dtonon
daniele

Working on Gossip, Coracle, Njump and other inspiring nostr projects. I love to build helpful things that people are pleased to use, mixing tech, design, usability and accessibility.

Public Key

npub10000003zmk89narqpczy4ff6rnuht2wu05na7kpnh3mak7z2tqzsv8vwqk

NIP-05 Address

_@dtonon.com

NIP-57 Address

tips@dtonon.com

Profile Code

nprofile1qqs8hhhhhc3dmrje73squpz255ape7t448w86f7ltqemca7m0p99spgpzemhxue69uhhyetvv9ujumn0wvh8xmmrd9skcqg5waehxw309aex2mrp0yhxgctdw4eju6t0s66kek

Publishing to

relay.nos.social

relay.damus.io

nostr.hubmaker.io

Author Public Key

npub10000003zmk89narqpczy4ff6rnuht2wu05na7kpnh3mak7z2tqzsv8vwqk

Show more details

Last Notes

2024-11-05 10:27:52

- reply

Benvenuto!

2024-11-01 06:57:14

- reply

It should discourage him, suggesting a "sensible" approach.

2024-11-01 06:49:46

- reply

Are you really showing a graph with a scale of 500 millions of years, to demonstrate that there are not problems, now, for the human being? The temperature is just a symptom, not the biggest concern. Think about what you breath or eat.

2024-11-01 06:31:18

- reply

Other's inbox relay are transparent from user's point of view, who should not have to worry about it.
I think that the main source of confusion is related to the fact the 99% of the time two different relays, inbox and outbox, are not really needed, they can be a single personal public relay.
Clients should just allow to add them, and only in an advanced configuration let the user tweak the read/write permissions (or deduce them by the actual permissions).
Then the user can be allowed to add an optional DM relay (suggesting that it enforces authentication), a search relay, etc.
As you see users think that the relay setting in Amethyst is quite confusing, after the Outbox model update; this approach could solve this.

2024-10-22 16:11:11

- reply

😂

2024-10-22 16:01:46

Today is my turn.
#nevent1q…q5wm

2024-10-22 15:21:54

- reply

Thanks!

2024-10-22 14:44:47

- reply

Do you have direct experience with LoRa (meshtastic/reticulum/etc)? I would like to understand the actual range on different terrain/landscapes.

2024-10-21 20:35:47

- reply

Scary. On which apps did you talked/texted about the products?

2024-10-21 20:04:08

- reply

Or make a new CLI command that simply wraps and calls nak?

2024-10-18 07:58:08

- reply

I suppose so.

2024-10-18 06:04:48

I like this relay-as-a-custom-feed approach. I hope this sort of experiments will force clients to finally embrace single feed browsing, and make it a first-class citizen feature.
#nevent1q…0anh

2024-10-17 20:32:18

- reply

Thanks Derek, I know I can find it around, but I would prefer a trusted source.

2024-10-14 15:20:58

LoRa buddy
#nevent1q…4yps
#meshtastic #reticulum #freakwan

2024-10-12 20:54:40

https://www.lesswrong.com/posts/bshZiaLefDejvPKuS/dying-outside
"I may even still be able to write code, and my dream is to contribute to open source software projects even from within an immobile body. That will be a life very much worth living."
Impressive reading, check also the comments.

2024-10-10 23:14:18

- reply

Oh right, they are creating a new desktop enviroment, I will check it.

2024-10-10 22:20:42

- reply

Even if it's not so hardcore, I like and find really usable the tiling manager included in PopOS

2024-10-10 13:48:52

Do you use any tilling manager on macOS?
I'm trying yabai + skhd, but I'm not sold.
#asknostr

2024-10-09 21:19:41

- reply

Cool!

2024-10-09 21:18:33

- reply

I also was confused by the UI, but if you use the square button on the right, you can login with a NIP-07 extension.
Then, if you inject https://github.com/fiatjaf/window.nostr.js via bookmarklet, you can also use your nsecbunbker.

2024-10-09 08:42:38

- reply

What is the incentive of arbitrators?

2024-10-07 14:44:18

- reply

Hardware signer are cool but unfortunately have poor scalability for the masses (cost, shipping logistic, mobile usage). I would aim for multisign/Frost solutions.

2024-10-05 09:19:43

- reply

A piece of history.
Cool stand, too.

2024-10-05 08:59:29

- reply

And I have the same problem with Voyage, @nprofile…xtm3

2024-10-05 08:57:33

- reply

I'm looking at 30000 "follow list".
Amethyst correctly loads plain lists, but it seems to discard the encrypted ones.
/cc @nprofile…vzaw

2024-10-05 08:53:11

- reply

> a problem I have now in Amethyst, which is that many notes are only "seen" by one or two relays
This should not be a problem, it is how the Outbox model works. Any other additional relay comes from a broadcast from users that interact with the event and this organically increase the decentralization and reachability of user's content.
It seems that you want to create an hybrid client/really, that actually could be useful in edge cases to support "thin clients", especially on mobile.

2024-10-04 19:27:20

- reply

Thanks, but Gossip produces corrects NIP-51 lists, so the problem should be different.

2024-10-04 19:25:56

- reply

Interesting.
What's the ultimate goal of this tool?

2024-10-04 14:03:32

- reply

I actually also remember using an encrypted list on Amethyst a long time ago, but now all my private lists are gone.

2024-10-04 08:27:41

- reply

The "unfortunately" refers to Amethyst.
@npub1gcx…nj5z are private lists planned?

2024-10-04 07:11:17

- reply

Siddhartha Gautama doesn't seem so primitive to me, and he said a few things about the reality of things.
I think we are improving overall.

2024-10-03 22:50:55

- reply

U
Yes, unfortunately only public lists.

2024-10-03 13:35:56

- reply

Nice cover too

2024-10-03 13:34:12

- reply

It's great!

2024-10-02 09:45:25

- reply

Nsec.app and local signers like Amber made custodial providers less interesting for tech savvy and diligent users that know how to self custody; but for onboarding a lot of casual newcomers, a custodial solution still seems a needed solution.
I'm reading the MuSign2 and Frost proposals, it's an interesting approach, but how do you ensure a robust infrastructure of more than 3 parties, which should be totally disconnected to demonstrate security? What incentives should these nsebunker providers have? Do they get paid? And should the user choose them randomly and pay them separately? And what happens if a payment is not made or if multiple nsecbunkers disappear at the same time breaking the quorum?
An alternative solution is to offer a single custodial nsecbunker, supported by a well-known entity (OpenSats?) and build a really clear user experience to lead the user (maybe forced after x amount of time?) to self-custody their key. Of course, this kind of structure would immediately become a centralized weakness, and thus a clear target for anyone who wants to destroy Nostr. Not to mention that it is not an absolutely easy structure to create and manage with good security standards; who would actually do it?
I don't know what would be the most effective way to proceed. I would probably try to elaborate the Frost approach, paired with a real good UI to enforce the user to keep a backup and validate it randomly every so often.

2024-09-27 08:35:25

- reply

It seems a great update, congrats!

2024-09-27 08:18:06

- reply

Damn, it's exploding.
@npub180c…h6w6 is the new lmdb going crazy?

2024-09-27 08:06:36

- reply

"Nostr-PHP dev Live now! Streaming hosted by Sebastix"?
It seems working fine here. Also the app buttons work.

2024-09-27 08:03:08

- reply

How can they tied someone else pubkey to their name?
NIP-05 includes the pubkey, the client verify that it matches with the pubkey of the (signed) kind:0 profile where the NIP-05 is saved, that's all.
Signing the NIP-05 doesn't improve this process.
Actually, signing NIP-05 could prevent someone, after hacking the server, from modifying NIP-05 itself. But it is a borderline case, adds a layer of complexity, and seems unnecessary for a simple identification tool.

2024-09-26 20:46:18

- reply

For the Outbox model, here is where all started (it was originally called Gossip, from the name of the client that introduced it): https://mikedilger.com/gossip-model/

2024-09-26 17:09:14

- reply

Damn, you parked over a police car?!

2024-09-26 16:26:02

- reply

There should be no delays in accepting notes, but in the last days we got several spam attacks and many relay tried to filter them, so this may have generated some rejections.
I suggest you to use a client that fully support the Outbox model, pick up a couple of public relays and a paid one with a good spam protection, to try to be visible to those using WoT relays.
Next step: run your own relay.
If can be useful:
#nevent1q…957d

2024-09-26 14:39:56

- reply

It depends on the number of calls in the unit of time.

2024-09-26 07:25:39

- reply

Is it slow?
I (partially) fixed a problem few hours ago.

2024-09-26 06:39:12

- reply

And Twitterbot is not better

2024-09-26 05:31:53

Damn Amazonbot

2024-09-26 05:16:43

- reply

In brief
Relays:
https://github.com/dtonon/chronicle
https://github.com/bitvora/wot-relay
Clients:
https://github.com/mikedilger/gossip
https://github.com/coracle-social/coracle/
https://github.com/dluvian/voyage
https://github.com/vitorpamplona/amethyst
The configuration should be fairly obvious, but I will eventually do a long format.

2024-09-25 21:10:13

👀
#nevent1q…aap9

2024-09-25 20:46:33

My current relays setup:
- Chronicle relay for inbox/outbox/dm and backup all my conversations
- Wot-relay to access my social-graph notes
- Pyramid.fiatjaf.com as secondary WoT relay + OpenTimestamp
- Nostr.wine to let flow in events outside the WoT with a good spam protection
- A couple of big relays (nos.lol, damus) as outbox relays, without announcing them (Gossip feature)
This setup, together with clients that support the Outbox model (mandatory!), is working extremely well, zero spam, snappy clients and low bandwidth usage.
TL;DR; The Outbox model plus some WoT wizardly, wins

2024-09-25 18:53:52

- reply

I think I found the bug, patch is coming soon

2024-09-25 16:26:24

I just pushed a little but important optimization to properly accept reactions, zapping, and deletion for all notes included in conversations.
*** Important: the default storage is now Badger, so if you need to upgrade a running lmdb instance, please use the appropriate tags explained in the readme.
#nevent1q…5kd9

2024-09-25 15:12:40

- reply

> That is what the word follow is used for in most social media.
True. Since we had no other tool, which is instead offered by Nostr.
It's all about a new paradigm and offering users a clear way to embrace it.
> Try making a new list type for your special use case like “people I trust” instead.
In this way you defend the legacy position of the usual social networks, to what end? A social graph is not just a feed, it is used and will be used in other contexts, such as checking the reliability of an application (see zap.store).

2024-09-25 14:14:55

- reply

Content can be a proxy for the trust, and in fact it usually is.

2024-09-25 13:41:04

@npub1utx…50e8 how did this airdropper infiltrate your WoT?
We need an option to automatically unfollow the weak links in the chain, haha
https://image.nostr.build/1ce9e7ec8d802ea931ae6e81654ecec9fadf299f14fcbd532e28caf3ee56974e.png
656769ed2e26d887b430c319c1c0d8fefe0c5c491d4d39eb8823a4aa29733a37

2024-09-25 13:31:37

- reply

https://follows.nostr.com
The usual suspect

2024-09-25 13:17:14

- reply

It should be better now.
Thanks for reporting!

2024-09-25 13:09:42

- reply

A bit. Work in progress. Please be patient.

2024-09-25 12:52:37

- reply

It could help communication to users, especially for paid relays.
In addition it could allow to point to a relay without knowing the domain, thus enabling easy domain switch, which would increase resistance to censorship.
Perhaps there are other uses.

2024-09-25 12:35:43

What is the status of the proposal to assign a pubkey to relays?

2024-09-25 12:34:13

- reply

You have waited patiently for this moment.

2024-09-25 06:02:52

- reply

Good question: you need an open relay for that, this currently is the only easy way to "infiltrate" the web of trust.
There are other possible solutions, such as whitelist notes with some PoW, or create an invite mechanism, but they all require some form of agreement by the clients.
By the way this is a limit of all WoT relays. I'm planning to make the WoT check optional and add other filters (keywords, pow, nip-05).
This should help to have a more flexible configuration, still keeping a good amount of protection.

2024-09-24 21:28:40

- reply

Does it support Amber?

2024-09-24 19:24:16

"It means we are actually building a decentralised protocol, not just acting out decentralisation theatre"
#nevent1q…veha

2024-09-24 12:11:31

- reply

> Will nostr require a consortium similar to W3C who maintain the http protocol?
> Can their nsec be linked to face id?
/ @nprofile…ej4c left the room
😂

2024-09-24 09:36:07

- reply

A NIP-32 label with a PoW invite, attached to the user kind:0?

2024-09-24 08:49:34

- reply

The concept of “dumb relay,” as it was initially coined, in my opinion should be framed in terms of minimum and necessary functionality. The backbone of Nostr must be able to sustain itself with relays that expose the minimum functionality provided by NIP-01, each addition being a bonus, cooperating with what clients can make available.
This is not a matter of shifting workloads from one end to the other, but of seeking synergy, where the result is richer than the algebraic sum of the two parts.
There will inevitably be overlaps, redundancies, and that is good, as this is also in its way a form of decentralization on the relay-client axis.

2024-09-24 08:34:26

- reply

> 1) Trolls will `@` their way onto your relay. It's a loophole you should be careful about using.
Chronicle protects you from that, unless the mention is within the conversation you are partecipating, and the troll is in the WoT. Actually, WoT would be sufficient.

2024-09-23 17:34:59

- reply

What is this, the "relay release day"?! 😀
Great!

2024-09-23 15:16:21

While everyone is getting nervous about spam, say hello to Chronicle!
https://github.com/dtonon/chronicle
Chronicle is Nostr personal relay, built on the Khatru framework, that stores complete conversations in which the owner has taken part and nothing else: pure signal.
This is possible since writing is limited to the threads in which the owner has partecipated (either as an original poster or with a reply/zap/reaction), and only to his trusted network (WoT), to protect against spam.
Chronicle fits well in the Outbox model, so you can use it as your read/write relay, and it also automatically becomes a space-efficient backup relay.
Try it out, and let me know if you find it useful and how it can be improved!

2024-09-22 21:14:17

- reply

I see.
Maybe you can create a simple command line tool to quey a large set of relays and create the nevent.

2024-09-22 20:08:52

- reply

Why? Which is the use case?

2024-09-22 16:31:39

- reply

Maybe the first time? For me this url loads instantly now.
I don't see any https -> http redirect; actually the inverse redirect takes place.

2024-09-22 07:47:05

- reply

Ok, now I understand the "time window" logic. I was thinking about the usefulness of the block hash alone.

2024-09-21 10:07:54

- reply

Hahaha, legit

2024-09-21 07:48:35

- reply

Can you give an example where this latter attestation might be useful? Usually the need is to prove that something is _older_ than X.

2024-09-21 07:37:24

- reply

In your note you said the inverse, adding the block hash as a tag. And I can actually create an event today, with yesterday's date, adding a yesterday's block hash.

2024-09-21 07:12:19

- reply

How can this help with past events? They can easily be forged.

2024-09-20 19:52:39

- reply

The wot network includes your contact list and the contact list of those you are following, so two degrees. It is not configurable.

2024-09-20 16:21:39

- reply

Add wot.dtonon.com

2024-09-20 10:49:03

- reply

More replies

2024-09-20 10:38:55

- reply

Interesting approach, but it seems resource intensive (calculate images hashes or similarities for all the social graph is heavy) and I suspect it can be quite fragile. Probably WoT is quicker and safer. Btw, NIP-05 is not involved here, even if it can be used to compose the final score.

2024-09-20 10:29:29

- reply

Uh, nostr-wasm makes a difference

2024-09-20 10:21:57

- reply

I know it is for identification, except for rare cases, in fact few weeks ago I updated NIP-05 to clarify that.
And that is precisely why there is no point in showing it everywhere, especially if it is invalid. The point is to simplify the interface (I know, I won you over here, haha) and avoid exposing a detail that is unnecessary and may indeed be confusing.
Intead in the profile, with a proper explanation, it can be useful to debug misconfigurations or have a clearer idea about what the profile is trying to do.
What is this impersonator tag?

2024-09-20 10:13:24

It's open.
#nevent1q…xa6s

2024-09-20 10:09:09

- reply

https://github.com/mikedilger/gossip/blob/master/filter.example.rhai
- - - - - -
This is a sample spam filtering script for the gossip nostr
client. The language is called Rhai, details are at:
https:rhai.rs/book/
For gossip to find your spam filtering script, put it in your
gossip profile directory. See
https:docs.rs/dirs/latest/dirs/fn.data_dir.html
to find the base directory. A subdirectory "gossip" is your
gossip data directory which for most people is their profile
directory too. (Note: if you use a GOSSIP_PROFILE, you'll need
to put it one directory deeper into that profile directory).
This filter is used to filter out and refuse to process incoming
events as they flow in from relays, and also to filter which
events get displayed in certain circumstances. It is only run on
feed-displayable event kinds, and only events by authors you are
not following. In case of error, nothing is filtered.
You must define a function called 'filter' which returns one of
these constant values:
DENY (the event is filtered out)
ALLOW (the event is allowed through)
MUTE (the event is filtered out, and the author is
automatically muted)
Your script will be provided the following:
caller - a string that is one of "Process", "Thread",
"Inbox" or "Global" indicating which part of
the code is running your script
content - the event content as a string
id - the event ID, as a hex string
kind - the event kind as an integer
muted - if the author is in your mute list
name - if we have it, the name of the author (or your
petname), else an empty string
nip05valid - whether nip05 is valid for the author, as a
boolean
pow - the Proof of Work on the event
pubkey - the event author public key, as a hex string
seconds_known - the number of seconds that the author of the
event has been known to gossip
spamsafe - true only if the event came in from a relay
marked as SpamSafe during Process (even if the
global setting for SpamSafe is off)

2024-09-20 10:05:55

All clients flag a NIP-05 in some visual way if it is invalid. This can happens for a misconfiguration but more frequently when someone try to impersonate. The problem is that this "flag" (e.g. green/red icon, open/closed lock) is not always obvious, also because it is often next to the profile picture, and newcomers may be confused and deceived. Moreover, an incorrect NIP-05 does not always correspond to spam/scam, so it cannot be further highlighted.
Best pratice proposal: just hide invalid NIP-05s in feeds and threads, and show them only in the profiles, with a proper description of the problem.
#nostrdesign

2024-09-20 09:54:42

- reply

Of course, in fact it is used for identification.

2024-09-20 09:48:02

Gossip + Spam filter by rhai script = Relief & Zen mode
Terrific feature @npub1acg…p35c

2024-09-20 08:46:22

- reply

Test replies

2024-09-20 08:45:17

- reply

@npub17nd…950x nice brand placement
https://image.nostr.build/ac08253690edc7563070237183b0055593398fe880b13771edd32a2cd4160225.png

2024-09-20 07:42:26

- reply

Web-Of-Trust
It is based on the social graph, the connection with people through those you follow directly. It can be used to 'weigh' the trustworthiness of people and then build a spam filter.
Since WoT filters can block unknown people outside your social graph, you can mix it with other techniques to whitelist exceptions, for example PoW (proof of work), some form of payment, profile and text analysis, and so on.
All this refers to the clients' side, on the relays' side we can enforce networks filters and other kinds of analysis.
Thank you for using Nostr :)

2024-09-20 07:23:35

- reply

But unfortunately they do not (yet) apply WoT within threads.

2024-09-20 07:21:00

- reply

Usually a newcomer is invited to join Nostr, even if only indirectly by reading an article or watching a video or talk. For the few who start from scratch, clients usually suggest a few people to follow or automatically follow the developer. Basically you always have someone to build wot.
But the point here is that without a sensible filter newcomers get confused, and runs away. The only alternative I can see is a single relay with good spam filters bundled in a client; but it's not very Nostr style.

2024-09-20 06:53:46

- reply

Yes, it's a surreal mess.

2024-09-20 06:51:48

- reply

Coracle and Vojage for sure, I am trying to find out if there are others.

2024-09-20 06:44:51

The next step in the spam attack: "catch-all" domains to produce valid NIP-05s. Be ready.
Just a reminder that NIP-05 does not verify.

2024-09-20 06:31:52

Any client without a life-saving WoT filter is doomed. And it should be forbidden to suggest one to a newcomer.

2024-09-19 21:52:55

Digital signatures and how to avoid them
https://neilmadden.blog/2024/09/18/digital-signatures-and-how-to-avoid-them/

2024-09-19 20:59:10

- reply

Two weeks ™️

2024-09-19 16:09:39

- reply

I'm quite busy right now, but If you can't find anyone else feel free to ping me :)