hodlbod

Christian Bitcoiner and developer of coracle.social. Learn more at coracle.tools

Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

NIP-05 Address

hodlbod@coracle.social

NIP-57 Address

hodlbod@getalby.com

Profile Code

nprofile1qqsf03c2gsmx5ef4c9zmxvlew04gdh7u94afnknp33qvv3c94kvwxgsprdmhxue69uhksmmyd33x7epwvdhhyctrd3jjuar0dak8xqg6waehxw309aex2mrp0yh8wetnw3jhymnzw33jucm0d5qcqy7x

Publishing to

hodlbod.coracle.tools

relay.westernbtc.com

relay.nos.social

Author Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

Show more details

Last Notes

2024-11-15 18:46:44

So Adam Curry is apparently pro-algorithm, which I did not see coming

2024-11-15 13:11:30

It's been a while since I announced any new @nprofile…89ta episodes, so in case you missed them, here are the last few:
On signers, with @nprofile…n6k3 : https://fountain.fm/episode/t0TJUY3C4i8frfzC26Fm
On chachi, with @nprofile…9yrf : https://fountain.fm/episode/xkZIvgCibHyc9OaUZ0y3
On zap.store with @nprofile…dvsl : https://fountain.fm/episode/NH0S9PClgN3B7NzrRt3E
All great conversations, thanks to all of you for coming on!

2024-11-14 20:51:31

- reply

It's the best AI code assistant I've seen so far, but it still just doesn't feel smart enough. I tried building a feature with it this morning but ejected after an hour or so. I love the way it incrementally makes changes and gives you full control, but the code it writes misses all kinds of semantics in the code (like distinguishing milliseconds vs seconds). Still hopeful I can figure out how to use it, maybe for obvious, large refactors.

2024-11-14 20:48:20

- reply

I really like this one, but I do think the copy could be tightened up a bit.
Oh yeah, I volunteered to do that didn't I?

2024-11-14 03:49:37

"Government, by its size, its momentum, and its authority, will not only perpetuate errors of doctrine or of policy, longer than they would otherwise retain acceptance, but it will multiply their effect on a geometric scale, as against the arithmetically cumulative effect of those errors if confined to individuals or smaller groups. The errors of tens of thousands of individuals, all thinking and probing in different directions and moved by different impulses, tend to cancel themselves out or to be softened by the attrition of doubt and disagreement. But let any one error become sanctified by government, and thus crystallized as truth, and little short of a revolution can discredit it or cause it to be discarded.
"An easy illustration of this principle is the witchcraft terror in the early days of the colonial government of Massachusetts. If there had been no governmental power to give phantasmagoria the semblance of reality by official decree, the common sense of a majority of the citizens would have kept this manifestation of fanaticism from ever having such widespread support and cruel results. But once government had authoritatively said, 'This is truth,' then the hitherto doubting citizen was willing to join others like himself in accepting it as truth. And we have at least a dozen idiocies, equally repugnant to man's common sense and sound experience, being perpetuated by our government in Washington today."
Robert Welch, The Blue Book

2024-11-13 22:55:14

- reply

["REQ","REQ-53019006",{"kinds":[0],"authors":["97c70a44366a6535c145b333f973ea86dfdc2d7a99da618c40c64705ad98e322"]}]
This is hodlbod.coracle.tools, just the regular vanilla url

2024-11-13 22:37:13

nip 46 is a never ending fractal nightmare

2024-11-13 16:41:53

- reply

#nevent1q…6mfe

2024-11-12 01:14:14

I've got another monster blog post on signers coming soon

2024-11-11 23:34:01

nprofile1qythwumn8ghj7mn0wd68ytntdaek6mmn9ehhyee0qythwumn8ghj7un9d3shjtnswf5k6ctv9ehx2ap0qydhwumn8ghj7mn0wd68ytn0wfskuem9wp5kcmpwv3jhvtcpzemhxue69uhk2er9dchxummnw3ezumrpdejz7qgawaehxw309ahx7um5wghxy6t5vdhkjmn9wgh8xmmrd9skctcpzamhxue69uhhyetvv9ujumn0wd68ytnzv9hxgtcppemhxue69uhkummn9ekx7mp0qy2hwumn8ghj7un9d3shjtnyv9kh2uewd9hj7qg3waehxw309ahx7um5wgh8w6twv5hszymhwden5te0wp6hyurvv4cxzeewv4ej7qpqxv8mzscll8vvy5rsdw7dcqtd2j268a6yupr6gzqh86f2ulhy9kkqdxa64k nprofile1qyt8wumn8ghj7etyv4hzumn0wd68ytnvv9hxgtcppemhxue69uhkummn9ekx7mp0qyw8wumn8ghj7mn0wd68ytf39ehxymewv9hxwctwdyhxxme0qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshszymhwden5te0wp6hyurvv4cxzeewv4ej7qg4waehxw309aex2mrp0yhxgctdw4eju6t09uq3wamnwvaz7tmjv4kxz7fwdehhxarj9e3xzmny9uq3wamnwvaz7tmjv4kxz7fwwpexjmtpdshxuet59uq3jamnwvaz7tmjv4kxz7fwwdhx7un59eek7cmfv9kz7qpqgetal6ykt05fsz5nqu4uld09nfj3y3qxmv8crys4aeut53unfvlqygds4v have you guys thought at all about adding nsec bunker support to AlbyHub?

2024-11-09 04:49:33

- reply

If my memory serves

2024-11-08 23:24:31

- reply

I honestly don't even know what I did wrong

2024-11-07 23:47:27

This gives me an idea. You could implement blocking by pulling your target's muted words list and always appending one of those words to your notes 🤔
#nevent1q…tje3

2024-11-07 21:03:00

- reply

Oh, but they read them if they're embedded right? note1/npub1 are nice because they're actual ids, but have no routing information embedded. I think we can't use them long term if we want nostr to work (npubs are probably ok because we can check indexers).

2024-11-07 16:41:33

- reply

What this means is the democrats could have had this election too if they wanted it.

2024-11-07 16:39:02

- reply

Do some apps not support nevent1? I know lots use note1, which results in failure to load in other apps that adhere more closely to the outbox model.

2024-11-07 14:52:58

- reply

I thought you might have

2024-11-07 14:15:26

I learned a little more about why people have such a hard time with bitcoin's "intangibility" while talking to my mom last night.
I asked her what it was like when credit cards were invented, and she explained that before electric cards there was something called a "charga-plate":
https://historyofinformation.com/images/Screen_Shot_2020-08-18_at_5.41.58_PM.png
This was a metal rectangle you would present at shops, which would be pressed into paper to create an authenticated artifact of the transaction.
The precursor to charga-plates was just regular paper checks. In either case though, the mental model is the same, and credit cards simply extended the same mental model of having some physical cash in the bank (whether or not that is strictly true), and authorizing someone else to talk to your bank and pull some out.
Bitcoin completely breaks this mental model. The problem isn't that it's intangible, because we've been using intangible money since the 16th century. The thing that breaks people's minds is that it is intangible, and has no custodian.
When you sign a transaction, who are you authorizing, and to request money from whom? It really doesn't make any sense from the legacy money perspective to authenticate ownership of a UTXO with cryptography, broadcast it to an etherial network, *pay* one of several miners to include your transaction in a "block" (?) so that the math money can be split and some handed to your counterparty.
Anyway, I think this difficulty might exist for nostr as well. Credentials authenticate you with the account holder, but keys authenticate your content with the reader. To make this worse, users have to custody their keys, making them the account holder and custodian — and when they log in to an application, they have to ask themselves permission to create self-authenticating messages! Weird.

2024-11-06 01:05:34

- reply

Also, aren't there like 6 open PRs with different approaches

2024-11-06 01:04:34

- reply

HEY!

2024-11-05 21:09:26

- reply

But that's the most extreme version of the argument. Why not make pkarr domains optional like this: https://github.com/nostr-protocol/nips/issues/1548
About home servers, I would say strong consistency doesn't scale. Even centralized web companies know this, and have embraced eventual consistency.

2024-11-05 20:54:43

- reply

Cool, well I think that's fair. Key management is a hard problem. If nostr can't solve it (somehow), then I agree, I don't think it'll succeed. Obviously I think we still have a chance to solve it without throwing away all our work so far, but I don't know enough about how PKARR works so I'll have to read up. I do think though that pubky is about as complementary to nostr as mastodon is. They can be bridged, but that's not a long-term solution, one network will have to win out (meanwhile blossom is pretty much orthogonal to both).

2024-11-05 20:13:31

- reply

Like, there could be good reasons like there were with scuttlebutt, I just don't know what they are

2024-11-05 19:53:14

- reply

What I don't understand is why you chose to essentially hard-fork nostr. Why not build all this cool stuff on nostr? It would all work as far as I can tell.

2024-11-05 18:46:30

- reply

Sleepy? Is that you? Blink twice if you're under duress

2024-11-05 13:57:43

I want this
#nevent1q…fucs

2024-11-05 13:31:13

- reply

"It's 5 am, just got done grounding myself, time for my sauna and cold plunge"
[Cut to bitcoiner eating a raw steak]
"I used to have ulcerative collitis. I still do, but I used to too"
[Checks the bitcoin price]
"Time to go to my job as an insurance broker. Gotta stay humble and stack sats"
[Cut to bitcoiner scrolling through millions of bitcoin podcasts]
"Lunch time, brought a pocket steak"
[Bitcoiner awkwardly eats a bloody steak from a plastic bag]
[Checks the bitcoin price]
"Time to orange pill some people"
"Do you guys take bitcoin? No? ...ok"
[Bitcoiner standing by the road holding a sign that says "vote for bitcoin"]
"Let's see what the latest is on nostr"
[Comes home to an empty room, grabs his only place setting from the cabinet]
"Steak time"
[Cecks the bitcoin price]
"Check out my library"
[Just 30 copies of The Bitcoin Standard]
"Can't wait for Nashville"

2024-11-04 19:03:48

- reply

yup

2024-11-04 18:56:09

- reply

This has never been more true

2024-11-02 15:24:32

- reply

Yeah, this idea is basically the flipside of subscription merging

2024-11-01 13:38:52

- reply

Yep, hodlbod.coracle.tools

2024-11-01 13:38:13

- reply

Blossom support was what pushed me over the edge on haven

2024-10-31 22:47:42

- reply

Nope 😞 it's on the very long list. This is what happens when you start a new product when you're only part way done with the first one.

2024-10-31 22:24:39

Running haven, thank you @nprofile…nuzx and @nprofile…4r8z

2024-10-31 19:19:52

- reply

Best CTA I've ever witnessed

2024-10-31 19:19:13

- reply

Just as I was about to bite into a PB&J sandwich... smh

2024-10-31 17:38:25

- reply

test

2024-10-31 16:10:58

- reply

test

2024-10-31 16:10:29

- reply

lol this was not intended to be sent

2024-10-31 16:10:13

https://image.nostr.build/8a2ad03f959938d67408f8ac89c821f44a2cdd257b577a025eb80d5b31214bae.png

2024-10-31 15:47:30

- reply

Yep, exactly. Definitely don't use it.

2024-10-31 15:46:53

- reply

Nice! Decided not to buy the book, but I will listen to this.

2024-10-30 23:16:44

- reply

Everything

2024-10-30 22:56:27

Timezones are a perennial nerd snipe https://ssoready.com/blog/engineering/truths-programmers-timezones/

2024-10-30 22:50:57

This is interesting, someone is quoting a translated version of one of my blog posts, and I still get mentioned. Nostr transcends language apparently.
#nevent1q…gvem

2024-10-30 22:12:21

- reply

You're much faster than I am

2024-10-30 22:09:38

- reply

Yep, just discovered myself that this is the source of the issue: https://github.com/airbnb/lottie-web/issues/3127

2024-10-30 21:46:30

- reply

Replicated it, it's an XSS

2024-10-30 21:46:21

- reply

Something is hijacking all button clicks. I don't know what post it is, but I was able to replicate it.

2024-10-30 21:38:39

- reply

This looks like an XSS attack

2024-10-30 17:41:44

- reply

Coracle does also show web of trust information on the relay browse page too

2024-10-30 17:30:47

- reply

Best I've come up with: https://github.com/nostr-protocol/nips/pull/1405

2024-10-30 17:29:19

- reply

Heck yeah, I put off messing with negentropy for a long time, but when I finally integrated it I was floored at how efficient it was.
https://tenor.com/bSJv9.gif

2024-10-30 17:26:39

- reply

hello

2024-10-30 17:26:36

- reply

Never got around to it. But it's useful information. There is a relay list on coracle's profile pages, but it doesn't show which list it comes from

2024-10-30 17:23:37

- reply

The difference between malice and humor is 24 zeroes

2024-10-30 17:22:48

- reply

Sorry, just saw this. The group posts thing is likely due to relay selections, and is a bug, but unfortunately it's not going to be fixed since I am sunsetting groups pretty soon. They may come back someday, but likely not in Coracle.

2024-10-30 16:51:35

- reply

Using advanced I assume? Validation is pretty light there right now, but try `search` instead of `content`: https://github.com/nostr-protocol/nips/blob/af4329986cae9b0ef625a01c8cefd5e802ca6895/fe.md#search

2024-10-30 16:23:44

- reply

There is a NUD and a PR: https://github.com/nostr-protocol/nips/pull/1554/files

2024-10-30 16:18:21

- reply

Where did you build this? `content` isn't specified in the NIP

2024-10-30 16:17:37

Russians have the best sense of humor
#nevent1q…v9j5

2024-10-30 16:17:36

Russians have the best sense of humor
#nevent1q…v9j5

2024-10-30 13:15:50

- reply

Screenshot?

2024-10-29 23:00:09

- reply

Started teaching my son this yesterday

2024-10-29 20:09:19

- reply

Cooperation requires conventions. Sometimes conventions are in conflict with an individual's strengths. My favorite example of the left/right handed thing is that castle staircases were built so that defenders could swing wide with their right hands, while attackers were up against a wall and couldn't swing as hard.

2024-10-29 19:20:55

- reply

Probably just chose the wrong icon, and the functionality isn't very useful for kind 1 notes, since coracle shows them fine. The idea is that for other kinds you can open the note in a client that supports the kind better. It's a first draft (like most things in coracle) and needs refinement.

2024-10-29 18:24:34

- reply

Yep, if there's a necessary server side component then 78 doesn't really make sense.

2024-10-29 17:16:38

- reply

I personally use NIP 78 to store user preferences, which are signed events on relays. If you're storing them on your server, I wouldn't bother signing them, since they're verified by your server. Unnecessary signatures/encryption creates more requests for user signers, which is UX friction.

2024-10-29 17:15:11

- reply

I think this is a possibility. Just get rid of ranges entirely and make everything replaceable.

2024-10-29 16:39:15

- reply

I agree, but I also think that nostr has adopted mutable state, for better or worse. I'm more concerned now about the complexity that this introduces to nostr's most important event kind. It's one thing for blog posts to support edit, which forces complexity onto only long-form clients, it's another thing to force everyone to support it.

2024-10-28 22:46:50

- reply

Luddism is great. Call it "reverse technological determinism"

2024-10-28 22:34:53

- reply

I've heard the same argument from Christians. As if God didn't invent math

2024-10-28 21:27:41

- reply

Coracle doesn't implement support for either, so showing it as a reply is the worst possible version (which is why annotations were done the way they were — you'll never be missing context). Amethyst also doesn't appear to implement annotations, leading to the same behavior. The difference is that edits overwrite, leading to different note content in different clients, whereas annotations always provide the full context.
TBH I'm fighting a losing battle with this one, nostr has long since embraced mutable state over event-sourcing. Not my preference, but that's ok. I still think edits come at a significant cost, even if everyone decides to agree to use them.

2024-10-28 15:27:27

- reply

This is indescribably awful, but also not very surprising. Definitely need to route around DNS

2024-10-27 13:41:53

- reply

If you used alby, you're safe.

2024-10-26 23:58:01

- reply

Signers need to connect to relays in most cases

2024-10-26 20:55:45

- reply

No such thing as negative press?

2024-10-26 20:26:55

- reply

Hey mom, I finally made it

2024-10-26 20:26:24

- reply

Not a good time, but "errare humanum est"

2024-10-26 20:24:50

- reply

The API key is public, because it's client side. So not privileged, however forks of coracle that are not up to date and havenct removed the bugsnag key may still be vulnerable.

2024-10-26 20:23:27

- reply

It's not categorically different, but in practical terms there are some benefits. For example, the codebase has fewer trusted dependencies and less code to review. On the other hand, they can become honeypots for attackers.

2024-10-26 20:21:20

Just found out my Coracle vulnerability made RHR as "breaking news" 🫠

2024-10-26 13:32:52

- reply

🌎🔫

2024-10-26 13:02:10

- reply

I have contacted bugsnag, we'll see what they say. And yes, moving towards forcing users to use remote signers.

2024-10-26 13:00:51

- reply

I think we should bite the bullet and figure out how to make it work

2024-10-26 12:58:47

- reply

Looks like it didn't go through before, just published again and it's updated now.

2024-10-26 12:56:39

- reply

Correct

2024-10-25 23:34:02

- reply

🫂

2024-10-25 23:25:09

- reply

yup

2024-10-25 22:32:58

Here's a quick postmortem on the Coracle vulnerability from this morning. If you haven't heard about it, please see below.
#nevent1q…9r8a
First off, the offending line of code was incredibly stupid. It only took a glance to realize that something was incredibly wrong. I went back and git-blame'd the line, and discovered that it was the result of a refactor, where a local variable named `session` was replaced by an imported variable with the same name. The former was a random string (in keeping with my attempts to anonymize users). The second was a user session object, complete with private key.
This leads me to my first observation, which is that no one is auditing nostr apps (just as no one is auditing most software out there). In many cases, there isn't even a code review step, because many of us are solo devs. Just because something is open source doesn't mean you can trust it. Just because you wrote something doesn't mean you can trust it! My key was leaked right along with those of my users.
Code review aside, there were some mistakes I made that resulted in the incident being worse than it could have been:
1. I used analytics and error reporting.
2. I did not self-host my analytics and error reporting.
Because I was using a hosted error reporting service, their servers were implicated in my mistake. Had I been self-hosting, I could be more confident that the data I have deleted is actually gone (even if my users don't have the same assurance).
Action item number one: analytics and error reporting are important enough to being able to develop Coracle that I'm not planning on getting rid of them, but I am moving immediately to self-hosted options. If you want to opt-out of that data collection, there is a setting for that within Coracle.
Another mistake I made is that I trusted myself to safely handle my users' private keys. This is more than just my mistake; despite the growth in use of remote signers, it's still very common for nostr applications to offer private key login or generation. But after this incident I'm of the opinion that no one should be handling unencrypted private keys, except for signers.
Applications should not generate private keys or allow users to sign in with them. Period. In fact, I propose we sunset the term "nsec" entirely. There's no need to make a friendly encoding for something that users should never see. Instead, users should be asked to export their private keys in the password-protected ncryptsec format only. This prevents clipboard attacks or poor key management from compromising users.
This is action item number two: I've already removed private key login from Coracle, and will shortly be re-working my onboarding process to redirect users to set up a remote signer instead of generating a key.
This will have implications for UX, and might make things more difficult for new users in the short term. But as @nprofile…4qru pointed out, the longer we allow users to treat keys like passwords, the longer they're forming poor habits for keeping their keys safe, because the two are categorically different. Removing support for private keys will cause pain in the short term, but will force us to improve our integrations with remote signers, improving security and UX in the long term.
That's all I've got for now. Thank you to everyone for your graciousness, I appreciate all the support. I'm honestly glad this happened, and I hope it will galvanize all of us into action to continue to improve nostr's security.

2024-10-25 20:42:56

- reply

I started that way, but ran into performance issues with my home baked solution. I'll take a look at glitchtip, I would definitely prefer self-hosted.

2024-10-25 20:29:52

- reply

I've asked them to, we'll see what they say

2024-10-25 18:32:15

- reply

There's no standard way to do it, but lots of people have success with social key rotation. Just make a new key and tell your follows you've moved. I'm sure we'll eventually come up with something more streamlined.

2024-10-25 18:14:01

- reply

I agree, nsec.app is the smoothest experience I've seen so far. Thinking about seeing if I can integrate it into the onboarding experience in Coracle, friction notwithstanding.

2024-10-25 17:47:29

- reply

😂

2024-10-25 17:33:11

- reply

Great points. Web apps also have lots more supply chain attack vectors than single-purpose signers might. I especially like your point about training users. Lowering security to accommodate UX doesn't do anyone any favors.

2024-10-25 17:29:45

- reply

You're probably right. I think we'll get there, we just aren't yet. Bunkers were introduced about a year ago, and have come a long way in adoption, but they're still not quite "easy" (unless they're custodial, and even then, most of those are offline).

2024-10-25 17:28:41

- reply

Agreed, it's a profitable conversation

2024-10-25 17:21:52

- reply

Very well put

2024-10-25 17:15:38

- reply

Neat project! Thinking about removing nsec login.