouldn't likely make it to them. It's not considered backward compatible such that you could send a user a DM, then cause their client to downgrade to the DM scheme that uses nip04.

It's also worth noting, the user _must_ be made aware of the encryption method that was used, their "signer" application, which is also responsible for encryption and decryption, would require their permission to do an operation in either direction. Users may often choose to grant a trusted client application the permission to decrypt all nip04 or nip44 messages alike, automatically, or generally manually with a popup. That's up the signer application how granular the permissions get.

To be clear this is a client implementation detail, im not a client developer, so I can't say in practice how many have handled the UX on this, but know that the signer, and the user had the final say on which algorithm was granted permission.

Clients and signers alike could choose to block obsolete encryption methods if they choose.

Post reply on HN