Mike Dilger

Author of Gossip client: https://github.com/mikedilger/gossip
Dual National (USA / New Zealand)
My principles are Individualism, Equality, Liberty, Justice and Life

Public Key

npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c

NIP-05 Address

mike@mikedilger.com

NIP-57 Address

greenleaf306199@getalby.com

Profile Code

nprofile1qqswuyd9ml6qcxd92h6pleptfrcqucvvjy39vg4wx7mv9wm8kakyujgpp4mhxue69uhkummn9ekx7mqpramhxue69uhkx6r0wf6hxtndd94k2erfd3nk2u3wvdhk6w35xs6qjn5quv

Publishing to

nos.lol

chorus.mikedilger.com:444

relay.nostr.bg/all

Author Public Key

npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c

Show more details

Last Notes

2025-01-10 22:04:43

NIP-22 has become non-optional. It solved a real problem and was a good idea, but also it was a breaking change. A non-optional breaking change. I made this point early on, calling the other devs mavericks and juggernauts.
Now we are in the situation where gossip either doesn't see anybody's replies, or it replies to their replies with kind-1 events which I am now told is a "sin". You see, I am not allowed to ignore this NIP-22. It is non-optional.
I'm not even against this being non-optional. What I am against is not running a migration campaign... not pushing everybody to upgrade to it. I warned this situation would happen and I was ignored. So now we have this mess.
I will now upgrade NIP-22, but somebody needs to go around to all the other clients and push them all to upgrade too.
@npub1use…k5ks @npub1l3c…6vs2 @npub180c…h6w6 @npub1gcx…nj5z @npub1jlr…ynqn @npub1ye5…knpr @npub1xts…kk5s

2024-12-25 04:27:47

Somebody has seconded with all of my seconds!
Oh, hang on, no worries, here come a bunch more seconds.

2024-12-24 22:34:11

- reply

An angel! We are blessed! Merry Xmas Marie

2024-12-24 08:53:06

- reply

I'd like to and I may.
I'd be interested to know in what ways they practice communism still, even just at a high level.

2024-12-24 08:46:20

- reply

Well if you lived there for 3 years you have FAR more experience and data than I do. So I bow to your superior experience. This is why I titled the thing "i might be wrong".

2024-12-24 08:44:36

- reply

I hear that. One-party rule is China's biggest problem, and not likely to be fixed for a long time to come.

2024-12-24 02:37:13

- reply

It is good to learn that my choices make some sense to other people, that I am not senile yet.
There are already 2 issues I want to fix: Metadata not loading for people in lists, and relay sorting by a useful score (which is fixed on unstable). But I'm spending less time online over this Christimas week so it might not be patch-released until January.

2024-12-23 21:19:29

- reply

They learned from their mistakes and corrected course, immediately after Mao. But you still haven't noticed? They started changing course in 1978 under Deng to ease towards a market economy, and have continued in that direction until today where China is now not much different from Western countries. There are state owned enterprises (same as most Western countries) and there are government regulators (same as most Western countries). China actually had to hold off some reforms in order to counter Trump's trade war. Xi is somewhat less reformist than Deng was, and I'm not promoting their particular system -- all governments suck. But to always harken back to the mostly environmentally-caused famine (made worse by communism negative affect on productivity) is pretty weak.

2024-12-23 08:34:56

- reply

I'm not going to argue this point because (1) I didn't understand the OP and I thought his post was accidentally missing context, so I thought my reply would be funny and not starting a debate and (2) you know what I mean.

2024-12-23 08:32:04

- reply

Ok, that information helps. Maybe the new UI person line widget doesn't trigger metadata fetches like the old one did.

2024-12-22 19:32:42

- reply

You might need more discovery relays. Go to Relay > My Relays. How many are marked "D"? If not too many, then go to Relays > Known Network and configure some more. I use about 12 myself. Unfortunately I just realize there is no way to sort them by 'score' (rank or success rate are not very useful by themselves, sorry).

2024-12-22 19:25:52

- reply

I'm not sure. There is a flake file, and also this PR to change the flake file: https://github.com/mikedilger/gossip/pull/920
But I don't know how to use nixos or flake.

2024-12-22 03:19:25

I like narr. It is a good fork. Now I just need a list of interesting RSS feeds to follow. Any suggestions?
#nevent1q…4dk4

2024-12-22 00:11:03

- reply

If it is as you say, you can copy it as it is, then do that revert, then diff the two copies and reapply the differences (probably manually).

2024-12-21 19:10:33

- reply

Nostr And Rss Reader

2024-12-21 19:02:14

- reply

The build was on bookworm. 0.12.0 was built on bookworm too.
I rebuilt on Bullseye and uploaded to the github release, just for you:
83a56f2dfe62aaf019d30806c29651da9c79c61e109599d09eb648121518a051 gossip_0.13.0-1_amd64.bullseye.deb

2024-12-21 05:36:10

- reply

I'll write a grant proposal and put a few grad students on the problem.

2024-12-21 03:44:32

When the govt shuts down, please just leave it off. Anyone who turns it back on is a rotten egg.

2024-12-21 02:48:49

- reply

Its been two millennia, nothing stays fresh for that long.

2024-12-21 00:37:52

- reply

If you want to see some code logic about how to pick the smallest set of relays that covers everybody (it's not perfect but that was the intent) you can look at https://github.com/mikedilger/gossip-relay-picker (warning, this is no longer in use by gossip, and it is unmaintained, but a previous version of gossip used it).

2024-12-21 00:34:15

- reply

or you could read everything I have to say about it here https://mikedilger.com/gossip-model

2024-12-21 00:25:18

- reply

I agree there is something missing, but I don't think it should be a nip.
I think the nips that define event kinds 1, 1111, etc, should have a section describing how such events are delivered and found. Each application may have a different delivery/discovery model.

2024-12-21 00:16:38

- reply

yessir

2024-12-21 00:12:44

- reply

It is a .webp. Maybe I should make it a .png

2024-12-21 00:08:50

- reply

I make them so large that they don't fit in the pan.

2024-12-20 00:19:30

- reply

I think it has to be one way or the other. Either people can send you messages out of the blue and spam you too, or neither. Am I wrong? Is there a middle ground?

2024-12-20 00:16:15

- reply

That is an organisational comment, as to how the protocol definition (the NIPs) are organised (or not organised). Nostr NIPs have no structure in terms of which NIPs apply to everybody (it is not just 1 anymore) at the base protocol, and what is an application riding on top of nostr. It isn't clear without reading or being around that NIP-10, NIP-18, NIP-22(?), NIP-11, NIP-09, NIP-51, NIP-59, and more... these are all kind of core facilities that applications can use. But NIPs 54 (wiki), C7 (chats) 64 (chess), 35 (torrents), etc, these are all applications that ride on top of a core.
IMHO the NIPs repo should just register application kinds so that applications don't clobber each other with their kinds, but not be defining all these applications. There could be a sister repo that aggregates lots of nostr app specs, it wouldn't have to be pushed out to separate owners.

2024-12-19 23:35:40

- reply

I'm not so sure. A lot of them are gay. Dasher (gay), dancer (gay), prancer (definitely gay), vixen (slut), comet (maybe a dude), cupid (gay), donner (dude), blitzen (dude).

2024-12-19 23:05:59

- reply

No, there is no good proposal for good interop. And mosaic won't succeed unless someone invents such a mechanism. I tried to make the point here https://github.com/SteveFarroll/mosaic-spec/issues/6 but even that is a bad idea (dual stack). So yes you are right it would fragment the user base and so I'm not in favor of it. Because users matter more than software, and software matters more than formats/specs. And so no matter how good you make the formats/specs, without awesome software and without the power of the network effect, you get nothing.
But that doesn't mean mosaic isn't interesting or can't be useful for ideas. Nostr might be able to borrow ideas from mosaic, or attempt to approach it in some ways.
Or maybe someone smart figures out a brilliant way to phase over. Who knows.

2024-12-19 22:50:56

- reply

The basics are easy to understand, but what is tricky is interpreting what the compiler is actually saying. The basics are just that if you borrow something, you must ensure that the owning variable stays alive during the entire lifetime of the borrow.... otherwise it will be freed and the borrowing reference will point at memory that isn't safe anymore. But the details about how to do this, and what the fuck the compiler just said, that is where the nightmare arises.
I have to admit I've avoided using Rc and RefCell and gone straight to Arc and RwLock instead because those work in more cases and I can't be bothered with the single thread cases anymore.
And I usually only have to reference lifetimes if a structure has borrowed data. Borrowed parameters in functions giving borrowed return values don't need explicit lifetimes anymore.

2024-12-19 22:43:10

- reply

Yes, the Ada language designers understood this way back in 1977. That is because they had studied and were fixing problems with (and superceding) 450 different languages!

2024-12-19 22:17:18

- reply

I use macros where typing it all out would be crazy. But the macro language isn't super easy to read.
If rust devs didn't care about the usually *tiny* cost of copying things, they wouldn't use lifetimes. But they want perfection. I'm sick in the head that way myself. Lucky for us newer compilers are much more able to figure out the lifetimes and we can elide them.

2024-12-19 22:14:04

- reply

I'm running a node with a similar setup, but this isn't it.
That drive is for movies and my TV is to the right of the picture. Otherwise I just use this box for compiling gossip for MacOS targets.
The googley eyes were the best upgrade.

2024-12-19 22:11:16

- reply

I'm aware of var and let and const (aware but not adept). People can and will still write hard to read code with distant vars, and you'll still have to read such code.
If you are disciplined, you can write C++ almost as good as rust now. But when reading C++ you never come across such disciplined code. When reading code you have to be aware now of all the different ways of doing it, which just grow and grow over time.

2024-12-19 21:13:02

- reply

There should be. The fixed amount buttons wasn't supposed to be the end of that work, but I never put in the field entry. Maybe I do that today.

2024-12-19 21:01:16

https://image.nostr.build/034fb550deb06c3a3a6d623df58763f78e8e916faef8c15fb8d9f1bd1a1dbe68.jpg

2024-12-19 20:55:20

- reply

Correct. It does not implement NWC. But you can do zaps if you use your phone and scan the QR code.
I signed up for the risk level associated with enabling free speech.... not for the risk level associated with enabling free money (a much higher risk level) even though I love free money. I'm trying to steer clear of things that capricious asshole governments might decide to prosecute in the future. I'm not anonymous.
If someone wants to maintain a downstream fork that implements NWC I would be happy to answer any questions about how the gossip code works.

2024-12-19 20:48:04

- reply

I clicked the wrong emoji. But whatever I guess the thinking man works too.

2024-12-19 20:47:05

- reply

👍

2024-12-19 20:32:11

- reply

I'm imagining a web app. You can install a copy locally. It could be running on multiple websites. And there would be alternate ways to do the same things. There would be no data in this... all the data would be on nostr (with a tiny bit in your signer of choice).

2024-12-19 20:29:07

- reply

It depends.
@npub180c…h6w6 made a push for making relays front-and-center and insisted that this needed to be nostr direction and paid out bounties for things like 'seen on' information.
IMHO for general microblogging relays are invisible. For DMs too. Nobody cares about the relays when you are just conversing deep down in some thread.
But for other apps (relay-centric chat, browing relay-specific feeds) the relays have to be known to the user. This is like a web browser: the URL is not invisible, the user goes to the URL they want to see.
So it very much depends on the nostr app in question.
In the context of this thread though, relays cannot be invisible. People have to choose their relays, often making decisions like "should I pay for service here", "is this relay reputable", "what does my son recomend as the best relay".

2024-12-19 20:23:06

- reply

No it is not centralization as long as there were others that were also good. But I think it is better to focus in more because with a narrower focus you can get higher quality.

2024-12-19 20:20:03

One way to keep up with what is happening is to watch the news. But governments control their populations this way, so while you will hear about many things, you will not hear about others, and you will be given politically-correct programming.
Ground news tries to show you which news sources are left and right, and fill in your blind spots.
Alternative news gives you stories you don't see elsewhere: greyzone, revolver, people on substack, youtube and rumble videos, etc.
But people lie and exaggerate for many reasons. They may say something is true because they wish it was so ("Ukraine is winning" or "Russia is stronger now"). They may express certainty for multiple propositions, when in reality they are far less certain about one of them.
You could have a show where people are required to not just express their views, but also give a confidence level. But they still would lie and exaggerate.
You could make them put money on the table. Then they will be less prone to lying and exaggeration.
Betting markets do this already. What is true, what confidence level do you have, and also people must put skin in the game. But they are more about events that have not transpired yet. But hell... those are even more interesting than what already happened.
It would be awesome if there were betting markets about past events, including recent newsworthy ones. If that existed I would read that to get my news. The obvious problem here is adjudicating and settling the bets. Maybe the winner is whatever the majority believes 3 years hence. People who bet COVID came from a lab would be paid out already. People who bet against Russiagate too.

2024-12-19 19:57:46

- reply

Elon Musk has far more important things to do. Don't tie the man up in politics!

2024-12-19 19:50:02

- reply

it is already turning into another super app

2024-12-19 19:49:43

- reply

it is already turning into another super app

2024-12-19 19:43:32

- reply

NIP-05 setup (guide them through it) and explain why they might not want one

2024-12-19 19:39:07

- reply

Each time I release gossip I run a complicated process involving 3 different programs in order to find and rank open relays that could be suggested to people starting a new nostr account. These relays don't say in their NIP-11 "I'm open to new users". I have to run tests against them, post as a new pubkey, then see if I can read back that post. I added something like this inside of gossip, but gossip is not user friendly and IMHO I'd rather direct users to NAM and have one app where all that effort was focused.

2024-12-19 19:33:56

- reply

I made a post about "Nostr 2?" pointing at how clean and nice nostr could be if we threw away all wisdom and reason and started over, but the only way I could imagine moving from here to there was dual-stacking like ipv4/ipv6 is. Of course I hate that idea... it wasn't a proposal, it was meant to help people to think outside the box and maybe come up with a smart migration path towards those some of those difficult-to-migrate-to features.

2024-12-19 19:27:16

We need a nostr client that is just about managing your relays (and maybe your keys, bunker, delegation, profile). The "nostr account manager" or NAM.
No content.
But very good at helping you understand all the relays out there, how they are different and what they offer, with lots of hand-holding so grandma could use it. Also assisting in moving content from relay to relay when you migrate.

2024-12-19 19:17:03

- reply

It seems to me there is a natural place to cleave between feature-sets based on what kind of event a user is focused on.
These would be best as separate apps:
Kind-1 apps
long-form apps
chat apps
marketplace apps
chess apps
dm apps
git apps
...
I avoided DMs initially because I felt they should be in a separate app. And long-form was probably a mistake to (badly) render in gossip, and given that we now have NIP-89 I could render the long-form title and a link to your handler instead.

2024-12-19 18:54:48

- reply

If we move to a separate encryption key (good idea) then I presume the messages are not NIP-17 giftwrap(seal(DM)) (since that specifies otherwise). And in such a case we can avoid spam by doing what Will says in the OP, which is to first require an endpoint-exchange and key-exchange through giftwraps (not 1059, something new), and if you get a giftwrap DM that is not from somebody that is already setup, you discard it. Sure it could be spam, but spammers won't have much incentive to send something that the user never sees.

2024-12-19 01:39:56

My town is packed full of people. Roads are all backed up. Parking lots overflowing. Grocery stores are approaching mosh pit density.
This happens every year, I'm not suprised. I just want to know one thing: if we have this many more people, there must be places with less people where they came from. Where are those places? That's where I want to spend my next Christmas.

2024-12-18 23:32:50

#politics
I've seen all good people turn their heads each day, so satisified I'm on my way

2024-12-17 00:44:07

- reply

I learned something

2024-12-16 23:30:57

- reply

Yes, but easily modifiable for debian or redhat or whatever.
$ sudo apt install torsocks

2024-12-16 21:48:08

- reply

I don't think that is my core axiom. My core axiom was that some changes are completely breaking (no way to interoperate) but also desirable.

2024-12-16 08:14:46

- reply

Thanks.
I know that zealots and fanboys might see mosaic as disloyalty or competition, but I don't. I think it is an interesting data point on the landscape of possibilites quite far from where we are right now, and even if too far outside-the-box and too disruptive as written, at least it is useful for discussion about how some of these issues could be solved in nostr.

2024-12-16 07:04:39

- reply

My opinion on this may not be the majority opinion among people who have thought about it, but I'll give you my thinking. Back around 2000, a bunch of p2p protocols started springing up like freenet, GnuNET, etc. They tried to do privacy and p2p file sharing together in one giant protocol. But Tor was already here (1997 IIRC) and at the network layer it solved IP privacy (IMHO). VPNs also (to a lesser degree) provide IP layer privacy. And so does i2p (if it works). So it seems to me that privacy is orthogonal and solvable at a lower network layer. Even if the aforementioned protocols are not good enough, then something else should come up at that layer.
But I'm sure I'm not comprehending the whole privacy problem space, so please do help me to understand better which nostr privacy issues you are thinking about.

2024-12-15 04:36:26

- reply

Protests. The only place where that flag flies.

2024-12-14 19:55:27

- reply

You should see a blue dot on their Avatar, and a little walking person next to their name. And they should be in People Lists > Followed. Are you saying the last part didn't happen, or none of it happened?

2024-12-14 05:48:17

- reply

Thanks. I can't easily check that, but if they are swapped I hope people figure it out. I'll check next time to make sure it's not a bug in the packaging scripts.

2024-12-14 05:30:17

GOSSIP updates:
Gossip (master branch) now has buttons on the Person page to see who someone follows, and to load all the people that follow them.
Two caveats to be aware of:
1) Loading who follows someone is slow and expensive and inaccurate... eventually the number settles down. Most people are probably only interested in doing this for themselves. You can adjust a setting to choose how many relays to ask (it will pick the relays with an algorithm). It will "clutter" your local database with lots of contact lists with no great way to clear it afterwards.
2) The resultant list has some kind of scrolling issue which I believe is an egui bad-assumption bug (they didn't predict our smooth scrolling!). See egui/crates/egui/containers/scroll_area.rs function show_rows() if you want to be the hero that rescues us.
Gossip (unstable branch) has an 'unread' indicator for the inbox, and has almost instant inbox recalculations (was getting close to 1 second for my large old database) due to a new database indexing scheme.

2024-12-14 01:23:28

- reply

What's the frequency, Kenneth?

2024-12-13 23:00:49

I have to admit, I don't know what this emoji means: 👀
Does it mean "I'm looking at you" like "I'm giving you the slant eye" or "I'm watching you buddy"...
... or does it mean "hey everybody, look at this!"
... or does it mean "I saw this but don't want to emote anything other than this simple fact"
... or something else?
I'm so old.

2024-12-13 21:38:39

- reply

correct spelling: hokum

2024-12-13 21:38:05

- reply

I fucking misspelt it!

2024-12-11 03:23:45

- reply

I should say it is not so much as "the greedy". It is more that all of us humans are lazy. We are lazy and ingenious. And we use our ingenuity to create machines to work for us.
And if you set up a system that can be gamed, people will game it. They will pretend to have medical conditions that prevent them from working, so they can continue to be lazy. These aren't bad people, they are normal ingenous people taking the path of least resistance, having been put into a game that brings out the worst in them.
OTOH I've seen people do the opposite too. I have a friend who lost his leg in a car accident. The government told him to not work for 2 years, they would pay him. He didn't want to not work, he started working anyways, I think within the first year.

2024-12-10 22:20:06

- reply

Actually did:plc doesn't require authentication. Or you could even self-host with did:web. People have PDSes!
#BeTheMeme

2024-12-09 04:47:29

A man trying to kill 10 fleas at the same time with 10 fingers is likely to fail.

2024-12-09 01:32:09

- reply

I've always seen Syria as closer to Russia than Iran. Russia (had) military bases there and was fighting to defend the Assad government, Iran was more of "moral support" from a distance. Iran shipped weapons through Syria into Lebanon, but that wasn't for Syria's benefit. Was Assad a muslim? I thought he was secular. And while he is Arabic, Iran isn't (it's Aryan). Anyhow I don't see it as odd. So AFAIK Iran is neither his race nor his religion nor his closest ally.

2024-12-09 01:26:45

- reply

Ok I misread my own code. It ought to be working.
Of the DMs which you are missing, do you know if they are NIP-04 or NIP-44? Do you know which relays they are on? Are these relays configured as inboxes?

2024-12-08 07:30:08

- reply

I took that as old news. It was pretty clear for the last year that Russia is done with the West, been lied to too many times, that they are doing far better now under the sanctions than they were before, that there is pent-up demand worldwide for an alternative to Western domination, and that the Russia-China thing is working out like gangbusters for them.
But Russia will play level-headed and make appropriate responses. When the West escalates, Russia will to. There are dozens of more rungs on the escalation ladder, I can't even count the number of things Russia could do next short of a nuclear attack.
The fear of the nuclear attack is warranted not because of its likelihood (exceedingly low) but because of how bad it would be. A humanity-ending war, even at only 1% odds, is worth putting a lot of effort behind preventing.
Also, it is clear to me that Trump always starts out with bluster, but also always negotiates and wants to "make the deal". He is a competent negotiator. The stuff he says up front about an issue is meant to draw people towards his side, his win, it is not a prediction of what he would actually settle for (which negotiators must keep very secret). And I laugh every time people freak out and take Trump seriously when he does these things. I also laugh when normie politicians completely fuck their negotiating position by being truthful. Incompetence.

2024-12-08 07:23:13

- reply

It is too soon for me to figure out what is true and what is lies. But I heard Israel is not comfortable with Salafi extremists at their border.

2024-12-08 06:07:27

#politics
I haven't posted about Syria because holy-fuck it is complicated. And happened fast. And I don't have a simple good-guy bad-guy opinion on something this crazy complicated. It can't be explained as a simple US-Russia proxy war, or a simple Israel expansionist war, or a simple Jihad (HTS isn't actually jihadist). All the groups involved are both good and bad depending on which perspective you look at it from.
All I can say for sure is I don't like seeing people die, and I'm glad I'm not there.

2024-12-07 02:58:17

- reply

When things don't work, we currently just print an error to the console and forget about it. To implement this we need to store the failed ToMinionMessage objects (or silmilar) along with retry information like when we last tried, and how big the exponential backoff currently is. It isn't a walk in the park, I'm not sure how much greater anybody's experience will end up being, but it would be better.

2024-12-05 03:06:06

https://companiesmarketcap.com/assets-by-market-cap/

2024-12-05 02:57:25

As the USD falls to new lows, there is no other place I'd rather be than nostr.

2024-12-04 23:03:55

- reply

Great ending

2024-12-04 18:43:09

- reply

Thanks. This is the part I was missing, RFC 9460. I didn't know about HTTPS resource records. SRV would be more general and more widely supported for protocols outside of HTTP.

2024-12-04 18:10:10

- reply

> following the chain of delegation from one Pkarr to the other. The last Pkarr is the one that informs me of the ip, port, alpn, and ech, but also the one used in TLS.
What is this of which you speak? I thought pkarr maps an ed25519 pubkey to a DNS record. Is there some chain of DNS records, and can you explain that chain (forgive my DNS ignorance)?

2024-12-04 17:49:29

- reply

OMG you are right! It is 100 million!

2024-12-04 07:05:04

My 1 bitcoin is now worth 8 bitcoin. Wait, no it is still 1 bitcoin. Dammit! Why isn't it going up?

2024-12-03 21:53:39

- reply

This is why I'm already following you. Great tip.

2024-12-03 19:21:41

- reply

I choose #2. Did I win?

2024-12-03 19:21:08

- reply

Both wrong. Nostr is good.

2024-12-03 08:25:23

- reply

#wisdom

2024-12-03 03:32:12

- reply

do tell

2024-12-01 23:45:28

- reply

I love how someone moving from one state to another can lower the avg IQ of both places. Sounds like it violates some law of conservation.

2024-12-01 20:34:52

- reply

Antisocialist is a fine term. I'd call myself that if people were familiar with it.
Don't touch me. #autism

2024-12-01 18:29:51

- reply

Beyond that, blood sugar spikes and insulin responses are NORMAL. The current obsession with them is the sickness. The only time blood sugar matters is when it doesn't come down rapidly, meaning you have become hyperglycemic or diabetic... and the cause of that is NOT blood sugar, but pancreatic/liver dysfunction generally caused by excessive fat.
That isn't to say that keeping blood sugar artificially low all-the-damn-time doesn't have benefits, like cancer starvation or weight control. It might. I don't know.

2024-12-01 02:13:04

- reply

You can use a curve for both signing and Diffie-Hellman key exchange. It is with the latter that you can construct encryption using ECIES. But Diffie-Hellman key exchange is constructed as an online back-and-forth thing. Alice needs Bob's ephemeral public key to compute the shared secret, and she needs the shared secret to encrypted data to Bob. But in many instances Bob isn't online and Alice is just sending him an encrypted DM, so she cannot get an ephemeral public key from him.
It is not safe to use your long term public keys to compute a shared secret. At least one side should be using an ephemeral keypair, and that is where I think it is ok to use Bob's long-term private key as long as Alice is using an ephemeral keypair.
And no this wasn't about secp256k1 in particular.

2024-12-01 01:36:04

TIL (via experimentation) that while BLAKE3 is far faster than SHA-512, when used within a much slower cryptographic primitive like EdDSA it doesn't matter which hashing algorithm you use (performance improvement was only about 3%, and some runs it was worse).

2024-12-01 01:34:01

- reply

Do it! I learned in 2005. Created some of my greatest memories.

2024-11-30 00:07:31

simple /ˈsɪmpl/ - adj
1. easily understood or done; presenting no difficulty.
2. I've already coded this NIP so if you accept it as is I won't have to do anything.
3. plain, basic, or uncomplicated in form, nature, or design; without much decoration or ornamentation.

2024-11-29 02:14:00

- reply

Yep that was convenient how PGP did it, encrypting the symmetric key to each recipient in the header of the encrypted message. But ECC keys don't work like RSA keys and encryption has to be done with diffie-hellman key exchange to agree upon a shared secret which might then be used for XChaCha20Poly1305 or AES or whatever. And for some security reason you can't use that same shared secret twice (or so I am cautioned by the cyrpto libraries I'm reading the docs in).
@npub1mxr…0htc gave me a good lead.

2024-11-28 02:53:30

- reply

Yes I am a fan of BLAKE3 and I would pull for it if we started over with a nostr2. But a DHT is *far* more than a hashing function. And existing DHTs have already defined their hashing function (mainline uses SHA-1 since it started long ago).

2024-11-28 02:09:43

- reply

Gossip checks (handle_websocket.rs lines 32-56). But it is also structured such that these events are not directly used by the UI, but pulled back out of the database by a different process (often using a similar filter or the same filter). So even if it didn't check when the events came in, you still wouldn't get spam in your feed via this attack vector.
(I replied to this note earlier but I don't see my other reply here in gossip so I'm replying again.)

2024-11-28 01:34:31

This note invites you, dear reader, to the gossip client chat at https://chachi.chat/groups.0xchat.com/R2yYwhsTcKO2b65i
All readers are invited, but I'm especially calling out @npub1000…vwqk @npub1hlq…z5wg and @npub180c…h6w6 with whom I have things I wish to discuss.

2024-11-28 00:18:05

I'm enduring a 7 hour planned power outage. It is strange how little I can do without power or water. Floors are clean, spiderwebs off the eaves. I miss the computer.