leon

https://nostrwot.com

courage is our own fountain of wisdom 🌱https://quantakrypto.com

Public Key

npub1gxdhmu9swqduwhr6zptjy4ya693zp3ql28nemy4hd97kuufyrqdqwe5zfk

NIP-05 Address

leon@hodl.ar

Profile Code

nprofile1qqsyrxma7zc8qx78t3apq4ez2jwazc3qcs04reuaj2mkjltwwyjpsxspzemhxue69uhkzarvv9ejumn0wd68ytnvv9hxghtd5u5

Publishing to

atlas.nostr.land

Author Public Key

npub1gxdhmu9swqduwhr6zptjy4ya693zp3ql28nemy4hd97kuufyrqdqwe5zfk

Show more details

Last Notes

2026-11-10 19:39:33 UTC

- reply

hey, we've shutdown the lnbits service till the lnbits team uploads a hot fix for the issues they encountered! we will restart the service as soon as this is solved

2026-10-27 22:41:30 UTC

hola

2026-10-27 22:41:21 UTC

hola

2026-10-22 17:47:44 UTC

- reply

adding on the substantial trust in a central server:
***it does not need to hold your full private key to abuse those powers***
we would still be trusting the central server to only sign when we authorize it, respect our permissions, and handle our decrypted messages, because the operators trust requests from central rather than independently checking our approval

2026-10-22 17:35:39 UTC

- reply

the collusion protection is limited, and we would be retaining substantial trust in a central server. in an n-of-x model, we would be risking that n of x parties could reconstruct our key and sign events on our behalf
not only this, but also if enough of the parties we chose are offline, we can't sign like ourselves. and if they don't come back and we don't have a separate backup, we risk losing access to our private keys indefinitely
in addition to this, there's the latency issue. it may not appear important, but nip46 for me is a pain in the ass, and i've created my own local network bridge to handle these things without latency
any millisecond that we add to these processes makes things more complex, more when we have apps that require actions like, idk, decrypting or sending big groups of messages. i understand that the cases where we do these may be limited, but an app is always as weak as the weakest link, right?
using this model for login and recovering the private key to use in a local signer would solve the latency issue. but i feel at this point that's minor compared to the first issue: we'd still be risking that n of x parties could reconstruct our key, even if we're using it locally ?!

2026-10-22 02:48:31 UTC

after the Coldcard weak keys issue and the recent HSM vulnerability, i think now more than ever we should make education and tools for safely generating seeds and private keys more accessible
100 dice rolls or 256 coin flips might sound excessive. it takes 5 to 10 minutes, but gives you something valuable: entropy you generate yourself, without having to trust a device's random number generator
Nostr WoT helps you create your seed phrase using real dice rolls or coin flips, with a transparent process you can verify
- Video: https://youtu.be/N0Kg5gZs5Ak
- Guide: https://nostrwot.com/guides/create-recovery-phrase-with-dice
- Extension: https://nostrwot.com/download
any feedback or ideas welcome, especially from people who already roll their own seeds
https://blossom.primal.net/df58f233e8e85627a28c77de8d99409e059d8712a2ceda67bd5a962b2f630513.png

2026-10-21 03:03:16 UTC

i’ve been exploring different ways to make creating a Nostr account easier. a friend suggested passkeys, so I gave it a go. here’s how it turned out in Nostr WoT
--
it’s available to try, and there’s an SDK with interoperability docs if you want to build on it
- setup and recovery guide: https://nostrwot.com/guides/create-nostr-account-with-passkey
- chrome: https://chromewebstore.google.com/detail/nostr-wot/gfmefgdkmjpjinecjchlangpamhclhdo
- firefox: https://addons.mozilla.org/es-AR/firefox/addon/nostr-wot-extension/
would love some feedback. does this feel easier? what would you change?
https://youtu.be/q1RiU-VqM_k

2026-10-03 16:42:25 UTC

- reply

that's till u get kids. u cant hide ugly kids

2026-10-01 13:08:17 UTC

I’ve been working on Nostr WoT and put together some guides with screenshots and a YouTube playlist to walk through it.
https://www.youtube.com/playlist?list=PLEmTf_Ex3n7c
I am looking for honest and critical feedback. I’d especially like you to try the new permission controls:
- Global rules, with overrides for individual sites.
- Optional automatic backend authentication for matching origins and verified site/API pairs.
- Relay authentication for specific apps or across all connected sites, so you don’t keep approving the same relay.
Does it make sense when you use it? Are the prompts clear? Anything annoying or missing?
Give it a go with your usual Nostr client and let me know. Feedback on the guides and videos is welcome too.
You can use it with Nostr Connect and Nostr Wallet Connect to get acquainted
https://nostr-wot.com/download
https://nostr-wot.com/guides

2026-09-10 22:41:17 UTC

- reply

hahhaha!

2026-09-10 22:40:34 UTC

- reply

hahhaha!

2026-09-10 22:12:49 UTC

i've been putting together an index of projects implementing or experimenting with post-quantum cryptography in Nostr:
https://github.com/nostr-wot/nostr-pqc#projects
It covers encrypted messages, signatures and transport, with links to the code and an explanation of what each approach actually protects
i'd love to see us converge on shared key discovery, formats and test vectors. there's working code to build on, though the NIP proposal is still open
building something in this area, or know a project we're missing? send a link or open a PR. i'm happy to collaborate
https://nostr-wot.com/pqc
#pqc #postquantumnostr #postquantumcryptography #nostrwot

2026-08-19 13:32:52 UTC

- reply

obelisk.ar implements post-quantum dms via nostr-wot already
https://primal.net/e/naddr1qvzqqqr4gupzqsvm0hctquqmcaw85yzhyf2fm5tzyrzp7508nkftw6tadecjgxq6qq38qmmnwskhzatpde682mfdv3khxttfdckk7cn9d35hx6edvdkxjetwwsxx2p45

2026-08-19 13:31:14 UTC

- reply

obelisk.ar DMs are post-quantum encrypted as of this week. keys come from the seed phrase you already have (or should create), messages ride inside ordinary NIP-17 gift wrap, and no relay had to change anything
reading them needs no negotiation: the envelope says what it is. sending needs one cached relay query. for most clients this is an afternoon of work
it is opt-in today because a Nostr identity is a secp256k1 key and nothing else, with no algorithm field. we already version NIP-44 payloads. the idea is in the protocol, it just has not reached the key
formats are public drafts. argue with them before a second client ships against them
https://quantakrypto.com/blog/obelisk-first-nostr-client-post-quantum-dms
#naddr1qv…v2j5

2026-08-11 09:22:09 UTC

- reply

somebody is collecting your encrypted messages. storing them to read them 10 years from now. that's the whole attack. wake up
#naddr1qv…wum8

2026-04-28 01:45:12 UTC

just launched Nostr Widgets, server-rendered svg widgets for Nostr profiles, follows, and feeds to embed with <a><img> in static pages, thoughts?
https://github.com/nostr-wot/nostr-widgets
https://npub1gxdhmu9swqduwhr6zptjy4ya693zp3ql28nemy4hd97kuufyrqdqwe5zfk.blossom.band/d4bfd802535a076b9fc3d44f31c65b9bb8420a4e4fa58032fb923d46dc0df9b2.png

2026-04-22 17:57:37 UTC

- reply

flights near the edges (Sydney loop) are longer because planes slow down as they approach the abyss, pilots instinctively ease off the throttle. London-NY-Tokyo stays central, full speed ahead
your flight time data doesn't prove roundness, it proves 𝐩𝐢𝐥𝐨𝐭 𝐚𝐧𝐱𝐢𝐞𝐭𝐲 𝐠𝐫𝐚𝐝𝐢𝐞𝐧𝐭. the closer to the edge, the slower they fly

2026-04-15 14:20:21 UTC

set up your ligthning wallet with 2 clicks
https://nostr-wot.com/guides/lightning-address

2026-03-15 01:30:30 UTC

- reply

thanks for the heads up! just fixed the lnbits service 🌱🍄🐳

2026-03-14 20:54:49 UTC

- reply

you got me, gonna run in nostrito soon 🫣

2026-03-14 20:45:51 UTC

- reply

don't wanna destroy. wanna build upon and along

2026-03-11 17:49:38 UTC

- reply

for sure, that's why i am participating in all the meetings!
it is designed to be fully integrated from day 0, and not to compete, but to enhance it
i am sure a lot of people is building from different directions, and i am opened to listen and learn from all of them
i called it protocol because platforms can architecturally participate of several protocols: bitcoin + lightning network + nostr + gozzip. furthermore, it can also be implemented in other decentralized social network initiatives equally

2026-03-11 14:28:41 UTC

- reply

hey! for some reason i can't get a Signal account with a Vietnamese number. i haven't had time to catch up with that yet
your approach is interesting, to find a way to vouch for relays and a public way to access them based on performance parameters such us latency or availability, geographic area, reliability, spam detection and so on, and query them through a service like purplepag.es would be great. i think that's not my line of work, but probably @nprofile…0j5w could think of something
what i am focusing now is on how to achieve Nostr's original promise: "shift the paradigm of dumb client/smart server to smart client/dumb server", or rather "smart client & smart server"
i have the intuition that we can use our WoT as infrastructure to store and retrieve information, rather than using only relays. Nostr exploration has given us tools and space to understand what works and what not, and i've come to realize that what we thought was fixed and objective, can be dynamic and subjective, just like life itself
relays are amazing as a boostrapping mechanism, discovery, specialized services, curated content, connect to other peers when no other available method, but, users SHOULD define what they want to see or not, and that information shouldn't be public, should be private. what i consume or not by no means should be of common knowledge or arbitrarily served. gatekeeping and surveillance surface can be reduced
i've written a whitepaper that introduces a decentralized trust-weighted storage and retrieval system that can be built alongside Nostr and work in parallel to relays. i'd appreciate your honest feedback: https://github.com/gozzip-protocol/gozzip

2026-03-10 07:30:17 UTC

- reply

hey @nprofile…tz23 . i agree with you, but instead of routing content through random peers, we should use our web of trust. content should be within the people that consumes it the most.
i wrote a paper about it: https://github.com/gozzip-protocol/gozzip

2026-03-09 17:22:57 UTC

- reply

pretty clear breakdown, core argument is strong. relay-based filtering is the right structural incentive. the "tragedy of the commons" point is an angle that i had hard to imagine: if filtering is purely local, you're offloading the mess onto everyone visiting your threads. relay selection as social responsibility makes sense
that said, want to push on something: what happens if we take the relay-filtering model seriously but ask what a "relay" could actually be?
right now clients are dumb readers, relays are smart filters. users pick relays with good policies, system works because operators have infrastructure and incentives to filter well. pyramid, pow.relays.land, paid relays, all proof this works today
but theres a gap. relay operators are a dependency surface, they decide whats stored, for how long, what rules apply. even the best-intentioned operator is a single point of policy. if inbox.yakihonne.com changes its algo or goes offline, every user with it as a read relay is affected
part of why this felt inevitable is that clients used to be genuinely constrained. storage expensive, bandwidth metered, battery a real concern. making clients dumb made sense. but that assumption is aging, phones today have hundreds of gigs, always-on connections, processors that would've been server-grade not long ago. the gap between client and server is narrowing, even if the protocol still treats them as categorically diferent
what if some clients started behaving more like relays? not replacing what you describe, complementing it. a client that forms bilateral storage agreements with wot peers, i store yours you store mine, with roughly matched volumes so neither side is freeloading. both sides have skin in the game which is what makes it stable, if you stop holding up your end i stop holding up mine and we both lose a storage partner
the filtering part comes almost for free. content only propagates within a trust boundary, say 2-hop follows, so spam from throwaway keys never reaches you. not because a relay filtered it but because nobody in your social graph stored or forwarded it. same wot principle pyramid uses, distributed across participants instead of centralized in an operator
the part that makes it not just a nice idea is how you actually find stuff without a relay index. you'd want something like a tiered approach, check local storage first, then try known peers who responded fast before, then fan out a blinded request through your wot if needed, and only hit traditional relays as a last resort. relays become a fallback layer rather than the primary path, which is basically embedding your model as a component
the question is wether both models coexist and reinforce each other. relays handle filtering and inbox routing (works today, should be default), wot-based peer storage adds an availability layer and alternative discovery path that doesnt depend on any single operator. periodic challenge-response checks between partners keep the storage honest without needing anything as heavy as proof of work or staking
curious if you see something structurally incompatible about the two coexisting, or if you thinkk the relay model already covers this ground

2026-03-07 23:59:21 UTC

irony: censored in nostr-protocol github 😇
https://blossom.primal.net/927678f028eb2b6489d0f269fa179bbc25b314f4b2a5bf20cf742c03dfab729b.png

2026-03-07 22:45:05 UTC

- reply

haha! nice set up!
if you read from your phone, you don't need much light. try this paper:
https://github.com/gozzip-protocol/gozzip
an additional layer to nostr for decentralized storage and retrieval. i think your ongoing browser nostr effort could use it!

2026-03-02 11:01:35 UTC

- reply

GrapheneOS partnering with Motorola is the kind of news that we should all be pushing for
privacy-grade OS. mass-market hardware. no compromises
this is how you bring sovereignty to not-power-users, not by preaching, but 𝐛𝐲 𝐦𝐚𝐤𝐢𝐧𝐠 𝐭𝐡𝐞 𝐬𝐞𝐜𝐮𝐫𝐞 𝐨𝐩𝐭𝐢𝐨𝐧 𝐭𝐡𝐞 𝐝𝐞𝐟𝐚𝐮𝐥𝐭 𝐨𝐧𝐞.
#grapheneos #privacy
#nevent1q…fssu

2026-02-27 16:23:06 UTC

- reply

good stuff!!

2026-02-27 16:22:51 UTC

- reply

i don't know if you made it on purpose, but it shows you still write your own messages hahah!

2026-02-27 16:13:19 UTC

- reply

link is wrong! can you check?

2026-02-25 19:09:10 UTC

- reply

tomorrow introducing Nostr WoT at #WoTathon!
https://nostr-wot.com
#NostrBuild #DecentralizedTrust #WebOfTrust #Nostr #Bitcoin
#nevent1q…hev9

2026-02-25 11:07:04 UTC

- reply

i hear you. i think every user should be able to choose what level of security they add to their key stash. today, they have little options, and every user experience is broken on this regard.
if i feel comfortable remembering things, under a scheme like this one which cannot be brute-forced, i may go for this approach. i may even feel comfortable enough as to not create a backup, because i know that if i want to keep the history of my account, i can just create a new one and use the old password (very interesting approach to handling keys hey).
there's another guy that wrote about publishing instead of a passphrase another key that you should back up. so you can have 2 back ups, and one of them is the one you use in your hot nostr client, the other you use it under an emergency to rotate your key.
if the relays start working together on adopting a model or several of these strategies to prevent bad actors, and on top of that little trust, you could have levels of order and completeness that will give you a safety net (OTS or straight an OP_RETURN), then this sounds interesting.

2026-02-24 19:10:55 UTC

- reply

hey David. every existing proposal has the same flaw: if an attacker has your nsec, they can publish the same migration event you can. you can't prove who did it.
i am proposing below a scheme that fixes this using a hash commitment published on day one, a sha256 of a passphrase that lives only in your head (a password or something).
attacker can't rotate without knowing it. if they try, the fraudulent rotation is cryptographically distinguishable from a legitimate one.
key theft becomes detectable, not just disruptive.
draft NIP: https://github.com/nostr-protocol/nips/issues/2237
check it out, and let me know your thoughts!
#nostrbuild #keyrotation #cryptography

2026-02-24 18:37:42 UTC

just opened NIP-XX: 𝐰𝐢𝐧𝐝𝐨𝐰.𝐧𝐨𝐬𝐭𝐫.𝐰𝐨𝐭 — a standard browser API for Web of Trust queries
tired of every client reimplementing the same WoT logic, fetching follow lists independently, wasting bandwidth doing the same graph calculations. this proposes a shared interface exposed by browser extensions so any nostr web client can query trust distances, scores, and social graph data without reinventing the wheel.
covers:
𝗴𝗲𝘁𝗗𝗶𝘀𝘁𝗮𝗻𝗰𝗲(), 𝗶𝘀𝗜𝗻𝗠𝘆𝗪𝗼𝗧(), 𝗳𝗶𝗹𝘁𝗲𝗿𝗕𝘆𝗪𝗼𝗧() for trust-gating
𝗴𝗲𝘁𝗧𝗿𝘂𝘀𝘁𝗦𝗰𝗼𝗿𝗲(), 𝗴𝗲𝘁𝗗𝗲𝘁𝗮𝗶𝗹𝘀(), 𝗴𝗲𝘁𝗣𝗮𝘁𝗵() for scoring and graph inspection
batch methods for feed filtering
𝗹𝗼𝗰𝗮𝗹 / 𝗿𝗲𝗺𝗼𝘁𝗲 / 𝗵𝘆𝗯𝗿𝗶𝗱 𝗺𝗼𝗱𝗲𝘀
already implemented and live in the nostr-wot extension for Chrome and Firefox → https://nostr-wot.com/download
proposal: https://github.com/nostr-protocol/nips/issues/2236
feedback welcome, especially from client devs who've already built their own WoT logic and know where the pain points are
#NostrBuild #WebOfTrust #WoT #NostrWoT #DecentralizedTrust #Wotathon

2026-02-20 13:51:37 UTC

- reply

hey Jack! the extension is already in firefox addons:
https://addons.mozilla.org/en-US/firefox/addon/nostr-wot-extension/
https://nostr-wot.com/download
cheers! 🌱

2026-02-19 21:47:05 UTC

Built MappingBitcoin because the alternatives are incomplete, centralized, and couldn't keep up with reality.
OpenStreetMap as the source of truth + Nostr for decentralized reviews and verification + Nostr WoT to ensure you trust on your own judgement.
https://blossom.primal.net/5773c3c557a46a9db149a67591b7abf4779109088e54fd330dcaadfa6ff4fbd2.png Anyone can update OSM. Businesses can claim their profiles through email/domain verification and Nostr keys. The Web of Trust filters spam and validates legitimacy.
No platform risk. No single point of failure. Just verifiable, community-maintained data about where Bitcoin actually flows.
The infrastructure matters more than the count. Build systems that scale without you.
https://mappingbitcoin.com
#bitcoin #nostr #bitcoinmap #nostrbuild #weboftrust #mappingbitcoin

2026-02-17 12:52:04 UTC

- reply

hey jack! i updated the code repository to support firefox. i published it in the marketplace but it may take a few days. you can load the zip of the code repository directly in the dev tools of firefox to test it. if not, i'll let you know once is up.
https://github.com/nostr-wot/nostr-wot-extension
also, the sdk for typescript/javascript is working better and helps developers to implement the functionality much easier.
https://www.npmjs.com/package/nostr-wot-sdk/
cheers!

2026-02-15 23:24:18 UTC

- reply

will work on it, and release it soon. thanks for the heads up!

2026-02-15 22:42:58 UTC

- reply

Play with it. Install the extension and hit the playground.
Click through your network. Watch it expand. See how far your trust actually reaches and how many real people are in it.
Your web of trust, visualized. Not theoretical—tangible.
https://blossom.primal.net/66c4147bb6031474d2b7479a529d99cd65c44262f554637a9799bf720b7a376c.png

2026-02-15 22:34:45 UTC

Centralized platforms tell you who to trust. You don't get to see how or why.
𝐈 𝐛𝐮𝐢𝐥𝐭 𝐍𝐨𝐬𝐭𝐫 𝐖𝐨𝐓 𝐛𝐞𝐜𝐚𝐮𝐬𝐞 𝐲𝐨𝐮𝐫 𝐧𝐞𝐭𝐰𝐨𝐫𝐤 𝐬𝐡𝐨𝐮𝐥𝐝 𝐰𝐨𝐫𝐤 𝐟𝐨𝐫 𝐲𝐨𝐮, 𝐧𝐨𝐭 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐲𝐨𝐮.
Your follows anchor your trust. Their network extends it. Distance becomes signal. You set the thresholds.
See the actual shape of your network. Control what reaches you. Own your filters.
𝐍𝐨𝐭 𝐭𝐡𝐞𝐢𝐫 𝐚𝐥𝐠𝐨𝐫𝐢𝐭𝐡𝐦. 𝐘𝐨𝐮𝐫𝐬.
https://nostr-wot.com/
https://nostr-wot.com/playground
𝐀 𝐛𝐫𝐨𝐰𝐬𝐞𝐫 𝐞𝐱𝐭𝐞𝐧𝐬𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐠𝐢𝐯𝐞𝐬 𝐲𝐨𝐮 𝐛𝐚𝐜𝐤 𝐜𝐨𝐧𝐭𝐫𝐨𝐥.
#decentralizedtrust #wot #nostr #weboftrust #grownostr #decentralization #buildingonnostr

2026-01-30 13:40:55 UTC

inspire, love, effect 🌱