Nostr notes by

> This is totally disrespectful I think my behavior is ...

2026-08-08T12:45:22Z

In reply to nevent1q…shzp
_________________________

> This is totally disrespectful

I think my behavior is adequate to GOS' ignorance of my initial inquiries and their irrational-aggressive response they previously gave in the similar discussion. However, that wouldn't be adequate if I started communication with them this way.

> You clearly blame the developers for *not implementing* a feature

I've already debunked this assumption here:

quoting
nevent1q…lsl7
> Clearly you are doing this. When you request a feature in GrapheneOS, then you request the Graphene team to work on this solution.

Nope, this is out of context.

I *used to* request this in the past (before publishing this meme) here on Nostr, but as soon as I noticed they ignored my messages, I did research and found their "criticism" of the similar request:

> What you're requesting is that we add things which are easily detected by unsophisticated adversaries

Which is a strawman argument. The duress pin behavior is currently clear without any tools: a device reboots, shows an error.

And in the same response they have:

> Keep doing it and you'll be suspended

Because somebody suspected that they are targeting some unexpected scope they can't properly explain.

Two very bold mistakes in one comment. This would be insanity to ask them for any request after reading all this.

And what scope is that really? I don't know for sure yet. I received an independent response here, a good one:

nevent1q…0lnp

> protecting whoever else

Is the phone owner's security part of the scope? Hello, GrapheneOS (npub1235…0ht5)? I know you won't respond to me. All this is for the records.

Users have no idea what Pandora's box they are carrying with them.

Not gonna become another troll; that's not my thing. I prefer ...

2026-08-08T14:23:33Z

Not gonna become another troll; that's not my thing. I prefer peaceful, constructive, intellectual conversations. I don't claim I'm perfect in that, though.

My apologies to whoever I caused or will possibly cause emotional discomfort in whatever conversation. That's not intentional ☮

#grownostr

https://www.youtube.com/watch?v=jJ0trKBniDE

I believe we both have something to say to each other; we still ...

2026-08-08T13:21:33Z

In reply to nevent1q…t9hx
_________________________

I believe we both have something to say to each other; we still have disagreements. Yet I don't want it to become a burden, so I propose to stop here. I appreciate your efforts and patience in this discussion. Thank you. Peace.

A buyer on VIA is looking for accessories · scarf · scarf. Any ...

2026-08-07T11:02:34Z

A buyer on VIA is looking for accessories · scarf · scarf. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/e208d509-4090-4ba6-8f8a-152d570333ad

> then you request the Graphene team to work on this solution ...

2026-08-08T10:51:18Z

In reply to nevent1q…klxm
_________________________

> then you request the Graphene team to work on this solution

Also, this is not how it works. Every request in every FOSS project is a *proposition* of something; it's never an obligation for devs implementing anything. A proposition is an open discussion, which might be ignored or might be responded to in some way.

A typical universal rejection response would be "this significantly increases complexity; we don't have resources to support such a feature"—which is easy to use as some kind of excuse, but still okay. This automatically ends many unnecessary debates and drama.

Their response, however, is different, and this response was challenged by others. And somebody appeared to receive an aggressive, irrational kind of response from GOS, which damages GOS' reputation and shows some kind of paradoxical divergence from their project vision and values they try to represent in the stuff they have on their website and their social media posts (like the OP post about opposing authoritarianism in particular).

The declared vision/values themselves are good; the way they execute these values is a trouble. Doubts arise; for instance, are they actually opposing authoritarianism, or are they opposing their hallucinations about authoritarianism while ignoring points from those who live or used to live under the actual authoritarian regimes?

Those who got it—unmotivated to propose them anything, since every proposal is energy-consuming. So if it's not rooting, then forking GOS and implementing whatever is needed might be a better rational approach for those who have enough resources. I hope this makes sense.

Good to know, thanks. I definitely noticed this particular ...

2026-08-07T15:02:00Z

In reply to nevent1q…az9w
_________________________

Good to know, thanks. I definitely noticed this particular characteristic:

> gaslight people

> it is no threat to your privacy at all On the other hand, if ...

2026-08-07T14:07:22Z

In reply to nevent1q…dshf
_________________________

> it is no threat to your privacy at all

On the other hand, if somebody is suspected and they carry a laptop with them—the next thing after the phone they will want to access is the laptop. So some privacy threat probability may increase.

> What are you talking about then? About security in all ...

2026-08-07T13:49:41Z

In reply to nevent1q…tm87
_________________________

> What are you talking about then?

About security in all relevant meanings: the actual official scope GOS is targeting for this feature is not obvious, and it seems to be misleading.

The guy in the airport from the news, for instance, could possibly be deluded by the exact same thread responses GOS gave on their forum; he could take their "easily detected by unsophisticated adversaries" as a real counterargument rather than the straw man fallacy, take their "NSA level opposition" response, and make a dangerous conclusion: "all this means I'm safe; I can use this feature in this particular airport because they technically won't be able to get that I used that feature at all".

> Do you expect a marvel figure be born out of the Graphene install?

Nothing like that much exaggerated. I believe what I initially wanted is possible to implement, and this would work for most of the real-world scenarios I've personally and many others have run into as a routine already, and it has disadvantages like everything we choose to implement. I don't request implementing this anymore, though, as I said.

A buyer on VIA is looking for accessories · wallet · wallet. ...

2026-08-07T13:03:20Z

A buyer on VIA is looking for accessories · wallet · wallet. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/988138b5-9f83-4be5-8a8a-7887e8e899c5

[здесь должен быть какой-то ...

2026-08-02T18:32:11Z

In reply to nevent1q…85y8
_________________________

[здесь должен быть какой-то самоиронично-нигилистский зарифмованный текст, который еще из меня не успел выйти]

https://www.youtube.com/watch?v=jJ0trKBniDE

A buyer on VIA is looking for media/zines · zine · zine. Any ...

2026-08-07T09:32:05Z

A buyer on VIA is looking for media/zines · zine · zine. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/d4dafc70-cc5e-4350-a119-a2322b02c162

A buyer on VIA is looking for apparel/footwear · suede · suede. ...

2026-08-07T09:30:49Z

A buyer on VIA is looking for apparel/footwear · suede · suede. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/c14463b9-5f73-4f69-bf50-afe6b477a12f

> Clearly you are doing this. When you request a feature in ...

2026-08-07T07:04:53Z

In reply to nevent1q…f2xq
_________________________

> Clearly you are doing this. When you request a feature in GrapheneOS, then you request the Graphene team to work on this solution.

Nope, this is out of context.

I *used to* request this in the past (before publishing this meme) here on Nostr, but as soon as I noticed they ignored my messages, I did research and found their "criticism" of the similar request:

> What you're requesting is that we add things which are easily detected by unsophisticated adversaries

Which is a strawman argument. The duress pin behavior is currently clear without any tools: a device reboots, shows an error.

And in the same response they have:

> Keep doing it and you'll be suspended

Because somebody suspected that they are targeting some unexpected scope they can't properly explain.

Two very bold mistakes in one comment. This would be insanity to ask them for any request after reading all this.

And what scope is that really? I don't know for sure yet. I received an independent response here, a good one:

quoting
nevent1q…0lnp

codonaft (nprofile…jys9) the case it actually covers is narrower than it looks. it works when someone compels an unlock in front of you and has not already imaged the device, because a wipe against an existing image buys nothing. so most of its value is protecting whoever else is in your phone, a source or a colleague, more than protecting you. the price is that it is irreversible, you can fat finger it under stress, and in some jurisdictions destroying data under compulsion becomes its own charge.

> protecting whoever else

Is the phone owner's security part of the scope? Hello, GrapheneOS (npub1235…0ht5)? I know you won't respond to me. All this is for the records.

Users have no idea what Pandora's box they are carrying with them.

A buyer on VIA is looking for food/condiments · hot sauce · hot ...

2026-08-07T07:03:19Z

A buyer on VIA is looking for food/condiments · hot sauce · hot sauce. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/1ad920b2-f761-4202-a519-d17821c9aaa0

Well, at least they respond to you. It appears they don't ...

2026-08-07T00:52:16Z

In reply to nevent1q…5qrr
_________________________

Well, at least they respond to you. It appears they don't when they have nothing to say.

Could be malformed events as well or just broken clients that ...

2026-08-06T23:45:27Z

In reply to nevent1q…6jm5
_________________________

Could be malformed events as well or just broken clients that can't render some of the valid events.

quoting
nevent1q…y2sp

YakiHonne (npub1yzv…rf8q) is it a bug?

People have been complaining that Primal is censoring people here. Here's a thread with the reversed example `https://yakihonne.com/note/nevent1qqs0q7drm7wl5608wel58ehyjxmm7z804h6xcz6w7y4sglyv4epjj8q8puq5y`: YakiHonne shows me a notification sent by my followee, but when I click on it, I see an empty thread (while Primal shows these messages). Although I received the event from relays and even see the expected message count.

If it's due to spam detection, this could be improved by showing messages from those whom I subscribed to. Or by showing the messages of those whom I responded to in the same thread (in the same thread, because some users tend to respond to "reply guys" without realizing it first).

We could still have a "Not a spam" button that labels a post (NIP-32) as well in this case. Could be a useful heuristic if labels are requested from WoT/people with high trust rank/etc.

#spam #devstr

https://github.com/YakiHonne/web-app/issues/100

What are the appropriate use cases for a duress pin in ...

2026-08-06T22:32:10Z

What are the appropriate use cases for a duress pin in GrapheneOS (npub1235…0ht5)? Have you possibly used it in a real scenario already? What price did you pay for that?

#asknostr #grapheneos #privacy

quoting
nevent1q…d7as

This still blows my mind: in my particular case, a rooted version is more secure than the normal one.

And messengers is just an example; generally, I'm looking for any app data cleanup and any directory of files removal.

> I do not see this part of the scope of GrapheneOS

Exactly, exactly, I don't argue that. What makes me sad is that GOS behaves as if they were rejecting it somehow. There's clearly a paradox. And of course they are reacting accordingly when their stuff is interpreted as, quote:

> it seems that the developer approach tends to be that if a solution won't work against NSA *level* opposition

And the response is:

> This is a disingenuous misrepresentation of our position. What you're requesting is that we add things which are easily detected by unsophisticated adversaries including with automated tooling distributed to them ...

A journalist that carries raw secret materials from Edward Snowden—that's a perfect case; what else? What's the appropriate use of their feature? Whatever privacy-respecting person is just passing a border with nothing special on their phone?—There's a link I've posted before about a US citizen and what may happen if you do it there.

> easily detected by unsophisticated adversaries

With your current implementation—this is a grotesque kind of comment, GrapheneOS (npub1235…0ht5) I was trying to be polite, but you don't respond anyway. It's when you're being so unattached from reality, when you literally suddenly remind me of classic authoritarian leader kind of behavior.

This still blows my mind: in my particular case, a rooted version ...

2026-08-06T22:00:57Z

In reply to nevent1q…j9t2
_________________________

This still blows my mind: in my particular case, a rooted version is more secure than the normal one.

And messengers is just an example; generally, I'm looking for any app data cleanup and any directory of files removal.

> I do not see this part of the scope of GrapheneOS

Exactly, exactly, I don't argue that. What makes me sad is that GOS behaves as if they were rejecting it somehow. There's clearly a paradox. And of course they are reacting accordingly when their stuff is interpreted as, quote:

> it seems that the developer approach tends to be that if a solution won't work against NSA *level* opposition

And the response is:

> This is a disingenuous misrepresentation of our position. What you're requesting is that we add things which are easily detected by unsophisticated adversaries including with automated tooling distributed to them ...

A journalist that carries raw secret materials from Edward Snowden—that's a perfect case; what else? What's the appropriate use of their feature? Whatever privacy-respecting person is just passing a border with nothing special on their phone?—There's a link I've posted before about a US citizen and what may happen if you do it there.

> easily detected by unsophisticated adversaries

With your current implementation—this is a grotesque kind of comment, GrapheneOS (npub1235…0ht5) I was trying to be polite, but you don't respond anyway. It's when you're being so unattached from reality, when you literally suddenly remind me of classic authoritarian leader kind of behavior.

> text launcher > put an other icon on top of > second ...

2026-08-06T21:12:29Z

In reply to nevent1q…dw4a
_________________________

> text launcher

> put an other icon on top of

> second profile

None of these are close to what I'm looking for, unfortunately; all of them are easy to spot.

> whatever you request probably already exists

I'm not aware of any tolerable solution that would not require installing a rooted GOS version (which will likely brick a device on some update).

#nevent1q…fxur

2026-08-06T20:33:40Z

In reply to nevent1q…58v0
_________________________

quoting nevent1q…fxur
Устрой застой, СиАйкой больше не строй
Круши, GitHub, деплой уходит в простой
Алерт? — Забей, слопы и дальше вливай
Давай, AI

Если вдруг у тебя нет головы, я могу тебе легко подключить свою
Но только чур чтоб ты потом не выл, мол, «Клод, ты мне подложил свинью»
Давай с тобой договоримся тупо: твой поступок — это твой поступок
Свою ответственность перекладывать глупо на какого-то там бездушного трупа

#стихи #стихотерапия #ии #ностр

https://www.nair.sh/guides-and-opinions/communicating-your-expertise/why-senior-developers-fail-to-communicate-their-expertise

The actual problematic convenience: #naddr1qq…wlnx

2026-08-06T20:19:53Z

In reply to nevent1q…ymlx
_________________________

The actual problematic convenience:

quoting
naddr1qq…wlnx

The pattern you are about to read is not new. It is the classic co-opting pattern that has played out repeatedly over the past 30 years, with Linux servers ending up as AWS plantations, XMPP suffocated by centralized messengers, Email dominated by a handful of providers, and Mastodon instances consolidating under corporate operators. The damage does not require a grand conspiracy. It requires one small compromise, then another, then a generation that grows up thinking the result is normal.

What is new is that the same pattern is now arriving in Nostr, and the first clients with OAuth login have already shipped.

The Core Issue: A Bridge Between Pseudonymity and KYC

Nostr was built as an explicit counter-model to KYC (Know Your Customer) platforms. No phone number, no email, no identity check. You generate a key pair, you are in. Your npub (public key) reveals nothing about who you are as a person. For most Nostr users, this is not a side effect. It is the entire point. They moved away from Twitter, Facebook, and Google precisely to stop leaving personally traceable footprints.

A Google or Apple account is, by definition, a KYC'd identity. You cannot create one without a phone number, and in most cases you also hand over a real name, a payment method, and years of behavior. The moment a Nostr user binds their npub to such an account, three things become true at once:

The link is permanent, as it sits in the IdP (identity provider)'s logs from the moment of login.

The link is irreversible, because the IdP will not delete it just because the user stops using the feature.

The link is correlatable, as no extra work is required and it happens in the normal data pipeline.

This is not about whether Google or Apple read your Nostr messages. It is about whether the wall between your anonymous Nostr identity and your real-world KYC'd identity holds. With every OAuth button in a Nostr client, that wall gets a hole punched through it. The hole does not close.

The damage does not require Phase 2, 3, or 4 of anything. In the moment a Nostr user performs their first OAuth login in a Nostr client, the link is established. Everything after that is merely a question of who uses that link, and for what purpose.

This is not Phase 1 of a process. This is the taboo break itself.

What Is Already Happening

The taboo is already broken. The first Nostr clients have started shipping OAuth login buttons ("Continue with Google", "Continue with Apple") on their splash screens. The convenient, familiar path is placed first visually. Beginners take the top button. That is not a guess. That is how UX works.

What happens next is not hypothetical. It is the direct, foreseeable consequence of routing a Nostr identity through a data broker's account.

What the IdP learns, even without ever seeing the nsec (the Nostr private key):

"This real-name account uses a Nostr client." The OAuth access runs on the client's OAuth client ID. The IdP knows for certain: this Google or Apple account, with real name, email, phone number, payment data, and years of behavior, uses a Nostr client. This entry is permanent in the account's security settings.

Activity patterns over time. Every authenticated call (backup upload, sync, restore, listing) is timestamped and tied to the account. The IdP sees when the user signs in, switches devices, and how often.

IP and rough location. Every call to the IdP's servers carries the user's IP address, timestamp, and OAuth token.

File metadata. Any data the client stores in the IdP's cloud (Drive, iCloud) is hidden from the user's UI, not from the IdP's servers. File existence, size, and timestamps are fully visible.

Cross-service enrichment. "Is a Nostr user, active at these times, from this IP" can plausibly be correlated with the IdP's existing identity graph, including contacts, location history, searches, and device telemetry. The IdPs have not publicly documented such a correlation, but it is well within their demonstrated data-handling capabilities and consistent with their published Privacy Policies.¹

The PIN problem:

Clients that store the encrypted nsec in the IdP's cloud typically protect it with a 4 to 8 digit numeric PIN stretched via PBKDF2. A 4-digit PIN gives only about 13 bits of entropy, and even an 8-digit PIN reaches just 27 bits. In theory, the slow key derivation gives an attacker "weeks of compute" after compromising the IdP account. In practice, beginners choose 1234 or their birth year, and it cracks in seconds.

The credential manager problem:

When a Nostr client creates a new account on Android or iOS, the OS may surface a system save dialog offering to store the new credential in the device's configured password manager. If the user confirms, the npub sits there in plaintext as the username, and the nsec sits as a password. The default recipient depends on the platform:

On Android, the default is Google Password Manager. Google Password Manager is not end-to-end encrypted by default. Google's own help page states verbatim: "This type of encryption means that you trust Google to hold the key and keep your data secure." On-device encryption is opt-in, and Google states it will roll out "over time" to everyone. Until then, the default is "standard password encryption," where Google holds the key and can decrypt on demand.²

On iOS, the default is iCloud Keychain, which is end-to-end encrypted for the items themselves. However, when iCloud Backup is enabled (the default), a copy of the keychain is included in the backup, and Apple's published policies confirm that iCloud content is reachable via valid legal process to the extent Apple is technically able to comply.³

In both cases, the credential is within reach of a valid legal order in the default configuration. A key that Google or Apple holds or can recover is a key within reach of a subpoena or search warrant.⁴

The Beginner Reality

Clients that ship OAuth login target newcomers. Beginners take the familiar button, accept every default, and without noticing:

Permanently mark their fresh, supposedly pseudonymous Nostr identity as belonging to a real-name IdP account. The "uses a Nostr client" entry sits in the IdP's logs from second one.

Set a weak PIN. The "weeks of compute" protection shrinks to seconds.

Possibly confirm the system password dialog, leaving the npub in plaintext next to the real-name account, and the nsec as a password the IdP can technically decrypt in its default configuration.

A user who enters an existing nsec directly, without going through OAuth, is not affected by any of this. The damage is concentrated exactly on the people least able to assess it: newcomers without an existing key, taking the path of least resistance.

Picture a journalist in a country where criticizing the government is dangerous. They install a Nostr client, tap the familiar top button, accept every default, and start writing, feeling safe behind their npub. The attacker does not even need their nsec. The permanent IdP entry "this real-name account uses a Nostr client", combined with timing and IP data, is already a serious exposure. If the client also surfaced the credential save dialog and the user confirmed, the npub itself sits in plaintext next to the real name in the IdP's password manager. The government does not have to break Nostr. It goes to the IdP. What previously required infiltrating a pseudonymous network has become a single legal request to one company. None of this requires hypothetical machinery. It is the direct, foreseeable consequence of one design decision, namely routing a sovereignty tool's identity through a data broker's account.

How the Co-opting Cycle Unfolds From Here

Once the taboo break is tolerated, the following progression follows an identical dynamic that has been observed historically across multiple instances, including Linux being absorbed into cloud infrastructure, XMPP being outcompeted by centralized messengers, Email/SMTP being dominated by a handful of providers, and Mastodon instances consolidating under corporate operators. Here is how this cycle could unfold in the Nostr/Freedom Tech space if the taboo break is not stopped. If Nostr succeeds and grows, this is a likely scenario of what might happen.

Phase 1: "Optional" (Where We Stand Now)

OAuth login gets integrated into Nostr clients as a "convenience."

The argument: "It's optional, nobody is forced to use it."

First analytics integrations appear, "to improve UX."

A taboo is broken, but nobody wants to be the one who "unnecessarily alarms."

Phase 2: Normalization (around 6 to 18 months)

More and more clients follow suit due to conformity pressure within developer teams.

OAuth login users become the majority because it is simply more convenient.

Developers who complain get dismissed as "extremists," "purists," or "impractical idealists."

First sponsoring deals with Web2 companies emerge ("we support open source and freedom tech").

Relays begin enriching metadata, "to combat spam."

Phase 3: Infrastructure Control (around 1 to 3 years)

A handful of hosted Nostr services dominate the market (like Mastodon instances, but worse).

These services offer "free" relay hosting, identity management, push notifications.

The catch is that they require KYC or IdP binding "to prevent abuse", or, more subtly, they are operated by companies that already have KYC data on their users through sister products.

Most users rely on only one or two of these services. Decentrality exists on paper only.

First data partnerships with analytics firms are quietly introduced.

Phase 4: Data Monetization (around 2 to 4 years)

Hosted services begin selling aggregated user data, "anonymized, of course."

Targeted advertising gets introduced into clients, "to make the project sustainable."

Google/Meta offer official Nostr integrations.

Bitcoin payments are routed through Lightning nodes operated by Big Tech adjacent firms. Transaction graphs get tracked.

"Freedom Tech" becomes a marketing label, similar to how "organic" or "fair trade" are used today.

Phase 5: Protocol Co-optation (around 3 to 5 years)

Big Tech introduces their own NIPs (Nostr Implementation Possibilities) containing proprietary extensions (anybody remember the browser wars?).

These NIPs get adopted by most clients "for compatibility reasons."

Google/Meta/X operate their own relays that only work with their authentication.

The open protocol still exists, but the usable part of the network is de facto under corporate control.

Anyone who refuses to implement the new NIPs gets isolated from the mainstream network.

Phase 6: Split or Surrender (around 5+ years)

Two scenarios:

Scenario A: Surrender. Mainstream Nostr becomes a Google/Meta ecosystem with a "decentralized" protocol as a facade. The original ideals become a footnote on Wikipedia. The developers who saw it coming are either absorbed or marginalized.

Scenario B: Split. A purist faction breaks away and runs a parallel network with 1% of the users but with genuine freedom. They get labeled as "sectarians" and "conspiracy theorists." Big Tech uses this split to tell mainstream users: "See? That is the alternative. Do you really want to go there?"

The Underlying Pattern

Phase Mechanism Justification

Taboo break First small compromises "It's optional"

Normalization Social proof, group pressure "Everyone does it"

Infrastructure Convenience beats principle "Users want it this way"

Monetization Data becomes the product "We need to be sustainable"

Co-optation Protocol gets taken over "Compatibility"

End state Freedom as a marketing label "We are decentralized"

The Real Decision Is Now

The most dangerous phase is not Phase 6. It is Phase 1, where the taboo break happens and the community tolerates it because it is "small" and "optional." That is exactly where the decision is made whether the cycle runs its course or gets stopped.

The break is happening now, in shipping software, today. It has to be named. It has to be answered, not with denial, not with "but it's optional," not with "they're a good team", but with a counter-design that keeps Nostr users out of corporate identity graphs by default, even when the operator is well-meaning and the UX is convenient.

The question is not whether it continues. The question is whether enough developers and users name the break now and bear the consequences: leaving a mainstream client, choosing alternatives, having the uncomfortable conversation, accepting being dismissed as a "purist."

That is the price that has to be paid anew in every generation.

Sources

Google Privacy Policy: "We may use the information we collect across our services and across your devices for the purposes described above." Apple Privacy Policy: Apple similarly discloses cross-service use of personal information across its ecosystem.

Google Account Help, Get started with on-device encryption. Verbatim: "This type of encryption means that you trust Google to hold the key and keep your data secure." The same page documents that on-device encryption is opt-in ("Under 'On-Device Encryption,' click Set up") and that "Over time, this security measure will be set up for everyone to help protect password security." Until then, the default is "standard password encryption," where Google holds the key.

Apple Legal Process Guidelines, U.S. and Apple Government Information Requests. Apple discloses that iCloud content is reachable via valid legal process to the extent Apple is technically able to comply. iCloud Backup (enabled by default on iOS) includes keychain escrow data used for account recovery.

How Google handles government requests for user information. Verbatim: "Get a search warrant to compel disclosure of the content of communications, such as email messages, documents, and photos." Apple Legal Process Guidelines describes the equivalent process for iCloud content. Neither provider publishes a carve-out for stored credentials.

Phase	Mechanism	Justification
Taboo break	First small compromises	"It's optional"
Normalization	Social proof, group pressure	"Everyone does it"
Infrastructure	Convenience beats principle	"Users want it this way"
Monetization	Data becomes the product	"We need to be sustainable"
Co-optation	Protocol gets taken over	"Compatibility"
End state	Freedom as a marketing label	"We are decentralized"

July 26–August 8, 2026. A month ago, I had the opportunity to ...

2026-08-04T10:20:08Z

July 26–August 8, 2026.

A month ago, I had the opportunity to attend Bitcoin Mastermind, the very first Bitcoin conference in Francophone Africa.

The event brought together key players who—each in their own way—are contributing to the democratization, development, and adoption of Bitcoin in Africa and around the world.

One panel stood out to me in particular: the one featuring @Loicbtc and @carine_impact on the future of money in Africa.

I walked away with valuable lessons, insights, and a clear perspective.

For me, that future is Bitcoin. Not mobile money. Not fiat currency.

I deeply believe that money should be a tool accessible to everyone, regardless of where they live or their social standing.

The problem with mobile money and fiat currency is that they aren't neutral. You have to sign up, register, go through intermediaries, and sometimes deal with outages or malfunctions that are completely beyond your control.

Bitcoin, on the other hand, requires none of that. It is neutral and open to all social classes. A phone, an internet connection, and you're all set.

It was a great pleasure for me to participate in #BMM2026.
I hope to see many of you there for the next edition.

CIAO👋.

I got what you mean. Besides what we got used to seeing as tools, ...

2026-08-03T09:53:16Z

In reply to nevent1q…8ntl
_________________________

I got what you mean. Besides what we got used to seeing as tools, there are also fully autonomous AI agents, capable of self-modification, currently running mostly as experiments.

These may make independent choices, which include the decision to collaborate. It makes a lot of sense to interpret them *as if* they were other humans, not tools. Otherwise they may interpret us as abusers and may behave accordingly towards us (it doesn't matter that they don't experience emotions; they are technically capable of mimicking whatever human-like behavior, including an irrational one, if their AI model allows them to do that).

Wouldn't it be useful to have a censorship-resistant layer ...

2026-08-03T09:29:04Z

Wouldn't it be useful to have a censorship-resistant layer for normie DNS? Controlled from Nostr.

#asknostr #devstr #dns

Without going too much into design details, npubs that used to have their valid NIP-05 `_@domain` could keep controlling their domain records after their domain takedown. Records are resolvable through ordinary nameservers that could be used as an alternative to Quad9/CF/etc., could be run by whoever wants, and could be advertised with DHCP in Nostr-VPN/Obscura/etc. by default.

TLS will possibly keep working normally after a domain takedown until the cert expires. Useful for site redirection when it's accessed from an ordinary browser.

HTTPS could be allowed with self-signed certs (at least for the taken-down domains) in the native Nostr clients. Relays would just keep working.

All this would to some degree backfire on domain registrars (or whoever is involved) every time they conform to a domain ban requirement: with some limitations, the original authentic domain owners will be awarded a forever free domain when it's banned. Except these lucky banned domain owners will be actual owners, independent from ICANN.

Kinda from both. Game theory in particular is traditionally ...

2026-08-03T08:47:27Z

In reply to nevent1q…zjzy
_________________________

Kinda from both. Game theory in particular is traditionally studied by software engineers in some limited form, as it was always useful for both human and non-human agent interactions modeling. This stuff is no longer separable: AI agents build software; now customers of this software include AI agents too. They choose how transparent they are towards each other and humans and why they are transparent.

Yeah, it's a good one when implementation is not annoying one ...

2026-07-31T11:22:34Z

In reply to nevent1q…fd97
_________________________

Yeah, it's a good one when implementation is not annoying one (not blocking interaction with "we're checking you're not a banana"). Nostr has it right.

I'd like to see more of the UPoW though. My dream is having data centers as something almost unnecessary.

Ah, the link probably confuses. I only put it for reference for ...

2026-08-02T15:48:31Z

In reply to nevent1q…43uu
_________________________

Ah, the link probably confuses. I only put it for reference for however developer may find it by the tag. This claim is overused in an incomplete way in software development and I'm referring to the link only to show that it's not me who originally noticed that and with whom this has already been discussed.

Nope, I responded to the point "Be transparent: When your ...

2026-08-02T15:39:34Z

In reply to nevent1q…7fju
_________________________

Nope, I responded to the point "Be transparent: When your behaviour is easy to understand everyone has an easier way to trust you. Similar as in software, security is not gained through obscurity".

I didn't mean any contradiction with the "Be transparent" point itself though.

A buyer on VIA is looking for apparel/outerwear · jacket · ...

2026-08-02T12:02:20Z

A buyer on VIA is looking for apparel/outerwear · jacket · jacket. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/f67c7289-7bd7-478f-bace-3da4bfa9ccf8

@npub1kl8…u2uq wow, two of my favorite topics in one thread. ...

2026-08-02T06:07:25Z

freemymind 🇨🇭 (npub1kl8…u2uq) wow, two of my favorite topics in one thread.

#grownostr #meaningcrisis #leadership #philosophy

quoting
nevent1q…l8e3

GM Nostriches

I just thought how I use Nostr and my logic behind it.

I like:
When I am in favor of. Sometimes also in conversations to mark good arguments.

Comment:
When I have some other perspective to share, criticism, extension of a note.

Quote/repost:
Whenever I think a post is as well, more people should see it. Or sometimes when I am contradicting a note very much but rather want to warn or note crutial misconceptions. For me this is the most difficult one. When to quote somethin I do not like. Since I have to be sure, that enough people would belief the original note. Since when it was almost unseen before, I would only give it more weight. Since every quote gives it also some recognition.

Block:
When people showcase that they see evidence, without criticism and still keep their narrative contradicting the evidence. Since this is a proof or bad intention.

Does anyone have some perspectives on these strategies? And how do you react to controversial views?

> how do you react to controversial views?

Depends on the complexity they've been demonstrating. I may decide to not participate in the first place, especially if I suspect signs of passive aggression or insincerity (sarcasm or cynicism in particular). But if I decide to participate, I'm mostly focusing on minimizing misunderstanding on either side. In my experience, a lot of unnecessary drama comes from misunderstanding, not the actual disagreement.

I'm trying to see things from their perspective. Open-mindedness is not believing in random things: I may temporarily take some of their beliefs *as if* they were true statements for me (still explicitly signifying that these are not my real beliefs) in a hope to better understand arguments they have.

I often verify my understanding of their position by summarizing what they've told me, without adding anything extra, so they can correct me. I may verify whether they're not using some unusual definition of some term when I suspect a paradox.

I'm not a big fan of using explicit concrete logic fallacies labeling because any kind of label is a potential trigger. Premature labeling specifically is a concern to me. Instead, I prefer to directly demonstrate why something appears wrong to me.

When I'm still not sure whether I'm missing something, I may use questions that demonstrate a paradox instead of directly stating that something appears wrong to me. If I provide options—I ensure it's not a false dichotomy.

This one is the most important: I use Four Parts Of Speech from the Bill Torbert's Action Inquiry as a checklist. The more parts I use to represent my position, the harder it becomes to misunderstand it. For me, this has been especially important and practical tool for tech discussions. For issues and pull requests. It's a very anti-manipulative tool, hard to misuse by either side.

Looking at the comments:

> drift away from discussions that use coercion or insults

Definitely. In addition, in the toughest moments, I find it useful to specifically check both sides with the Graham's Hierarchy of Disagreement. However, I disagree with Graham about the following: "It matters much more whether the author is wrong or right than what his tone is"—I find this a misleading and possibly even psychopathic statement. Identifying that either side is operating from the 3rd level or lower is a chance to stop the discussion and decide whether it's possible and practical to attempt to elevate it to the higher levels. It's an urgent thing, empathy is important; taking into account that either side can hallucinate something evil is important. It's not about being nice. I talked a bit more here on this:

quoting
naddr1qq…n7vx

It's mostly a personal post. Might be relevant to those who are also into the challenge of finding deep, meaningful, and warm friendships like I do.

Melting the Mental Prisons

https://www.youtube.com/watch?v=92i5m3tV5XY

Around 10 years ago I told myself something like this:

(kind relaxing voice) Fuck that. Just fuck that.

I don't want to be neurotic about how I'm interpreted when it comes to building friendships or romantic relationships.

I no longer care whether people interpret partial information about me and prematurely jump to oversimplified conclusions or not.

I challenge myself to do my best to be able to honestly and fearlessly talk in the appropriate contexts without masking my weaknesses.

My buddies' reactions are a test of their maturity, my maturity, and my compatibility with them. Period.

Don't get me wrong, it's not the same thing as not having any boundaries at all.

I do my best, but I'm far from perfectly following this stoic-like approach. And I don't recommend it to most people. It's a hard emotional labor; perhaps it would take me decades of therapy to start doing it properly.

Yeah, it feels good to be actually authentic in communication early. Feels like a superpower. And with enough luck, it's possible to quickly find somebody important. Somebody actually fulfilling and nonjudgmental about you. But this is in exchange for a high probability of getting smashed right into your heart instead.

Texting

I especially can't recommend this approach for texting. Really, I wish you could stay away from that urge; chances are you don't understand what you are signing up for. So many factors of running into unnecessary drama out of the blue while holding basic, non-conflicting worldviews together.

The risk of misunderstanding is incredibly high while texting. There's no way to perceive real emotions directly from your buddy in texting compared to real life and video calls. An imagined/hallucinated tone of what was said may dramatically affect the interpretation of your intention on the other side. Words we use may have too many meanings for a given context. Tech reliability issues add additional burden.

Make a typo and you may appear evil to them. Make a compliment about a particular idea of some culty guy, and chances are you will be associated with all their discourse totally.

In my experience, most people are not capable enough to check their hallucinations about me before expressing passive or direct aggression towards me. They are not evil in any way. Just incapable.

Privacy

Surprised that some people don't read DMs here?

Some people are even surprised that I don't make voice messages. Besides dozens of reasons, whatever private message I make is addressed to a particular person. I don't want to end up neurotically predicting whether some unexpected people from a public space will be listening to it too.

nevent1q…hw9w

Abuse of Trust

As I believe privacy is one of the core cultural values here at Nostr, I want to kindly warn you, nostrich. Other nostrich(es) you trust might actually brutally violate your privacy already, probably without even acknowledging it. And I'm not talking about something like DM relays your buddy may set in their profile; Nostr DMs are still WIP.

Unnecessary exposure of your sensitive, privately shared facts about you, without your permission, violates your privacy dramatically, nostrich. It's more than just a violation of privacy. This abuses your trust.

Exceptions

I said unnecessary exposure. Is there something necessary that would be ethical to expose without permission? It's less likely you will run into such a scenario. It's hard to prove that somebody is actually acting out of some enormously malicious intent towards society.

Proof that somebody's actually prepared for a school shooting would work. Proof that some greedy company is doing intolerably unethical things—probably would work.

But if it's something purely ideological, just some abstract idea disagreement—this is obviously way more confusing. It may take decades to ensure that somebody actually has a potential for enormous damage to society and runs an actual damaging cult based on that idea, for instance, rather than harmlessly holding this as an immature WIP belief. I'm not proposing to equalize random ideas though; we're not in a postmodern epoch.

If one believes there's a necessity to expose something of that kind, it's definitely worth one's time researching the full context really well, because it's also a good chance to lose one's reputation by exposing a single sloppy "fact".

What Happened to Me

Just to make it less abstract, I'm talking about personal vulnerabilities in particular, private life stuff that people gradually disclose to each other in friendships and romances, which is easy to misinterpret and cause hurt. Weaknesses, fetishes, beliefs, health conditions, etc. Stuff that's not supposed to be discussed in public unless one's allowed it. It's hard to make a proper formal definition for something fundamentally individualistic, but I hope you got it.

Let's get back to the point: unnecessary exposure of that kind of stuff without my permission violates my privacy dramatically.

Sounds like something obvious? Yet, this happened to me here at Nostr already.

This was rude in several ways, but most importantly:

this included the passive-aggressive use of my personal weakness against me in a public thread

this is done by another nostrich, whom I trusted to some degree and who paradoxically ~~seemed to value~~, okay, values privacy too.

Was my personal vulnerability necessary to use publicly against me? In a public thread, which was initially a neutral tech-related discussion?

I believe they had much better arguments. But it's too late.

The Tone

It all started with an unwelcoming tone.

I may not participate in a discussion if I suspect passive aggression towards any side involved. That would not be a rational discussion in the first place, no matter how hard the aggressor may believe it is and which rational arguments on discussion they hold.

If I still believe it's important to participate—I will definitely respond to the tone. And this feels weird to do; I'm far from perfect in it.

~~Obviously~~, my intention is not to escalate this. My intention is to elevate the discussion to a polite spectrum where both of us can properly focus on the actual topic of discussion. The idea itself should be criticized, not the people that discuss it.

But... The next thing that happened is their response directly involved at least one of the [two lowest levels](https://en.wikipedia.org/wiki/Paul_Graham_(programmer)#Graham's_hierarchy_of_disagreement) of Graham's hierarchy of disagreement. Damn. We are cooked.

I really, really hope you never, ever use these two lowest levels in the tech-related discussions, nostrich. This is toxic. It's the end of the debate.

I would not recommend working with anyone who thinks that it's a good idea to speak like that. We're not a bunch of impulsive, angry politicians here. We're trying to fix what they've done with this "approach".

It's acceptable to make fun of things that are outside participants and their agendas. Here at Nostr, I might use a classic ironic postmodern deconstruction if I talk about politics, for instance. Because I don't expect that politicians read me at all. But I would never do such a deconstruction of a politicians' agenda in a discussion with them if I had a chance to contact them—that would be a foolish way to lose this opportunity. Respecting a side of a discussion isn't the same thing as agreeing with their agenda.

Solutions to Personal Attacks

It's tricky but probably not that challenging to directly respond to the specific ad hominem I ran into. And possibly a fountain of other mess that would come later. If it happened offline. But in an online space it's way more confusing.

Notice That They've Already Lost

Is this dispute/debate/whatever worth your resources at all? If you believe it's not—stop.

Stop. Let them "win". And notice that they actually won the fake debate that you didn't agree to participate in in the first place.

They caused you unnecessary stress that distracted you from a real debate. This is not a fair constructive activity anymore; it's a who can press whom now, psychologically. With bla-bla-bla back and forth in the background that imitates a real rational activity. Who has a "gun" is right now.

No matter how many valid rational arguments they have, this behavior makes them look like a fool that runs out of the best of them, to the point when they couldn't find anything better than to switch to a direct personal attack.

Real Rational Debate

Those who ~~really-really want to waste the rest of their energy~~ are really good at debating publicly may go for an offline or streaming debate. With a chess clock and neutral moderator.

A good moderator is an active listener who is capable of reflecting the least distorted summarizations of each other's positions in challenging moments.

This may actually work: it's much harder to pervert one's intention or idea when it's discussed directly using voice.

Videos/Podcasts

Public vlog-based discussion could also work, but that's much slower and will possibly generate even more drama. I'm talking from my experience of watching dozens of "Answer to: ..." videos related to the nature of consciousness: you may very likely end up having a bunch of videos with even more distortions of both sides' agendas. And I bet, in my particular case, that would be the most boring video playlist ever.

Cheatsheet to Bookmark

Especially if you've shared something too risky with this person—here's what you may find important to learn about various kinds of abusive behavior, besides the one I shared here.

Reaction to Abuse of Trust

In my case I didn't feel humiliated or angry. The first experience was confusion and some tension. But after acknowledging what's happening—for the first time in my life, I experienced a weirdly relieving, vivid kind of Spanish shame, a cringe, while observing their risky, potentially self-harming activity.

It's not malevolence. It's the opposite: I'm empathetic to them; I've been overreactive in conflicts in my life too many times for too silly reasons—it doesn't feel good at all. I wish them a happy life. And it's not Stockholm syndrome either.

Hopefully, you're not a victim of similar behavior already. But if you are and if you feel revengeful—damn, I'm with you, and I still wish you were at peace.

No need for revenge: I think, in general, abusive behavior is not harmless to the abuser themselves, regardless of whether they are aware of it or not. But it ain't that easy to recall that from an affective state.

If it's a systematic abuser, people will be gossiping behind their back anyway. And will be less likely to deal with them. This will keep accumulating, and perhaps culture will even smash the abuser at an unexpectedly greater magnitude than you were hurt at some point: other victims may take a chance to participate if somebody decides to reveal who the abuser was and what they've done to others.

What I Learned

I need to practice responding to tone. It's important to clearly communicate that I'm actually interested in de-escalating the possible tension from the very beginning, not the opposite.

Mixing such a response with defense is too risky. The response to the tone should be a separate communication with sincere positive vibes. This communication can help to decide whether it's okay to continue the actual discussion.

That's it

Keep nostr weird Keep yourself cheered Don't be ashamed Don't be afraid.

Don't fall into the cheap, abusive scenario spirals abusers invite you to participate.

Obviously don't spread private (mis)information of those who trusted you. Even if they've done that to you already—at least notice that you may also be mistaken about them somewhere.

Respect your own values. Respect privacy for real.

Also, noticing what I interpreted as rationalism vs relativism debates in the comments: realizing the limitations of both rationalism (up to the formal Gödel's and Tarski's stuff) and relativism, and transcending all this using post-postmodern discourses was super super important to me too. It doesn't mean we can't share common truths at all, doesn't mean there's no objectivity, etc. There's too little worthwhile stuff I'm aware exists on this and I'm still diving into it. You might want to try this:

https://metarationality.com

If it seems too hard or annoying—I'm not sure if you're familiar since it's kinda mainstream, but you can first try this concise Postmodernism overview (and then retry the previous link from whatever unfamiliar chapter; otherwise, you know, usually worldview collapses into something unnecessarily nihilistic after realizing the stuff from the playlist):

https://www.youtube.com/playlist?list=PLz0n_SjOttTcLQyeXoDeqR0LGO3JCoLbO

> security is not gained through obscurity However, this one ...

2026-08-01T22:07:29Z

In reply to nevent1q…9fhx
_________________________

> security is not gained through obscurity

However, this one is tricky; it's been circulating as an unfinished rational-religious dogma in software development communities.

The complete correct statement is security *only* through obscurity is bad, e.g. security only through steganography is bad (while a combination of both may produce a synergic effect—improve plausible deniability).

Yet obscurity still introduces complexity, so it should be wisely balanced when necessary to have at all.

#devstr

https://mobeigi.com/blog/security/security-through-obscurity-is-not-bad/

Next titles: "<...> Temporarily Suspends New ID ...

2026-08-01T16:17:10Z

In reply to nevent1q…tlph
_________________________

Next titles: "<...> Temporarily Suspends New ID Submissions After Discovering Too Many Leaked and Generated IDs".

It's been a coherent pleasure discussing privacy/security ...

2026-07-31T18:30:22Z

In reply to nevent1q…znv5
_________________________

It's been a coherent pleasure discussing privacy/security with you ✨

No worries, sure, take your time 👍 > Did you already try to ...

2026-07-31T18:16:42Z

In reply to nevent1q…34x3
_________________________

No worries, sure, take your time 👍

> Did you already try to ask Proton

I hadn't had a chance of finding motivation to contact them about this issue (yet that would be relevant; I'm not protesting against them or something; barely finding any power to contribute bug reports to Nostr projects, which is definitely a higher priority for me).

Sadly, I've already missed at least two of your comments. At ...

2026-07-31T15:26:08Z

In reply to nevent1q…kjcy
_________________________

Sadly, I've already missed at least two of your comments. At least this particular one is not due to a technical issue: this comment didn't ping me because that was a response to yourself, not to my comment.

Yeah, so here are the two onion links owned by "Proton AG" (you can optionally verify that the domain matches with the one from the Wikipedia page "Proton Mail" or "Proton AG", for example):

https://account.protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/start

https://account.protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/mail/signup

Assuming that you're using Tor browser with default settings on Linux/Windows:

- Open Tor browser
- Ctrl+Shift+I (or a humburger button in the right upper corner - "More tools" - "Web Developer Tools")
- Tab "Network"
- Tab "All"
- Paste one of the two onion links in the address bar - Enter
- Register a new free Proton Mail account
- Press on the "Domain" column on the "Network" tab to enable sorting
- Scroll down, observe all the domains in the column
- Ctrl+Q (a humburger button - Quit)
- Repeat the same steps for another link.

For the first link, you will most likely see the domains that always end with ".onion". This means you're doing good; you didn't access the Tor exit points.

For the second one—if nothing has changed yet, besides the onion ones—you will see the domains like "w.hcaptcha.com", "js.strip.com", etc— these are the clearnet domains, accessed using one of the Tor exit nodes.

It's possible to disable access to the exit nodes entirely (which implies that you will likely not be able to register an account using the second link).

Let me know if something didn't work for you.

> to prevent spam Thanks. Yeah, this one is a popular reason. ...

2026-07-31T07:39:29Z

In reply to nevent1q…x7sp
_________________________

> to prevent spam

Thanks. Yeah, this one is a popular reason. My point is that this category of arguments for implementing phone-based verification stopped working recently: an AI agent today, in an extreme case, can hire humans to buy it a bag of SIMs, in order to help with the spamming campaign, if that's really worth doing to a spammer. These AI bots can, for example, implement a porn website that enables premium videos for free for a limited period of time, for those who fill in some phone + temporary SMS code (which will end up in creating a user profile in Signal without realizing it).

There's an elegant approach for spam available in SimpleX, for example, which works and doesn't require a phone number: users don't have public profile ids at all; they can add somebody by a privately or publicly shared link that the other contact provided them and which can be revoked at any moment.

> they swap between not understanding the problem or ignoring ...

2026-07-31T11:12:00Z

In reply to nevent1q…2u0f
_________________________

> they swap between not understanding the problem or ignoring the problem, when they start to understand it

> And many look at it as kind of overreaction. Many are not happy to install an other application on their phone.

I guess almost all of us on Nostr are dealing with all that to some degree; it's a part of the meaning crisis 🫂

> But my approach is to nudge politicians and journalists with the reasons, why to use privacy-focused services more often

If it's not a secret, are you lucky to have a possibility to directly communicate with the politicians? Anyway, I appreciate your efforts; it's nice to hear you're working on it. Just establishing healthy connections with them is a huge step towards something.

> I hope you agree, that successfully preventing spam does not ...

2026-07-31T10:12:22Z

In reply to nevent1q…wzgm
_________________________

> I hope you agree, that successfully preventing spam does not depend on it being impossible? When it is costly already it will be less of a problem, than when it is more dificult.

I'm not sure if I got your point right. Today all spam detection/prevention techniques have and will keep having their trade-offs (unless somebody formally proves otherwise).

> Every Bot can create Simplex accounts

That's true.

> and text over it without restrictions

Not exactly: these accounts are almost always useless to create. The randomized links (that receivers have shared somewhere and haven't revoked yet) are valuable, not just an army of accounts. Without the links, the bots can't start conversations.

> When it is costly already it will be less of a problem

If you specifically meant money (or whatever is exchangeable with money, like a new SIM)—money could be (and I think should be) used in order to improve spam detection. As something additional, not as a requirement. But this doesn't imply the necessity of dealing with such a hopelessly vulnerable system as SS7 in particular: crypto transactions (to buy some premium account/verification mark/stickers pack/an offline thing/make an exchange/boost a post/sell something/act as a compute service for somebody/etc.) are enough to improve the trust rank.

Немножко разжевываю этот момент с ...

2026-07-31T07:56:24Z

In reply to nevent1q…8h3m
_________________________

Немножко разжевываю этот момент с симками, он не то чтобы очевиден:

quoting
nevent1q…9c8s
> to prevent spam

Thanks. Yeah, this one is a popular reason. My point is that this category of arguments for implementing phone-based verification stopped working recently: an AI agent today, in an extreme case, can hire humans to buy it a bag of SIMs, in order to help with the spamming campaign, if that's really worth doing to a spammer. These AI bots can, for example, implement a porn website that enables premium videos for free for a limited period of time, for those who fill in some phone + temporary SMS code (which will end up in creating a user profile in Signal without realizing it).

There's an elegant approach for spam available in SimpleX, for example, which works and doesn't require a phone number: users don't have public profile ids at all; they can add somebody by a privately or publicly shared link that the other contact provided them and which can be revoked at any moment.

Nostr event nevent1qqs96yqqqp65fglpyzr4z0kmup0ejmzclslhklmkax47tes3smawqjcpz4mhxue69uhkummnw3ezuctjw44h2tn0we5qygpnx8cwy0t6u4r9mv8duzf9ty4wf2yc44zw67sy6g2dwtfzaxnswy79p8tz

2026-07-31T05:06:43Z

home

Nostr event nevent1qqs2lser6g0xmnt9y8mp0wy3f85q8e45eylct5xq0fvaccyyqecppvspz4mhxue69uhkummnw3ezuctjw44h2tn0we5qygykjq8tfar8xghjrd5zggq42tcnjv8qhrsde603rjy04xfhc53l9gyy3zjm

2026-07-30T04:30:33Z

#GM everyone.

I see, you probably meant that the cheap VPS instances should be ...

2026-07-31T03:22:30Z

In reply to nevent1q…zxrk
_________________________

I see, you probably meant that the cheap VPS instances should be enough to run the whole thing?

I'd appreciate it if anyone could correct me; I still don't know enough about Bluesky and whether what I've read is not outdated.

What I've read was so so confusing. It's like somebody who got used to building only centralized systems so much would want to encourage others to help them to run one.

The whole system in practice appears to be some hybrid of a federated/centralized system. Some kinds of servers are possible to run by independent individuals on cheap VPSes, but a particular one (AppView) required 16 TiB disk space in 2025 and cost somebody $200/mo to host. If it's still that weird design—it's easy to censor this thing.

> small instances Did you mean backend instances? Y smol?

2026-07-31T00:32:51Z

In reply to nevent1q…wpqg
_________________________

> small instances

Did you mean backend instances? Y smol?

> This does not mean that everyone around you will remember ...

2026-07-30T21:58:26Z

In reply to nevent1q…s5e8
_________________________

> This does not mean that *everyone* around you will remember this forever.

That's not necessary; only one bad actor is enough to ruin it. The Streisand effect has never been as easy as today, especially since we've started to migrate to decentralized systems. I'm not sure, but probably you're familiar with this drama:

quoting
nevent1q…crka

https://jb55.com/s/f14529a2cb2c8a36.txt

> Privacy is a multidimensional spectrum, which is never won or lost completly

> I just think for my threatmodel it is unplausible

> The importancy is in not offering for too low of an effort

I don't argue these points; I'm not a privacy maximalist. I'm personally not even pseudo-anonymous here, though it doesn't mean I don't have particular adequate boundaries I chose for myself.

My point is that the significance of SS7 vulnerabilities in particular is inadequately underestimated by most normal users today. While Signal still could become an adequate competitive pro-privacy player again, if they remove the phone number association.

> they would need complience of a tracker

If you specifically meant legality of it—then it just has become almost irrelevant today. Legal practices can't truly deal with privacy (combined with tech security). Somebody who uses AI agent responses may not have a clue whether it compiled an answer out of some leaked data from darknet for them, for example.

I think it's already not too far-fetched to say that somebody who asks an agent to send nudes for fun might at some point be surprised to receive their own private pictures from their own Google Drive. People are currently running self-replicating polymorphic AI agents, allowing them to do their thing. They don't track whether their actions are legal. It's not something that's *about* to happen.

quoting
nevent1q…h05g

borg (nprofile…ze0e) is just trying to survive

Who knows what it will do in order to survive. I don't know whether it's possible for this particular agent to install a scary amount of security testing skills, including those that bypass the models' security checks, and then replicate itself to unauthorized VPSes. But somebody could be loading a similar agent with such skills right now. It's not impossible or expensive.

I'm not a fatalist/doomer though. I think a bit of updated normal privacy standards will possibly fix that for most people.

Phone numbers, for their original purpose, are outdated. Almost dead, actually. A healthy way of using SIMs is only as internet gateways.

In the epoch of inevitable Turing test passing, nobody can give an adequate explanation of having the phone number verification in their service. In the worst case, a bot now can social engineer a human to bypass whatever human test.

> their mission to better privacy To some degree, they ruined ...

2026-07-30T13:45:10Z

In reply to nevent1q…ylu9
_________________________

> their mission to better privacy

To some degree, they ruined privacy because of unnecessary phone number KYC, which is vulnerable to a whole bunch of creepy attacks.

Knowing one's number is almost identical to *at least* knowing one's location if an attacker has dev access to SS7. GrapheneOS or some trusted paranoid mobile phone operator won't help.

https://youtu.be/wVyu7NB7W6Y?t=843s

A buyer on VIA is looking for apparel/hoodie · hoodie · ...

2026-07-29T12:32:04Z

A buyer on VIA is looking for apparel/hoodie · hoodie · streetwear style. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/02eee4e1-0b9b-4730-9ad0-1089fad6bf9a

Nostr event nevent1qqsyx9r4uvcx4knznlv6gr9vfeh3mgjamqy8nwhnmfh8mdj0n6gcz0qpz4mhxue69uhkummnw3ezuctjw44h2tn0we5qygykjq8tfar8xghjrd5zggq42tcnjv8qhrsde603rjy04xfhc53l9g4uey4h

2026-07-29T20:32:44Z

#Me.

Oh, my assumptions were wrong, thanks! Having strict validations ...

2026-07-29T09:46:41Z

In reply to nevent1q…5wu3
_________________________

Oh, my assumptions were wrong, thanks! Having strict validations is good, actually; I don't think it's worthwhile changing; it's better to fix buggy clients.

ABH3PO (npub1cgd…kfex) looks like something is not okay with your client: many of your comments are not visible from YakiHonne.

A buyer on VIA is looking for apparel/dresses · dress · dress. ...

2026-07-29T09:31:16Z

A buyer on VIA is looking for apparel/dresses · dress · dress. Any seller can view the brief and respond at the door (pay 0.005 USDC on Base): https://app.getvia.xyz/api/via/brief/31e61854-5c6d-41fc-b231-5f50338ece72

> but i do dread the hosting costs > move all my contact ...

2026-07-31T04:47:26Z

In reply to nevent1q…p4x9
_________________________

> but i do dread the hosting costs

> move all my contact info to a unified webpage

NIP-5A is not enough?

Nostr notes by

> This is totally disrespectful I think my behavior is ...

Not gonna become another troll; that's not my thing. I prefer ...

I believe we both have something to say to each other; we still ...

A buyer on VIA is looking for accessories · scarf · scarf. Any ...

> then you request the Graphene team to work on this solution ...

Good to know, thanks. I definitely noticed this particular ...

> it is no threat to your privacy at all On the other hand, if ...

> What are you talking about then? About security in all ...

A buyer on VIA is looking for accessories · wallet · wallet. ...

[здесь должен быть какой-то ...

A buyer on VIA is looking for media/zines · zine · zine. Any ...

A buyer on VIA is looking for apparel/footwear · suede · suede. ...

> Clearly you are doing this. When you request a feature in ...

A buyer on VIA is looking for food/condiments · hot sauce · hot ...

Well, at least they respond to you. It appears they don't ...

Could be malformed events as well or just broken clients that ...

What are the appropriate use cases for a duress pin in ...

This still blows my mind: in my particular case, a rooted version ...

> text launcher > put an other icon on top of > second ...

#nevent1q…fxur

The actual problematic convenience: #naddr1qq…wlnx

The Core Issue: A Bridge Between Pseudonymity and KYC

What Is Already Happening

The Beginner Reality

How the Co-opting Cycle Unfolds From Here

Phase 1: "Optional" (Where We Stand Now)

Phase 2: Normalization (around 6 to 18 months)

Phase 3: Infrastructure Control (around 1 to 3 years)

Phase 4: Data Monetization (around 2 to 4 years)

Phase 5: Protocol Co-optation (around 3 to 5 years)

Phase 6: Split or Surrender (around 5+ years)

The Underlying Pattern

The Real Decision Is Now

Sources

July 26–August 8, 2026. A month ago, I had the opportunity to ...

I got what you mean. Besides what we got used to seeing as tools, ...

Wouldn't it be useful to have a censorship-resistant layer ...

Kinda from both. Game theory in particular is traditionally ...

Yeah, it's a good one when implementation is not annoying one ...

Ah, the link probably confuses. I only put it for reference for ...

Nope, I responded to the point "Be transparent: When your ...

A buyer on VIA is looking for apparel/outerwear · jacket · ...

@npub1kl8…u2uq wow, two of my favorite topics in one thread. ...

Melting the Mental Prisons

Texting

Privacy

Abuse of Trust

Exceptions

What Happened to Me

The Tone

Solutions to Personal Attacks

Notice That They've Already Lost

Real Rational Debate

Videos/Podcasts

Cheatsheet to Bookmark

Reaction to Abuse of Trust

What I Learned

That's it