This is how the world starts to descend into mediocrity.
View quoted note →
Login to reply
Replies (107)
I broadcast the event, of course he could have done it too
The posts are backdated with the commit date they're based in.
That would be easy to find out with `nak req -k 10002 -a e4641d0eed71d2d0c0f68cd3508d50fcdb1954ac1ccda269ddbb7a7897c22614 relay.damus.io purplepag.es user.kindpag.es relay.nos.social relay.nostr.band`, but the answer is yes.
Add relay.westernbtc.com as a relay.
That is precisely the reason @fiatjaf is producing all these posts... to put the problem into developers faces so they can smell it up close.
Without the ability for clients to fetch notes from (perhaps the only relay that doesn't censor them) as specified in the nevent that points exactly to where that note can be found..... then what was the point of making a decentralized protocol?
So *this* is why no one ever zaps me
Why wouldn't it be friendly?
At a current stage nostr feels like a toy project
For those of you using substandard web clients like primal or nostrudel:
View quoted note →
View quoted note →
How would people have found out that relay.westernbtc.com exists if we weren't replying in these threads with the address?
It is a toy project. It has always been. No Nostr app is anywhere near what I would call a stable version.
But what’s so special about this note? Why doesn’t it render anywhere?
Is it a relay issue or something else?
It renders on coracle.
It has a relay hint that we are not tracking yet because connecting to random relays allows people to track you.
Just ive noticed clients use timestamps a lot to limit their reqs.. and tend to be very timeline centric. They won't usually see old notes. Tho that doesn't explain why they can't pull a specific eventID from a specific outbox. Relays also can tend to limit old messages, unless they're serving backups capability, so that would make it important that the outbox gitlost uses supports very oldness.
Ah good to know.
When you say track you, you mean me being forced to connect to a relay I don’t want? And possibly malicious?
The relay is not in your list, so the app won't connect to it. We are making a new permission screen to allow you to connect by clicking a button, but it's not ready yet. :(
But yes, attackers can use relay hits to monitor the IPs of victims they want to track. If they know IP, they can get a rough location. If they can track over time, rough locations become more precise identifiers. It would be an elaborate social attack, but it is possible.
know your relay operators just as you get to know your devs.
Yep. Relays know everything about you: your interests, the time you spent on each post, your IP/ location, etc.
If that's the case then fucking fix it. If I can be tracked from NOSTR I'm out of here.
Huh, so even if I follow the account, amethyst will not connect to that accounts outboxes? How will it find anything in that case unless your relays match their outboxes? Or you're just saying, outbox is not fully operational till you have the extra settings?
Yeah, the attack vector is much much larger than a centralized social platform.
Instead of Facebook or Twitter knowing everything about you (which at least they protect).
Here any rando could figure out a lot of things.
Guess I should really not use nostr without a vpn. Though now sure how much that helps.
Though VPNs somehow still leak a lot of information.
Servers can always track you. Relays are the same. That's why we avoid connecting to random relays. You MUST trust the relay operators in your relay list. If you don't trust them, don't use them. Find better ones.
Stfu nanny bitch Ava.
Literally ANY web service you use has this capacity. The only difference here is that its in the open. Many devs DO in fact advocate for privacy and security. @Ava is 🐏 and gives amazing tips and advice.
Know your threat model and how to work with it. No one else is going to hold your hand and do it for you.
Follows yes. We assume if you follow the account, you trust their choice of relay. But we are not there yet. We make to make sure users understand that risk before activating it.
But should the easy solution be.
If I see a note, and I quote it, the client should rebroadcast that not with my quote? Isn’t that just a thousand times simpler?
It doesn’t solve everything, but gets rid of some issues.
Ava is a nanny cunt bitch and I hate her.
Right, so I followed gitlost, and amethyst still couldn't find the note that was quoted. Anyway, just made me curious.
Find better ones how exactly?
Is there a central trust list?
Do you delete your browser history several times a day and use a vpn ? If not, you dont have to worry about little old nostr then lol
Yep, next step is adding their relays to your list automatically. Or at least getting your permission to connect when they are not there already.
I see... well anyway 💁
If people aren't using Tor and aren't using a VPN but they care about this, then I sure hope they never open a web browser.
But giving people the head's up and asking permission is nice. People want to see the note, but they also want to feel in control.
Every day.
thats exactly what we're trying to move away from
But there is a difference between my local diner knowing about me vs anyone who wants to.
Gotta do your research. Find each of your relay's operators, read their privacy policies and terms and conditions. You need to know who you are "in business with" and what they are and are not doing with your data. Don't delegate that due diligence to anyone else.
And always remember, if it's free, you are the product.
Thoughts on this @Vitor Pamplona ?
That's the goal. That security on Desktop is less of an issue, but mobile is crucial. You don't want people to know where you have been all the time.
We already do that. :) others should do too.
*cough cough* nostr registries *cough cough* @Laeserin 🇻🇦 *cough* *cough*
first as an answer to centralized nips repository. Next as an answer to trusted relay operators and developers. Close will be our answer to DNS. Thoughts @Vitor Pamplona?
https://wikifreedia.xyz/nip-event-register/npub1m4ny6hjqzepn4rxknuq94c2gpqzr29ufkkw7ttcxyak7v43n6vvsajc2jl
This is not easy for non tech people.
We have to make it easy. Or we are not building anything new.
Having some kind of built in VPN just for amethyst traffic would be really nice.. I can dream. Yes I know you can sort of do this with split tunnel but not for ever changing outboxes.
Yeah, but clearly the client @fiatjaf is using isn’t. lol now I I’m curious what he’s using?
If you connect to a relay, that relay knows you connected (your IP address) and what questions you asked. This is EXACTLY like a web browser. Everytime you go to a website, that website knows you connected (your IP address) and what questions you asked (the URL).
People who insist on hiding their IP address use VPNs or Tor. This works perfectly well with nostr just like it works for the world wide web.
Trying to avoid connecting to some relays just makes nostr dysfunctional. This problem is outside of nostr, and nostr clients are just making the problem much more complicated than it needs to be by coding connect-based relay access control lists. Just tell the user to use a VPN or Tor if they are concerned about privacy.
As for AUTH, that makes more sense to me. You shouldn't just AUTH to a random relay. But fetch a note... I don't see what the big deal is.
How about you go fuck yourself already. Go get laid stay the fuck away from me.
I am on board. We just need to keep moving on the right direction.
I love that you separated the relays into sections, is it possible to have a drop-down menu I relays that work in each section, that we can choose from and research or have a star system?
no wonder snowden quit lol
Nostr is a toy project? I thought that was the name of an ostrich 🤔
Can't wait for clients to run on notes.
Agree on Tor and on Auth. But we don't have a good/easy solution for Tor yet. Most people just use their regular connections on the go. So, I see as a massive privacy risk.
Yep that would be awesome to have.
Snowden knew that from day 1. I don't know if he quit but I can guarantee it wasn't because of this.
Yes, having used this option in gossip I can tell you @Vitor Pamplona with confidence that absolutely no one will use this option and leave it on to be bombarded by hundereds of questions whenever they open nostr..
We made the questions just a number in the lower left. AND after you answer all the several hundred questsions, they don't keep repeating eventually you catch up with it. BUT YES your point is very valid. It is fucking annoying to approve every relay.
But I'm also coming around to the idea that an 'nevent' is kind of like phishing, getting you to go to a relay that is malicious, just like a link in an email trying to send you to a malicous website. Whitelisting relays is one solution, painful as it is.
Conflict is the essence of drama. And this is an epic read. Convenience vs. Security will be a leitmotif of Nostr for months or even years to come...
🍻
just kidding, he didnt quit, he just get more attention on x
to much dev wasted redoing the same functions while big problems of content replication are not well solved
Cracks
what about a proxy relay for those connections? a relay relay
It is, and so is media loading.. which no one ever talks about they just harp on relays. VPNs or relay proxies that you trust are the only solution. And probably image proxies if you're doing the proxy option. Tho I applaud the efforts in attempting a UI for connections, it has enabled me to see that using nostr means you go to weird servers all the time. At least nevents don't have JavaScript payloads or anything, it's safer than browsing (I think). But images, yeah those are likely the most dangerous thing.
have you tried keet.io ? p2p imho is the solution
he just stop posting? maybe he is using another nym?
Media loading was the straw that cascaded this conversation in January. Malicious user posting people's ip from loading an image sent as a dm.
Does reading from a relay and not writing to it offer any changes in privacy?
its the internet you have an ip, its well known how to hide it
Yeah, but then they quickly cascaded into ranting about relays about 5min later.
It depends on which filters you send and if you have to auth or not. We just have way too many filters bundled in one subscription to risk. Gotta redesign that part of the code :(
sequence of events reads very familiar 🤔
sounds like drugs/ prohibition etc crazydays/metadata?
ya, still seeking solutions(can't code),,,,ffs
he'll be back
It feels like a startup company producing protoypes for a product line.
🤷🏻♂️ 
Except without the startup capital or time
Or staff. 😂
What can a malicious relay do to you besides spy on your IP?
It could ask for AUTH and if your client allows it your client will tell it (and prove) your npub. Then it knows WHO is at that IP. This IMHO is a step too far and clients shouldn't AUTH to random relays w/o asking the user. But gossip lets users turn that off if they don't care.
I'm not really sure how malicious a relay could be.
How about the note to be rendered show the relay name below an "Allow" and a "Whitelist" button.
I guess generally this is a similar problem as emails and images.
Many email clients just load you YOLO all images received, which is a stupid behavior.
That's also hard, because what "requests" do you allow, and what "requests" do you ask the user? At the end, if every key interaction is asked, it is the safest, but the most annoying.
Come on @primal I still don't see anything here.
Yeap. The majority people whom I onboarded left just because apps are poor and buggy and people confused. Simplicity and stability will win.
client decisions and technical debt are no reflection on the protocol imo.
Buckle up. The epoch is near.
Anyone concerned with the future usability of #nostr should read this thread to be aware of present challenges...
#nostr relays should talk between themselves as in a NETWORK so we can connect only to our trusted relay and pay them to protect our privacy
Your IP is recorded and tracked at every website that uses google tag manager for example, and thar is almost all websites. Your IP is sold and resold hundreds of times by Google and the hundreds or thousands of data aggregators. They build detailed profiles of everybody, and it's on the market. It's not just nostr, everyone needs a full time VPN and ad blocking, period, as a bare minimum.
Yes, but with nostr at least it’s possible to fix and make relays just a dumb servers that relay notes and nothing more than that
Centralized platforms knowing but "protecting" your information is a total fallacy they would like you to believe. Selling your information is how they got huge. They anonymize it maybe, but once it's sold it's out of their hands, and it is quickly de-anonymized, attached to a detailed profile, and resold.
The fixes have to be client-side and whatever can be done in the protocol because we don't know what malicious software relays run. I am glad to see devs are exposing what the problems are and iterating on potential solutions. Sites that just want your traffic will be quiet about the vulnerabilities, especially when keeping you vulnerable is so profitable.
I started to write that, but then I was like well, I did a thing a few years ago without staff, and we kind of have a "staff" now :)
VPN or tor is the only way to obscure your IP on the internet, feel like I'm talking to a wall sometimes. Is this just beyond most people's understanding? Relays are already as dumb as they can possibly get.
You don’t have to tell me this. I’m with turned on orbot but there are not too many people like me. Vitor did it right by implementing it inside the Amethyst, that’s what all of the mobile should do as well to make people aware and use it by default or turn off if they struggle with performance
Ok your note was very confusing then.. this one makes more sense. That's right you even ran a relay and use Tor now.. it's just sad when people see a note like this and go 'wtf? Back to centralized then'. Instead of, oh, how do I VPN?
Not relay yet, was lazy this weekend😅
We're also one of the largest and most well-known groups and we have steady income, already, and we haven't released a product, yet.
We're like Project Unicorns. 😂
thank you, i will start using nak more, very useful
I thought #nostr only recorded time and the content of posts? You’re saying individual relays can add their own trackers for other metrics if you choose to connect to them? I guess that makes sense, different servers/websites can use different analytics so why not relays.
Sure. They receive all requests you ask for from the app. They just need to save it.
Would be interesting if relays had a special REQ type that effectively says “go to this other relay and get me this event”. It’s like rebroadcasting the note without the client actually having the note. If the relay stores the note then it doesn’t even have to retrieve it with other requests.
This event doesn't exist.
