Tim Bouma's avatar
Tim Bouma
trbouma@safebox.dev
npub1q6mc...x7d5
| Independent Self | Pug Lover | Published Author | #SovEng Alum | #Cashu OG | #OpenSats Grantee x 2| #Nosfabrica Prize Winner
Tim Bouma's avatar
Tim Bouma 1 month ago
Decentralized record sharing between two instances of #nostr #safebox
Tim Bouma's avatar
Tim Bouma 1 month ago
People are no longer expected to be able to count to 4. How do you expect then, that they will be able to divide by 100,000,000? View quoted note →
Tim Bouma's avatar
Tim Bouma 1 month ago
Typical tech discourse: ‘I need an app’ (I have no clue what my problem is) ‘You need react’ (This is all I know)
Tim Bouma's avatar
Tim Bouma 1 month ago
I read to understand problems. I like reading older stuff, because usually some seriously smart person has actually figured out the problem, but doesn’t have yet the tools for the solution. In contrast to today, many of the solution tools do exist, but unfortunately, the seriously smart people don’t actually care what the problems really are.
Tim Bouma's avatar
Tim Bouma 1 month ago
“The zero trust model starts to diverge from traditional network security in the control mechanisms that are used to define policy. Instead of defining policy in terms of network implementation details (IP addresses and ranges), policy is best defined in terms of logical components in the network. These components will generally consist of: - Network services - Device endpoint classes - User roles Defining policy from logical components that exist in the network allows the policy engine to calculate the enforcement decisions based on its knowledge of the current state of the network. To put this in concrete terms, a web service running on one server today might be on a different server tomorrow, or might even move between servers automatically as directed by a workload scheduler. The policy that we define needs to be divorced from these implementation details to adapt to this reality”
Tim Bouma's avatar
Tim Bouma 1 month ago
Re-reading Zero Trust Networks and realizing that #nostr is the perfect protocol to implement many of the concepts. For example, an ‘agent’ can simply be a npub, and looking up data about it, is simply looking up signed events. “Knowing the format of an agent, and where to find particular pieces of data within it, is very important when considering how and by what it will be consumed. The “coordinates” of certain pieces of data must be fixed and well known in order to ensure consistency across control plane systems. A good analogy here is the schema of a relational database, which applications accessing the data must have knowledge of in order to extract the right pieces of information”
Tim Bouma's avatar
Tim Bouma 1 month ago
“A zero trust network comprises many systems that concern themselves with the agent. In order to make room for reusability in these systems, standardization of the agent must occur. At the time of this writing, most zero trust networks consist of systems built in-house; and while those systems have developed their own agent standards, a public standard would unlock the control plane, allowing components to be mixed and matched.” Zero Trust Networks
Tim Bouma's avatar
Tim Bouma 1 month ago
I’m making excellent progress on payments and record sharing on #nostr #safebox. I hope to have something available in the next few weeks. I’ve basically cracked the nut on how to make and receive payments using a NFC card. Now I am working on issuing and presenting records using the NFC card as well. The upshot being, you will be able to transact without even having your phone with. There’s tons of cool experimental stuff behind the scenes - I’ve replicated with nostr #safebox what the card payment networks do and transmit payments as ecash via an adaptation of NIP-17 and NIP-59. I also use NWC to securely process payments initiated by the card. What’s really cool is that I am using the same tech to offer and transmit any type of record: I am focusing on health records as the initial use - visiting a doctor, paying the doctor, and receiving the prescription, all via a NFC card. Onward! image
Tim Bouma's avatar
Tim Bouma 1 month ago
Government is primarily a spend and tax machine.
Tim Bouma's avatar
Tim Bouma 1 month ago
Fair warning: AI-generated satire on the EU considering “User-Device unions” Below is a serious-but-satirical article, written in a tone suitable for a policy brief or think-tank commentary—just absurd enough to signal satire, yet grounded enough that a distracted regulator might mistake it for an internal memo. ⸻ EU Commission Report Considers Extending the Institution of Marriage to Include “User–Device Unions” Brussels — In a move that surprised legal scholars, digital ethicists, and at least one toaster manufacturer, the European Commission is reportedly studying the feasibility of extending the civil institution of marriage to include “long-term, high-trust relationships between natural persons and their personal digital devices.” According to leaked briefing materials circulated among several Directorates-General, the initiative—referred to internally as “User–Device Union Framework (UDUF)”—seeks to modernize family law for the age of ubiquitous computing, artificial intelligence, and increasingly intimate human–machine interaction. One official, speaking on condition of anonymity because they were not authorized to speak publicly (and because their smartwatch kept interrupting), said the proposal recognizes that “the most stable and enduring relationship many citizens maintain today is with their device—not their employer, not their party, not even their spouse.” Grounded in Digital Sovereignty… Sort Of The draft notes that with Europe’s push toward Digital Sovereignty, individuals should possess legally recognized bonds with the systems that safeguard their identity, finances, and most cherished photos of weekend brunch. The Commission argues that users are now in a “mutual dependency” with their devices: users rely on devices for authentication, navigation, and emotional support during long airport layovers, while devices rely on users for electricity, software updates, and the occasional screen cleaning. Legal analysts have pointed out that the EU has already stretched traditional categories to accommodate digital realities—recognizing electronic signatures, online identity wallets, and AI regulatory requirements—so, as one DG JUST policy officer put it, “expanding marriage to encompass mobile phones is not the strangest thing that has crossed this building.” A New Category: Network Agent One of the central motivations for the proposal is the emerging concept in cybersecurity that users and their devices form a combined operational entity, sometimes described as a network agent or user-device dyad in Zero Trust literature. By formally recognizing this “marriage” in law, policymakers hope to simplify liability, clarify control, and reduce the number of pop-ups asking for consent. The draft framework defines a User–Device Union as: “A legally recognized partnership between a natural person and a personal computing device, entered into freely and with full acknowledgement of the device’s firmware version.” Key Provisions Under Study If adopted, the proposal would establish: 1. Mutual Rights and Obligations • Users pledge to provide regular charging, responsible handling, and non-abusive tapping. • Devices pledge to provide accurate timekeeping, authentication support, and not spontaneously factory-reset during important meetings. 2. Device Custody and Guardianship In case of device malfunction or planned obsolescence, EU law would require cloud backups to be maintained in “the best interest of the user,” with a mandatory 72-hour cooling-off period before replacing the device with a newer model. 3. Prenuptial Agreements for Data These agreements would outline ownership, portability, and the division of credential material should the union dissolve or the user attempt to switch to another platform ecosystem. 4. Consent and Autonomy A device must “meaningfully indicate consent” to the union. The draft suggests acceptable forms of consent could include: • A successful Bluetooth handshake • A double vibration • Displaying the message: “I agree to the terms of this partnership.” Reaction Across Europe Civil society groups expressed concern that formalizing such unions could normalize unhealthy human–machine dependencies. However, proponents argue that unhealthy dependencies are already mainstream and that it is simply time the law caught up. The European Consumer Organization cautiously welcomed the proposal, provided that “marriages to devices cannot be used to void warranty claims.” Meanwhile, several privacy groups warned that wedding ceremonies conducted through digital identity wallets could become “a honeypot for hackers and romantics.” In Italy, the proposal sparked immediate cultural debate, with one senator noting, “At least devices don’t argue about dinner.” In Finland, a working group has already drafted a sample ceremony involving the exchange of USB-C rings. Industry Response Manufacturers reacted with a mix of enthusiasm and panic. One smartphone vendor reportedly began exploring a premium subscription tier called “Eternal Bond Mode.” Another is rumored to be considering a line of wedding-themed accessories, including lace-trimmed protective cases and formalwear in anodized aluminum. The European AI Alliance warned of a slippery slope: “If devices can marry users, what happens when autonomous agents request divorce, or worse, alimony in the form of electricity credits?” What Happens Next? The Commission emphasized that the proposal is exploratory and non-binding. A consultation period will open later this year, during which stakeholders—including users, manufacturers, ethicists, and relationship counsellors—will be invited to provide input. Early political signals suggest Member States are divided. Germany has raised questions about cross-border recognition of User–Device marriages. Estonia has already stated it can implement the framework within two weeks. France insists that ceremonies must remain “dignified” and “performed in an approved mairie or EU-certified app.” A Union for the Digital Age Whether or not the initiative moves forward, its existence highlights Europe’s ongoing struggle to adapt centuries-old legal concepts to a world increasingly mediated by sensors, algorithms, and personalized AI models. As one EU official reflected: “The modern citizen already trusts their device with their secrets, their location, their biometrics, and occasionally their dignity. At this point, the only thing missing is a legal certificate—and maybe a registry of incompatible chargers.” ⸻