Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nostr

nostr.com

Post reply on HN
Print view View original

331–340 of 347 posts

Re: Nostr

#331

Post by vnuge »

duskwuff wrote: post #329
some_furry wrote: post #328

Earlier quoted context omitted.

That doesn't answer my question at all. Is the decision (regardless of who fucking decides) based on metadata attached to the key the client controls or from a breadcrumb included in the message itself ?

I think that the (unsatisfying) answer is that there's no established standard for how protocol selection works. nip04 and nip44 are completely different types of messages, and it's up to the client how it'll use and/or respond to them.

Kind of. They are standards for encryption, not the direct message itself. You'd be speaking about nip17. Which i've been mis-speaking as nip19.

https://github.com/nostr-protocol/nips/blob/master/17.md

Notice that nip44 IS the standard. again, nip04 is deprecated, and should be treated by clients as such.

Re: Nostr

#332

Post by vnuge »

duskwuff wrote: post #329
some_furry wrote: post #328

Earlier quoted context omitted.

That doesn't answer my question at all. Is the decision (regardless of who fucking decides) based on metadata attached to the key the client controls or from a breadcrumb included in the message itself ?

I think that the (unsatisfying) answer is that there's no established standard for how protocol selection works. nip04 and nip44 are completely different types of messages, and it's up to the client how it'll use and/or respond to them.

I guess it's worth also saying, there is no algorithm selection. Nip04 is dead for DMs. It doesn't need to be backward compatible. A user can't know which client another user is on, nor what their capabilities are, nostr is not smart in that way. Most, if not all, operations on nostr are completely stateless.

When a user decides to send a DM to another user, the client must choose the standard for encryption, and message wrapping. Then hope the other user is using a client that implements the same standard, in order to decrypt the message.

Again, remember, DMs don't have a session. Every message derives a new symmetric key. The only metadata that makes a "chat" session is the timestamp, and the public keys of the users.

Re: Nostr

#333

Post by tptacek »

vnuge wrote: post #268
tptacek wrote: post #239

Earlier quoted context omitted.

If you read the entire paper you'll see that the paper presents a formalized set of security goals that acknowledge Nostr uses public keys as identities. They haven't misunderstood the system. Meanwhile: the cryptography is obviously unsound: it relies on unauthenticated CBC, and signatures that aren't verified, and provides attackers with the ability to coerce users into following links.

nostr cryptographic developer here (author of libnoscrypt C library) Nip04 has been deprecated, and to be clear, in practice the nip04 payload is in a signed nip01 event wrapper. nip44 replaced nip04, which has been reviewed/audited. Does use authenticated encryption in the message payload with forward secrecy, again in practice wrapped in a nip01 event, singed by the author, usually by the same cryptographic softwar…

Hey, I should say this, and wish I had earlier:

I don't really so much care whether Nostr is good or bad. I'm a connoisseur of cryptographic vulnerabilities, and the ones in that paper are fun. We host a podcast (me, Deirdre Connolly, and David Adrian) that is mostly about good crypto vulns. If there's someone affiliated with Nostr that would want to chat for an hour or so about how applicable the vulns in this paper are or aren't, and how they're addressed in NIP44 --- we'd love to talk. My email address is in my profile. Whoever showed up, they'd be in good company!

https://securitycryptographywhatever.com/

Re: Nostr

#334

Post by oblongdefeat »

digitalbase wrote: post #130
TheAceOfHearts wrote: post #7

Last time I tried navigating the Nostr ecosystem I found their Twitter-equivalent platform and it was full of people posting about cryptocurrencies and other topics that weren't of particular interest to me. Are there any major figures of interest primarily participating on any Nostr platform? Or is there any kind of uniquely interesting content that is being primarily produced and shared on Nostr?

As a 1 year nostr user i can relate to this sentiment. Most conversations today are either about crypto or about (building) nostr. My guess is that the better the network becomes the more that specific content will take a backseat

Same experience here. An overwhelming amount of the content is Bitcoin evangelism, AI slop art, and self-congratulating nostr meta-discussion. All with a heavy-handed libertarian / anarcho-capitalism leaning.

Even the #art is 95% Bitcoin and nostr fan art.

Re: Nostr

#335

Post by oblongdefeat »

nunobrito wrote: post #238
cropcirclbureau wrote: post #198

Earlier quoted context omitted.

Word of warning: was blasted with NSFW on the first page of that link.

No you didn't. Please stop the FUD. You and your 3 friends tend to do the same every time NOSTR is mentioned just because you use another platform. Please be honest and admit the affiliation.

I just went to Yakihonne while not logged in -- it took me to the Home "Global" feed. Scrolling down a bit to see what was there I was met with a link to "HD Porn Videos" and the preview image was essentially a frame from whatever video was being promoted.

I wasn't "blasted" with NSFW but it was definitely present (and not very far down the feed). And the feed seems to be chronologically ordered, so depending on your timing something like that could be front and center.

Re: Nostr

#336

Post by tegiddrone »

rgreeko42 wrote: post #212

My "apolitical" shirt has people asking a lot of questions already answered by my shirt. What an odd word to use in the first sentence of your product description, which also includes the word "open", an inherently political concept in this context. Did/does Nostr have some cryptocurrency connection or am I thinking of something else?

I concur and "apolitical" is probably not the best word. I think it is an attempt to convey that the platform can't ban people. It is resistant from infrastructure censorship. Here is an example specific use case:

https://how-nostr-works.pages.dev/

I find that example pretty humorous... Damn, what kind of controversy is Pamela spreading?

I like it but feel nervous that there is synergy with the bitcoin space. Hype and validation is thick in that space

Re: Nostr

#337

Post by subscribed »

littlecranky67 wrote: post #196
nunobrito wrote: post #191

Earlier quoted context omitted.

I don't think you ever used Monero because payments are settled in a few minutes and the user gets fast notification of incoming transaction. So that point you raise is fake. However, if you want to pick a more realistic reason then complain about the fees which are still high when doing for example a payment of 5 cents and the fee will often also be 5 cents whereas it should be free. Anyways, I'm not even a fan of M…

There is no point discussing with you, you twist every argument around - "...payments are settled in a few minutes and the user gets fast notification of incoming transaction." is not even contrary to what I wrote, you repeated my point. Minutes to clear a transaction vs. a second (sometimes a couple of seconds) is not even close to comparable. Anyway, I am out of this thread.

Your claim was:

> It is noteworthy that zapps are based on lightning (which is Layer-2 for bitcoin), and similar in privacy as monero (and instantaneous).

Entire subthread was 99% about your lightning "privacy" claim, which was incorrect.

The difference between minutes vs seconds might be interesting or crucial to many, but that wasn't the most important thing you've been called out on.

Hope this helps with understanding the other guy.

Re: Nostr

#338

Post by jonstaab »

tptacek wrote: post #316
eduction wrote: post #314

Earlier quoted context omitted.

Interesting way to spell “i was extremely wrong”

Is the protocol the paper was written about no longer deployed anywhere, or is this just a dunk?

It was (and still is) deployed in a number of places, so it's a valid criticism in that context. That said, it's mostly dunk.

Re: Nostr

#339

Post by yellowapple »

BinaryIgor wrote: post #309
yellowapple wrote: post #294

Earlier quoted context omitted.

That's where I feel ATproto strikes the right balance: it's basically “What if Nostr but the identity lives on a potentially-self-hostable server instead of the client?”, avoiding that risk of “oh no I lost my private key” while still providing the means to control where one's identity lives and move elsewhere if necessary (even if the current server is uncooperative or no longer exists).

Isn't it centralized though, thus defeating the whole purpose?

That depends on what “centralized” means (i.e. whether we're conflating “decentralized” with “federated”, as is usually the case when talking about systems like ATproto, ActivityPub, Nostr, etc.).

In any case, AFAICT it's possible to self-host every part of the ATproto stack, and people have indeed done that. Third-party PDSes, relays, and applications/clients can talk to one another and with the ones Bluesky PBC operates. That satisfies the meaning of “decentralized” as most people use it (at least as well as other federated protocols like ActivityPub and email satisfy it).

Re: Nostr

#340

Post by mediumsmart »

tptacek wrote: post #242
fiatjaf wrote: post #231

Earlier quoted context omitted.

Unfortunately this paper doesn't live up to its goal of being a cheap attack on Nostr. The fact is that clients do verify signatures from events received from servers, that is in the protocol specification and should be obvious to anyone mildly honest. The entire assumption of the paper is that clients don't do that and it is void. Yes, they did find a couple of clients 2 years ago that didn't verify signatures -- so…

They're academic cryptography researchers. They do not care what messaging system you use. This is what academic messaging cryptography papers look like; a paper like this is why Matrix transitioned (is transitioning?) from ad hoc cryptography to MLS.

Thanks for clearing up that the issue is academic as in irrelevant concerning nostr
Post reply on HN