semisol

Unfortunate to see, but oh well.
If you want to save your notes, sign up to Nostr.land to import your notes with a click and 0 hassle.
It is the longest operating paid relay, having done so for over 3 years.
https://nostr.land/subscribe
#nevent1q…73ke

2026-07-01 22:23:32 UTC

Why is the developer of CLINK trying to sabotage Bolt12 by spreading FUD about LND introducing onion relay?

2026-07-01 22:13:38 UTC

The American mind cannot comprehend this
https://i.nostr.build/TfZCv8BZ6ROyPopc.jpg

2026-07-01 19:11:05 UTC

👀

2026-07-01 15:58:03 UTC

gm 👀 👀

2026-06-30 13:15:26 UTC

Many ecash projects are solutions in search of nonexistent problems

2026-06-29 20:03:39 UTC

- reply

I think it is a mix of top contributors to the repo and selected people.

2026-06-29 11:47:55 UTC

gm nostriches 👀

2026-06-29 08:14:52 UTC

- reply

wat

2026-06-28 21:55:36 UTC

BIP-110 and Core is a false dichotomy

2026-06-28 21:46:00 UTC

- reply

This is a great reason to use NIP-44 v3

2026-06-28 21:20:13 UTC

- reply

On the extension side, yes. Same can be done on the app side to autodetect the version.
For DMs, there is a designated tag to the DM relay list so that it is only used for when the recipient supports it.

2026-06-28 15:54:52 UTC

- reply

Can’t. Too busy right now, even if I let an LLM barf up a PR.
However, if you’d like to provide a more secure encryption UX for users, you can point your LLM to the repo. It is more than enough.

2026-06-27 01:11:59 UTC

- reply

Well, it is very subject to change compared to paid services.

2026-06-25 22:38:59 UTC

- reply

There is no free

2026-06-25 15:15:40 UTC

- reply

Technically it would be possible for it to explain it, if it did “reason”. The KV cache is actually just a processed version of the model’s intermediate states on each layer.
But there is no reasoning.

2026-06-23 22:46:37 UTC

- reply

It is not. My point is that open source software does not automatically imply a security budget, meaning that even if you *could* see it, doesn’t mean you do.

2026-06-22 19:51:36 UTC

- reply

I did not say they were mutually exclusive? Only that there is no correlation, at all, and it is not “better” for security in 99.99% of cases

2026-06-22 18:20:13 UTC

- reply

Them being visible *with a lot of effort* does not mean that they will be seen or reported or fixed.
And on the other hand, security researchers can also do security testing on closed systems, which happens all the time.

2026-06-22 17:33:43 UTC

- reply

Bouncy Castle sells support especially for FIPS, so they have an incentive.
OpenSSL is used basically everywhere and almost all big tech firms have a vested interest in submitting security fixes. Same for a bunch of GNU tools.

2026-06-22 17:22:03 UTC

- reply

It means that the security of a piece of software does not change because it is open source

2026-06-22 17:20:12 UTC

- reply

I think it is completely uncorrelated.

2026-06-22 17:19:35 UTC

- reply

Technically yes, in practice you have 1 or 2 yrs at most.
During this time, most pieces of software, especially specialized ones, will have on average 0-10 people look at it. Out of these, approximately 0.01 will report any issues.
The biggest and most secured OSS projects are corporate backed with many companies having a vested interest in its security, not a medium sized company or random person dumping their code on GH

2026-06-22 17:13:20 UTC

Open source does not mean more secure.

2026-06-22 08:40:01 UTC

- reply

https://fossil-scm.org/

2026-06-20 16:18:05 UTC

By this, a majority of zaps cost more to process in LN fees, server load and human time than they are worth.
#nevent1q…qzgf

2026-06-20 13:48:17 UTC

Most zaps are pointless

2026-06-20 13:34:31 UTC

gm 🤔

2026-06-19 22:05:12 UTC

- reply

As a relay operator, I have very little concern about the impact on me or my users arising from a kind 1 feed.
Instead, I am more concerned about the follow lists which can get huge and use a lot of data. On this topic I am thinking to introduce an HTTP API for relays

2026-06-19 22:01:08 UTC

- reply

I would say that the figure of 1000 notes for a feed is too much. It is usually enough to fetch 100-200.
Even in this case, advanced relays like Nostr.land already apply compression to the sent data.
The codepath duplication caused by kind 1 is limited. It would be treated like a reply either way, with slightly different parsing.
A migration to kind 1111 is simply not possible. It would involve the sequential migration of every post, with interaction from every author, to keep the IDs consistent. A half-complete migration would be useless.
For a switchover date, it would be hard to coordinate this. 50% of what, for example? Users? Clients? Who defines the “everything” set?
This could be implemented as a filter optimization, rather than a break. The benefits of kind 1111 for kind 1 posts are negligible, considering that a majority of the data usage from clients come from images, not relays.
Many clients also have a replies-inclusive feed, which users already switch to frequently.

2026-06-19 19:38:57 UTC

- reply

Users are not impacted by kind 1. For clients and relays, this can be said about many decisions. For example, the current signature format is awful for performance due to requiring costly JSON-encoding.
I unfortunately think that it is too late for kind 1 at least. Users care about the end result, and for them, very little changes. To them it looks like losing immense amounts of posts for no reason.
Protocols like negentropy already fix the data usage problem, and the filtering of replies is of low concern imo
Also: Anyone also trying to unilaterally force this is an idiot.

2026-06-19 18:20:20 UTC

- reply

Yes, but the impact is on clients which will lose years of old data, along with a “transition” that will never finish.

2026-06-19 18:13:07 UTC

- reply

I do not believe that the “performance improvements” to relays, data usage that is miniscule (plaintext) compared to media downloads or follow lists are worth breaking backwards compatibility.
I wouldn’t even notice a change in the stats for Nostr.land I’d say.

2026-06-19 13:45:39 UTC

- reply

I have not seen any response from them that addresses the claims.

2026-06-17 22:26:36 UTC

🤔

2026-06-15 16:47:57 UTC

True unlimited data plans (no “throttling after X GB”) are amazing

2026-06-15 09:44:40 UTC

- reply

As an independent party I can attest to this fact

2026-06-15 09:35:28 UTC

- reply

Nostr.land does this.

2026-06-14 20:11:01 UTC

Please tell me what your main concerns with Nostr relays are, especially in terms of privacy.

2026-06-14 20:09:09 UTC

- reply

It is a company resource provided to you.
Unless they encourage you to waste tokens, then you should use it only for work and efficiently.
If they do, you should not be profiting off of it or putting the company at risk.

2026-06-14 18:17:26 UTC

- reply

They are opening themselves up to termination if someone were to abuse those tokens for anything that violates the providers’ usage policies. Which are easy to trigger if you try.

2026-06-14 11:11:01 UTC

Corporate “Bitcoin” events are a waste of time

2026-06-14 05:59:01 UTC

- reply

and Intel SGX keeps getting broken in general

2026-06-12 20:19:43 UTC

No motive, monetary cost, and easily blocked. What is the point?!
#nevent1q…04k6

2026-06-12 20:17:03 UTC

I wonder who is paying for all the tokens to run these slopbots?

2026-06-12 20:11:22 UTC

as part of regular testing, I have deleted all data on a production storage node
it works as designed and there was no effect

2026-06-12 16:06:51 UTC

Slop will not be tolerated

2026-06-12 11:54:25 UTC

A pay per use model would significantly enshittify paid relays, lead to horrible UX and allow tons of spam:
1. It would lead to unpredictable charges for users. A fixed fee per month/year means the relay just works.
2. The cost acts as a bond for spam and abuse, compared to pay-per-note.
3. It is incompatible with services like aggr.nostr.land and NIP-05 where there is no “usage”.
4. It would allow a monetary DoS for services like inbox relays, where someone can spam you with junk giftwraps.
5. Users should not need to worry about constantly having a topped up wallet and using a supported client.

2026-06-11 16:56:01 UTC

&time>now-60&time<now+60&id=03…&method=pay&pinvbolt11_node=03…

2026-06-11 13:55:23 UTC

- reply

if done right: harder
usually: a little bit

2026-06-11 13:55:00 UTC

- reply

Any automated ways?

2026-06-11 13:49:32 UTC

- reply

Nostr.land is planning to support OTS.
I’m planning to use the standard OTS spec that is already well-implemented. “Inline” proofs is not something I plan to support as a client can easily request OTS proofs when necessary.
Also, I hate AI written “specs” so much as they have so much useless junk (like wtf is the s tag for?) and overcomplicate things.

2026-06-11 06:19:54 UTC

- reply

Well until you merge the dust outputs which then links all of the unlinked addresses back together

2026-06-10 16:06:08 UTC

CLINK or whatever this protocol is, is worse than NWC. What is the point?

2026-06-10 16:04:41 UTC

Code is a liability, to some extent. Each feature and line incurs a maintenance cost.
Less code is better.
#nevent1q…njx9

2026-06-10 15:29:15 UTC

Code has always been cheap. You don’t need an LLM to generate slop.
For me, nothing has changed

2026-06-10 13:36:06 UTC

- reply

This only makes me less confident, unfortunately.
“Your keys are never stored in a usable form” does not make sense, as that would mean that you can’t use them.
A PIN can be easily brute forced if you break the secure element, as it needs to know the PIN to verify it.
Tamper detection switches are not very good protection. Attacks have been done on devices with multiple layers of tamper protection with an entry less than 2mm.
The OS is “fine”, but claiming Xous’ reputation while having majorly changed it for your own usecase is weird. It’s not the same thing anymore.
My other points still stand.
I’m not going to assume malice or intentional deception, but it feels like they do not really have much experience with secure hardware.

2026-06-10 06:36:41 UTC

Anthropic has released a new money-incinerator that predicts probabilities better than the previous money-incinerator and also incinerates your money faster

2026-06-10 06:33:58 UTC

- reply

Yes your client would still have to AUTH that is it. Gift wrap spam/DoS being hard to mitigate is one reason for this, and especially mass-DM scambots.

2026-06-09 22:43:18 UTC

- reply

The UI is being retarded

2026-06-09 22:39:52 UTC

- reply

The bot is not wrong. It says !payment (inverse) not payment

2026-06-09 21:46:59 UTC

- reply

I believe it is fiatjaf’s thing.

2026-06-09 21:45:22 UTC

- reply

Well, auth depending on the pubkey acts as a strong anti-spam signal. It also indicates explicit consent for anything you send to it, instead of someone being able to say “well I didn’t put it on nostr.land”

2026-06-09 21:35:24 UTC

- reply

To some extent. Nostr.land already requires AUTH for a huge amount of features, so it would encourage devs to actually support it properly.
And for some things like gift wrap spam filtering, it would not be possible at all.
What is the use case?

2026-06-09 21:29:07 UTC

I am considering requiring NIP-42 authentication for a majority of event writes.
It would prevent random rebroadcasts where it is not desired and allow for better spam filtering, so why not?

2026-06-09 21:20:47 UTC

- reply

relays.land is a completely unaffiliated service that comes with way less, and it is confusing that they picked that name :/

2026-06-09 18:56:12 UTC

The current grant structure has successfully led to the exit of most competent devs.
Now, most “devs” are looking for quick grant money for vaporware, or want to cosplay software development with AI slop tools.

2026-06-09 16:35:34 UTC

- reply

More generally: The urge to add “comments” and “labels” that state the obvious / are redundant to places where they do not belong

2026-06-08 21:30:25 UTC

- reply

Funding currently is unconditional and so selects for people that do the bare minimum and want the most. AKA burning money

2026-06-08 20:24:54 UTC

- reply

I frontran basically everyone. and I am very sad at the rapid decline in the last year especially due to AI slop, and wannabes larping as devs while pumping out utter garbage.
garbage that users should be PAID to tolerate

2026-06-08 18:03:54 UTC

- reply

[Hadamard] count-min sketches are also great

2026-06-08 18:02:28 UTC

- reply

thats the thing… it uas to be used correctly and understandably by everyone involved
otherwise you end up with shit.
one usecase I have is that it makes it really to make a “LookupModule[T]” function to lookup the instance for a given relay

2026-06-08 17:17:09 UTC

- reply

I think that these tools are great, when used right and in the correct circumstances. I very rarely use any of these except iterators, which are simple to understand.

2026-06-08 16:28:22 UTC

I don’t get why people strongly feel that they should share private communications for any reason. Especially people “exposing” others is really icky.
You can do all of that, without sharing every single detail. Redaction and using your own words is not hard.

2026-06-08 16:26:03 UTC

- reply

False dichotomy
You can deny it without doxxing the sender, it’s called the reply button.

2026-06-08 16:24:18 UTC

- reply

I think the compression and metadata removal probably killed it

2026-06-08 16:23:35 UTC

- reply

why?

2026-06-08 16:23:11 UTC

- reply

Signing or not doesn’t change anything.

2026-06-08 16:10:51 UTC

- reply

I think that for public posts as well, a remote scanmer could be used as well. This would be a tradeoff.

2026-06-08 15:55:13 UTC

Data ownership is not something that exists. Privacy should be respected, but a false illusion of fully controlling what you share is as harmful as ignoring requests to delete.
“Homeservers” don’t fix this as archive.is, archive.org, Trove and many others will happily keep permanent and trusted records of what you said, some of them even if you ask them to delete it.

2026-06-08 15:52:12 UTC

- reply

You will have a hard time finding people that actually know hardware security, as it is a very small space, and most of them work in places where their work is actually appreciated. Not in markets where people have a completely distorted view of “security”.
Bitcoin and Monero are getting the scraps.

2026-06-08 15:50:42 UTC

- reply

That is why it is named that ;) People claim they are the next Galileo and they will be proven right because they are getting opposed or prosecuted or otherwise “suppressed”

2026-06-08 15:48:59 UTC

- reply

WoT and PoW are futile solutions, as they are actively hostile against new users, and have a huge asymmetry between real users and spammers.
AI spambots when designed right can easily manipulate WoT at little cost, while WoT excludes new users.
PoW is just a joke. It’s designed entirely for huge server farms, and people are expecting anything outside of that.

2026-06-08 15:41:57 UTC

- reply

Nostr can benefit from blacklists but it also needs real-time filtering (not whitelists) more than email. Rspamd is a great example with content scanning and local reputation scores.
RBLs work on finite identifiers that have *some* cost. Nostr works on infinite numbers of pubkeys.
This is the approach I am working on with nostr.land, where it combines multiple different types of information. Such as blacklists, historical reputation, but also content analysis, network, etc.
The goal is to make it work for 99% of new users. The other 1% can solve a CAPTCHA and wait a bit.

2026-06-08 15:31:41 UTC

- reply

Foundation is ran by good people but I can’t trust their products.
Many of their statements, including:
- calling the SAMA5D2, which lacks security features found on many security-oriented processors, a “security processor”
- using the ATECC secure element, when it is known to be insecure and was designed by a defunct company
- calling smart cards, which are the most secure way to protect your keys and are constantly evolving, “ancient and dated technology”
- *forking* Xous instead of using a well known kernel like seL4 or Linux or even writing their own (from their marketing, it seems they want to associate with the good reputation of Xous)
make me strongly think that they do not have significant knowledge with security.
As with any HWW company, they have to prove that they can be trusted to make security products. I am not convinced at all.

2026-06-08 14:57:41 UTC

Galileo fallacy (noun)
A fallacy whereby it is implied that one is correct due to being widely criticized or persecuted.