Carlos

Public Key

npub1zg69v7z7u7q4w5wzsqzwdnh58x8py4hef2fm750eqqvw9zkvh76q4yjdwv

Profile Code

nprofile1qqspydzk0p0w0q2h28pgqp8xem6rnrsj2mu54yal28usqx8z3txtldqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsl7xj95

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1zg69v7z7u7q4w5wzsqzwdnh58x8py4hef2fm750eqqvw9zkvh76q4yjdwv

Show more details

Last Notes

2024-06-27 06:26:36 UTC

- reply

It worked a year ago, as I recorded the demos, but now some APIs have changed and it stopped working.
I can fix them if anyone's interested.

2024-06-27 06:22:21 UTC

- reply

Yes: https://lab.oak-node.net/powpub
A few demos:
https://lab.oak-node.net/powpub/uv/demo/demo-client.gif
https://oak-node.net/uv/demo/demo-powpub-client.gif

2023-12-09 10:22:48 UTC

The nostr github bot @npub15vu…u4kv may just be the first bot who's using PoW.
@npub1xdt…ntxy that's pretty cool.
I'm curious, what's the rationale behind it?

2023-12-09 09:58:52 UTC

@npub13az…8m54 wen NIP-07 support for get-tao?
Atm there's no way to re-use a pubkey across PoW posts.

2023-12-06 05:44:19 UTC

- reply

Default 21 PoW works, but if I change anything in the settings, posting doesn't work. It tries to connect to http://localhost:42068/powgen and fails.

2023-12-06 05:12:52 UTC

- reply

PoW vs PoS, nostr edition
#note10ms…8umt
#note1y0s…6d78

2023-12-06 04:44:30 UTC

- reply

I tried the latest master with rust 1.74 on a fresh new checkout.
`cargo build` worked.

2023-12-05 09:46:29 UTC

- reply

TLDR: Spammers will only actually spam with PoW if it makes economic sense. This means PoW mining has a price at which it is profitable, which means there will be miners specializing in selling event hashrate at the cheapest price. This is great news for mobile clients, who can tap into that and simply buy PoW if they so desire. If spammer GPU miners make hashrate cheap for spammers, they will also make it cheap for honest users. The spammers are at a disadvantage though, as a sustained attack means continuous costs. For honest users, worst case this means a one-time cost (post as anon during spam attack, see below).
---
A dynamically adjusted PoW requirement by relays is IMO an easy and cheap way to reduce spam:
- A sustained spam attack on one relay is impractical. To keep the spam going = spammers have to keep burning lots of energy continuously.
- A sustained spam attack on multiple relays is extremely impractical, as every relay can have its own "PoW gateway" even for the same event (see AUTH example below).
At best, spammers might venture for short bursts of spam, affecting a few relays for short periods of time.
Most clients won't even be affected during a spam attack. If they only read, they see no difference. If they want to post, they only see a difference if they post
1) at the time of the attack,
2) to a relay that is under attack,
3) have no history or subscription to that relay (see below), and
4) do not wish to buy even moderate amounts of PoW.
Worst case, they can simply wait a bit and post a few seconds later. Or buy some PoW and post now.
Relays can use PoW in a bunch of ways that make life harder for spammers while sparing real users, like for example:
- plain PoW for every new event: dynamically adjust up or down based on server load (spammers must mine now or stop spamming; honest users can simply post later, when PoW threshold is lower)
- plain PoW for every session: same as above, but only ask for PoW in the AUTH event, which is once per session. Authenticated users can have fair-use or common-sense rate limiting, like max 1 event per second per session. If spammers want to go faster than that, they'd have to re-AUTH, so mine again.
- plain PoW for AUTH for anons, no PoW (or lower) for subscribed paying members: Paid accounts have their npubs whitelisted from PoW requirements. The higher the subscription level, the higher the chance they're not spammers, so the bigger the PoW discount can be. This adds another incentive for paid subscriptions to relays.
- plain PoW for new events from new keys: Combination of the above, where strictest POW requirement apply only to new events from fresh keys with no previous activity.
What affects spammers for 100% of their activity, and reduces their attack to short bursts -- benefits the honest users 100% of their time, and reduces their inconvenience to short bursts, if at all.

2023-12-05 07:56:21 UTC

- reply

"Almost-Unforgeable Zaps: Wash-zapping can be almost entirely eliminated by requiring zaps to have PoW attached. The client can choose what an acceptable amount of PoW is, either absolute or relative to the zap amount. Anything below this threshold can be considered possible wash-zapping and ignored."
https://oak-node.net/book/powwow/use_cases.html

2023-12-05 07:51:44 UTC

- reply

Re your 1. "PoW as an anti-spam measure":
I'm working on PoW WoW, a distributed marketplace for event PoW. Can be used by mobile clients who can't afford to mine themselves, allows miners to join or leave at will, and be paid non-custodially over LN.
It has Rust libraries for clients and providers, but I can add bindings for other languages too.
#note1qqq…r9dd

2023-12-05 07:17:27 UTC

- reply

`cargo clean` also helps.

2023-12-04 20:40:59 UTC

- reply

That's one hop away (you trust Uncle Jim).
But if one of Uncle Jim's friends (2nd hop) signs the attestation? What if its 3 hops away?
It gets real tricky real fast.

2023-12-04 19:26:59 UTC

- reply

You mistyped PoW there.
LN promotes spam resistance only for the sender and receiver, cause only they can tell if a payment (zap) is real or not. Any 3rd party cannot tell the difference between a payment and a self-payment.
Outside of direct connections, distingushing spam from non-spam becomes exponentially harder, the further you go down the social graph.
Problem is, there will always be good content voiced through anons. Any platform with a spam filter that ignores this is self-limiting.
A good way for anons to cut through the bot noise is with PoW.

2023-12-04 19:04:57 UTC

- reply

Looking forward to it!

2023-12-04 19:02:59 UTC

- reply

Yes but its a very long list
https://www.nostr.net

2023-12-04 18:28:10 UTC

- reply

No, but you could create a fake wrapper event, add random data in a tag, and sign that.
https://github.com/nostr-protocol/nips/blob/master/07.md

2023-12-04 18:17:15 UTC

- reply

Is there a way to reward answers with plain and simple sats? I've only seen the zap option.
Zaps leave a trace for every payment (sender, receiver, amount) in nostr events, but simple LNURL doesn't.

2023-12-04 17:58:07 UTC

- reply

Feel free to give it a shot. I didn't try that myself because my Umbrel runs on a very old and low-powered raspi.
https://i.redd.it/oabjm4opcoz81.jpg

2023-12-04 17:43:10 UTC

- reply

Thanks, fixed.

2023-12-03 18:24:24 UTC

PoW WoW goes 007!
You can now use any NIP-07 browser extensions, like nos2x or Alby, to buy PoW for your notes.
https://oak-node.net/demo/powwow/

2023-12-03 18:12:59 UTC

- reply

Would work for either individual highest-PoW likes, or the posts with highest sum(pow(like)).
First is easier, second is cooler. Tough choice.

2023-12-03 18:08:40 UTC

@npub13az…8m54 could getwired have a page with the highest-PoW likes in the last 24h? So instead of showing count(likes), it shows count(pow(like))? Or have a toggle to switch between them?
Everyone compains likes are meaningless (see "onlyzaps" feature on Damus).
But IMO PoW engagement (likes, reposts, replies) are even better than "zaps", because you cannot fake it like with wash-zaps.

2023-12-01 06:49:00 UTC

- reply

Agree, nothing is set in stone.
A good protocol can be ignored for years, but can suddenly catch on for a random reason: #note164g…g9u3
IMO nostr will sooner or later turn to PoW, so the more methods for using it and buying it, the better.

2023-12-01 06:20:57 UTC

- reply

LMK if I can help with the payment setup.
Btw when this gets merged
https://github.com/nostr-protocol/nips/pull/685
the PoW provider will work with simple NWC.

2023-11-30 22:57:30 UTC

- reply

Yes it solves that problem, but adds trust in the mint.
You're not receiving sats per se, you're receiving cashu, which is redeemable to sats via the mint.

2023-11-30 20:47:37 UTC

- reply

Isn't mutiny the one that blastr uses?
If so, it's probably the best choice cause it blasts the notes to most (all?) public relays.

2023-11-30 20:40:35 UTC

- reply

My bad, looks like it works with normal "pay to LN Address" too.
#note12ue…ppmc

2023-11-30 20:37:36 UTC

- reply

AFAIK Blixt and Phoenix do the plain anonymous "pay to LN Address flow", which doesn't touch nostr.

2023-11-30 20:36:31 UTC

- reply

I think it relies on the privacy-invazive zap flow, meaning your LN tip leaves traces in nostr events of who sent the sats.
Otherwise it wouldn't know the npub of the sender, e.g. who to send the DM to with the token.

2023-11-30 20:24:58 UTC

- reply

The NIP for ephemeral events (incl. some used in NWC flow) was recently updated, not all relays respect that. Some SDKs expect the new behavior, which leads to weird bugs when using older non-compliant relays.
See more details here: https://github.com/rust-nostr/nostr/issues/164#issuecomment-1786049227
To be backward compatible and handle both types of relays, make sure to not expect an "OK" response after sending an ephemeral event.

2023-11-30 20:05:35 UTC

- reply

Hey @npub1zfs…w445 , it was great to see you add NWC so early on. I used it extensively to test some of my own NWC implementations.
Tried to use it now and I see it on a screen that links it to zaps: "Nostr Wallet Connect / Send zaps easily with Bitcoin Lightning"
Is there a way to use NWC in Lume to just send LN tips? e.g. without the privacy invasive zap overhead?

2023-11-30 19:35:01 UTC

- reply

Also interested in that.
The closest to this I tried is https://localai.io which can do images, but not video yet.

2023-11-29 21:31:39 UTC

- reply

Why not ask for PoW, like #note1dvx…pz5e ?

2023-11-29 21:23:34 UTC

- reply

Sounds impractical.
Nobody would go for a "pay per sent email" mail provider.

2023-11-29 21:20:47 UTC

- reply

I agree, its the relays who face the brunt of the spam, so they have to deal with it the most.
IMO there are 2 ways to go about it:
1) Paid relays. This means only members can post. This means free relays are left behind, vulnerable to spam attacks. Which is a disaster for onboarding, as new users will basically have to pay to post on nostr.
2) PoW. Just like Tor is using PoW to defend against spam attacks, relays can dynamically ask for PoW for new events, or even for subscriptions. Higher relay load = higher PoW needed. PoW means constant work for spammers and only occasional work for honest posters. If you look at the bigger picture, it exponentially harder for spammers to attack multiple PoW relays at once. This is good news for honest users, who will likely be using a few relays: if some relays are under attack, the others are likely not, so you can still post at a low or no PoW threshold.
Either sats or mining, it comes down to a provable cost. At the end of the day, sats are PoW are interchangeable. You can buy PoW with sats, or sell PoW for sats.
TL;DR: With PoW all relays, including the free ones, have a chance to ward off spam atacks.

2023-11-29 08:32:15 UTC

- reply

https://api.invidious.io
Choose an instance close to you.
Haven't seen any YT ads in years.

2023-11-28 20:22:04 UTC

PoW WoW v0.1 is out!
It is a distributed marketplace for event PoW.
Anyone can be a client, offering to buy PoW for their event. And anyone can be a provider, selling hashrate.
A reputation system based on past trade behavior punishes dishonest clients or providers. For example, a client who creates requests but doesn't pay gets a bad reputation. Similarly, a provider who delivers a blinded solution which, after payment and unblinding, turns out to have less bits of PoW than asked by the client, also gets a negative reputation.
There are 3 clients available: WASM, CLI, and a Gossip fork. A CLI provider is available for those who want to try out mining.
Check it out at https://lab.oak-node.net/powwow
cc @npub19md…6vzk @npub1hxj…agw3

2023-11-28 17:29:30 UTC

- reply

I'm using blastr to send PoW notes.
I see them show up on powrelay and getwired, so it must be working.

2023-11-27 09:28:10 UTC

- reply

Or pay for PoW from mobile, for any event: #note1qqq…8g0d
Yes scammers have botnets, but they'll only use them when it's economically viable. But if it's economically viable to mine PoW for spam, then:
1) it's also profitable for honest miners to sell PoW (e.g. in a marketplace), because there is now economic demand for PoW
2) relays can add a number of cheap defenses that makes spamming exponentially more difficult, even for spammers with botnets: for example, AUTH with PoW (one time per session), then post without PoW

2023-11-27 09:07:06 UTC

- reply

Proper link: #note1qqq…8g0d

2023-11-27 09:00:21 UTC

- reply

24 bits PoW, posted on mobile, but mined somewhere else
note1qqqvzjsnln2zcvlww2wwfmemw3mtldegdgq7rylvf5rahghvktqslwx2ha

2023-11-26 22:41:11 UTC

- reply

Which relays does getwired.app monitor?

2023-11-26 22:31:56 UTC

- reply

No they don't, I looked for it too.

2023-11-26 22:26:42 UTC

npub13zyg3zysfylqc6nwfgj2uvce5rtlck2u50vwtjhpn92wzyusprfsdl2rce that's a cool key

2023-11-26 12:16:49 UTC

- reply

A few of ideas with little server overhead:
- Authenticated FTP or HTTP view of all of someone's files, then they can download them with clients like aria2
- Expose a read-only Syncthing share with the user's files, then the user can pair and download them (similar to dropbox)

2023-11-25 16:33:31 UTC

- reply

https://shop.nitrokey.com/shop/product/nitrowall-nw678-480
OPNsense or OpenWrt. VPN.
Can customize hardware. Can be sent in tamper-evident packaging. Can be bought with Bitcoin.

2023-11-24 17:08:39 UTC

- reply

Is the DLEQ essentially a proof of payment?
And if yes, did I understand it right that any 3rd party can look at it and tell the sender, the receiver, and the amount?

2023-11-24 11:57:58 UTC

- reply

Currently testing it with Gossip : https://github.com/ok300/gossip/tree/ok300-powwow-client (cc @npub1acg…p35c). This lets my Gossip client buy PoW for every event (note, repost, etc). Very rudimentary, but good enough as proof of concept.
There is also a WASM client, which I'm testing on mobile: https://oak-node.net/demo/powwow/
Best would be of course a native mobile app, but haven't found the time to do that yet.

2023-11-24 11:51:33 UTC

- reply

There are ways to buy PoW from a marketplace of providers, all over nostr.
#note1qqq…8g0d

2023-11-23 19:27:57 UTC

Looking for testers or feedback on PoW WoW.
It's a protocol to buy PoW for any notes, or to sell hashrate.
The idea is: clients can start "shopping" for PoW for any event they create. They say how much PoW they want, how fast, and how much they're willing to pay. Providers mine the PoW and send it over together with an invoice. The PoW is packaged in such a way that it's only usable after the invoice is paid (e.g. the preimage is known). Long story short, after the client pays, they can "open" (unblind) the PoW, add it to their event, and broadcast it right away.
To see it in action: https://lab.oak-node.net/powwow/uv/demo/powwow_20231123.mp4
For details see https://oak-node.net/book/powwow/
Any feedback or questions, let me know! Thanks.
#pow #askstr

2023-11-03 20:14:13 UTC

Hey @npub1utx…50e8, is it possible to customize supported NIPs with relaying.io?
For example setting setting `created_at` limits with NIP-22.

2023-10-28 10:06:09 UTC

- reply

I played with a prototype for this a while back: https://oak-node.net/doc/trunk/doc/ons/ons-4.md
If there's any service provider interested, LMK and I could revive it.
Essentially comes down to:
- offer a LN address where customers can easily pay to: user_id@service_provider.com
- the LNURL-pay endpoint creates invoices with the user ID in the description
- in effect, any payment to that LN Address results in an invoice with the user's ID in the description
- user can setup a recurring payment (or stop paying, or change the payment amount) anytime, using any recurring payment solution
- service provider needs a simple piece of software that can lookup current user balance based on paid invoices with that User ID as description
- the service can stop or resume, based on the user account balance

2023-10-26 07:25:37 UTC

- reply

For the fully non-custodial version of this, see Oak Node.
Lets you have a bot on your Umbrel, who will listen for your Likes and react with a LN payment directly from your node.
#note1qqq…lhaa

2023-10-25 13:39:59 UTC

- reply

Yep.
You're basically describing https://lab.oak-node.net/powpub
Anyone can run a provider (miner) to do exactly that and get paid for mining pubkeys.

2023-10-18 17:22:00 UTC

- reply

Wait until you see the zap metadata.

2023-10-10 19:32:48 UTC

- reply

Already in the works, having a CLI version out soon.

2023-10-04 11:50:10 UTC

- reply

Hey @npub137c…k37w I came across your note note18nhpu65c84s0pv0pvytwmynevzemlm0hvmp4gqyt8uv7z2a2umnsz9s9lp
Just recently pushed a release that fixes some NWC issues on Oak Node (keeps relay connection alive, choose most responsive one for NWC, etc)
I use it constantly with Amethyst and have tested with Damus too.
LMK if you have any issues!

2023-10-02 12:30:01 UTC

- reply

PoW will solve it.
Clients will eventually be able to aggregate PoW-weighted likes, replies, reposts, etc.

2023-09-29 05:17:04 UTC

- reply

Would use with recurring payment that I can automate.
Is there a way to get a LNURL-pay endpoint that, if I pay to, is associated with my account?
Like a 1month_npub_here@eden.nostr.land LN Address?

2023-09-29 04:53:24 UTC

- reply

Yep works now

2023-09-27 07:46:03 UTC

- reply

Btw your Strike LN Address isn't working, can't send you sats

2023-09-27 07:44:10 UTC

- reply

What app did you use?
Mined on the phone, or you delegated the mining to another device but signed from the phone?

2023-09-24 20:17:29 UTC

- reply

Try Oak Node on Umbrel. You can view and re-view the NWC QR as many times as you want.
AFAIK Alby shows only once the NWC secret (and QR code), when you create it.

2023-09-18 12:20:04 UTC

- reply

We just need a way to let clients easily buy some of this cheap computing power to add PoW to their notes.

2023-09-18 12:06:13 UTC

- reply

Mobile clients are limited in how much PoW they can mine.
No simple solution yet for them to delegate PoW to 3rd party.
I'm working on a solution for that. Tentative spec: https://oak-node.net/file?name=doc/ons/ons-2.md&ci=trunk

2023-09-17 20:32:24 UTC

- reply

Can confirm

2023-09-17 17:27:56 UTC

- reply

Corrigido! Obrigado

2023-09-17 14:13:19 UTC

- reply

True. But they need extra logic that checks if a relay is misbehaving in the first place.

2023-09-17 09:59:59 UTC

- reply

cc @npub1acg…p35c

2023-09-17 09:57:33 UTC

- reply

I think he means relays who don't play by the rules.
A malicious relay coud:
- send the same message(s) multiple times
- send extra messages that don't match the filters
- do this both for stored events (pre EOSE) and for streamed events (post EOSE)
IMO its a viable attack vector, because clients have less resources so by doing the above, a relay could DoS a client.
Even if unexpected events are "filtered out" by the client before showing them to the user, the client still presumably verifies they're valid events, and signature verification is quite intense. So unexpected large events are also an attack vector, they can hit the client CPU hard.
Nostr SDKs used in clients could defend against most of this by
- only returning events that match the subscription filters
- only validating if an event is valid (signature) if the above is true
- not processing and returning events that have already been seen before (much harder to do)
cc @npub1drv…seet
Probably not a concern now, because Nostr is small.
(Another defence for clients is to use a semi-trusted relay aggregator like Wine or caching service like Primal)

2023-09-17 09:07:07 UTC

- reply

Check out NIP-10, it's written exactly to explain this.

2023-09-17 08:57:59 UTC

- reply

cashu-lnurl looks like a quick and simple way to do offline receive. Though you have to trust the provider. And you get the sats as cashus.
Am I right?

2023-09-17 08:50:17 UTC

The Gossip client is shaping up!
Just started using it again after a couple of months and:
- now it has proper support for DMs
- UI is much faster, almost instant
- UI is much slicker
It may just be the best desktop Nostr client yet 🤔

2023-09-16 06:49:08 UTC

- reply

What hardware specs? Looking into CLN too.

2023-09-16 06:47:45 UTC

- reply

40 bits, that's awesome!
Those gaming PCs are starting to look quite appealing now :)
Would you be interested to help me test something out? It involves nostr, PoW, Rust and generally many CPU cores.

2023-09-16 05:31:00 UTC

- reply

@npub1xnf…lpr5 wen NWC?
A bunch of nostriches are already making noise about it:
#note1vt0…ps77
#note1s6s…5yjn
#note1vc4…xp8n

2023-07-07 15:40:12 UTC

- reply

See @npub1wxl…hcan and #note1qqq…0vev

2023-07-07 15:39:14 UTC

- reply

Quick, get the Nostr CEO on the line!

2023-07-07 15:38:09 UTC

- reply

@npub1u8l…turz @npub1wxl…hcan
Great minds think alike ;)
#note1qqq…0vev

2023-06-30 18:46:45 UTC

- reply

Is there such a thing as "proof of payment" in cashu, like the preimage is for a LN invoice?
As in a way to prove to 3rd parties that a certain (cashu invoice?) was settled?

2023-06-29 09:32:52 UTC

- reply

https://github.com/mikedilger/gossip/

2023-06-29 08:48:33 UTC

- reply

No way to tell if they're real or fake tho

2023-06-29 08:45:57 UTC

- reply

https://oak-node.net/wiki?name=demo-powpub-client

2023-06-28 21:24:10 UTC

- reply

The NIP has an example command with curl:
curl -H "Accept: application/nostr+json" https://eden.nostr.land
If the client says it accepts content of type `application/nostr+json`, seems reasonable to expect the relay should respond with exactly that content type header.

2023-06-28 21:15:09 UTC

- reply

Yes

2023-06-28 21:13:14 UTC

- reply

#note1qqq…5rdy

2023-06-28 21:11:45 UTC

- reply

Is your app up and running? It has to be online to receive payments, with the Breez SDK initialized and running.

2023-06-28 21:04:42 UTC

- reply

cc @npub1xdt…ntxy
nostr.band has embeddable notes, maybe it could have an embeddable audio player for podcast episodes? WIth LN tipping and Boostagram support?

2023-06-26 14:57:21 UTC

- reply

Famous last words

2023-06-26 14:55:31 UTC

- reply

cc @npub1ccs…dc57

2023-06-26 14:55:11 UTC

- reply

Or azteco, that's exactly what they're offering.
Could be easier with azteco, because you're just redeeming a voucher, you're not touching any exchange.

2023-06-26 13:57:35 UTC

- reply

Here's a scenario: a service provider lets you run a Nostr bot. It has its own keys, but it can watch for events of your main Nostr keys and react to them with configurable "if this then that" rules.
For example, "if I reply with a smiley face :) to a note from my main account, then bot will send 1000 sats to the author of that note"
"If I reply with two smileys, send 10k sats"
"If I like and repost a note => send 50k sats"
Will the fruit company be able to ban smiley replies? Reposts? Likes?

2023-06-26 13:47:58 UTC

- reply

Sure they can try.
But it ain't gonna work.
#note1qqq…qrag

2023-06-26 13:43:41 UTC

- reply

Then @npub1get…0nfm ser, why u spreading fake news?
"Alby is the first to bring #1tapzap experience to Nostur"
I guess Alby might be the first to bring the proprietary integration. But there are already several other services exposing pure NWC.

2023-06-25 13:00:43 UTC

- reply

#note1qqq…qrag

2023-06-25 09:35:01 UTC

- reply

JohnOnAir

2023-06-25 09:34:48 UTC

- reply

JohnOnchain -> JohnOnCast

2023-06-24 21:39:24 UTC

- reply

I'm surprised people expect zaps to be the default.
Zaps are less private, less secure, more centralized and more confusing to newbies than plain LN.
The one thing it got right is the catchy name.

2023-06-24 17:10:18 UTC

- reply

nprofile encodes pubkey + recommended relays in bech32
npub encodes only the pubkey

2023-06-24 17:05:30 UTC

- reply

Depends on the client. That doesn't happen on Gossip.