Sharing some thoughts during development of my first web application on/with NOSTR.
The beauty of this protocol and also its promise lays within its censorship resistance. So it is an obvious design philosophy during development. This concluded for me two leading principles:
1- do not use a database for user generated/relevant data (as far as possible): publish events to relays!
2- ensure that the app does not get into power of the data, e.g. the data has to be in the ownership of the user and not in the ownership of the app
The second principle is a real challenge and very important at the same time.
Because if an app starts to publish all user-relevant data in events, that the app signs itself, then the user loses all power about it - the protocol does not really nip here.
Instead, the app must be built in a way that all user-relevant data will be published in the name of the user, e.g. using his public key and signed with his private key.
The challenge about this is that if the app gives all power to the user, how can the app be sure that the user is not cheating?
It is possible to built, but not easy to grasp at first. There must be more than one event to cover a case, that could be done in a "classical" way with one. And in some cases it might make a database necessary to ensure nothing gets lost.
Maybe this was clear or redundant to others from beginning, but I just realized that the protocol only makes sense, if the data on the relays is in the ownership of the author itself. App developers should be careful with this.
Otherwise, the app/platform can always censor the data as before and mislead from the actual protocol.
Let me know if you have also encountered this challenge and what are your best approaches to handle them.
Curious to know what plebs would chose:
1) Get Bitcoin worth 1 Million USD now on your wallet.
2) Wait a year and get 1 Trillion USD on your island X bank account.
👀⚖️⏳💰🌊
Do not use your `nsec` directly with web apps to login. It will be saved in local storage of your browser and might be grabbed through XSS attacks.
It is more safe to use signers that are supplied by browser extensions, such as:
Alby
nos2x (Chrome)
nos2x-fox
More info and links here: