brugeman

New iframe-based signing coming to nsec.app and nostr-login!
Many of you have tried nsec.app and had issues. It might be slow and unreliable, because it involves talking over relays and waking up the signer using web push. iOS users had to keep nsec.app tab open to make it work.
Now check out this demo:
https://v.nostr.build/sajUBBgYejAShlcr.mp4
Basically, client app (or a library like nostr-login) can embed signer (nsec.app) as an invisible iframe and talk to it using browser APIs. Talking to your keys no longer involves relays or web push - it's instantaneous! Works perfectly fine on iOS Safari.
We're releasing the updated nostr-login on https://npub.pro, https://nostr.band and on https://primal.nostrapps.org for you to try it. If all goes well and public scrutiny doesn't kill this, we'll publish the new nostr-login on unpkg and every app using it will get a boost with nsec.app.
The NIP proposal is here: https://github.com/nostr-protocol/nips/pull/1557
I encourage web client devs to check it out, maybe this is how we take safe key access to the next level of usability on the web!

2024-10-28 10:12:48

- reply

Hi there's no such tool at this point. If you'd like to help us build it, you can find a good wordpress exporting plugin, export the public data you need and give us the exported file. Then we'll see if we can build an importer tool. Thanks!

2024-10-19 14:39:07

- reply

Looks like you only have 2 relays in your list - "wss://nostr.chrysalisrecords.com/" and "wss://nostr.indiemusic.com/" and both aren't responding. Please try adding more relays, i.e. wss://nos.lol or wss://relay.damus.io

2024-10-17 15:00:52

- reply

Websites made of your nostr posts and articles

2024-10-17 14:29:15

- reply

You want to fill it in yourself or want it pulled automatically somehow based on the event timestamp?

2024-10-17 08:39:48

- reply

Oh my didn't know I was to talking to you elsat! :)

2024-10-11 19:42:00

- reply

Custom domains section in site settings

2024-10-11 16:11:03

- reply

Sql works with indexes, without them it won't help. To add proper index you add single letter tag. If you want joins then all you are asking is for relay to bear the weight for you. Just denormalize your data, add a tag, and make life easy for both sides

2024-10-11 16:00:36

- reply

Try publishing it with npub.pro, people can highlight on the site too

2024-10-11 15:57:39

- reply

Awesome!

2024-10-11 07:47:32

- reply

Hi I've fixed it, there was a real mess with your sites somehow, need to improve that stuff. Your site is now available under your domain. Could you please go to Theme settings and change the "Logo" - the one specified now is broken, and this Logo isn't editable in general Settings so you probably missed it. Will fix this too. Thanks!

2024-10-11 07:22:32

- reply

Normally you'd just enter your username to the client and it would open the connection screen of nsec.app. If client is asking for "bunker url" (or just not allowing username) then go to nsec.app, open Connect app modal, choose "Advanced" and copy "bunker url". The "connection string" is nostrconnect:// string which most apps don't yet support.

2024-10-10 17:53:31

- reply

Latest retention is broken

2024-10-09 20:29:28

- reply

What I am asking is where does the nsec fit into the picture? Just using npub as user handle?

2024-10-09 17:58:13

- reply

So it's not working with Alby, right?

2024-10-09 17:57:10

👀
#nevent1q…czcy

2024-10-09 09:18:20

- reply

Please let me know if you need any help with npub.pro

2024-10-09 08:12:45

- reply

You mean npub.pro itself? Themes have dark modes

2024-10-09 07:17:19

Is Google Android really that much messed up?
https://ia.net/topics/our-android-app-is-frozen-in-carbonite
Is iOS trending there?
Web often seems like a mess too, but at least it's still open and standardized and not ran by bureaucrats changing rules and APIs at will.

2024-10-08 17:23:21

- reply

Looks like zap cooking npub has no relay lists published. Not sure where habla published your posts, but nostr sites can't find them. Can you please try setting up some relays for it? Maybe republish with habla to rebroadcast there? I will take a look tomorrow in case it doesn't help. Thanks!

2024-10-08 17:21:04

That's the way!
#nevent1q…s9ca

2024-10-08 08:25:24

- reply

Thank you, it's still our fault, we need to handle this automatically

2024-10-07 13:39:00

- reply

Thanks! Please let me know if you ever need any help or have any feedback!

2024-10-07 08:55:17

- reply

That might be possible, how would you envision this be show on the site? Some mark on each post?

2024-10-07 08:50:48

- reply

Could you please clean the site cache on mobile? Does the problem go away?

2024-10-07 08:50:08

- reply

Hi this is possible on theme level but will require significant customizations, unfortunately we can't prioritise that atm

2024-10-03 11:52:48

- reply

15 seconds might be for the self-hosted client-side-rendered version. I agree it's very slow, and it can and will be improved, it's just not our priority at the moment.
Our architecture is quite different from Nostrudel, our pages need the full data set loaded to generate proper HTML using a theme, vs Nostrudel that has no themes and can update parts of the page while receiving new events and thus can start showing you stuff much faster. We also have much higher expectations for coverage - if Nostrudel misses some events you won't notice and won't be too mad, if we don't show one of your posts on your site - you will 100% notice and report a bug. So we can't just copy what Nostrudel and others do, we have to figure out our own way of loading the necessary data as fast as possible.
We'll get there, but it will take a while.

2024-10-03 11:27:21

- reply

Hi, I understand. It's awesome how you're experimenting with the collaborative blogs!
I agree that content management there can be a challenge and it's not even clear how to do it right:
1. You might want to specify included hashtags per author - different for every npub.
2. You might want to "map" some hashtags to others on the site - your proposal above.
3. You might want to be able to edit metadata of each post to "reassign" it's hashtags etc.
4. You might want to just manually add all the posts you need without relying on hashtags for filtering.
The last 2 points seem like the most versatile - you can achieve anything that way. But it's a manual process.
And automated options usually have limitations - eventually you'll want even more customized filtering.
I'm happy to explore these options with you to figure out the best way to build collaborative blogs!

2024-10-02 19:15:30

- reply

You can put a url into the search input field to open it. Not sure why your app isn't showing up, will check tomorrow

2024-10-02 17:02:50

- reply

Can you please post a screenshot? I can't reproduce it

2024-10-02 15:03:37

- reply

Let me know if you have any issues

2024-10-02 15:01:22

- reply

Yes that's possible! Although zap splits are only convenient when you have extension or NWC wallet connected. In the future we plan to experiment a lot with zap splits and built-in ecash wallet, there are many things to explore including creating incentives for curators with zap splits etc.

2024-10-02 14:58:18

- reply

Relays only search for exact match. So for us to find a post, general rule is would need to specify exact unicode string. But there might be exceptions - some clients would add uppercase and lowercase version of the tag you post, which distorts the picture and makes you think that things work some times but not others.
It's a complex problem across apps, so for now please include exact tags.

2024-10-02 14:40:39

- reply

Nsec.app has self-hosted mode (that nobody tried, obviously), need to wrap it with some cross-platform app framework to make a desktop app.

2024-10-01 17:30:44

- reply

I understand the need here, but it might be non-trivial because Ghost themes that we use don't support this. So will leave this as a longer-term idea.

2024-10-01 16:54:26

- reply

Yes

2024-10-01 16:45:54

- reply

Sounds good, it would be symmetric to the general settings

2024-10-01 16:15:27

- reply

Submenu would have to be supported by the themes. Need to think on this.

2024-10-01 16:12:44

- reply

No need, we added it this morning after your report 😅

2024-10-01 15:05:26

- reply

Great question! We could do that right now selectively manually using code injections. Ghost themes do have some support for internationalization, but we haven't used them and will take a while to figure things out here. That's on a longer-term roadmap.
If there's a production site that needs translation please reach out, will try to help with manual translation.

2024-10-01 15:02:11

- reply

Right now there's no way to exclude hashtags, you'd need to manually mention included hashtags. But exclusion hashtags looks like a pretty simple feature, adding to the todo list, thanks!

2024-10-01 14:54:46

- reply

Really cool blog indeed! Great theme choice and settings!

2024-10-01 07:20:21

- reply

Looks like your site should be there at atyh.npub.pro and hashtags work fine for everyone afaik. Please let me know if the issues persist when you try it next time. Thanks!

2024-10-01 07:17:12

- reply

You can create any number of sites from 1 npub, just start from homepage by choosing a theme. There's just no "create site" button in admin panel yet, will add :)

2024-10-01 05:52:48

- reply

Thanks for the input! Unroll tag sounds interesting!

2024-09-30 19:17:50

- reply

Hi, just copy a link to anything you want in your browser and paste into Link field in navigation settings. Does that work?

2024-09-30 19:16:43

- reply

No special treatment for pow notes, will investigate tomorrow

2024-09-30 18:08:59

- reply

Thank you once again! Good feedback goes a long way too!

2024-09-30 11:27:19

- reply

You're welcome! Please let me know if you ever need any help!

2024-09-30 07:11:10

- reply

Is it not working for you?

2024-09-30 07:09:44

- reply

Looks really good!

2024-09-30 07:04:23

- reply

Hi, you mean when you reply to your own posts? We don't show replies in general, but threads seem like a useful case, will think on that. Thanks!

2024-09-28 18:35:16

- reply

Could you please try clearing the cache of npub.pro in the browser, go to homepage, click get started, click "preview" on some theme, then when it opens click "log in". Does it work this way? Thanks

2024-09-28 18:26:44

- reply

How does npub.pro die? Are you logged in? Using a browser extension? Can you post a screenshot please? Thanks!

2024-09-27 20:45:04

Which app gonna get a nostr website next?
#nevent1q…jflv

2024-09-27 09:31:31

- reply

It's actually not trivial to get right, so using an off-the-shelf component could make sense until you build your own solution. I wrote some thoughts on nip46 and nostr login options at nostrconnect.org and nostrlogin.org

2024-09-27 08:08:44

- reply

I see "Survive & Thrive in Orange". And it should be "Loving Girlfriends ⚡Zaawaadi & Angelika Grays".
Parse naddr and check that d-tag doesn't match the event you're showing.

2024-09-27 07:59:35

@npub1000…vwqk something's wrong here:
https://njump.me/naddr1qqjrzdfj8yenqcej95ungvf5956rzep495unxdmp943rjdm9xq6kxv3n8qer2q3qeaz6dwsnvwkha5sn5puwwyxjgy26uusundrm684lg3vw4ma5c2jsxpqqqpmxw0f7c5m
Wrong event is displayed, App buttons open invalid urls.

2024-09-27 07:19:42

- reply

Hey guys, take a look at nostr-login - would be awesome to try your wallet with nip46 signer app!

2024-09-26 15:38:56

- reply

Which site? It's usually CORS issue which doesn't happen in native apps

2024-09-26 14:29:16

- reply

Please let me know how it goes!

2024-09-26 13:35:50

- reply

Try this https://media.nostr.band/events-latest.jsonl.gz

2024-09-26 11:15:10

- reply

You can create a file /.well-known/nostr.json on your site and put your pubkey there:
{"names":{"_":"your_pubkey_hex"}}
Pubkey must be in hex, not 'npub' form - use nak.nostr.com to convert.
Then you put _@yoursite.com to your profile into NIP-05 field.

2024-09-26 07:52:30

- reply

I'm not sure what is meant by cache hijacking.
Re. session hijacking we might be talking about at least two things:
- vulnerability inside nsec.app such that someone gets access to your "session" in nsec.app
- vulnerability inside nostr app connected to nsec.app that exposes the app's session/connection info so that hackers can access keys on behalf of the app
The first part doesn't have much surface with nsec.app - we only use server to store encrypted keys and to subscribe to notifications for the signer to wake up. There's basically no "session". And any server-side auth is based on nip-98 which requires a new token signed by your nostr keys for every request, so again there's no "session" - you can only sign those tokens if you steal the main key.
The second part doesn't depend on the signer (online or offline) - no matter which signer you use, it's the app that's connected to the signer that needs to be hardened against session hijacking. That's why it's super-important to not give excessive permissions to any (even trusted) app in your signer, so that potential hackers' access to keys was as limited as possible. Also when connection is established using bunker-url or nostrconnect url we use a one-time "secret" so make sure the connection can't be spoofed and url can't be reused.
I'm not a security specialist, and I agree that a formal security audit would be beneficial. We'll get there eventually.

2024-09-25 17:17:03

Future!
#nevent1q…3gtj

2024-09-25 16:43:21

👀
#nevent1q…7m63

2024-09-25 11:44:30

- reply

Awesome!

2024-09-25 07:56:20

👀
#nevent1q…u2gn

2024-09-24 15:12:14

- reply

Yes! You can add several authors on your site and have them all contribute their share of content.

2024-09-24 15:00:50

- reply

Oh, there was a bug - the menu showed up in the wrong place on reiartur. Fixed, can you please try again?
https://i.nostr.build/yZOqWZUQ0dvgd8mo.png

2024-09-24 10:16:54

- reply

The reply above doesn't link to root post published on the site, it links to your comment as the root. Which app did you use to comment, @nprofile…sunc ?

2024-09-24 08:48:07

- reply

Highlight and quote show up if you select some text

2024-09-24 07:28:04

- reply

Sounds about right!

2024-09-23 20:31:10

- reply

10gb was a test one that I mistakenly left there when published. It's 550gb. But I can cut a small piece for you. How about 10m recent events?

2024-09-23 19:23:14

- reply

Looks like most of the stuff on the micro.blog feature list (aside from import/cross-posting and newsletters) is doable right now with npub.pro+nostr apps. Of course it's all buggy in many areas, but the bones are there.
What's the primary limiting thing we should fix asap? Thanks!
https://i.nostr.build/GFh636EADT4TwHs3.png

2024-09-23 19:15:27

- reply

Looks great!

2024-09-23 14:40:52

Nostr-sites getting more interactive!
#nevent1q…zsan

2024-09-23 14:39:29

- reply

We could set up a special purpose relay and post various labels there, like nostr.build's content-moderation labels or "profiles with 'replyguy wss' mentioned". Ideally clients would let users choose which labelling pubkeys to pay attention to, and then would use the labels to filter stuff. Relays could use it too, but that's a bit trickier.
I also agree that it's much easier to make blacklists explode than to get spammer's pubkey into a "trusted" status (whitelist). We could publish "trusted" labels in the same way on special purpose relays.

2024-09-23 10:39:37

- reply

Hi, thanks for the report. Some relays didn't receive your deletion request and still serve old site events, and in case we fail to fetch your deletion requests from other relays for some sites those would re-appear. They should be gone if you reload the page. We're aware of the issue, but it's not trivial to solve for now. Reloading the page should make them disappear.

2024-09-23 10:35:29

- reply

Looks like some caching issue, seems fine now.

2024-09-23 09:41:48

- reply

Hi the issue is with relays - please choose some relays for this new profile and make sure those relay lists are saved on nostr, how to do that depends on the app you're using. We can't find your relays and then can't send you one-time login code and can't load your content and then can't publish your site event.

2024-09-23 09:34:23

@npub1ye5…knpr account switching seems broken in nostrudel. When I add another account I can't switch to the previous bcs it doesn't show up in dropdown, and then if I reload I'm signed-out and have to re-login on every further reload - resetting local data helps.

2024-09-23 09:34:20

2024-09-23 09:24:33

- reply

Ok that sounds useful, need to think about it

2024-09-23 09:24:00

- reply

These buttons are theme-specific. We are adding a generic sharing options for all themes

2024-09-23 09:23:00

- reply

Share on nostr coming soon

2024-09-23 08:47:37

- reply

Thanks for the report. It stays "loading" forever because there's no such page - the address should be lowercase "/tag/privacidade", not uppercase Privacidade. It's probably our own fault - we should a) treat lower and upper-case tag names as equivalent, and b) make addresses lowercase when we pre-populate your navigation with popular tags.
The reason for 404 is technical - that's how our server handles non-found pages - it redirects to a special address which asks client-side code to run in the browser to try to find that page on nostr relays. That's why you see "loading" spinner there. What's missing is spinner becoming "Sorry page not found" page after the engine failed to find the content.
Will fix all this.

2024-09-23 08:36:03

- reply

Dawn seem good, it showcases your logo and description on the homepage and has some featured posts at the top. Also Solo and Edition.

2024-09-23 08:28:27

- reply

Great point, thanks. We don't handle delete-requests on the client for now and rely on relays, but some relays didn't get your deletion request (relay.nos.social) and still serve that note.
Adding to our todo list.

2024-09-21 12:35:13

- reply

Fixed, thanks

2024-09-21 10:59:55

Hi @nprofile…fr2d @nprofile…672f anything we should improve for reiartur.npub.pro ?

2024-09-21 08:06:56

@nprofile…vzaw some more fixes for you
#nevent1q…x4g0

2024-09-20 12:20:37

- reply

Just days ago I improved a thing and nostrin shouldn't be there anymore. Please let me know if you find it in some search results again.

2024-09-20 12:15:42

- reply

Fixed on reiartur, please check. Coming to other sites later today.

2024-09-20 08:18:42

- reply

@nprofile…pt5w some fixes:
1. You can add this to code injections to fix the banner position on mobile:
<style>
img.gh-header-image {
object-position: left;
}
</style>
2. Could you please go to Theme settings and re-publish the site? This should fix the Github/Obtainium icons on mobile, and should make the image appear on your mascot post page.

2024-09-20 07:39:56

@npub1unm…d0j2 title of https://fountain.fm/clip/J1gWbM7MlOeChsztQ5sF has "@undefined"

2024-09-20 07:14:08

- reply

Do you already have a website on npub.pro to which you'd want to attach the custom domain?

2024-09-20 07:12:00

- reply

Sounds good. Do you have any idea of how to upgrade softly without breaking all existing clients?