ciori

Public Key

npub1hupmmajeu337x9t54lmknr8c8dxdsx430q5uytmatn8hd74vmw7s6unnm6

NIP-05 Address

ciori@nostrplebs.com

NIP-57 Address

ciori@lnaddress.com

Profile Code

nprofile1qqst7qaa7ev7gclrz462lamf3nurknxcr2chs2wz9a74enmkl2kdh0gppemhxue69uhkummn9ekx7mp0plh6r6

Publishing to

nos.lol

Author Public Key

npub1hupmmajeu337x9t54lmknr8c8dxdsx430q5uytmatn8hd74vmw7s6unnm6

Show more details

Last Notes

2024-09-03 20:37:44

What is the best platform or tool to properly search and setup all your relays (inbox, outbox, dm, search, etc...)? Is there a standard or best principles to follow?

2024-08-21 15:17:36

- reply

Ehi @npub180c…h6w6 curious on what distro/DE/VM you are using, is that i3, sway or something else?

2024-08-20 15:16:37

- reply

Ok this: https://guides.getalby.com/user-guide/v/alby-account-and-browser-extension/alby-hub/faq-alby-hub/why-do-i-need-to-link-my-alby-account should clear pretty much all doubts, the Alby Account is the middle man to make everything which is public work, so they basically see all that is related to the getalby LN address if you link the node with the Alby account. I mean, it makes sense.

2024-08-20 14:47:23

- reply

How does the thing work? What about VPNs, Tor and LN addresses when I am self-hosting it inside a private network without opening anything to the public?

2024-08-19 19:38:45

- reply

Solved it, obviously it was something strange between an async/await function and a framework component.

2024-08-19 12:09:16

- reply

Yep, it's a problem on my part, the future connection in a simpler rust program does work.

2024-08-19 06:42:47

- reply

Oh ok, thanks, but it seems I am unable to make it work even following that example. I'll try by doing a simpler cli program, maybe the problem is more with the web framework I am using.

2024-08-18 17:42:07

@npub1drv…seet Hi, I was trying the nostr rust crate to test the nostr connect feature where a web app is generating a qrcode with the "nostrconnect://..." url for Amber to scan and sign. So in this case I am creating the NostrConnectURI object by providing the local public key of the app (not the remote signer) and the usual relays. This goes all well as I am able to then use the Client object, the problem is that when I refresh the web page all the internal state, meaning the Client object, get lost (I am using dioxus as web framework if it can help). The thing is that during the initial "login" phase I save every important value as a String by leveraging the integration with the browser localstorage, so I am fairly certain that the Client object can be recreated, but I don't understand how. I have looked at the examples on the github repo and tried different options but I am unable to properly recreate/parse the NostrConnectURI and then the Nip46Signer. What should be the correct way to do it if I initially "logged in" with a "Direct connection initiated by the client"?

2024-08-16 20:19:40

@npub180c…h6w6 @npub1ye5…knpr Thinking about some alternative home feed: I have to say I find "duplicated" content from people I follow too much often, what I mean is that when someone is resharing other people posts I see both the original post and the reshare it confuses me because I see multiple time the same content. I think it could be an interesting idea to have the option (not a DVM, just an option for the feed that I can decide to enable permanently) to display reshares from people I follow only when they reference a note from a person I don't follow, so that I can avoid duplicated content and feed is less bloated.
What would you say? Could this be useful?

2024-08-15 20:04:21

- reply

I might not have the ability to properly view each pro and con since I am not that technical into cashu and LN low level details and for sure you make some good points, but I still have some questions/doubts:
- Aren't people connecting with shockwallet to a Lightning.Pub node effectively using a custodial service? More trusted for sure if they use a friend or family one, but still custodial right? So in this case isn't using a cashu mint as a base adding only benefits? You still need to trust the node not to "rug pull" the LN liquidity right? Which is the "same" with a cashu mint or am I missing something? (A part from the added technical layer obviously)
- So if I am understanding right, under the hood you basically have "multiple keys for each user" so it would be problematic to add whitelisting (please "explain like I am 5" if not 😅 ) and it will negate the benefits of it. Then again the anonymity set is usually low in uncle jim nodes, so almost perfect privacy of cashu mints is not that perfect and not that almost 🤣 .
So basically you say that the Lightning.Pub implementation is actually more private (for this kind of use case) and simpler (less technical layers)?
Hope I am understanding right.

2024-08-14 07:00:02

- reply

Thank you, that was very helpful for me.

2024-08-13 19:51:17

- reply

Sorry to bother you again, but is there a way with nostr-sdk to save the state of the client and/or signer/bunker in the localstorage of the web app that is running everything? Or is this outside of the scope of the crate and therefore needs to be achieved by the framework in use? I am trying something with Dioxus Web but apparently the Client and NostrConnectURI types doesn't support serialization.
I am still a beginner with Rust, so I might say stupid and incorrect things.

2024-08-13 11:42:40

- reply

I think it would be really cool if the Lightning.Pub accounting system (for users using shockwallet) was on top of a cashu mint and not only a pure LN node (neutrino). In this case you could have both the nostr real-time sync and connection to the node (instead of having to manage VPNs, Tor, etc...) and privacy for each user wrt the node operator, right? And maybe this could enable a "private cashu mint" where only whitelisted npubs could connect (family, friends, etc...).

2024-08-11 19:41:22

Ehi @npub1drv…seet I see you are working on the Rust Nostr library, I was playing around with it mostly for NIP46 and NIP65 stuff following the example codes on the repo and I was wondering: if I want to publish an event using the outbox model what do I need to do? Is there a method or option on the Client object to automatically publish the event on the outbox relays of the user or do I need to make sure to "client.add_relay(...)" for every outbox relay (taken from "Kind::RelayList" events) prior to sending the event?

2024-08-11 12:01:14

Ehi @npub18am…p424 , is it possible to configure the well-known content on nostrplebs.com with the nip46 key to advertise relays used for remote signing with apps like Amber? I am talking about this login flow: https://github.com/nostr-protocol/nips/blob/master/46.md#nip-05-login-flow

2024-08-11 11:22:59

- reply

Do you mean the well-known stuff with the nip46 relay urls inside?

2024-08-11 10:04:15

- reply

Oh nice.
Now I am trying to play with the NDKNip46Signer but I am not sure about this: if I want to sign in using the nip05 or npub string, does the remote user need to have advertised the relays in which it will "listen" for bunker connections? I am thinking about the scenario where I want to login on a desktop web page while I have Amber on mobile to sign requests. At least with nostrudel you have the whole bunker url with hex pubkey and the relay you want to use, and I am not sure how this translate in NDK.

2024-08-10 18:19:25

@npub1zuu…c2uc @npub1w4u…0jr5 @npub1ye5…knpr After watching some Nostr Dev videos about NDK I was wondering: are there some nostr clients that uses the outbox model and the "Nostr Connect" login option (the one with the bunker url talking with Amber, like in nostrudel) that are done with NDK? Does NDK support this type of auhtentication?

2024-08-08 13:57:49

- reply

Motherfucking client*

2024-08-06 15:33:27

Some thoughts about Fedimint and Fedi given the recent launch event:
I like the idea behind distributed eCash at least in principle, BUT I still have some doubts on the practical side of things:
- As I understand, Fedimint is distributed only at the cashu level as the federation still requires a SINGLE lightning gateway to function properly. While it is obviously a nice thing to have, I wonder whether this will really make a difference in practice: if we think federations as communities or companies, they might be "distributed" technically, but are still a "single" attackable entity, so what's the difference here from a simpler cashu mint?
- When Fedi open source code? You have money and chat together and expect us to trust a closed source app? I hope the code will be available soon (and with reproducible builds)
So in the end, what I want to say is that unless we get federations composed of different entities that have little to do with each other, like a sort of good "cartel" (so that multiple guardians will actually make sense), fedimint "is only" useful to increase (how much? You still rely on a single LN gateway) the technical difficulty to attack a federation (guardians on geographically distributed nodes, on different cloud provider or datacenter, with different implementations, etc...).
I might have been to harsh here, but this is just my first thought about this, anyway I still like the general fedimint idea.

2024-08-01 16:01:44

@npub1qz2…m8hf Any chance you could add krux?

2024-07-31 17:11:28

@npub1ye5…knpr Would you say grouping "reposts" of a note from multiple users into a single visible note (with the icons/avatars of all the people that reposted it) could be an interesting feature in nostrudel?
For me it happens sometimes that I see a repost of a note I already saw and think "oh ok I've reached the bottom of all the new posts for today", but then I keep scrolling and I actually see something new, so basically that repost was a new one from a different user.
So sometimes the feed is a bit confusing for me in this sense, maybe there could be a way to group these kind of similar events where the actual content is the same (reposted note) and therefore it feels like it's "duplicated".
Might be a stupid thing, but I have this feeling this could actually be interesting 😅 .

2024-07-29 19:03:14

- reply

The wording seems something Trump would say 🤣

2024-07-27 21:09:15

Following the nostr feed during the conference got me thinking: it would be nice to have a DVM that summarize/collects the most relevant messages that were posted during a specific event, so that people can catch up with what happened even after few days have passed.

2024-07-23 21:37:34

- reply

I think that if you want to stay on "normal" linux, the best way is to run Fedora Workstation, at least it has the (imho) best sane defaults (security wise with uefi support, selinux and so on, btrfs and snapshots, etc ...) and only touch connestions using nmcli (network manager)

2024-07-18 17:36:01

- reply

Given the tokens are "saved" as nostr events on relays, what information is an external observer able to get by looking at a nostr profile? Just a bunch of tokens unable to be "decrypted"? Amount? Mints used? What is the level privacy of this thing?
Sorry for the probably stupid question, but I am not that technical on this stuff.

2024-07-17 21:39:43

- reply

I don't fully uderstand the part on the middle of the scheme with those nostr relays, does that mean that each traffic/packet coming from the proxy is "encapsulated" into nostr events that are then read by NWS exit nodes?
So basically we have HTTPS traffic into nostr events and then back to HTTPS traffic again?

2024-07-17 12:39:02

- reply

So you still need to use certificates and be bound to certificate authorities, unless you use a self signed one and trust it?
So basically this is "only" (I mean it's a lot) an alternative way to reach a web site? And does the website still need to have a public IP or is the NWS component "pulling" the connection from the relay somehow?

2024-07-17 12:14:40

- reply

So basically the HTTPS encryption is based not on certificates but on nostr keys? Therefore the relay cannot see the content of the connection?

2024-07-17 07:54:39

- reply

Ops, didn't finished the post:
..., creates the amber application and then you are ready to go (without needing to first copy the string from the phone app to the site you are trying to login)

2024-07-17 07:51:46

- reply

Yeah I think you can make the login process with a bunker managed by amber so that you don't need to previously create an application in amber.
The flow would be really cool if you could somehow login by typing your nostr username and then amber sees the bunker request from the set relays

2024-07-13 10:46:12

- reply

With this process, what info is an external "attacker" able to get from looking at the relays where the tokens are being posted?
Only who is receiving those ecash? Other info about the "payment"?

2024-07-13 09:47:01

- reply

Thank you, this is awesome.
Now we only need proper private DMs and this thing is gonna be fire!!!

2024-07-13 09:38:12

- reply

Is the wallet creating a sort of hidden seed like other cashu wallets (so you are dependent on using the Highligther app), or is it only relying on your nostr pubkey? Were is the difference here? Apart from the "ecash token on relays" part.
Might be a stupid question, but I am still learning these kind of stuff.

2024-07-13 09:19:22

- reply

Yeah I guess you can basically treat each zap (ecash token) as a nostr event propagated on some relays

2024-07-12 20:06:11

- reply

Yeah too much coffee for my understanding, try once a day maximum, and never after the afternoon, it messes with your sleep.
Then again, anyone is built different, but still...

2024-07-12 15:13:31

- reply

How much coffee per day were you drinking?

2024-07-10 21:23:01

- reply

I'll say LN payments to nostr posts? I mean it is a nice first thing to experience.

2024-07-09 17:45:37

- reply

On an unrelated note: is there a nostr "bot" that notify the user everytime a new message/conversation has been written on a "root" post?

2024-07-08 06:38:38

- reply

What about Linux?

2024-07-06 11:06:49

- reply

Mmh apparently wlroots based WMs/DEs are bad security wise.

2024-07-06 09:08:10

- reply

Yeah pretty much agree on everything, especially the "one giant controlling the system's future" part.
By the way, I wanted to try out Alpine and labwc to see whether they could replace Fedora/Debian and Gnome/KDE as a desktop daily drive (at least for me), do you have some insights on those?

2024-07-06 07:20:50

- reply

It was actually interesting to see chromebooks mentioned on those guides, do you know whether there is a degoogled ChromeOS alternative/fork much like GrapheneOS is for android?

2024-07-05 17:19:02

- reply

Now I am interested, do you have some good videos and/or guides to start/learn about linux hardening?

2024-07-05 05:45:25

- reply

Would you say Alpine linux could fit as a more secure linux distro? Otherwise are there some "ready to go" linux distro that checks those characteristics?

2024-07-04 20:03:44

- reply

Mmh ok, and how is BSD as a daily "distro" option? Are you limited in certain scenarios/use cases? Or are you using it for things other than a personal computer?

2024-07-04 17:18:53

Ehi @npub1az9…m8y8 I really like when you go into low level and security stuff on your Bitcoin.Review podcast, so I was wondering (maybe a little bit off topic) in the linux desktop world, are you a Wayland or X11 guy? Do you have some knowledge about those two options? And if so, is Wayland really necessary and useful to confine and separate windows, or the surface attacks could be so that when you have a "faulty/malicious" app it doesn't really make a difference?

2024-07-01 13:20:28

@npub1kva…tkzv A few days ago I had a problem with the latest OTA update with Minibits, it now shows zero balance on all the three mints I had, plus the icon/avatar of the profile went back on using the first image it had when I installed the app the first time (the LN address seems to be correct), the app also forgot the mints. The transactions list is also displaying duplicated transactions with an error status (the actual correct transactions I had before are present). Then I tried to increase the index and also delete transactions with errors, but the balances are still zero. Today I tried to receive a LN payment using the minibits LN address and it completed successfully (sats is showing, yet no previous tokens are there), but I am getting a duplicated transaction in the list, with an error status saying "Error: Token already spent.". Sending also works and with no duplicated tx in the list.
Some other notes:
- For a brief time the wallet loaded everything and I could see the balances (with no changes on my side), but now is back into forget land
- I may have activated and deactivated local storage and encryption multiple time while I was playing around with the app in the recent days
Is anyone else experiencing this problem, is there a standard recovery process from here?
It was just a bunch of sats, so not a big deal, but I would like to solve this issue, Thanks.

2024-06-25 14:36:49

@npub12rv…85vg @npub1kva…tkzv I really like the idea behind the minibits ln address to cashu mint flow, and it made me think about this: is there a way to achieve the same thing, but without being dependent from a specific wallet app (nothing against minibits in particular, I am just reasoning about this from a general point of view). So a ln address service that will lock all the received sats on a user specified cashu mint based on some logic (nostr pubkey, wallet seed, etc...). I might be saying stupid things here as I am not an expert on these topics, but I like the general idea.

2024-06-24 13:28:33

- reply

How are we on Private Chat apps replacements on nostr? Are there some good ones implementing the double ratchet thing?

2024-06-24 07:24:00

- reply

Thank you guys for the clarification.

2024-06-23 14:55:51

- reply

Ok it makes sense, so let's say that I find the way to import all the tokens on the new app, then I just need to make sure to always have at least their minibits mint as all the sats coming from the ln address will go there right?

2024-06-23 13:55:51

@npub1lxk…5xlc Hi, I saw the last minibits update with support for a "@minibits.cash" LN address, and given your experience with these kind of stuff I wanted to ask you: do you know if I am forced to use their minibits app, or could I just use another cashu wallet imported from the same seed generated with minibits?

2024-06-22 13:09:34

- reply

It was this post: nevent1qvzqqqqqqypzpte8562wrm20dljp9yqnnfypnvvzmsumalvas40hrq5923km5ly0qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmwdaehgu3wdau8gu3wv3jhvtcqypuyg9wz485xtsxc9fw88zpmtl9cg4gnrn7allryac7whpn4vft8sjkvgwr

2024-06-21 21:26:16

- reply

I don't think it is because of the relay choice, I think the problem here is in the "private" nature of the payment, maybe the wallet used and therefore the corresponding LN payment needs to be done in a way that is recorded as coming from the right nostr profile, so that the event can be associated with it and then be displayed/retrieved. Otherwise it is considered a "rogue" payment, but this is just my two cents.

2024-06-21 19:38:40

@npub12rv…85vg Is there a way to setup a "private" cashu mint?
Let me explain in a more detailed way:
let's say I want to create a cashu mint for friends and family, is it possible to make it so that, even though it would be publicly accessible on clearnet, only them can "register" to the mint and when they pay or are payed by others, these other people (the NOT friends/family users) will not "retain" cashu tokens on this particular mint, but the payment would somehow go to one of their public mints?
I don't know if this is even possible directly on the mint or if it would require something wallet side (for example having a public plus this "private" mint where ecash are "autoswapped" to the private one).

2024-06-19 19:33:47

- reply

Yeah, exactly.
Btw, I also sent you a zap (manually this time, not through Amber or NWC this time, still need to figure that stuff out), but I was just wandering, do you see something in your balance? Because I can see sats are sent, but noStrudel is not showing me anything.

2024-06-19 19:14:14

- reply

Thanks, wow, It works with "direct connection" for me too.
So basically the relay at nsec.app is just the medium to make Amber and the web client talk to each other, but then it's Amber that actually signs the events and sends them back to the web client, no private keys leave Amber right?

2024-06-19 17:29:19

- reply

Wait, this is cool, but I don't understand the bunker part, let's say I only have amber and nostrudel desktop, how do you login the first time on nostrudel? With your npub?

2024-05-30 06:59:27

- reply

Mmhh this is interesting

2024-05-28 21:02:15

@npub12rv…85vg @npub1t0n…jgqv As of today, is there the technical possibility to have multiple clients/wallets access the same cashu/fedimint "account"? Meaning can I login on different wallets and access the same "esats" and mints at the same time? Like for example from a web wallet while on desktop and then from the phone while on the go?

2024-05-22 21:20:00

- reply

Yep, everything is fine on that front, probably was just some weird connection problems.

2024-05-22 21:18:19

- reply

Aaaand now it loaded, could simply be bad internet connection, randomly on some notes, meh.

2024-05-22 21:14:52

- reply

Why I am seeing an empty note? I am using the public nostrudel.
It started to happen recently (days ago)

2024-05-17 10:15:25

- reply

My doubt as well, I have this definition in mind but I am not sure this is correct: "Using silent payments is like giving a sort of xpub to the sender so that it can generate a different address each time, but with the advantage that the sender only knows the address he or she generates and not every possible address"?

2024-05-15 19:12:28

- reply

A bit overkill, but you could try a local gitea + its own runner to test actions (they are not 100% compatible with github actions though)

2024-05-03 18:01:28

- reply

They are on it just for the "Number Go Up" part, probably.

2024-04-23 10:15:50

@npub1az9…m8y8 I really loved your recent podcast episodes where you talked about all the security concerns on normal hardware devices. So I wonder, in your experience with Coldcard and other "low hardware" devices, would you say it is possible to have an ESP32 or similar device (maybe I am just stupid and there already is a coldcard version doing this) that with additional modules (like a camera, a screen and a keyboard) is able to scan a qr code containing an encrypted seed and ask for the passphrase to decrypt it (plus all the other signing stuff)? I am not talking about the 25th word of the seed, but 12 or 24 wordsof a seed that have been encrypted in a file and then converted as a qr code image, so the scan part will have to decrypt it before accessing the seed. The thing I don't like about hardware signing devices is that they assume a seed qr image to be in clear.
Maybe I am just wrong on some level, maybe there is something I am not considering, but I would like to know your opinion on this.

2024-02-06 14:46:29

- reply

Oh wow didn't know that. Guess I have something new to learn now, thanks.

2024-02-06 14:42:28

- reply

What do you mean "only for first install"? Shouldn't you verify packets at every release?

2024-02-06 14:36:07

- reply

How does Obtainium handle package/apk verification?

2024-02-02 21:39:27

@npub1ye5…knpr Hi, really loving your nostrudel client, but is normal that when I click on a post, open it and then close it I never return to the same position on the feed I was previously? I always go back to some newer post on the feed, it is like the client forget how much I've scrolled.
This does not happen if I open the post using the dedicated button to view it "on top of the current screen" (I don't know how to say it better), because then you have a "go back" button taking you to the post right on the feed.
Maybe it is only my problem, but it happens on both mobile and desktop browsers.
Am I missing something?

2024-02-02 06:59:36

- reply

Doesn't using wayland solve the linux apps display problem?

2024-01-29 09:48:33

@npub14sl…t5d6 Hi, do you happen to have already used/looked at the Kagi search engine? It's a paid only search engine with no ads and more relevant (unbiased) results. They say searches are never linked to your account or sold.
Apart from the usual trust involved, do you have an opinion on this in terms of privacy?

2024-01-20 13:00:14

- reply

Maybe Electrum (it is for android also), or SBW? No really "watch only" only, but they should have that feature.

2023-12-24 18:28:46

@npub14sl…t5d6 Hey, really love your software comparison posts.
Recently I stumbled upon Twingate (Zero Trust Network Access), do you know it? Do you have any opinion on this for a personal "access your home stuff" usage?
The idea seems pretty nice, maybe there are some other selfhostable privacy oriented alternatives for ZTNA?

2023-12-20 20:50:12

- reply

I recommend looking at DivestOS before going Lineage, they try to mimic graphene but for non pixel phones.

2023-12-12 21:55:42

- reply

You basically pay just by bringing your own money

2023-12-07 19:40:18

- reply

Given it will be open, I hope it will be possible to create your own private hardware "stone" interoperable with the original one.
It will be nice to hide the fact you are using a Bitkey.

2023-12-06 19:24:30

- reply

Tried on both librewolf and ungoogled-chromium, the browser will find the search engine and save it with the "searxng" name but the query url is "nitter.simplifiedprivacy.com"

2023-12-06 18:49:05

- reply

Setting that as the deafult search engine, when you try and search something it seems to error out and redirect to your nitter instance.

2023-11-22 22:28:57

- reply

So they call goin to war "travel the world" now? xD

2023-10-17 09:37:49

@npub1xnf…lpr5 The new alpha version with Zeus Pay and LN Address integration looks really cool.
But, how does the embeeded LN node handle onchain connections? Where does it connect to? Is tor involved somehow?

2023-10-14 07:30:28

Test

2023-09-13 12:11:48

@npub180c…h6w6 @npub1gcx…nj5z I was thinking about replacing all email/telegram notifications from my selfhosted stuff with nostr messages (giftwraps?). Do you think this is already doable? Are there some good tools for linux systems?
I think I need something able to trigger a nostr send when a program tries to send an email, or some similar "cheat". Do you know anything worth considering? O maybe a better solution?

2023-09-10 10:45:33

- reply

What app is that?

2023-08-29 07:36:30

- reply

I guess the moderator banning him was one of those not supporting free speech.

2023-08-27 21:33:23

- reply

I hope so, but I am more inclined to say the younger generation is more occupied in understanding what is the right pronoun.

2023-06-28 05:58:11

- reply

Please just team up with GrapheneOS

2023-06-15 09:12:47

@npub14tq…hy62 Hi, I am asking again for a raspiblitz info: is there a proper/standard way to update services that are not present under the Update menu, like RTL or LiT?

2023-05-29 17:30:25

@npub14tq…hy62 About Raspiblitz initial setup where you copy the blockchain data from another already synched blitz, can you stop the process and continue it later or even finish it by synching from where it stopped?