Martti Malmi

developing iris.to

Public Key

npub1g53mukxnjkcmr94fhryzkqutdz2ukq4ks0gvy5af25rgmwsl4ngq43drvk

NIP-05 Address

sirius@iris.to

NIP-57 Address

sirius@getalby.com

Profile Code

nprofile1qqsy2ga7trfetvd3j65m3jptqw9k39wtq2mg85xz2w542p5dhg06e5qppamhxue69uhhxmmvda3k7tnwdsq3gamnwvaz7tmnw3exvune9e5hy6tn9e6x73z74yz

Publishing to

soloco.nl

strfry.iris.to

relay.damus.io

Author Public Key

npub1g53mukxnjkcmr94fhryzkqutdz2ukq4ks0gvy5af25rgmwsl4ngq43drvk

Show more details

Last Notes

2025-04-03 11:28:09

- reply

Yes!

2025-03-31 13:00:46

#nevent1q…gxy9
I was thinking of doing this in Finland, but then you'd be a money transmitter and probably have to do KYC, which trashes the UX and defeats the purpose.
Setting up BTCPay Server or https://opennode.com for my favorite online stores might be a better way to make them accept bitcoin. Help them with bitcoin storage, exchange and accounting. The EU kindly doesn't yet require KYC from them.
What would be even more rad? Crawl online stores onto Shopstr, let users send orders that are paid in Cashu. Notify merchant of pending orders and let them redeem the nuts. User can reclaim the payment if merchant did not respond.

2025-03-30 10:06:28

Is anyone working on AI agents that can order stuff from any online store that takes credit cards, and you would pay the agent in Bitcoin? I think there was some company in Poland that does this manually.

2025-03-29 19:46:33

Briar: "Censorship-resistant peer-to-peer messaging that bypasses centralized servers. Connect via Bluetooth, Wi-Fi or Tor, with privacy built-in." https://briarproject.org/
Would be cool to have bluetooth & wifi sync on native Nostr apps. Would be useful in offline situations and countries where the internet is censored.

2025-03-03 13:03:11

https://image.nostr.build/7a53c9f29106e6c33b365a45cc0050757efd7a4447defde3591bfbb54227fa02.png
https://image.nostr.build/795774f84d2f4f709023d2a4e5c3b7f2186f8daac5d81a03445e9994a313e63f.png

2025-03-01 13:07:53

https://image.nostr.build/d8042bbd2caf45678003214f9c68a572b9e02333ba54d166741cabc75be58103.png
Double ratchet tests passing in my Damus fork. Yet to properly hook it into Damus UI and event system. https://github.com/mmalmi/damus/tree/doubleratchet/damus/Models/DoubleRatchet

2025-02-26 09:03:39

- reply

MLS also rotates keys after every message?

2025-02-24 09:27:50

Double ratchet messaging is deployed on iris.to. Try sending me a message at https://iris.to/sirius ! Thanks to Human Rights Foundation for supporting the project!
https://image.nostr.build/916a9511040129752750c3e33a334aa1a773a6985dc5c4d0890ff1779ade2a1a.png
https://image.nostr.build/2f7304813b3b002dd9d04e04db4b70969854192515d649399dae53bfe6bc768c.png
https://image.nostr.build/de549a76939bb38ffd06f6a4d788e54bd573d7804d181c018d0182e0adac6077.png
"Add to home screen" on iOS to enable push notifications.
The point of double ratchet is 1) hiding message metadata (who you're messaging and when) and 2) keeping your past and future message history safe in case your main Nostr key is revealed.
I'll write a nip for it. Basically it's Signal's "double ratchet with header encryption", but using Nostr keys instead of symmetric header key rotation. The algorithm is not too complicated. https://signal.org/docs/specifications/doubleratchet/
Typescript library, only uses cryptography from nostr-tools. https://github.com/mmalmi/nostr-double-ratchet
"Public invite" on your "new chat" page is published on Nostr. It's used when you first send message at someone's iris.to profile. Initial message to public invite is from anonymous sender, but publicly visible. From thereon, keys are rotated and stay hidden. "Private invite" is not published, so it's more private when shared over QR code or other channel.
Sometimes the chat sessions stop working at iris.to, probably it's incorrectly saving an old version of the ratchet session state. Working on it.

2025-02-24 07:24:44

- reply

It's a bit of apples to oranges comparison. Idk how Larry got hacked, but chances are that it was something other than compromised device. He might not have been hacked on Nostr. Compromise of Nostr key is unrecoverable unlike compromise of X account, but chances of it happening might be lower.

2025-02-24 06:59:19

- reply

App specific keys and some way to link and unlink them with each other.

2025-02-18 15:22:09

- reply

iris.cx

2025-02-11 11:47:30

Nostr-double-ratchet tests finally passing. Both ratchets should be working now, but don't take my word for it 😄
Signal-style 1-on-1 chat encryption in ~200 lines of typescript. Now just need to make it work again on iris.to and then other clients. https://github.com/mmalmi/nostr-double-ratchet

2025-02-01 10:51:33

- reply

2025-02-01 10:45:20

Sauna, swimming and hacking near Helsinki. Maybe we should do a Nostr retreat here after BTC HEL in August? https://image.nostr.build/baef27da5ff9fded8a3becdd0da0e0c0cef0aa00a79212583142829954c22144.jpg

2025-01-24 11:31:19

- reply

Iris only shows content from users who are in your social graph (web of follows) and also shares mute lists automatically. There's also checkmarks based on social graph distance and follower count.

2025-01-24 11:29:16

- reply

Yes, doing both

2025-01-23 15:32:36

@npub1l2v…ajft I'm initialising NDK with
const options = opts || {
explicitRelayUrls: DEFAULT_RELAYS,
enableOutboxModel: true,
cacheAdapter: new NDKCacheAdapterDexie({ dbName: 'irisdb-nostr' }),
};
ndkInstance = new NDK(options);
but not seeing connections to relays other than explicitRelayUrls. Should it be connecting to author relays as per outbox model?

2025-01-23 10:46:43

Any good free blossom hosts out there? Need something for iris.to.

2025-01-22 14:35:16

- reply

Locally generated follow & mute stats
https://image.nostr.build/9978051ad4bb22b1f8002a883d3d6d4e9e88a6e370cec1f85ff490bed9bf02cd.png
https://image.nostr.build/59a5b7f6353f65d084691a0ee854263cc1fdf4eedc14ceef31987a710403989c.png
https://image.nostr.build/a1f5f6da36b553571062de709ee9978ae4b9764917cfae07eb2bf528cf9b61c2.png

2025-01-22 14:17:55

Fixed iris.to mute function and added mute list sharing. @npub12rv…85vg
Users who are muted more than followed are automatically hidden from feeds and replies. You can disable the feature in settings if you want.
Mutes / follows by 1st degree (users followed by you) are checked first. If there are none, then 2nd degree and so on.

2025-01-22 13:29:43

- reply

We used to build Iris and Snort from the same codebase (branded differently, with different build config). Last year I rewrote Iris from scratch, so now it's a separate codebase again.

2025-01-22 13:23:54

- reply

[iris]
name = "Iris"
categories = [ "microblogging" ]
description = "Simple and fast web client"
gallery = [
"https://image.nostr.build/325c6c9573a76bfea1091539ab218bd6023b13f7b7fd8e19138bcd5799503fba.png",
"https://image.nostr.build/27ce28127b2fd457d7be0cf583af941d39707a073c48a76550e8652ad49d6382.png"
]
features = [
"Short notes",
"Social graph filter",
"Image grid feeds"
]
npub = "npub1wnwwcv0a8wx0m9stck34ajlwhzuua68ts8mw3kjvspn42dcfyjxs4n95l8"
platforms = [ "web" ]
source = "https://github.com/irislib/iris-client"
thumb = " https://image.nostr.build/5457b339d6ed801fe1c50f2cd47c3d5e2a5d41524fbea31f9bd0ae70e3c067b3.png"
url = "https://iris.to"

2025-01-22 13:18:22

- reply

Iris is a separate codebase now

2025-01-22 07:59:16

https://image.nostr.build/c2e3c6b2a23b476d01a5725c9ade8f0d0a033a089a82581d91f83c51f713ea4b.jpg

2025-01-03 14:02:11

- reply

This would be useful at conferences where the internet can't handle 200 simultaneous GM posts to Fiatjaf.

2024-12-31 21:03:32

- reply

You can always use a desktop or mobile client if browser clients don't work for you.

2024-12-31 20:47:19

I don't know how long iris.to has been blocked in China, but maybe this explains the recent drop in traffic. https://image.nostr.build/620613e955d872eb9f2146dc474b6d7ccf852d67c965794d7131cf7a8fdc92f5.png

2024-12-13 11:09:28

Found myself at the Shibuya hard techno club ANUBIS in September, after Bitcoin Tokyo 2024. @npub17pl…ezx0 had to take the last train home, so I went to check it out by myself. It was such a fun party that I stayed on the dance floor late into the night. https://ra.co/ has the best raves. https://image.nostr.build/bbe745cae458fcba49b6b815613c6decef15e37bdd377a2f4247192efac157b1.jpg

2024-12-13 10:37:11

- reply

I want all apps like Mullvad VPN: paid with bitcoin. Account is just a random number: no email, phone number, street address, credit card etc. required.

2024-11-19 09:01:01

- reply

Unfortunately browsers won't let you connect to insecure ws / http from a secure https origin. We could do a Tauri desktop version of Iris to bypass that restriction.

2024-11-19 06:54:04

- reply

Yes, nearly every house and many large apartments have a sauna. Then there's hundreds of thousands of summer cottages.

2024-11-19 06:51:12

- reply

It's better to wait until the ticket sale opens.

2024-11-18 08:41:05

- reply

See you in HEL!

2024-11-18 08:04:27

- reply

Who should represent El Salvador?

2024-11-18 08:04:11

- reply

@npub1qg8…24kw @npub1exc…n72a @npub1xts…kk5s @npub12rv…85vg @npub1qny…95gx @npub1c87…8avm @npub1l2v…ajft @npub18am…p424 @npub10vl…sp42 @npub1cj8…rz4u @npub1lr2…dl6a @npub16vr…p2va @npub1szp…h3td @npub1cn4…3vle @npub1sg6…f63m @npub1cjw…j2rh @npub1a2c…w83a @npub1e0z…0txy @npub1wg4…6a4f @npub1sn0…jdv9 @npub1dg6…sguz

2024-11-18 07:33:04

Always wanted to visit Finland, the land of 5 million people and 3 million saunas? Now’s the perfect chance.
BTC HEL, the largest Bitcoin conference in the Nordics, will take place in Helsinki for the first time on August 15–16, 2025.
Join us in orange-pilling Finland before the anti-crypto narrative has a chance to catch on, like it has in other Nordic countries.
We have a positive and true story to tell: Bitcoin can make even renewables more profitable and balance the power grid. In the North we can use up all the excess heat. All the while, sound money fixes short-sighted fiat culture.
Please DM @npub1w2e…pmgp or email hello@btchel.com if you’re interested in speaking! Flights and hotel are covered for speakers.
Tag the people you’d like to see there!
Sign up for the mailing list to know when the ticket sales begin: https://btchel.com
https://image.nostr.build/fd016e6c41a5010cdeeae1eeee5066a35d38db7b240ba04c946a9d5520df8bba.jpg
https://image.nostr.build/1192f7cc27b490ede3286160769996f12d1dd8687830a461cf9eea01f52a7dd4.jpg

2024-10-30 06:44:29

- reply

#nevent1q…twju

2024-10-30 06:43:50

- reply

Applied after hard refresh? 😄 @npub12rv…85vg

2024-10-30 06:43:15

Sorry, I had introduced a bug to tags, should be fixed now.

2024-10-29 08:23:25

- reply

I wonder why they did not build on Nostr keys and events. Anyway, the pubkey-dns resolver is super cool! It should be complemented with a browser extension for looking up public keys in your social graph.

2024-10-28 20:05:41

- reply

https://youtu.be/KgkBWZXVLyk

2024-10-28 11:49:56

- reply

Toxicity 🔥
https://video.nostr.build/1d605c049c58762159fe48e99b96d75fc67ea4cf11c6128067d37c6db763592c.mp4

2024-10-28 11:45:31

- reply

You too!!!
https://video.nostr.build/91378e7e899e28555297fa3ea96a11aa7c685f18f3bc32919a9ca4f5e6cb630b.mp4

2024-10-28 09:09:59

Lugano was so much more crazy and fun than I expected 😄
I played my first gig since high school. Can't wait for the next Rockamoto!
@npub1jt9…la9y @npub1fk8…cwld @npub1exc…n72a @npub1lr2…dl6a @npub1au2…t53j @npub1ydx…rlcw @npub1z77…09sr
https://video.nostr.build/bfcda3d2f4c4d0e6cea5cf2f998307d7ada0bc42858b48864c4a9bd28359c1b7.mp4
https://video.nostr.build/ef74d46ad5dbed1eba0530b070b8175ecd2e44d00e0bb6ab1bdbe27997c89342.mp4
https://image.nostr.build/1ca9cd775380252595caa7f789f098cc309cb541a5102d60927567ee6867d432.jpg

2024-10-23 10:33:58

- reply

Also I think I want to do a LMDB version of this: https://github.com/mmalmi/nostr-social-graph/blob/master/src/SocialGraph.ts
Can be used as a strfry web of trust filtering plugin.

2024-10-23 10:32:07

Daily dev thoughts: Nostr notification server should probably connect to relays and let them do what they do best: filter -> subscription matching. On the notification server you'd just match the subscription ID to notification endpoints. Resubscribe everything if the relay websocket reconnects.
If you're self-hosting and only have a small number of notification subscriptions (less than 20 or so), you can connect to public relays. If you're running a notification server for 1M users, you'll need your own private relay that has no subscription limit.
I'm thinking of pubkey -> [notification subscription JSON] database. Pubkey is client & session specific, not linked to a Nostr public identity.
What DB to use? I want it to be easy to self-host (docker at minimum) but also scaleable, so it can be the default notification server of a client. Efficient persistence is an obvious requirement. LMDB seems like a good option, but on the other hand MongoDB has lots of existing tools for administration, monitoring, indexing, JSON handling etc.
@npub1xts…kk5s

2024-10-23 06:14:04

Such an inspiring story!
#nevent1q…d2c7

2024-10-19 08:55:46

- reply

And one-click zap with other wallets too

2024-10-19 08:55:25

- reply

Yes, being able to one-click-zap using the Cashu wallet would make it a lot better. I just probably don't have the time to do it anytime soon 😬

2024-10-19 08:34:54

New Iris version source code is here. Now you can fix your favourite annoying bugs: https://github.com/irislib/iris-client

2024-10-14 08:25:21

- reply

#nevent1q…kt8k

2024-10-14 08:00:01

- reply

We should have had @npub1l2v…ajft on stage to boost our energy 😄

2024-10-14 07:53:57

- reply

Yeah, we are often our own worst critics when others don't care so much. It's healthy to learn from mistakes, but also to get over them. I've had difficulty with the latter and found that talking about things helps in the process, even if it can be uncomfortable.

2024-10-14 07:42:44

- reply

I mentioned it later on the panel: building applications that move money and taking a cut of them, even if it's a voluntary donation that's enabled by default.

2024-10-14 07:39:04

Fug... now that I'm home, I woke up last night to reflect on past cringes. On the main stage panel in Amsterdam I forgot what I was about to say (how to make money with Nostr) after already starting my answer and ended with "and umm yeah [awkward silence]". Should have re-asked the question.
I'm quite sensitive to cringe, but fortunately those moments have been mostly off stage since Slush 2014 which was pretty bad (or maybe I just haven't noticed). I'm not the best speaker, but I'll try 😄 Come see me in Lugano next week!

2024-10-13 19:50:57

- reply

So it would actually be a general notification service, not just web push

2024-10-13 19:46:05

- reply

For those who don't do push notifications, it could send email, sms or fax

2024-10-13 19:21:23

Random dev thoughts: Would it be a good idea to do an open source web push notification server for Nostr?
It could have fine-grained options for what notifications you want, from whom and how often.
It could be used automatically in the background by a client, or through its own web UI. Clicking the notifications would redirect you to the client of your choice.
It would be a lot like a relay in that it needs to match incoming events to a potentially large amount of subscriptions. Subscriptions would be persisted in a database and maybe managed over a REST API.
In addition to the stuff typically sent over Nostr, you need to send the subscription object and other things like notification frequency, maximum social graph distance or score, minimum zap amount to notify etc.
It would connect to other relays and maybe also have a websocket endpoint for receiving events over Nostr protocol.
Extending strfry into this direction crossed my mind, but maybe something like Django (or whatever web framework you're familiar with) would be better, as we need to persist the subscriptions.

2024-10-12 07:39:50

- reply

If you want to use multiple Nostr clients for the same double ratchet or MLS chats, they can technically be different members of a group. MLS would handle that better especially as groups get larger and numerous.

2024-10-12 07:24:39

- reply

It's a step in the right direction, but it still reveals the recipient and doesn't do key rotation, so all your message history and future messages are revealed if your main Nostr key is ever compromised. It's a tradeoff between security and availability. I'd personally choose Signal-style key rotation.

2024-10-12 07:19:01

- reply

True, I forgot to mention that with double ratchet or MLS we can solve the metadata privacy on Nostr. Working on double ratchet, already deployed on Iris: https://github.com/mmalmi/nostr-double-ratchet

2024-10-12 07:17:12

- reply

Absolutely, I should have mentioned that with double ratchet and MLS we can solve the metadata issue on Nostr. Working on double ratchet, already have single ratchet on Iris. https://github.com/mmalmi/nostr-double-ratchet

2024-10-11 16:46:43

- reply

You can use disappearing messages if you're worried about device access. Disappearing messages require ratcheting, otherwise the message history will be found on relays and decryptable. Ratcheting protects your past and future messages even if your main key is stolen by a compromised client or one-time device access.
On Signal, maybe someone who borrows your phone could link another device without you noticing? Idk. But double ratchet still protects from all the other scenarios.

2024-10-11 16:09:48

- reply

What would this attack look like in practice, against Signal for example?

2024-10-11 08:10:54

- reply

No, we use temporary keys that are rotated and only live on device. Main key is only used for authentication on the first key exchange.

2024-10-11 03:50:11

- reply

Temporary npubs are quite similar to message queues. Maybe you could also send a "delete" event to relays after receiving a message.

2024-10-11 03:37:48

- reply

We can use temporary npubs that are not linked to long-term identities and rotate them all the time. Iris.to messages already do that. The code is here: https://github.com/mmalmi/nostr-double-ratchet

2024-10-11 03:25:39

- reply

That's easy to do on Nostr with secure messaging protocols like double ratchet and probably MLS. Just add "create anonymous chat" in the UI.
It's just that relays can probably figure out who you are if you also make other Nostr requests. Maybe need a different client and relays if you want to avoid that.

2024-10-11 03:18:20

Secure DMs and groups might be how Nostr wins. Like Signal, but better: no phone number or centralized service provider needed. Actually there are no publicly visible user IDs involved, so in that regard it's similar to simplex.chat.
Unlike public messaging, DMs do not depend on the network effect. Great for onboarding people and keeping them returning with push notifications. They get a bitcoin wallet, zaps and all the other Nostr greatness on the side.
Many people don't want to let go of their existing follower base on X, but "Nostr DMs only" is easier to do. I could imagine that becoming a thing in the Bitcoin scene at first.

2024-10-10 12:09:05

- reply

Can MLS be done using only nostr-tools primitives like DH and hkdf?

2024-10-10 11:59:12

- reply

I’ll definitely look into MLS

2024-10-10 11:58:11

- reply

I’m very uncomfortable using DMs that don’t have forward secrecy. That builds up a growing trove of private message history that will all be revealed if your key is ever compromised, increasing the potential harm with every message.

2024-10-10 10:14:07

- reply

This is right next to the conference venue, which is a beautiful old brick building

2024-10-10 10:12:29

Got a bit awestruck again by the combination of natural beauty and a city built for humans by all the generations before us. We need a renaissance of beautifully built environments.
https://video.nostr.build/c83e3e13ed65932f234e1107e305724d1309ca15bc20087135bdbee1ffdae5de.mp4

2024-10-09 15:54:11

- reply

Double ratchet is simple to implement and works well for 1-on-1 chats. MLS is better for groups. In case the MLS is also good for 1-on-1, happy to change.

2024-10-09 15:41:34

I'm at Bitcoin Amsterdam, but spent half the day finishing some Signal-style double ratchet messaging.
Deployed an experimental version on https://iris.to. You can create chat invite links and give them to friends via QR or other messaging. The UI is still lacking and glitchy, but just had to demo at the conference.
The chats cannot be publicly linked to either participant, and even if your main Nostr key is revealed, the content and existence of past messages stays hidden.
https://image.nostr.build/b4533acd973793f7114fd5c272ccd5b5045ea0bd127c214e8314fc4c8282a354.png
https://image.nostr.build/ded8c0437548cb1359d34b43b966b64f798cd2f98ae5f859771f47cc551cd5bd.png
https://image.nostr.build/4458f2de8f4d424aff137d2d7ed283dd27501e1abc0a43234405008614a5cb70.png
Also published npm package nostr-double-ratchet 0.0.1: https://www.npmjs.com/package/nostr-double-ratchet
It's not actually double ratchet yet, but the single ratchet already achieves forward and backward secrecy.
The second ratchet would help secure the latest consecutive messages by same author, in case a message key for the most recent of their messages is compromised. That makes disappearing messages or manually deleted messages more secure. I guess we'll have to do it so we can say "Signal-level security".
This is obviously not tested or audited yet, but probably it's not worse than normal Nostr DMs 😅
You can take a look at the source code, but I'll write a better technical description later. It's using existing Nostr cryptography + some key derivation stuff. Chat invites use gift wrap -like arrangement addressed to the inviter's temporary session key. https://github.com/mmalmi/nostr-double-ratchet

2024-10-07 19:26:32

How to do millisecond timestamps on Nostr? 🐒 In chats it's not unusual to send multiple messages during the same second, not to mention other stuff like games.

2024-10-07 05:06:51

- reply

Seems there's no whitespace before the url, so other clients interpret the leading part as part of the url.
Maybe Iris shouldn't highlight urls that don't have leading whitespace or linebreak, so users notice in the editor that something's wrong. (I actually used to have that check in my regex, but that broke other things in the library I used.)

2024-10-06 18:58:21

- reply

Gzip can however compress the text content of notes whether binary or json

2024-10-06 18:54:59

- reply

Event IDs, pubkeys and sigs are such high entropy data that gzip probably won't compress them much. Also binary formats are faster to decode than json (+ gzip).

2024-10-06 18:49:54

- reply

I believe we'll always have JSON for simplicity and backward compatibility. Simplicity is indeed important, it's why Nostr attracted developers. I don't think opt-in binary format supported by some clients and relays can break that. We already have many nips not supported by everyone.

2024-10-05 19:18:25

- reply

Fields like event id, sig, pubkey, p & e tags would be 50% smaller in binary vs utf-8 hex. Follow lists are currently quite large and their size would be basically cut in half.
But if we implemented NIP-114, we could save even 90% or more in bandwidth and some processing as well, depending on how many relays you connect to. Hoping to find some time for it again. https://github.com/nostr-protocol/nips/pull/1027

2024-10-04 07:06:20

- reply

You have a point. The user's own avatar is one of the first images shown on the page, in a certain size, so you could even guess the Nostr user.
Without the proxy, requests are sent to multiple servers, making it more difficult to associate everything the user does.
On the other hand, those other image hosts might include those that are built expressly for logging and tracking users. Popular service like nostr.build or imgur.com can do that kind of analysis anyway.
Using a proxy, you can at least choose which host(s) you trust. Ultimately, the choice of proxy should be configurable, just like relays. Image loading without proxy is privacy-wise somewhat equivalent to outbox model (or nip05) where you connect to random addresses that see your requests.
Relays also know a lot about what you're looking at, and you might even reveal your identity by authenticating. The only way I see around this is onion routing where Nostr requests would be relayed on behalf of others, so there's plausible deniability.
Associating network address to a geolocation is a feature of the internet protocol. Tor and VPNs (where you also need to trust a 3rd party) seem to be the only solutions to that.
When it comes to image proxying, file size is one very pragmatic consideration. Without a minimizing proxy, avatars can be 100 times larger. Maybe multi-resolution image formats are the best solution to that.

2024-10-03 13:49:38

- reply

They pretty much even copied the iris logo I had pre-nostr https://image.nostr.build/8d4bf8052c62821e9b0f42f142880040fae4ee659742efd662ca18980b4acdad.png

2024-10-03 10:48:13

- reply

Fixed these two

2024-10-03 09:33:51

- reply

Unfortunately, yes. The wallet is hosted on the same domain (iris.to), but it's a separate application running in an iframe. I haven't integrated it on the actual Iris side yet.

2024-10-02 07:47:16

@npub1h0u…rwx8 do you have a spec for the double ratchet protocol you're building?

2024-10-02 04:59:18

- reply

testing cmd+enter

2024-10-02 04:58:15

- reply

#nevent1q…kema

2024-10-02 04:57:19

Fixed it for you
https://image.nostr.build/17202defe2d4295a3fd83b7bb4bbc3b982a724e14f940d35e05c8174e1c9ec33.png
Upload is fast, but nostr.build takes some time to check the image and return the url
https://image.nostr.build/1cc298a7cce6d0519962f410fc1be085d1c9e3d24a743009e920865c1edbd82f.png
#nevent1q…6wzz

2024-09-30 18:59:49

- reply

Zap.army

2024-09-30 17:50:05

- reply

They're separate codebases again. Iris uses NDK and Snort uses the Snort system (also available as a library).

2024-09-30 16:48:03

- reply

There's no download indicator but it should be downloading https://files.iris.to/large_social_graph.json. You can also try downloading from that link and feeding to "load from file".

2024-09-30 16:41:44

- reply

It’s so large that it crashes the mobile browser though 🤷‍♂️

2024-09-30 16:31:55

Added to https://iris.to and https://graph.iris.to the option to download a large pre-crawled social graph with 161K users and 5.25M follow relationships.
https://image.nostr.build/c937f408d0543e06c86ae4df700d3ead8e61122c53fe7d1c54e3bb7382c487a4.png

2024-09-28 13:45:40

- reply

Forward secrecy means that compromise of a long-term key doesn't reveal past messages. Signal does provide that. It's a different category of attack if someone gets access to your device and sees your chat history, or tricks you to link an untrusted device.
Export is possible in any client, at the very least with screenshots or by writing the message history on a piece of paper, but that's not related to forward secrecy. Disappearing messages is the solution when you don't want your message history potentially seen by anyone later.
You can use a VPN to hide your geolocation from Signal (which you should do on Nostr as well if you need privacy), but it's true that they can connect your messages to your phone number, see when and probably with whom you're chatting. Not surprised if intelligence agencies are mining that data.
With Nostr we're at least over the phone number part, there's no single service that sees all traffic and there are different ways to fix the metadata issue — and do forward & backward secrecy when desired.

2024-09-28 09:16:19

- reply

Signal doesn't have forward secrecy if you can save a backup of your chat? I don't think that's the definition.

2024-09-28 09:14:24

- reply

How would you derive the address? Something like event.pubkey = publicKey(KDF(messageKey))? I imagine "mailbox address" would need to be the signer's public key so others can't spam the mailbox.

2024-09-28 09:09:13

- reply

There's nothing preventing users from moving to another DM client. You can always go back to the old client or export or copy paste message histories if you need them.
It's not comparable to Twitter or Facebook, because you own your identity key and can always change the client or relays.
There's always a tradeoff between availability and security of messages, and maybe there are different use cases for both kinds of messaging. On Nostr, we are free to choose.

2024-09-28 08:38:40

- reply

Actually even without device linking, I'd rather use forward-secret messages even if they're out of sync with some other client.