Gabriel

Freedom Tech

Last Notes

2026-06-03 06:49:27 UTC

- reply

As for the neo4j password, would you share with me in which project you found that config please?
I assume it came from pubky-docker, which is intedended to be used as dev tooling only, so that hardcoded password makes sense.
Neither you nor your LLM understood that this is just dev tooling it seems, so I'm making it more explicit to avoid future confusion: https://github.com/pubky/pubky-docker/pull/27
Thank you for moving Pubky forward with us.

2026-06-03 06:47:49 UTC

- reply

2026-06-03 06:04:19 UTC

- reply

> secrets in unencrypted MMKV storage
This could probably be improved. We're taking it up, thanks for the report.
> - Cloudflare binary downloaded at runtime with no checksum? Why? That's a supply chain risk for every Umbrel self-hoster.
Very much work in progress, we haven't announced the Umbrel integration anywhere yet and are still in development. For now we recommend not to use that project yet until we release our first Alpha version.
> Neo4j shipping with hardcoded password
User is encouraged to configure his setup when self-hosting. Don't open up your machine to the internet without understanding what your doing. No big difference to many other systems. A password change could be enforced, there is room for improvement, yes.
> - GCS backend with no auditable configuration surface?
GCS is an implementation detail of one hosted deployment (Synonym), not a requirement of self-hosting. Our vision is to have many independent operators to run instances on infrastructure they control, using whatever platform fits their needs. We can provide deployment guidance, but operators ultimately control their own configuration. Real self-sovereignty comes from the ability to self-host or choose a host you trust, not from visibility into any particular operator’s production config. We may explore additional transparency and deployment documentation in the future.
> - you said users have a choice where their data is hosted. True for the homeserver. But is there a credible alternative to Synonym's Nexus for discoverability? Without it, content exists but nobody can find it. Self-hosting a homeserver without an accessible Nexus isn't a real credible exit for most users.
Discoverability does require indexing. A homeserver can host your data, but an app still needs some way to aggregate and process the data. Simple apps can often do that on the fly; For more complex apps it's a good idea to externalize that work into an asynchronous indexer, otherwise the user experience becomes slow or incomplete. That aggregator / indexer can be run anywhere. It could be self-hosted (even though that's not yet as trivial as we'd like it to be). For pubky.app that aggregator/indexer is called Nexus. any users may choose a managed Nexus because it is convenient, while others may prefer to run or use an alternative operator’s Nexus.
Many people run their own Bitcoin node, but for indexing they still rely on 3rd-party-hosted block explorers, even though they have all the raw data locally, but they don't want to run the indexer themselves. Offering indexing for self-hosting as well as providing a well-run default seems like a fair deal to users. Do you think it should be done differently?
> These aren't philosophical objections to the vision of 'your' protocol.
Exactly, you pointed out implementation details in young projects that are still under active development, so perfect stability is not expected. What is your view on the broader picture, the fundamental protocol and vision?

2026-06-02 06:56:05 UTC

- reply

If I did, would you try to understand our vision and our protocol, or would you just desperately try to find ways to discredit our efforts to built user-sovereign tech?
We believe that users have a CHOICE where their data is hosted, we don't believe that we need to FORCE users into maximum self-sovereign solutions. But giving an option and Credible Exit at all times is key.
So yeah, once you find real flaws, I'd appreciate a well-meant issue report or PR, which is not just AI slop, but actual useful work.
I'm not gonna waste any time fighting anybody that has the same mission as I have but follows different means to achieve that goal.
That said, the fact that all of you are so passionate about this topic is also a good sign, so let's use that energy and focus to building better protocols and tooling

2026-06-02 06:37:15 UTC

- reply

Pubky is Slashtags, evolved

2026-06-01 11:26:40 UTC

- reply

Pubky in a nutshell
#nevent1q…5zzf

2026-06-01 11:25:24 UTC

- reply

- Asymmetric cryptography for identity and auth
- All data is stored on Homeservers, *not* on the servers of the app / website your using
- Decentralized discovery (I know your key, how can I communicate with you?): Homeservers are found through a decentralized network (Mainline DHT). The 'DNS' records for this discovery can be updated at all times, which means migrating to other homeservers is always possible without breaking the system, which was a fundamental design decision for Pubky (Credible Exit)
- The fact that data is not siloed on proprietary servers but accessible to all Pubky apps, allows for interesting interoperability between different apps, requiring only permission from the user, *not* from any app / system .
Pubky choses different tradeoffs than nostr, but I'd argue that discoverability is better approached on Pubky than on nostr (maybe that's why it takes a bit more to explain), and that using servers instead of relays improves reliability in many cases.

2026-06-01 10:55:25 UTC

- reply

Glad to help 👋

2026-06-01 10:53:05 UTC

- reply

Let me know if you have any questions @nprofile…jhr3

2026-05-28 09:03:03 UTC

- reply

Nostr vs Pubky
#nevent1q…u2qv

2026-05-28 08:54:21 UTC

- reply

Public-key-identity like nostr, but with improved discoverability. --> If I know your identity (public key), how do I know how to communicate with your device/app? On nostr there is no clean solution for this, so it's a mess that causes centralization and unreliability/inconsistency. On Pubky there's PKARR, look it up.
What about the data, where do your nostr posts live? Well a relay relays, but what does it do after that? It's called relay, not server, right? What if the data we're talking about is not a social media post but data on a street map for example. Kind of important that that data is served reliably, and completely (as in "learn all data from all users", but also as in 'old data doesn't vanish from the network'). Pubky uses 'Homeservers' as a reliable data layer in a decentralized world.
So am I saying Pubky is better than nostr? No, I'm saying use the right tool for the right job. Different trade-offs. Different designs. You may have a hammer, but not everything is a nail.
There's more to the story. Credible Exit. Separation of functionality (app) and data. Payment abstraction (Paykit). Decentralizing DNS. Check out these links: https://pubky.app, https://pubky.org, https://pubky.tech for more.