4 ms·

I don't really understand Nostr. Without having your own personal relay or website, how can you publish your public key? (or without a trusted centralized autho

I don't really understand Nostr. Without having your own personal relay or website, how can you publish your public key? (or without a trusted centralized authority) And if you do have a website where you publish your private key, why wouldn't you just publish your content there? How do you manage public keys you trust? Is this something a client implementation should do? What happens when all relays you write to go down? You lost all your followers? How would they learn of the new relays you write to? Doesn't really make sense in terms of free speech. Sure, you can still write/publish but if no one knows where anymore isn't that the same as having disappeared/been banned? I do understand that "nostr is just the protocol" but what makes this usable at all in practice?

throwaway420690 3y ago
You sign messages with your key and then publish it to any relays you want. Once your message is signed, it is good to go on any relay. You manage pubkeys you trust by signing a message with a list of pubkeys you trust, simple as that. People can learn about what relays you are on by (again) signing a message that states which relays you are publishing to. If all relays go down you just send your messages to any other relay. FYI, a signed message is just a simple json object with string of content, list of tags, time, your pubkey and a signature. “Notes and other stuff”
- sureglymop 3y ago
  So: You sign your message and then attach the public key and push that to a relay? How would anyone reading that message know that this was actually signed by you and is your public key? There has to be a trusted exchange of the public key before or the relay could just spoof your message. Some messaging apps do a thing where you meet in person and scan the other persons QR code for example. Otherwise, you have to trust the relay. But as I understand it that is not the idea of it. Again, if you sign a message with a list of pub keys, what if the relay disappears? How do you get around that problem at all without hosting your own relay? About the relays disappearing, how will people find you on a new set of relays you choose unless they are reading from those already? Relays don't communicate with each other. Other protocols like ActivityPub ultimately have the same problem. You have to host your own mastodon server to address these things. I understand the signed message. But this is not P2P, the relay is the (untrusted) middleman. So how is that in any way different than just sending someone an email and signing it? Or publishing signed messages in any other place online? Is it about the convenience of very quickly being able to switch to another relay without a hassle?
DANmode 3y ago
Who doesn't have a homepage, that wants one? It can be a Twitter bio, a (gulp) keybase page, or a personally hosted page.
- sureglymop 3y ago
  Okay. Well, then you have to trust Twitter or Keybase, centralized authorities. And your profiles there can be taken down also. And if you have a homepage, why do you need Nostr at all? You can just sign content and publish it on your website then, no? I'm starting to think that the main thing with Nostr is convenience. Should you run into an issue with any relay(s) you simply change to different relays without much work involved, i.e. without "your operations" having to pause. But that doesn't solve the discoverability issue with relays. It's actually not much different than if you signed your tweets and then if you got banned just moved to facebook. Just more convenient.
  - DANmode 3y ago
    I trust any public service like that only as far and as long as needed - as long as they're serving how to find and properly contact me unscathed, (meaning I haven't made it politically or financially uninteresting for them to serve it), what more is needed? Check archive.org or against the secondary page I have set up on MostPopularNetwork#2, if security-minded.

throwaway420690 3y ago

You sign messages with your key and then publish it to any relays you want. Once your message is signed, it is good to go on any relay. You manage pubkeys you trust by signing a message with a list of pubkeys you trust, simple as that. People can learn about what relays you are on by (again) signing a message that states which relays you are publishing to. If all relays go down you just send your messages to any other relay. FYI, a signed message is just a simple json object with string of content, list of tags, time, your pubkey and a signature. “Notes and other stuff”

sureglymop 3y ago
So: You sign your message and then attach the public key and push that to a relay? How would anyone reading that message know that this was actually signed by you and is your public key? There has to be a trusted exchange of the public key before or the relay could just spoof your message. Some messaging apps do a thing where you meet in person and scan the other persons QR code for example. Otherwise, you have to trust the relay. But as I understand it that is not the idea of it. Again, if you sign a message with a list of pub keys, what if the relay disappears? How do you get around that problem at all without hosting your own relay? About the relays disappearing, how will people find you on a new set of relays you choose unless they are reading from those already? Relays don't communicate with each other. Other protocols like ActivityPub ultimately have the same problem. You have to host your own mastodon server to address these things. I understand the signed message. But this is not P2P, the relay is the (untrusted) middleman. So how is that in any way different than just sending someone an email and signing it? Or publishing signed messages in any other place online? Is it about the convenience of very quickly being able to switch to another relay without a hassle?

DANmode 3y ago

Who doesn't have a homepage, that wants one? It can be a Twitter bio, a (gulp) keybase page, or a personally hosted page.

sureglymop 3y ago
Okay. Well, then you have to trust Twitter or Keybase, centralized authorities. And your profiles there can be taken down also. And if you have a homepage, why do you need Nostr at all? You can just sign content and publish it on your website then, no? I'm starting to think that the main thing with Nostr is convenience. Should you run into an issue with any relay(s) you simply change to different relays without much work involved, i.e. without "your operations" having to pause. But that doesn't solve the discoverability issue with relays. It's actually not much different than if you signed your tweets and then if you got banned just moved to facebook. Just more convenient.
- DANmode 3y ago
  I trust any public service like that only as far and as long as needed - as long as they're serving how to find and properly contact me unscathed, (meaning I haven't made it politically or financially uninteresting for them to serve it), what more is needed? Check archive.org or against the secondary page I have set up on MostPopularNetwork#2, if security-minded.