Tor and the average commercial VPN like PIA or ExpressVPN will do close to nothing for relay operators if an enforcement agent comes for them, unfortunately. (And I'm not talking out of my arse, by the way… end users need to keep this in mind: their anonymity is mostly an illusion, and most folks who think they're "off the grid" are actually doxxing themselves in a myriad of ways every single day.) I'm still in the "Is there anything to comply with? And if so, what and how?" stage. I assume most people on Nostr won’t comply, and at worst, they'll just take their personal relays offline. But assuming there is an option to comply (involving relays) I need to take my "the resistance" hat off for a moment, and try to understand if it's even possible to provide people with a compliance path to begin with. Ultimately each relay operator should make the call as they are the ones with skin in the game.

Replies (3)

Agreed. Morals are what emerge beyond fear of repression… Either when you're genuinely beyond repression (which is rare), or when you're fully aware of the consequences and still act according to your beliefs. I don't think I need to state where I stand morally, or I wouldn’t be maintaining Haven as my most expensive hobby, nor encouraging people to self-host in the first place. If we had 20,000 people self-hosting relays (be it Haven or any other relay software), the picture would look very different compared to just a few hundred. And if Nostr blows up like torrents did back in the day, that would again be a very different scenario. I strongly believe is that the default path on Nostr will be one of non-compliance (again, assuming there’s even anything to comply with). Still, my take is that healing happens when, given the choice, people voluntarily choose correctly (which, as you're suggesting, might be doing nothing). I don't believe in imposing compliance, but I also don't believe in imposing non-compliance. That doesn’t mean I can’t hold strong opinions about it, of course.
So are you speaking from the relay operator perspective or from the developer's responsibility? I would expect operators to comply with legislation for the region they operate in, exactly how typical web2 application operate. I would expect to be forced to comply with cease and desist or take-down orders if you fall under the jurisdiction of the region summoning you. If you operate a relay in the EU, and the EU government slapped you with a take-down request I'd expect to comply. These are things we've discussed at GitCitadel, we agree we don't intend to operate out of compliance, however we will do everything we can to empower customers to operate their own equipment to avoid government action. Dealing with feds in any country is no joke, they have the power to turn your life upside-down with the click of a pen. I personally believe a single company or founder of a company should not die on the hill of non-compliance, there are ways (for now) to keep you on the outside of a prison cell. IMO we are way more useful outside than inside one.
Answering here since the conversation below went in a different direction. In Anthony’s Wishful Thinking Universe, there’s basically no distinction. That is, users running relays on their mobile devices or Raspberry Pi are operators just like the big ones, such as @someone, @cloud fodder, and others. Folks running Haven, for instance, are storing and serving notes from people in their WoT when those people tag them. (I’m serving your note above from my Inbox relay; it’s small scale, of course, but people running personal relays are still relay operators.) In practice, I expect law enforcement to go after the big players (Primal, Damus, nos.lol, nostr.mom) first, due to their scale and the higher likelihood of finding adult content on their relays. But we also need to provide tools for the smaller-scale operators to self-moderate as well. Regarding government compliance (e.g. facial recognition, ID checks for age verification), I don’t think it’s up to me or other relay software devs to bake compliance directly into the relay software. However, moderation tools should be designed in a way that allows operators to build their own ad hoc compliance solutions. For example, @Mike Dilger ☑️ suggested implementing an approval queue. Then it's up to the relay operator to verify the user’s age before releasing a post, however they see fit, especially if they’re operating in the UK. Of course, I wouldn’t impose this on all Haven users / operators. There should be an auto-approval flag for folks in countries with less strict compliance requirements. Still, the option to enable an approval queue should be there, and it’s definitely jumping the queue on my list of side quests (That said, it’s not something that’ll be ready tomorrow, unfortunately).