Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

311–320 of 347 posts

Re: Nostr

#311

Post by camillomiller »

Cameri wrote: post #288
camillomiller wrote: post #5

I find open protocols the most naive endeavour in tech nowadays. The reason why social media protocols work is because the incentive is to have them siloed, controlled, and artificially convincing people through algorithmic suggestions that posting what they had for lunch is somewhat interesting. These protocols seem to think that people actually want an alternative to what Instagram, Facebook, X etc. give them. They…

> Do you wanna change social media? Try and find and effective way to bring them down. You don't change social media by building yet another closed protocol. You'd be building more of the same. The only option left is to build open protocols, and nostr is another attempt. Checkmate.

You change them with serious regulation. Leave the tech bubble for a minute, there’s a world outside.

Re: Nostr

#312

Post by agalush »

Yizahi wrote: post #274
enether wrote: post #213

Earlier quoted context omitted.

It's still pretty affordable and not-hard to run your own Lightning node; The pseudo-bank hosted wallets people use (e.g Wallet of Satoshi) is purely out of convenience. The real lesson is that most people don't care enough about the underlying risks - they care about convenience.

If I'm not mistaken, running own Lightning node would mean opening channels to every single merchant you want to trade with AND those same merchants would need to open a symmetric channel back to you with the same amount of locked funds. And then during the transaction this system would need magically solve traveling salesman problem per each transaction in the system, taking into account that after each completed tr…

you just need to open one channel to another node (better if well connected) and all your payments will be routed through that node.

If you have multiple channels you have more routing alternatives and can choose the best one for every single payment.

Re: Nostr

#313

Post by [deleted] »

tptacek wrote: post #264
jonstaab wrote: post #260

Earlier quoted context omitted.

The cryptography was thrown together in the very early days as a proof of concept, that reached some level of adoption because of how nostr suddenly grew at the end of 2022. The community has since largely switched to a new standard (NIP 44) which has been independently audited, although there are some popular clients that haven't yet transitioned.

From a brief scan, NIPS 44 seems reasonable; it's just AEAD ChaCha20, which is boring, which is good.

[deleted]

Re: Nostr

#314

Post by eduction »

tptacek wrote: post #264
jonstaab wrote: post #260

Earlier quoted context omitted.

The cryptography was thrown together in the very early days as a proof of concept, that reached some level of adoption because of how nostr suddenly grew at the end of 2022. The community has since largely switched to a new standard (NIP 44) which has been independently audited, although there are some popular clients that haven't yet transitioned.

From a brief scan, NIPS 44 seems reasonable; it's just AEAD ChaCha20, which is boring, which is good.

Interesting way to spell “i was extremely wrong”

Re: Nostr

#315

Post by skinkestek »

eduction wrote: post #314
tptacek wrote: post #264

Earlier quoted context omitted.

From a brief scan, NIPS 44 seems reasonable; it's just AEAD ChaCha20, which is boring, which is good.

Interesting way to spell “i was extremely wrong”

I think it is an HN standard:

I am less on HN these days, but as far as I have seen:

Telegram is still judged by its very early releases, still called "unencrypted" while it is about as encrypted as your bank transactions (they definitely aren't e2ee either).

Signal can do what they want including dabbling in crypto currency without being open about it. Signal can also have extremely "interesting" bugs (didn't it at some point send messages to random people?) and glaring security issues (relatively trivial remote code in the desktop client IIRC a few years ago).

Last I checked WhatsApp was supposedly also good since they now use good encryption despite now being owned by Facebook, sending my social graph to them and sending peoples entire backups (including chats with me) unencrypted to Google for "free" (IIRC) backup.

That said these days I am definitely looking for Telegram alternatives.

Re: Nostr

#316

Post by tptacek »

eduction wrote: post #314
tptacek wrote: post #264

Earlier quoted context omitted.

From a brief scan, NIPS 44 seems reasonable; it's just AEAD ChaCha20, which is boring, which is good.

Interesting way to spell “i was extremely wrong”

Is the protocol the paper was written about no longer deployed anywhere, or is this just a dunk?

Re: Nostr

#317

Post by tptacek »

skinkestek wrote: post #315
eduction wrote: post #314

Earlier quoted context omitted.

Interesting way to spell “i was extremely wrong”

I think it is an HN standard: I am less on HN these days, but as far as I have seen: Telegram is still judged by its very early releases, still called "unencrypted" while it is about as encrypted as your bank transactions (they definitely aren't e2ee either). Signal can do what they want including dabbling in crypto currency without being open about it. Signal can also have extremely "interesting" bugs (didn't it at…

Your bank doesn't operate in Telegram's threat model! You are never concerned that your bank's servers are attacking your transactions: if you can't trust your bank, you're fucked anyways. That's precisely what's not supposed to be the case about a messaging service!

Re: Nostr

#319

Post by some_furry »

vnuge wrote: post #300
duskwuff wrote: post #284

Earlier quoted context omitted.

How robust is nostr against downgrade attacks - can an attacker induce users to use nip04, or are there safeguards against this? (I have no significant knowledge of the protocol; if this is a meaningless question just say so.)

Hard to say how relevant that is. DMs are simply a collection of events sitting on a relay. It's not really a mutual tunnel, most clients implement nip44 via nip19 (giftwrap DMs) so your ni04 message wouldn't likely make it to them. It's not considered backward compatible such that you could send a user a DM, then cause their client to downgrade to the DM scheme that uses nip04. It's also worth noting, the user _must…

> It's also worth noting, the user _must_ be made aware of the encryption method that was used, their "signer" application, which is also responsible for encryption and decryption, would require their permission to do an operation in either direction.

Let me ask a more pointed question about downgrade attack resistance then:

Is the algorithm being used determined by the encrypted message contents? Or is it determined by the key controlled by the signer app?

Re: Nostr

#320

Post by lxe »

jonstaab wrote: post #290
lxe wrote: post #289

Earlier quoted context omitted.

"nostr is a simple distributed protocol to build internet applications for social networking, communication and media. It requires lightweight relay servers, as opposed to large federated servers like in mastodon or email, or fully p2p like scuttlebutt. It can be used to some extent via a browser using web clients, but it's best used alongside extensions for authentication and key management" That is what I'm looking…

Going back to the site, I see what you mean. Very fair criticism. The site appeals to a bunch of implicit ideals without defining its terms.

> appeals to a bunch of implicit ideals without defining its terms.

That's such a good way to summarize it!

Post reply on HN