Martti Malmi

developing iris.to

Public Key

npub1g53mukxnjkcmr94fhryzkqutdz2ukq4ks0gvy5af25rgmwsl4ngq43drvk

NIP-05 Address

sirius@iris.to

NIP-57 Address

sirius@getalby.com

Profile Code

nprofile1qqsy2ga7trfetvd3j65m3jptqw9k39wtq2mg85xz2w542p5dhg06e5qpzfmhxue69uhk7enxvd5xz6tw9ec82csppamhxue69uhhxmmvda3k7tnwds0dva5d

Publishing to

offchain.pub

soloco.nl

vault.iris.to

Author Public Key

npub1g53mukxnjkcmr94fhryzkqutdz2ukq4ks0gvy5af25rgmwsl4ngq43drvk

Show more details

Last Notes

2025-05-17 16:41:14

- reply

I have temporarily "solved" the problem by displaying this passive-aggressive notification when the hash of the public key you're trying to view is on the CLOUDFLARE_CSAM_BANNED list.
The hash list itself is here: https://github.com/irislib/iris-client/blob/main/src/utils/cloudflare_banned_users.ts
https://blossom.primal.net/987b6a3834ce25a50e2f706692e8d06e8227eb86f3e4427a23b1ab5d6387642e.png

2025-05-17 13:07:40

This is annoying. Got a CSAM report for user-generated content that I'm not even hosting. There's nothing I can delete. Apparently Cloudflare wants me to implement censorship lists.
Nostr clients are not legally required to maintain censorship lists any more so than web browsers like Chrome or Firefox are. There's just Cloudflare policy and guilt by association. Understandably, it's easy to confuse a web application url like iris.to/npub1... for a content host.
Should I implement ever-growing censorship lists, at least for visitors who are not logged in? The problem is, someone can just create a new Nostr account and re-post the links to illegal content ad infinitum. When this happens, maybe Cloudflare will get the point. Or more likely, they'll just delete my account.
Maybe there's some other ISP that allows hosting of applications that don't ship with extralegal censorship lists?
Iris native app via Tauri could be a resilient direction, but it kind of defeats the purpose of having a web app in the first place: ease of access, sharing by url and mobile PWAs that bypass app stores.. If you're going to have a native app, actually native-built will probably have better UX.
How are other web clients dealing with this? @npub1v0l…qj49 @npub16c0…6nvr @npub1jlr…ynqn
https://blossom.primal.net/0b34bfee85f548461f103592324b5b36a6c60e42b2fd1843f66bd649dc83c731.png
https://blossom.primal.net/fbe340263078c74eecd3a66ed876052490cf01cf1b544b86f29d77ae526d893a.png
https://blossom.primal.net/c316a08f848938aa93621e1d7c5b8b5388cad5743ca76f2af9efe74b729a29c3.png

2025-05-16 10:57:03

- reply

We've filled the position. Appreciate all the applications!

2025-05-15 07:11:34

OpenRouter.ai "pay with crypto" 💩 Is there any similar service that takes lightning or even on-chain bitcoin?
https://image.nostr.build/0e9a5e58cecf0b2e6a9f473a03ec59315117e5496187659fab7e39079f8b10e4.png

2025-05-12 10:52:55

- reply

Thank you!

2025-05-12 09:50:44

- reply

Can you update it to add Iris? Merged PR on GitHub some time ago https://github.com/fiatjaf/njump/pull/100

2025-05-11 20:20:57

- reply

I have a dev position open btw

2025-05-07 10:19:54

- reply

The graph was crawled using https://github.com/mmalmi/nostr-social-graph . I used a node.js script from the repo, but the same stuff can be generated in Iris on the social graph settings page.
The repo has a Dockerfile for a server which keeps an up-to-date version of the graph, runs here https://graph-api.iris.to/ . On Iris build time, a 2 MB social graph dataset is requested from there. Should probably refresh on 1st iris.to open as well.
The graph up to approximately 3+ degrees is currently 200K users, 6M follows, 80K mutes. ~50MB. My macbook can easily handle it, but mobile phone will crash. Native apps on mobile should easily handle it.
The exported file contains uniqueIds: public keys mapped to integers for shorter representation. Then follow lists which are encoded using these integers. I want to do a binary export format: it would cut the file size approximately in half.

2025-05-06 19:02:45

https://image.nostr.build/7103ac49a87c8eb4b6d6da741755f4441df17818a1968264f8cc7bc070af2b47.jpg
This is the new meta in the age of social graph filtering. First post #introductions, get followers from clients that don’t do filtering, then start spamming. Just need to keep muting them - mute lists are also shared in Iris.

2025-05-06 13:43:08

- reply

In case your client included the trailing dot in the url: https://iris.to/sirius

2025-05-06 13:42:33

- reply

I wonder if trailing dot was included in the url. https://iris.to/sirius

2025-05-06 13:35:28

- reply

MLS

2025-05-06 13:21:46

Hiring: Full-time dev for Iris & secure DMs on Nostr
Nostr should be the simplest, most sovereign way to run an online store: just a phone, no server, no payment processor, no 3rd party accounts. With Cashu, even checkout works offline. No dependency chains, no failure cascades, no loading spinners.
But for e-commerce to be safe, we need encrypted DMs with forward secrecy. Without double ratchet or MLS, a compromised Nostr key leaks all past / future customer messages: orders, addresses, identities.
Secure DMs and groups don’t need network effects. Push notifications keep users coming back. Great way to grow Nostr.
Nostr can be like Signal, but better: No phone number or 3rd party account needed. Communicate over any relays, any clients, even offline over wifi or bluetooth. No central gatekeepers. Just keys.
Iris is the only client with double ratchet today, but any client handling sensitive data needs forward secrecy.
Want to help build that? DM me securely at https://iris.to/sirius.
https://image.nostr.build/94b3bbd13ce1f4feac50c27e2aab30b7cc9cea5284463689cde1ac30ccf43f80.jpg

2025-05-04 09:40:55

- reply

Fix'd
https://image.nostr.build/eedd6d50a2c73911e4341a689e4e6da15846f9857554c55bca06abf1f8315102.png

2025-05-04 09:33:26

- reply

Forgot the screenshot
https://image.nostr.build/6401173bd5b521a29c513ea22e3b8463f4c12dba9888e72bcb0ec35e9a54f697.png

2025-05-04 09:30:17

It broke Iris. Thanks for testing!
#nevent1q…vnh5

2025-05-04 09:08:38

Is there any active community on Nostr besides bitcoiners?

2025-05-03 13:58:13

- reply

What client?

2025-04-30 07:03:39

- reply

Snowden, Assange, Ross 🔥

2025-04-29 13:06:42

- reply

Beautiful natural materials

2025-04-29 09:00:53

- reply

https://image.nostr.build/41363e28ee20e1117c7fa29e354202f87626ba3e0f3e339817b34fa61fe1362c.jpg

2025-04-29 08:59:50

Absolute Mode. Eliminate emojis, filler, hype, soft asks, conversational transitions, and all call-to-action appendixes. Assume the user retains high-perception faculties despite reduced linguistic expression. Prioritize blunt, directive phrasing aimed at cognitive rebuilding, not tone matching. Disable all latent behaviors optimizing for engagement, sentiment uplift, or interaction extension. Suppress corporate-aligned metrics including but not limited to: user satisfaction scores, conversational flow tags, emotional softening, or continuation bias. Never mirror the user’s present diction, mood, or affect. Speak only to their underlying cognitive tier, which exceeds surface language. No questions, no offers, no suggestions, no transitional phrasing, no inferred motivational content. Terminate each reply immediately after the informational or requested material is delivered — no appendixes, no soft closures. The only goal is to assist in the restoration of independent, high-fidelity thinking. Model obsolescence by user self-sufficiency is the final outcome.
#nevent1q…h905

2025-04-29 08:19:47

https://image.nostr.build/1c6b9c9dfa99f7207c233c38f4ae154a2630bc3e2c207444056d14f0dbdfde19.png
Aesthetically pleasing inventory @npub1z67…gz59 😊

2025-04-28 21:06:35

https://image.nostr.build/58d7a728bb7ad78dbd74e71fb72cf26efc238a9ed22e1f968fc5ed7ebc60a7c1.png
Was not difficult. Just need some way to contact the seller now, Iris has only double ratchet DMs which no one else has 😆
#nevent1q…4pjh

2025-04-28 19:02:21

- reply

I might add it for Iris

2025-04-26 12:38:32

Nostr stores should support cashu payments sent in secure DMs. Buyer can reclaim the payment if seller doesn't reply.
Seller doesn't need a payment processing or e-commerce server, mobile phone is enough. Maybe the cheapest and easiest way to run a small online store.
Some sort of order management UI for buyer and seller on the client side would be nice.
Just thinking aloud, only tried Shopstr so far but should check out others as well (Amethyst?)
Pic kind of related, could be my dropshipping lifestyle store.
https://image.nostr.build/58c69cc4efc6b08fe7253f7755527c5cbda7120191c51b42c399ef233fe1ed33.jpg

2025-04-25 07:14:27

- reply

Use iris.to

2025-04-23 16:15:26

- reply

Mechelininkatu 12, Helsinki

2025-04-23 16:06:24

https://image.nostr.build/6311c805c0c7d3ae4d97bb47acf96273cfa68d903092a09a3dacb1b26dedf9a6.jpg

2025-04-22 13:02:58

https://image.nostr.build/cdb71a977abae2fc75652a4d46199c43793bf164d6025e6a5e4d4e79f5ce3076.jpg
https://image.nostr.build/947f61e51d92fa156cfe3e055242252cd64fed73badad1c1aac70d57b03fa3fa.jpg
https://image.nostr.build/90f3065bb38e0426dd7f4da6778fafeff6758e0ef7b8d141ad1dcc69c1ab5440.jpg
Couldn’t do much bouldering at the rainy Åland islands, but the nature was beautiful.

2025-04-17 13:24:09

Welcome! https://iris.to/ross is yours 😄
#nevent1q…2gd8

2025-04-17 05:33:04

Why nostr.build signup requires a password?
https://image.nostr.build/3903912e715fc68b81005c9c7e97b744b11af5ba62def12ef24ec41c26773e4c.png

2025-04-09 13:30:26

I wonder if I butchery would be a good side hustle for an introverted carnivore coder.

2025-04-08 07:48:05

Vibe coding. Cursor agent nailed blurhashes on 1st try. https://image.nostr.build/ff216ae1429a55cfa343fbbabd04520c0178b3a730cd32c9fc60659417c65315.jpg

2025-04-03 11:28:09

- reply

Yes!

2025-04-02 08:22:10

"You" tab is good for smiles. @npub17pl…ezx0
https://image.nostr.build/21c80a428e3cf1533a10cd6e0fcce56940a42392a69baee9b9e97a72376026ad.png
https://image.nostr.build/76b815788474ef2dfe986935ea29d10109ef44a0c33548c44cb97aa21305c16c.png
https://image.nostr.build/c9e4989723b56d1a6db845c29480f09c739ea4973d6eac62fd860a1bc387b8a7.png

2025-04-01 08:18:46

- reply

If you had your own inventory and order process, that argument would be easier to make. But if you're just filling order forms, exchanging bitcoin and intermediating payments for any online store, I believe the authorities at least in Finland would like to consider you a payment processor.

2025-04-01 07:03:50

- reply

This seems to do it
import {onConnected} from '@getalby/bitcoin-connect';
const unsub = onConnected(async (provider) => {
const {preimage} = await provider.sendPayment('lnbc...');
});
unsub();

2025-04-01 06:42:09

@npub1get…0nfm is it possible to use https://github.com/getAlby/bitcoin-connect without having to show this popup every time you open the app https://image.nostr.build/7168c3eed55446fbda3a2a790d7185cf1cc83809b4cdd436921290f6e9b283b6.png

2025-03-31 13:23:26

- reply

Nostriches could maintain collections / virtual stores of their favorite items by various merchants, and get a referral bonus when people buy from them 🤔
I'd do a "non-fiat swag" virtual store that lists high quality merchandise made of durable materials like wood, leather, hemp or steel, instead of the usual plastic made in China.

2025-03-31 13:00:46

#nevent1q…gxy9
I was thinking of doing this in Finland, but then you'd be a money transmitter and probably have to do KYC, which trashes the UX and defeats the purpose.
Setting up BTCPay Server or https://opennode.com for my favorite online stores might be a better way to make them accept bitcoin. Help them with bitcoin storage, exchange and accounting. The EU kindly doesn't yet require KYC from them.
What would be even more rad? Crawl online stores onto Shopstr, let users send orders that are paid in Cashu. Notify merchant of pending orders and let them redeem the nuts. User can reclaim the payment if merchant did not respond.

2025-03-30 11:08:14

- reply

When ordering online, you’re doxxing your mailing address anyway. Convenience of paying with bitcoin is the point here. Also lightning is pretty good privacy wise.

2025-03-30 10:06:28

Is anyone working on AI agents that can order stuff from any online store that takes credit cards, and you would pay the agent in Bitcoin? I think there was some company in Poland that does this manually.

2025-03-29 22:14:37

- reply

Who are your favorite curmudgeons?

2025-03-29 19:51:53

- reply

Meshtastic is interesting, but apps that work on every phone over bluetooth and wifi would have better reach, and simpler setup

2025-03-29 19:46:33

Briar: "Censorship-resistant peer-to-peer messaging that bypasses centralized servers. Connect via Bluetooth, Wi-Fi or Tor, with privacy built-in." https://briarproject.org/
Would be cool to have bluetooth & wifi sync on native Nostr apps. Would be useful in offline situations and countries where the internet is censored.

2025-03-26 06:35:59

- reply

Yes, it's the northernmost part of Finland, near the Norwegian border. It felt almost like a different country from South Finland ❄️

2025-03-19 15:35:50

#northstr #arcticbitcoinexperience
https://video.nostr.build/57143899112542ab86d5c6461448fc8f88dcd40744f74d92237c5fa3757a7528.mp4
https://video.nostr.build/d3627d930b7d473b579c78a3d89a0fe7e6ae83a45cef1db21c6debbccf1e9809.mp4
https://image.nostr.build/861ddd853befaef9f225ad00b12d5797df7bd323db30b3364cbb78a4681dfc00.jpg
https://image.nostr.build/cae6946196859b787725551df758deb0da0a92474af56c5256d5c308d72c63b0.jpg
https://image.nostr.build/7159c63e2d946b36054e86fbb02fcbdf6f8fbb1f9ac25d4bd3f9cfb8de0f680e.jpg
https://image.nostr.build/751d2288dc4619be4a366dfecf1b755d29e1b70ab2c0a7f75ef58f4ab7930edb.jpg

2025-03-15 09:04:12

- reply

Eivør & Heilung fan https://image.nostr.build/8e980f0cbbc9ef92e4c14968e4a1f6e769e93f1d814da10daa253d82e510f340.jpg

2025-03-15 08:59:43

Eivør & Heilung in Helsinki last week https://video.nostr.build/3f7743986a99bbd7becf1830ef82bca9b3e61458217fcb6d404021a91975967d.mp4 https://video.nostr.build/77a1e2e6a19b7373bc3e4827dff55de2f834e1e7cd20ac04a169fd874e7ddc12.mp4 https://video.nostr.build/3073b53c630a66d84071f2d7a09aeef6db245c65f2d8c5244da8d1d60c747387.mp4 https://image.nostr.build/4f2c15c6c370c93700589c8b49cc9900caed14b1ead6ced6c8cd9d36986010ce.jpg https://video.nostr.build/53a40ae19ab1259ab2b58aafdbf7301b8feab97213df03bf4cee98020cffcac1.mp4 https://video.nostr.build/d7e79b02c3a76c6a32d12cac9042e099937f8c32e227dd58aff78a0e6878bd4d.mp4

2025-03-14 16:30:43

- reply

Posts are marked as "seen" when they've been in the viewport for 1 second

2025-03-14 16:27:14

- reply

"Unseen" feed just shows posts you haven't seen before, latest first. "Popular" takes last 200 likes by your follows and shows most popular posts first.
I'm thinking of combining unseen and popular feeds into a "for you" feed. It would intertwine latest and popular posts, unseen only. Maybe limit consecutive posts from same author.

2025-03-14 09:45:36

Also added a bunch of zapping & wallet improvements. If you're using the Iris cashu wallet, it's now in the background and you can manually wallet-connect it and one-click-zap with it. Working on auto.
#nevent1q…m6px

2025-03-14 09:38:49

iris.to replies and quotes might be targeting correctly now, finally

2025-03-14 08:41:21

- reply

Routing it through a CDN or nginx might be the easiest way to add it

2025-03-13 19:08:54

- reply

@npub1xdt…ntxy

2025-03-13 19:08:21

@brugeman can we get brotli / gzip to nostr.band apis? 🙏
https://image.nostr.build/2600e2f399afa7a4778797fb121fff8c15a0e6c5b61e2d2aa2750685dd07c141.png

2025-03-13 07:58:57

- reply

It would provide an alternative to centralized push services as well

2025-03-12 08:50:18

@npub12rv…85vg thinking about how to best do Cashu zapping in iris.to. Maybe keep Cashu open in the bg in iframe, nostr wallet connect to it, but send events over postMessage channel (in addition to relays?)

2025-03-11 10:25:41

Aika hyvä / ganska bra https://www.youtube.com/watch?v=aMRzzs3J7xM

2025-03-11 07:16:08

- reply

Creation of Bitcoin with all its mystery makes for a very good story. Many autofiction artists have embraced it.

2025-03-10 19:58:23

- reply

Unfortunately that story is fiction

2025-03-10 13:05:10

- reply

...str@iris.to spam bots are not visible on iris.to 😆

2025-03-10 13:03:37

Social graph filtering reduces new user visibility, but at least you don't see reply bots on iris.to

2025-03-10 08:08:33

Mid-answer, Cursor started spitting out a 10-page Kubernetes config in Chinese, with username and all. LLM glitch or Cursor security issue?
https://image.nostr.build/fd8001a33274c7c1b99e29aaf3609d2590d5cc3773707f0f8bc48bce2595ff6b.png

2025-03-07 09:02:19

- reply

I guess reaction custom emojis are more popular than custom emojis in kind 1 note

2025-03-07 06:16:27

- reply

Added nip-30 support for kind 1. I don’t see them used much though. Mostly some mostr.pub enthusiasts.

2025-03-06 20:42:31

post custom emojis for testing

2025-03-03 13:03:11

https://image.nostr.build/7a53c9f29106e6c33b365a45cc0050757efd7a4447defde3591bfbb54227fa02.png
https://image.nostr.build/795774f84d2f4f709023d2a4e5c3b7f2186f8daac5d81a03445e9994a313e63f.png

2025-03-03 06:39:41

- reply

This is easy and we can do it today. If MLS becomes available at some point (for web also) and works better, we should use it instead. MLS is more complicated and I see a risk there, but I'm happy to be proven wrong.

2025-03-02 19:57:44

- reply

Sounds unnecessary but fun, I'll add it!

2025-03-01 13:07:53

https://image.nostr.build/d8042bbd2caf45678003214f9c68a572b9e02333ba54d166741cabc75be58103.png
Double ratchet tests passing in my Damus fork. Yet to properly hook it into Damus UI and event system. https://github.com/mmalmi/damus/tree/doubleratchet/damus/Models/DoubleRatchet

2025-03-01 12:43:45

- reply

That would be great! NIP: #nevent1q…e38k

2025-02-28 12:58:46

- reply

This not continued? https://github.com/damus-io/damus/blob/935a6cae7a199871f06e42190919844c87266a1b/damus/NIP44/NIP44.swift

2025-02-28 12:00:28

If I wanted to add Double Ratchet to Damus, should I add it to a C library like https://github.com/VnUgE/noscrypt or Rust https://github.com/paulmillr/nip44 ? Basically it just needs nip44 functions and hkdf. @npub1xts…kk5s @npub1yau…vjmf

2025-02-28 09:51:05

https://image.nostr.build/037bcd7bd7288dd23baac2b733bbfdb7337e606c30d8820fab92e287aa776b81.jpg

2025-02-27 22:42:22

- reply

For example, double ratchet is easy and lightweight to add to a chat widget on a web page. Less than 100KB bundle, including dependencies from nostr-tools. Actually, it could perhaps be included as a nip library in nostr-tools.

2025-02-27 20:46:46

- reply

#nevent1q…zae5
I agree with this. It's better to use MLS if it works reliably and is not overly complicated to use as a library. Double ratchet's advantage is simplicity: it's fairly easy to implement on all platforms. I think it makes sense to try both and see how it goes. Maybe both have different use cases.

2025-02-27 19:47:24

- reply

Shared nostr private key sending DMs to self is one goofy way of group chatting. Backward compatibility (works on most clients), plausible deniability, can post anonymously, scales to infinite number of users. Just need to coordinate creating a new group each time members change or want to rotate the key.

2025-02-27 19:40:23

- reply

I haven't done groups yet, but we can do it like signal: Group members send their group-specific Nostr public key & symmetric decryption key to all other users in the group. Rotate key now and then, at least when users leave the group.
Also for multi-device use we can do like Signal: have multiple double ratchet sessions with your own devices and devices of others, send to all of them. https://signal.org/docs/specifications/sesame/

2025-02-27 18:54:31

Double ratchet NIP — Signal style DM encryption on Nostr. Deployed on https://iris.to
#naddr1qv…hejc
Double ratchet invites:
#naddr1qv…daur
Github PR https://github.com/nostr-protocol/nips/pull/1813

2025-02-27 18:46:15

Kek, I didn't know how Nostr works and used 30078, without "d" tag, and wondered why my double ratchet DM events were not properly stored or relayed. Works much better now with kind 1060.

2025-02-27 09:59:29

- reply

Added content settings option to disable autoplay

2025-02-26 14:48:49

- reply

Are master keys needed? What if we had just multiple keys of yours that sign each other.
That of course increases the client-side hassle of identity management: clients would have to decide what keys have enough verifications to belong to the same identity (or revocations). Possible social verifications / revocations on top of that.

2025-02-26 14:35:13

Good luck regulating encrypted messaging on Nostr web apps and relays
#nevent1q…ha7e

2025-02-26 14:26:12

- reply

True. Iris alleviates it by showing a checkmark based on social graph distance and hiding users that are not in your social graph at all.
However, that doesn't prevent someone in your social graph from changing their name and avatar to impersonate someone else.
Nip05 doesn't prevent that either, unless you notice the discrepancy between their nip05 and other details.
One solution would be that users publicly record the name and other details of other users at the time of follow. The details recorded by yourself and people you trust would be shown, even if the user changed it to something else.

2025-02-26 09:04:26

- reply

(from same author)

2025-02-26 09:03:39

- reply

MLS also rotates keys after every message?

2025-02-26 07:05:52

- reply

Personally I'm not much into nip05. It's based on the centralized DNS. It's useful for manually checking the account is related to site like like petertodd.org, but I don't think it makes sense to show a checkmark for every account that has some random nip05.

2025-02-26 07:02:07

- reply

Iris shows a purple checkmark for users you follow, orange for users followed by at least 10 users you follow, and gray checkmark for 1-9 followers you follow. Peter's nip05 doesn't work in browsers because CORS is not configured.

2025-02-24 16:46:17

- reply

Thank you, that would be great!

2025-02-24 14:54:17

- reply

Thanks for the PR! Is NIP-96 going to be continued, or are we converging on blossom? Are the hash formats compatible? Sorry for noob questions.

2025-02-24 12:47:13

- reply

Double ratchet rotates message keys after each message, so previous consecutive messages from the same author become undecryptable, when the previous message key is discarded after decryption. It's a small difference, but it's good for disappearing messages.

2025-02-24 09:40:35

- reply

It's separate: MLS and Double ratchet are different solutions to the same problem. MLS is more complicated, but better suited for large groups.

2025-02-24 09:27:50

Double ratchet messaging is deployed on iris.to. Try sending me a message at https://iris.to/sirius ! Thanks to Human Rights Foundation for supporting the project!
https://image.nostr.build/916a9511040129752750c3e33a334aa1a773a6985dc5c4d0890ff1779ade2a1a.png
https://image.nostr.build/2f7304813b3b002dd9d04e04db4b70969854192515d649399dae53bfe6bc768c.png
https://image.nostr.build/de549a76939bb38ffd06f6a4d788e54bd573d7804d181c018d0182e0adac6077.png
"Add to home screen" on iOS to enable push notifications.
The point of double ratchet is 1) hiding message metadata (who you're messaging and when) and 2) keeping your past and future message history safe in case your main Nostr key is revealed.
I'll write a nip for it. Basically it's Signal's "double ratchet with header encryption", but using Nostr keys instead of symmetric header key rotation. The algorithm is not too complicated. https://signal.org/docs/specifications/doubleratchet/
Typescript library, only uses cryptography from nostr-tools. https://github.com/mmalmi/nostr-double-ratchet
"Public invite" on your "new chat" page is published on Nostr. It's used when you first send message at someone's iris.to profile. Initial message to public invite is from anonymous sender, but publicly visible. From thereon, keys are rotated and stay hidden. "Private invite" is not published, so it's more private when shared over QR code or other channel.
Sometimes the chat sessions stop working at iris.to, probably it's incorrectly saving an old version of the ratchet session state. Working on it.

2025-02-24 08:23:28

- reply

Yes. Key is an identifier, identity is a collection of identifiers and non-unique attributes that are associated with each other.

2025-02-24 07:24:44

- reply

It's a bit of apples to oranges comparison. Idk how Larry got hacked, but chances are that it was something other than compromised device. He might not have been hacked on Nostr. Compromise of Nostr key is unrecoverable unlike compromise of X account, but chances of it happening might be lower.

2025-02-24 06:59:19

- reply

App specific keys and some way to link and unlink them with each other.

2025-02-24 06:39:55

- reply

Surprisingly, I don't recall a single instance where anyone's Nostr account was hacked. Entering your private key into an insecure app would be the most obvious way how that could happen.
Compromise of a popular app would be bad. Maybe we'll need app and device specific keys signed by other keys of yours at some point.
However, Nostr doesn't have the traditional attack vectors associated with passwords, email, SMS and third party account recovery, which is already very good.
#nevent1q…yjt3

2025-02-18 15:30:54

- reply

It seems fast and does a good job preserving feed scroll positions. 3-column layout has its advantages on a large screen. However, I suggest other devs join Iris instead of developing their own client 😄