hodlbod

Christian Bitcoiner and developer of the coracle.social nostr client. Learn more at https://coracle.tools

Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

NIP-05 Address

hodlbod@coracle.social

NIP-57 Address

hodlbod@getalby.com

Profile Code

nprofile1qqsf03c2gsmx5ef4c9zmxvlew04gdh7u94afnknp33qvv3c94kvwxgspz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3vamnwvaz7tmjv4kxz7fwdehhxtnnda3kjctva7qmpr

Publishing to

relay.damus.io

relay.nos.social

relay.westernbtc.com

Author Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

Show more details

Last Notes

2024-11-05 13:57:43

I want this
#nevent1q…fucs

2024-11-05 13:31:13

- reply

"It's 5 am, just got done grounding myself, time for my sauna and cold plunge"
[Cut to bitcoiner eating a raw steak]
"I used to have ulcerative collitis. I still do, but I used to too"
[Checks the bitcoin price]
"Time to go to my job as an insurance broker. Gotta stay humble and stack sats"
[Cut to bitcoiner scrolling through millions of bitcoin podcasts]
"Lunch time, brought a pocket steak"
[Bitcoiner awkwardly eats a bloody steak from a plastic bag]
[Checks the bitcoin price]
"Time to orange pill some people"
"Do you guys take bitcoin? No? ...ok"
[Bitcoiner standing by the road holding a sign that says "vote for bitcoin"]
"Let's see what the latest is on nostr"
[Comes home to an empty room, grabs his only place setting from the cabinet]
"Steak time"
[Cecks the bitcoin price]
"Check out my library"
[Just 30 copies of The Bitcoin Standard]
"Can't wait for Nashville"

2024-11-04 19:03:48

- reply

yup

2024-11-04 18:56:09

- reply

This has never been more true

2024-11-01 13:38:52

- reply

Yep, hodlbod.coracle.tools

2024-11-01 13:38:13

- reply

Blossom support was what pushed me over the edge on haven

2024-10-31 22:47:42

- reply

Nope 😞 it's on the very long list. This is what happens when you start a new product when you're only part way done with the first one.

2024-10-31 22:24:39

Running haven, thank you @nprofile…nuzx and @nprofile…4r8z

2024-10-31 19:19:52

- reply

Best CTA I've ever witnessed

2024-10-31 19:19:13

- reply

Just as I was about to bite into a PB&J sandwich... smh

2024-10-31 17:38:25

- reply

test

2024-10-31 16:10:58

- reply

test

2024-10-31 16:10:29

- reply

lol this was not intended to be sent

2024-10-31 16:10:13

https://image.nostr.build/8a2ad03f959938d67408f8ac89c821f44a2cdd257b577a025eb80d5b31214bae.png

2024-10-31 15:47:30

- reply

Yep, exactly. Definitely don't use it.

2024-10-31 15:46:53

- reply

Nice! Decided not to buy the book, but I will listen to this.

2024-10-30 23:16:44

- reply

Everything

2024-10-30 22:56:27

Timezones are a perennial nerd snipe https://ssoready.com/blog/engineering/truths-programmers-timezones/

2024-10-30 22:50:57

This is interesting, someone is quoting a translated version of one of my blog posts, and I still get mentioned. Nostr transcends language apparently.
#nevent1q…gvem

2024-10-30 22:12:21

- reply

You're much faster than I am

2024-10-30 21:46:30

- reply

Replicated it, it's an XSS

2024-10-30 21:46:21

- reply

Something is hijacking all button clicks. I don't know what post it is, but I was able to replicate it.

2024-10-30 17:41:44

- reply

Coracle does also show web of trust information on the relay browse page too

2024-10-30 17:30:47

- reply

Best I've come up with: https://github.com/nostr-protocol/nips/pull/1405

2024-10-30 17:29:19

- reply

Heck yeah, I put off messing with negentropy for a long time, but when I finally integrated it I was floored at how efficient it was.
https://tenor.com/bSJv9.gif

2024-10-30 17:26:39

- reply

hello

2024-10-30 17:26:36

- reply

Never got around to it. But it's useful information. There is a relay list on coracle's profile pages, but it doesn't show which list it comes from

2024-10-30 17:23:37

- reply

The difference between malice and humor is 24 zeroes

2024-10-30 17:22:48

- reply

Sorry, just saw this. The group posts thing is likely due to relay selections, and is a bug, but unfortunately it's not going to be fixed since I am sunsetting groups pretty soon. They may come back someday, but likely not in Coracle.

2024-10-30 16:18:21

- reply

Where did you build this? `content` isn't specified in the NIP

2024-10-30 16:17:37

Russians have the best sense of humor
#nevent1q…v9j5

2024-10-30 16:17:36

Russians have the best sense of humor
#nevent1q…v9j5

2024-10-30 13:15:50

- reply

Screenshot?

2024-10-29 23:00:09

- reply

Started teaching my son this yesterday

2024-10-29 20:09:19

- reply

Cooperation requires conventions. Sometimes conventions are in conflict with an individual's strengths. My favorite example of the left/right handed thing is that castle staircases were built so that defenders could swing wide with their right hands, while attackers were up against a wall and couldn't swing as hard.

2024-10-29 19:20:55

- reply

Probably just chose the wrong icon, and the functionality isn't very useful for kind 1 notes, since coracle shows them fine. The idea is that for other kinds you can open the note in a client that supports the kind better. It's a first draft (like most things in coracle) and needs refinement.

2024-10-29 17:16:38

- reply

I personally use NIP 78 to store user preferences, which are signed events on relays. If you're storing them on your server, I wouldn't bother signing them, since they're verified by your server. Unnecessary signatures/encryption creates more requests for user signers, which is UX friction.

2024-10-29 16:39:15

- reply

I agree, but I also think that nostr has adopted mutable state, for better or worse. I'm more concerned now about the complexity that this introduces to nostr's most important event kind. It's one thing for blog posts to support edit, which forces complexity onto only long-form clients, it's another thing to force everyone to support it.

2024-10-28 22:34:53

- reply

I've heard the same argument from Christians. As if God didn't invent math

2024-10-28 21:27:41

- reply

Coracle doesn't implement support for either, so showing it as a reply is the worst possible version (which is why annotations were done the way they were — you'll never be missing context). Amethyst also doesn't appear to implement annotations, leading to the same behavior. The difference is that edits overwrite, leading to different note content in different clients, whereas annotations always provide the full context.
TBH I'm fighting a losing battle with this one, nostr has long since embraced mutable state over event-sourcing. Not my preference, but that's ok. I still think edits come at a significant cost, even if everyone decides to agree to use them.

2024-10-28 15:27:27

- reply

This is indescribably awful, but also not very surprising. Definitely need to route around DNS

2024-10-26 23:58:01

- reply

Signers need to connect to relays in most cases

2024-10-26 20:55:45

- reply

No such thing as negative press?

2024-10-26 20:26:24

- reply

Not a good time, but "errare humanum est"

2024-10-26 20:24:50

- reply

The API key is public, because it's client side. So not privileged, however forks of coracle that are not up to date and havenct removed the bugsnag key may still be vulnerable.

2024-10-26 20:23:27

- reply

It's not categorically different, but in practical terms there are some benefits. For example, the codebase has fewer trusted dependencies and less code to review. On the other hand, they can become honeypots for attackers.

2024-10-26 20:21:20

Just found out my Coracle vulnerability made RHR as "breaking news" 🫠

2024-10-26 13:02:10

- reply

I have contacted bugsnag, we'll see what they say. And yes, moving towards forcing users to use remote signers.

2024-10-26 13:00:51

- reply

I think we should bite the bullet and figure out how to make it work

2024-10-26 12:58:47

- reply

Looks like it didn't go through before, just published again and it's updated now.

2024-10-26 12:56:39

- reply

Correct

2024-10-25 23:34:02

- reply

🫂

2024-10-25 23:25:09

- reply

yup

2024-10-25 22:32:58

Here's a quick postmortem on the Coracle vulnerability from this morning. If you haven't heard about it, please see below.
#nevent1q…9r8a
First off, the offending line of code was incredibly stupid. It only took a glance to realize that something was incredibly wrong. I went back and git-blame'd the line, and discovered that it was the result of a refactor, where a local variable named `session` was replaced by an imported variable with the same name. The former was a random string (in keeping with my attempts to anonymize users). The second was a user session object, complete with private key.
This leads me to my first observation, which is that no one is auditing nostr apps (just as no one is auditing most software out there). In many cases, there isn't even a code review step, because many of us are solo devs. Just because something is open source doesn't mean you can trust it. Just because you wrote something doesn't mean you can trust it! My key was leaked right along with those of my users.
Code review aside, there were some mistakes I made that resulted in the incident being worse than it could have been:
1. I used analytics and error reporting.
2. I did not self-host my analytics and error reporting.
Because I was using a hosted error reporting service, their servers were implicated in my mistake. Had I been self-hosting, I could be more confident that the data I have deleted is actually gone (even if my users don't have the same assurance).
Action item number one: analytics and error reporting are important enough to being able to develop Coracle that I'm not planning on getting rid of them, but I am moving immediately to self-hosted options. If you want to opt-out of that data collection, there is a setting for that within Coracle.
Another mistake I made is that I trusted myself to safely handle my users' private keys. This is more than just my mistake; despite the growth in use of remote signers, it's still very common for nostr applications to offer private key login or generation. But after this incident I'm of the opinion that no one should be handling unencrypted private keys, except for signers.
Applications should not generate private keys or allow users to sign in with them. Period. In fact, I propose we sunset the term "nsec" entirely. There's no need to make a friendly encoding for something that users should never see. Instead, users should be asked to export their private keys in the password-protected ncryptsec format only. This prevents clipboard attacks or poor key management from compromising users.
This is action item number two: I've already removed private key login from Coracle, and will shortly be re-working my onboarding process to redirect users to set up a remote signer instead of generating a key.
This will have implications for UX, and might make things more difficult for new users in the short term. But as @nprofile…4qru pointed out, the longer we allow users to treat keys like passwords, the longer they're forming poor habits for keeping their keys safe, because the two are categorically different. Removing support for private keys will cause pain in the short term, but will force us to improve our integrations with remote signers, improving security and UX in the long term.
That's all I've got for now. Thank you to everyone for your graciousness, I appreciate all the support. I'm honestly glad this happened, and I hope it will galvanize all of us into action to continue to improve nostr's security.

2024-10-25 20:42:56

- reply

I started that way, but ran into performance issues with my home baked solution. I'll take a look at glitchtip, I would definitely prefer self-hosted.

2024-10-25 20:29:52

- reply

I've asked them to, we'll see what they say

2024-10-25 17:47:29

- reply

😂

2024-10-25 17:33:11

- reply

Great points. Web apps also have lots more supply chain attack vectors than single-purpose signers might. I especially like your point about training users. Lowering security to accommodate UX doesn't do anyone any favors.

2024-10-25 17:29:45

- reply

You're probably right. I think we'll get there, we just aren't yet. Bunkers were introduced about a year ago, and have come a long way in adoption, but they're still not quite "easy" (unless they're custodial, and even then, most of those are offline).

2024-10-25 17:28:41

- reply

Agreed, it's a profitable conversation

2024-10-25 17:21:52

- reply

Very well put

2024-10-25 17:15:38

- reply

Neat project! Thinking about removing nsec login.

2024-10-25 17:11:54

- reply

Keys are simple, external 3rd party dependencies aren't (and, as you note, may not be any more secure). It's all about ease of use for non-technical users. But the days of nsec login are numbered, we just need really solid flows for secure custody. nsec.app comes close.

2024-10-25 17:07:01

- reply

Unfortunately I don't think you can get simpler than nsec login. It's also the easiest way to create an account. Anything more is very confusing for normal people. You either have server-side custody, a different browser app like nsec.app, or a new app on your phone, all of which can have the same problems. A key rotation scheme would be an improvement worth having, and educating users to reduce key exposure and not use their main key for storing ecash or secret communications or whatnot seems like the way forward in the short term at least.

2024-10-25 16:54:41

- reply

Yep, remote/extension signers are best practice. You can get better security with hardware signers, at the cost of lots of pain. But as with any hot key or custodial account it's best not to risk too much with any identity.

2024-10-25 16:41:40

- reply

Yep, remote signers and browser extensions are a great solution for this, and have been around for years now.

2024-10-25 16:30:36

- reply

Yep

2024-10-25 16:23:44

- reply

Agreed, I've been very lax with this myself. Will have to be more careful going forward.

2024-10-25 16:17:20

- reply

Yep

2024-10-25 16:17:12

- reply

I've been dreading this day tbh

2024-10-25 16:17:05

- reply

Nope, the worst that would happen would be your pubkey would be shared with me. Not ideal, but also not sensitive.

2024-10-25 16:12:36

**Security Update**
I've got some bad news for you guys. This morning, as I was adding error handling to flotilla, I discovered that Coracle has been sending user session objects to bugsnag when reporting errors.
Who is affected: Users who triggered an error in Coracle while signed in with their private key, since December 5th 2023.
What I've done:
- I immediately released a new version of Coracle, both to web and to zap.store
- I have deleted the affected apks from my releases
- I have deleted all my error data from bugsnag
- I have deleted my bugsnag project and rotated my api key, so lingering error reports will be dropped
- I have audited my code for use of the session object to ensure nothing else like this is happening
What you should do:
- If you're logged in with your private key, log out
- Hard refresh the page to ensure you have the latest version of Coracle
The bottom line is that if you signed in to Coracle with your private key, it has been shared with me and with bugsnag. In practical terms, your keys should still be secure, since they were sent over TLS, and have been deleted. But there is no guarantee I can offer that they are in fact gone.
I take my users' privacy seriously. My error reporting implementation doesn't record user IPs, it redacts identifying data, and it allows users to opt-out. I also warn the user when they attempt to enter an nsec into a text field. In this case, I simply screwed up, and I sincerely apologize. Reply to this note if you have any questions.

2024-10-25 13:35:57

- reply

1. Improving our home
2. Gardening and permaculture
3. Revolutionary France

2024-10-24 23:35:50

- reply

Whatever not caring/never remembering is

2024-10-24 19:14:10

test

2024-10-24 18:58:03

- reply

4 🫠
Just weird state things, like one route getting called on a different page. It's been really bad this morning.

2024-10-24 18:25:53

Sveltekit is so buggy

2024-10-24 17:54:19

- reply

😂😂😂

2024-10-24 17:53:13

Two of my favorite projects lately are nostr-editor by @nprofile…uqk9 and nostr-signer-capacitor-plugin by @nprofile…gqeu . Both projects provide high-quality solutions to specific, difficult problems that application developers can use to significantly improve their UX without reinventing the wheel. Looking forward to more of this kind of thing.

2024-10-24 16:12:54

- reply

What client did you use to send this? It uses `note1` instead of `nevent` and doesn't have a `q` tag, which makes the quote impossible to find.

2024-10-24 02:27:10

- reply

The note includes a `note1` entity, which is just an id, and no tags. Ideally, clients would encourage people to use `nevent` entities instead, since they include relay hints, but more important would be to add a `q` tag with relay hint + pubkey hint: https://github.com/nostr-protocol/nips/blob/e3afd7ac5b72c20fe209edf3ea84cd986d0bd4ef/18.md?plain=1#L21

2024-10-24 02:24:40

- reply

This was specifically in the context of a social media site (from 1997), where you had to go through a few pages of content before being able to post.

2024-10-24 01:00:16

- reply

🙇‍♂️

2024-10-24 00:59:59

Here's an idea for relay operators, particularly for communities: you could create a public relay that prevents spam by allowing people to post only after they have a certain amount of activity. If they're not AUTHing, or REQing, they're likely spam. Ask them to engage more with existing content before posting.

2024-10-24 00:21:06

# stuff

2024-10-23 23:38:44

- reply

Coracle does render it

2024-10-23 16:34:10

- reply

HEY

2024-10-23 00:43:22

- reply

coracle.social does

2024-10-22 14:27:02

- reply

🫂

2024-10-22 02:07:21

- reply

👀

2024-10-21 23:50:24

Really enjoying @nprofile…knce 's new yahoo pipes podcast

2024-10-21 22:23:31

- reply

lisp is the simplest language

2024-10-21 22:22:40

- reply

😂

2024-10-21 20:10:45

For some reason I simply cannot do css today

2024-10-18 17:26:32

One time I did `apt-get upgrade` on debian and my terminal stopped rendering text. And when I restarted my computer it couldn't find the boot partition.
#nevent1q…whjl

2024-10-18 17:21:57

BRB reinstalling nvm/npm/node and running `brew upgrade` for the first time in a year. Tell my family I love them.

2024-10-18 13:27:33

"The bottom line is that human beings are subjective, personal creatures by definition. And communities are about connections between people. Personal stories are the glue that holds any community together, online or off. So never underestimate the power of a personal story and a direct question."
- Derek Powazek, "Design for Community"

2024-10-17 17:36:05

- reply

this should be interesting, since coracle (and I think others) use a windowing algorithm to force sort order. Will the relay respect that or ignore since/until? Seems like there are downsides to both approaches

2024-10-17 17:35:05

- reply

I knew you would

2024-10-17 16:37:12

- reply

The latest: https://fountain.fm/episode/rrZNKoROI34ccbuWesrW