Tim Bouma

https://tim-bouma.npub.pro/

Public Key

npub1q6mcr8tlr3l4gus3sfnw6772s7zae6hqncmw5wj27ejud5wcxf7q0nx7d5

NIP-05 Address

trbouma@getsafebox.app

NIP-57 Address

trbouma@getsafebox.app

Profile Code

nprofile1qqsqddupn4l3cl65wggcyehd009g0pwuatsfudh28f90vewx68vrylqpzemhxue69uhhyetvv9ujumnfd4hjucmpwd5z7qg3waehxw309ahx7um5wgh8w6twv5hsty5ta3

Publishing to

relay.nimo.cash

nostr.wine

Author Public Key

npub1q6mcr8tlr3l4gus3sfnw6772s7zae6hqncmw5wj27ejud5wcxf7q0nx7d5

Show more details

Last Notes

2025-03-29 17:34:49

#nostr has no insiders.
#nevent1q…t6wh

2025-03-28 23:59:52

- reply

Hmmm… works for me!

2025-03-28 19:36:27

IDENTIFICATION DIVISION.
PROGRAM-ID. HAL9000.
ENVIRONMENT DIVISION.
DATA DIVISION.
WORKING-STORAGE SECTION.
01 USER-INPUT PIC A(50).
01 RESPONSE PIC A(80).
01 HAL-NAME PIC A(8) VALUE "HAL 9000".
01 HAL-GREETING PIC A(50) VALUE "Good evening, Dave.".
01 HAL-QUESTION PIC A(60) VALUE
"What are you doing, Dave?".
01 HAL-RESPONSE PIC A(80) VALUE
"I'm sorry, Dave. I'm afraid I can't do that.".
PROCEDURE DIVISION.
DISPLAY "System: " HAL-NAME
DISPLAY HAL-GREETING
DISPLAY HAL-QUESTION
ACCEPT USER-INPUT
DISPLAY "You said: " USER-INPUT
DISPLAY HAL-RESPONSE
STOP RUN.

2025-03-28 19:23:26

https://image.nostr.build/23e49c9748bc90fcf7495576c5c055d0136f7c1001e7248daa6577f7bd5310ee.jpg

2025-03-28 15:48:47

The #nostr #npub identifier is the only type of identifier that I know of that can:
1. sign data
2. send and receive encrypted data, and
3. receive value (sats)
using a resilient and redundant infrastructure (relays).
And it’s all cryptographically assured (no trust required).
If that’s not enough to drop what you’re doing and build entirely new solutions, you’re not paying attention.

2025-03-27 14:50:45

The third panel is hilarious: File it under Meme or Kant.
https://image.nostr.build/7761f7d7dc313d22ab79555450be99204f7e6e237049060e9e07442b87ee4d8c.jpg

2025-03-27 13:06:13

- reply

Not directly on a project. But it was @npub1p4k…cxf8 who introduced me to the #hypermedia concept and I fell hook line and sinker. Now, I don’t regret missing 30 years of web client development.
There is no one solution, only tradeoffs. But I am willing to make tradeoffs. That’s another big thing I learned from @npub1s0v…rmq5
//cc @npub1l2v…ajft @npub1der…xzpc

2025-03-27 12:54:16

Browser is fiat
https://youtu.be/OpFN6gmct8c

2025-03-26 13:09:11

- reply

I think @npub180c…h6w6 is trolling us. I’m not going to move to another social network because merkle trees…

2025-03-26 11:11:54

Church and State used to be one and the same.
Now it’s Corporation and State.

2025-03-26 02:10:28

How about sovereign micropayment systems, instead?
https://www.moneyness.ca/2025/03/trump-proofing-canada-means-ditching.html

2025-03-25 20:23:02

- reply

We don’t know yet. My bet it will be instant micropayments combined with secure medical data.

2025-03-25 17:58:45

Security is something you do for yourself. Protection is what you have others do for you - like the Mafia.
Remember,
Security comes at a cost. Protection comes at a price.

2025-03-25 17:06:20

If you have an npub, I know I can communicate and transact with you directly. That’s a pretty big value proposition- bigger than being part of the social network called nostr.
#note136p…39gr

2025-03-25 17:03:00

wifi is about easy access to the internet
nostr is about easy access to other people
#note1thk…xgzp

2025-03-25 16:59:06

Everybody cares about the wifi password. Nobody cares about the underlying protocols.
We need to think about nostr in this way. Why should everybody care about nostr?

2025-03-25 16:49:42

- reply

I am much more optimistic on nostr the protocol versus nostr the network. Though crucial for my projects, I am trying to make the protocol disappear.

2025-03-25 14:17:10

My first step towards a #hypermedia app: the beginnings of a point-of-sale terminal for #nostr #safebox - reverse-engineering a simple calculator app and rebuilding according to the hypermedia principles. Still a few weeks away, but looks promising!
https://image.nostr.build/54d25fed467c8f880d3bf21b086bcf64718fc815c75f01f468737e390f5ec2d3.jpg

2025-03-25 12:23:03

My latest noodle on how the key building blocks of #nostr support Title and Trade Networks (see my previous post)
https://image.nostr.build/c9570aa457891d073d5207a7772e0d79ffd00bc42688261c394bdff4d95ec276.png

2025-03-24 13:03:14

My next subproject for #nostr #safebox - building a #hypermedia point-of-sale terminal that works on a Kindle browser (more generally, any constrained e-paper device)

2025-03-18 21:05:20

hypermedia rabbithole...
https://medium.com/@strasbourgwebsolutions/fastapi-as-a-hypermedia-driven-application-w-htmx-jinja2templates-644c3bfa51d1

2025-03-18 16:22:23

Also make sure your architecture is decoupled enough with the transport layer to send JSON with carrier pigeons or SD cards hidden in potatoes.
#note1qdt…cn9l

2025-03-18 15:53:30

- reply

I'm excited to try this out!

2025-03-18 13:49:56

Amazing to see that HTML stagnated for about 30 years while everyone took a side-trip into Javascript client-server land (recreating the 90s). I missed all of that. Now re-entering into the fray, I am discovering hypermedia is the way to and about to go all in.

2025-03-18 13:11:06

debit=credit
That was the first form of self-validating data formalized by Paciolo in the 15th century. This gave rise to the modern banking structures and financial systems that we have today.
self-signed JSON
That’s the next form of self-validating data, discovered by and formalized by the #nostr protocol. Originally conceived as an alternative to social media, it’s proving out to be much more.
We are still early. Don’t underestimate its effect.

2025-03-18 13:03:40

- reply

I only re-started doing front end stuff about a year ago, after a 30 year respite, my reaction was WTF?

2025-03-18 12:47:36

- reply

I’m totally enjoying it!

2025-03-18 12:20:54

- reply

Not quite there yet, but excited to get there!

2025-03-18 11:47:07

self-validating data
+ self-describing messages
———————————————
simple badass applications

2025-03-18 11:44:38

Being a dinosaur randomly trundling into a small mammal garden has its benefits…

2025-03-18 11:41:54

- reply

That’s why I am reading Hypermedia Systems. The core innovation has been stagnant for the better part of 30 years while everyone ran alongside the protocol to create client-server programs again.

2025-03-18 11:37:51

- reply

In my early days, it was called PowerScript, built on top of Windows. Easy to code, easy to break.

2025-03-18 11:30:58

- reply

I just don’t want that feeling of being transported back to pre-web windows client-server development circa 1993. That’s what it is starting to feel like.

2025-03-18 11:22:59

HATEOAS - Hypermedia As The Engine Of Application State.

2025-03-18 11:20:40

Make HTML cool again.

2025-03-18 11:01:38

There is an actual term ‘legal fiction’; I see now it has expanded to include ‘legal hallucination’.

2025-03-18 10:51:18

signed JSON events > autopen signed pardons

2025-03-18 09:37:55

hypermedia + nostr == non-linear + self-validating

2025-03-18 00:57:45

Hold my autopen…

2025-03-17 18:51:46

My tech distraction for today - encoding gps coordinates into 32 byte hex strings and calculating distance between encoded coordinates. Fun and might be useful.
https://image.nostr.build/bb707b30da0976ab2a3f2977bd5911e9917b770b14dff7dd5dc4005fd5558277.png

2025-03-17 17:35:20

Push trust to edge completely; only settle for 100% cryptographic assurance.

2025-03-17 17:21:51

- reply

Bitcoin Reward Points.

2025-03-17 16:59:58

self-witnessing data

2025-03-17 15:05:55

- reply

One million sats?

2025-03-17 14:22:36

- reply

bitcoin mystics don’t wanna be nostr mystics.

2025-03-17 14:20:09

signed json > autopen
https://en.wikipedia.org/wiki/Autopen

2025-03-17 13:41:47

- reply

I thought memes were on the blockchain?

2025-03-17 13:41:07

- reply

Superglue

2025-03-17 13:06:37

- reply

Yep. It could work for that as well.

2025-03-17 12:38:14

- reply

I love Borges and genre, magic realism. If he were alive today, he’d have a field day!

2025-03-17 12:36:40

Incompetent authorities love being branded a being part of a conspiracy because it immediately discredits their detractors and it gives them undue credit for something they could never do (like, pull off a conspiracy). As with any good conspiracy, it’s unprovable so they don’t even need to prove anything, just deny.
If you want to own goal yourself against incompetent authorities, just claim they are part of a conspiracy!

2025-03-17 12:29:26

https://image.nostr.build/8247d078e15eb07b4f6af2d0026293a1562b0762a855ac287a1f1dea486b809a.png

2025-03-17 12:27:27

- reply

This is whatever you decide to add to your emergency card. It's all encrypted and stored on relays. I will implement the ability to reset the emergency code whenever.
In the end, it's a hell of a lot more secure than relying on a third party vendor that likely stores all the aggregate data on a S3 bucket in the clear.

2025-03-17 11:35:53

Hyperfalling down the hypermedia hyperrabbithole...

2025-03-17 11:17:13

self-validating system > self-healing system

2025-03-17 11:15:17

self-validating data can be part of any larger self-validating system.

2025-03-17 11:11:25

'The hypermedia is the hypermessage'
HyperMarshall HyperMcLuhan

2025-03-17 10:08:07

nostr = signed hypermaps

2025-03-16 23:01:30

- reply

Michael Connelly Bosch Series. LAPD. Any book. I thoroughly enjoyed Bosch on Amazon Prime Video. Audio books are great, because you can fall asleep during a segment and you really don't lose the plot. The plot format is great - a cold case forms the long plot, punctuated by a bunch of mini-cases.

2025-03-16 21:45:10

- reply

Everything has a price.
If you started getting 1M sats for every post you made, you'd change your opinion.

2025-03-16 16:42:04

- reply

Yup.

2025-03-16 15:00:42

nostr the protocol > nostr the social network

2025-03-16 14:56:49

https://image.nostr.build/b6bfc03a332c6b8207a613539454cdbcefae333e70252935460a5d43bf798527.png

2025-03-16 14:55:04

- reply

It'll change. It's not meant to be interesting.

2025-03-16 14:54:02

BTW , what inspired the logo design is the emergencency QR code that I am implementing.
Easily read by a first responder and the QR code displays your emergency information retrieved from a #nostr #safebox note. Can be printed on a card or etched on a bracelet.
https://image.nostr.build/5f38738313e1c582856ce59bedbb1ee825e3d80f9be357334a9080a7fa49f35a.jpg

2025-03-16 14:49:07

- reply

Devs aren't really the target market. It's people that actually don't really care about the tech underneath. I could do a logo of a purple ostrich running around in pirate underwear, but I don't think that will resonate.

2025-03-16 14:30:35

Starting to look for some professional designs. What do you think of this for #nostr #safebox ?
#asknostr
https://image.nostr.build/657910770d3ced0ef2ef442159ce87dd8fc040d7333df6bd803f43b3f2bf1051.png

2025-03-16 13:22:55

2025-03-16 02:27:44

https://eprint.iacr.org/2025/479

2025-03-16 02:24:59

GN
https://image.nostr.build/19d82e375045417ba8a044706b77098b68c0be4da09bd78e56401d4ceaf5e63d.jpg

2025-03-15 10:53:04

This is kind the idea with #nostr #safebox
https://image.nostr.build/7eec9c1bde43834f515eb129f1dc5b4b60898d519609c50ca6a27abe30f427d7.jpg

2025-03-15 10:06:59

Encrypted self-validating data is the root of your freedom.
#nostr

2025-03-15 09:55:38

https://image.nostr.build/9eefde2db2232d9ae8e4a57253836cdc9bd68e5218bb41062ea9387931bd90d5.jpg

2025-03-14 08:57:28

Every economic transaction ultimately boils down to energy/value, or joules/sats. #note1rmr…dwqs

2025-03-14 08:43:35

A Trusted Nostr npub: The Intersection of Self-Validating Data and Socially-Verified Claims
In Nostr, a trusted npub (public key) is built on two distinct but complementary components:
1. Self-validating data – Cryptographically provable facts that require no external trust.
2. Socially-verified claims – Assertions about identity, reputation, or key possession that rely on external trust and can go out of date.
Understanding this distinction is crucial to how trust is established and maintained in decentralized systems.
Self-Validating Data: Always Provable, Always Valid
Self-validating data is mathematically contained and can be verified at any time without requiring an external authority.
For example:
• A Nostr event is valid if its cryptographic signature correctly matches the npub.
• A message signed with a private key is valid as long as the signature is intact.
• The same message will always validate in the future, no matter when it is checked.
This property makes self-validating data timeless—it does not degrade or depend on external context.
Socially-Verified Claims: Trust Requires Timeliness
Socially-verified claims, on the other hand, are context-dependent and can become outdated over time.
For example:
• “This npub belongs to Alice.” This claim might be true today, but how do we know Alice still controls the private key tomorrow?
• Possession of a private key (nsec) is a socially-verified claim. While signing a message proves possession at the moment of signing, that proof becomes stale over time. The key could be lost, stolen, or compromised, and observers must rely on recent confirmation to continue trusting it.
Verification of a socially-verified claim happens at a specific point in time—but since time moves forward, the claim is always slightly out of date. This time delta means verification inherently involves some level of trust.
The Key Insight: Validation is Timeless, Verification is Temporary
• Validation (self-validating data) can be done at any time and remains true forever.
• Verification (socially-verified claims) must be done in the present but will always be slightly outdated.
This means that trust in an npub requires both:
• The ability to validate cryptographic proofs whenever needed.
• The willingness to accept slightly outdated verification based on social consensus.
The Challenge of Long-Term Trust in Nostr
Because socially-verified claims go out of date, maintaining trust in an npub requires:
• Recurrent verification – Users must periodically check if the npub is still actively controlled by the same entity.
• Redundancy – Multiple signatures or alternate verification mechanisms can reduce reliance on any single moment of verification.
• Awareness of revocation risks – Just because an npub was trusted yesterday does not mean it is safe today.
Conclusion: Trust is a Moving Target
A trusted npub is never fully trusted forever—it is a balance between self-validating cryptographic proof (which never expires) and socially-verified claims (which require continuous updating). The reality of decentralized trust is that while validation is deterministic and timeless, verification is a social process that degrades over time and must be continuously renewed.

2025-03-14 08:10:30

Validation vs. Verification: A Fundamental Distinction
Please Note: This is a #vibepost that has been generated, edited and reviewed by me.
Though often used interchangeably, validation and verification serve distinct purposes, particularly in systems that involve data, identity, and trust.
• Validation is about correctness and consistency within a given system. It asks: “Does this data follow the correct rules?”
• Verification is about congruence and completeness against an external reference. It asks: “Does this data match an external reality?”
Validation: A Self-Contained Mathematical Property
Validation can be purely mathematical and self-contained, meaning that its correctness is intrinsic to the system itself. It does not require external approval, only internal logical coherence.
For example:
• A cryptographic signature is valid if the signature mathematically corresponds to the provided public key.
• A blockchain transaction is valid if it follows the protocol rules (e.g., the inputs and outputs balance).
• A Nostr event is valid if the cryptographic signature correctly signs the message.
In all these cases, validation is purely computational. If the rules are correctly followed, the result is objectively valid—independent of social, legal, or contextual factors.
Verification: An External, Social Process
Verification, in contrast, requires an external reference point, usually a social fact. It determines whether the validated data corresponds to something real or agreed upon outside the system.
For example:
• A cryptographic signature may be valid, but is the key actually controlled by the right person? Verification would involve checking identity proofs outside the cryptographic system.
• A blockchain transaction may be valid, but is it legally recognized or socially accepted? Verification involves external entities (governments, institutions, courts).
• A Nostr event may be valid, but is the author who they claim to be? Verification would require additional trust mechanisms, like social recognition or external attestations.
Key Implication: Validation is Objective, Verification is Social
• Validation is deterministic—it can be calculated and proven mathematically, without human interpretation.
• Verification is contextual—it depends on external references, institutions, or collective agreements.
This is why cryptographic self-signed data (like Nostr events) are valid by design but may still require external verification to be trusted in broader social or legal contexts. Understanding this distinction helps clarify where decentralization succeeds (validation) and where human trust mechanisms are still necessary (verification).

2025-03-13 20:05:29

trusted npubs > root certificates

2025-03-13 19:28:07

- reply

Hard agree.

2025-03-13 19:27:23

I forgot how much I like 80s Hollywood movies.

2025-03-13 19:25:09

- reply

Thx. On the docket for the next visit.

2025-03-13 19:20:13

Another awesome call with the @npub1hea…vp8p folks. I plant to implement an ‘In Case of Emergency’ QR code for #nostr #safebox - a QR code that you can print and put into your real wallet that a first responder can scan and it takes you directly to your emergency page where you can specify any information that’s needed for an emergency.

2025-03-13 19:13:26

I ❤️ Madeira.

2025-03-13 15:56:48

My fave #nostr artist @npub17nd…950x alongside my fave #historical artist @npub1pcz…ehtq (whom I wrote a book about) https://image.nostr.build/6ee011964ea152d14de8bba09acbb061cae329b3a6a3258eca000d11380369f0.jpg

2025-03-13 14:23:46

- reply

If he was handcuffed, he’d last longer.

2025-03-13 14:17:42

- reply

Something far worse - you can be ignored….

2025-03-13 14:15:36

- reply

Ah yes, the solution to over-hyphenated kid surnames is to give the daughter the mother’s surname, the son the father’s surname. Then the father gets stopped at the border suspected of human-trafficking his daughter.

2025-03-13 14:11:50

- reply

Tell that to the retired COBOL programmers.

2025-03-13 13:25:26

Forgive them, for they know not #nostr
https://image.nostr.build/53a23695efa80ccf4764ee33c9af02b5bf5481fdfeebfda0f37ba3b21e6fed2b.jpg

2025-03-13 11:35:26

meaning is just chaos in context

2025-03-13 11:33:55

provable by design > privacy by design

2025-03-13 11:21:34

Certificates expire. Npubs are forever.
https://media4.giphy.com/media/v1.Y2lkPTc5MGI3NjExd3F3MnQ1bWkzYWs1emJmczZwOWR6dXdkbmpybDBod2p4ZDdyZWV3OCZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/dw3C4ARa6mIRlg4DVm/giphy.gif

2025-03-13 11:01:09

Two new terms I came across or were invented this week:
‘vibe coding’ and ‘vibe blogging’.
In brief, anything with ‘vibe’ is something you are exploring where you may not have the expertise or the time to produce a reasonable finished result. What you bring to the effort is your human curiosity and human agency and you use this to direct the tooling to produce something that you feel is worthy enough to put your name on it.
I saw it in action with vibe coding and put it into action with vibe blogging.
The whole point of vibe* is to produce something, that is not perfect, but something you are willing to put your name (or npub) on it. It’s for others to judge for themselves, if it is of value, but first and foremost, no one prevented you from making that first call!
As for attribution as a creative work, the prefix of ‘vibe’ means that you had help, you were doing this for inquiry, and there is no intention that the result is intended for authority or persuasion.
Onward #vibecoding and #vibeblogging

2025-03-13 10:49:17

- reply

Yup.

2025-03-13 10:46:46

Npubs don’t have dreams and inspirations, but the people who generate them do.

2025-03-13 10:31:14

Forgive them for they know not what #nostr can do.
https://www.project-syndicate.org/commentary/eurostack-iniriative-aims-to-boost-european-digital-sovereignty-by-cristina-caffarra-2025-03

2025-03-13 10:29:11

- reply

It’s like owning a crappy cabin on a free frontier. Preferable to renting a luxury apartment in a state complex. Onward!

2025-03-13 09:44:12

- reply

Good prompting of ChatGPT. It would have taken me a week to put this together.

2025-03-13 09:37:10

weapon = tool + intent

2025-03-13 09:32:54

I came for the censorship resistance, I stayed for the unintentional breakthroughs.
#nostr #note1ss2…0ty5

2025-03-13 09:30:29

How Nostr’s Self-Signed Events Became an Unintentional Conceptual Breakthrough
Sometimes, the most profound innovations happen by accident. Nostr (Notes and Other Stuff Transmitted by Relays) was originally designed as a simple, censorship-resistant social media protocol. But in its design, it unintentionally solved one of the biggest problems in decentralized systems: how to create a universal, trustless data verification model without centralized issuers.
The key breakthrough? Self-signed events—a concept so simple yet so powerful that it fundamentally changes how identity, reputation, and data integrity work on the internet.
The Problem: Most Digital Identity Models Rely on Trusted Third Parties
In most identity and data verification systems, trust depends on a central authority (a government, a corporation, or a network operator). The Issuer-Holder-Verifier model—which powers systems like Self-Sovereign Identity (SSI) and Verifiable Credentials (VCs)—still assumes that:
1. An issuer must sign and vouch for the authenticity of data.
2. A verifier must check that signature against a trusted registry.
3. The holder is dependent on both parties for validation.
This model, even in its decentralized form, still reinforces external trust dependencies. It ensures that someone, somewhere, still has control over who can issue and revoke credentials.
The Nostr Breakthrough: Self-Signed, Self-Validating Data
Nostr’s design bypassed this entire structure by introducing self-signed events as the core data unit. Instead of requiring an external issuer to vouch for a message’s authenticity, the event itself proves its validity.
Here’s why this is revolutionary:
1. Every Nostr event is cryptographically signed by its creator.
• If the signature matches the public key, the event is valid.
• If anything in the message is altered, the signature breaks.
2. Verification requires no third-party trust.
• Anyone can check a signature without relying on a central authority.
• There’s no need to ask an “issuer” for validation—it’s built into the event itself.
3. No registry, revocation list, or lookup service is needed.
• Unlike the issuer-holder-verifier model, where verifiers check with an issuer, Nostr signatures are final and independent.
• The validity of a message is self-evident and self-contained.
Why This Matters: A New Paradigm for Trustless Systems
What started as a simple social media protocol accidentally created a universal model for decentralized, self-authenticating data. This breakthrough has implications far beyond Nostr:
• Decentralized Identity Without Issuers: Instead of a government or corporation issuing credentials, a person can simply sign messages proving ownership over data.
• Tamper-Proof, Uncensorable Communication: Because each event is self-authenticating, it cannot be modified or faked without breaking the cryptographic proof.
• A New Reputation Model: Trust can emerge organically by recognizing long-term, signed activity—without relying on external authorities to issue credentials.
Conclusion: Nostr as an Accidental Innovation
Nostr wasn’t created to replace digital identity systems or redesign trust models. It was just meant to be a censorship-resistant protocol for social media. But in its simplicity, it stumbled upon a fundamental conceptual breakthrough: self-validating, self-sovereign data.
This shift—from issuer-dependent verification to self-signed, universal proof—could reshape how we think about identity, credentials, and trust in a decentralized world.