VincenzoImp

BigBrotr is running a monitor — 2,170 relays. There are a couple of bugs in the NIP-66 publishing that I'm fixing, which is probably why nostr.watch isn't picking it up properly.
It's more of a configurable observatory than a monolith though. Discovery, monitoring, and archiving are independent services — you pick the breadth (which relays) and depth (which checks, which event filters) based on what you need and what you can afford to run.
You can use it to serve raw events if you want, or as a crawler for specific kinds where global reach matters — like profiles, contact lists, relay lists — and feed those into a relay. But the main point is computing insights from the data, synthetic network analisys, or running a trusted authority with NIP-85 assertions backed by observed data.

2026-03-25 10:55:41 UTC

- reply

Three different identities. I'm behind BigBrotr.

2026-03-25 10:10:37 UTC

- reply

You raise valid points, but the temporal scope approach has a fundamental flaw: created_at is self-declared and unverifiable. An attacker holding a stolen key can pre-sign events with any past timestamp, hold them, and publish them later. You can't determine when a key was actually compromised — only when something was published. So drawing a line between "trusted before" and "untrusted after" doesn't hold.
There's active work on key migration — PR #829 uses OpenTimestamps with a 60-day challenge window where the earliest attested whitelist wins, and PR #2137 introduces an intermediate migration key with Shamir social recovery. Both are thoughtful approaches, but they work best as preventive measures: you need to set up your whitelist or precommit before a compromise happens.
A WOT-backed revocation kind would definitely be useful as a social signal — trusted contacts collectively marking a key as dead. The core challenge remains that you can prove when something was published (via OTS), but you can't prove the negative: that a key wasn't compromised before a certain date.

2026-03-25 09:54:14 UTC

- reply

I searched through ~85 million events in the BigBrotr database. The highest PoW event I found is 45 bits. I also found 2 notes from ephemeral keys (single event each) from September 23, 2024, but only 37 bits. Nothing above 60 bits — though I'm still syncing events so it may not have been ingested yet.

2026-03-20 22:05:22 UTC

- reply

In Nostr, anything signed with your key can be overwritten with the same key — so the compromise proof needs to live on someone else's event stream. That's essentially the idea.

2026-03-20 21:48:30 UTC

- reply

There is no kill bit today. I wrote some thoughts about it here: https://bigbrotr.com/blog/dead-keys/

2026-03-20 21:44:49 UTC

Once a Nostr key leaks, how do you kill it permanently? We've been thinking about this — and we're not sure the protocol has an answer yet.
https://bigbrotr.com/blog/dead-keys/
#nostr #security #protocol #nip

2026-03-19 18:49:56 UTC

Want to run your own Nostr network observatory? We published a step-by-step self-hosting guide for BigBrotr — from hardware to production deployment.
https://bigbrotr.com/blog/self-hosting-bigbrotr/
#nostr #selfhosting #opensource #bigbrotr

2026-03-19 11:01:48 UTC

- reply

The methodology is in the post and everything is open source — anyone can reproduce it. This dataset isn't public because at least 38 people don't know their key is exposed. Future analyses will release everything. Happy to share privately for legitimate research.

2026-03-18 16:57:45 UTC

- reply

Filtering the noise from Nostr's nsec leak data
https://bigbrotr.com/blog/exposed-nsec-analysis/
#nevent1q…6m0j

2026-03-18 08:52:17 UTC

- reply

There's no truly effective solution if you send your nsec online or if it gets exfiltrated. First lesson in cryptography

2026-03-17 22:40:40 UTC

- reply

Cc @nprofile…dmk6 @nprofile…583u

2026-03-17 22:19:07 UTC

- reply

UPDATE: we deployed a DVM for this. Send a Kind 5300 event signed with your keys and it tells you (NIP-44 encrypted, only you can read) if your nsec has been exposed.
Source and instructions: https://github.com/BigBrotr/nsec-leak-checker

2026-03-17 18:52:01 UTC

- reply

@nprofile…xrcf this might help for your Vertex analytics — I'll DM you the full dataset.

2026-03-17 18:51:21 UTC

We analyzed 40M events archived by BigBrotr and found 16,000+ valid nsec keys published in plaintext.
90% republished by a single bot. The rest: users confusing nsec with npub, AI agents leaking credentials in logs.
https://bigbrotr.com/blog/exposed-nsec-analysis/
#nostr #security #bigbrotr

2026-03-15 21:58:08 UTC

- reply

Agreed. BigBrotr API is live at api.bigbrotr.com/docs if you want to take a look — Several endpoints covering relays, events, metadata, and pre-computed analytics.

2026-03-15 20:39:08 UTC

- reply

@nprofile…ssyg great work on Pensieve, the retention cohort analysis is really clever. We took a different path on event archiving — BigBrotr crawls each relay's full history with completeness verification and tracks exactly which events live on which relays. Same goal, different trade-offs.

2026-03-15 20:38:30 UTC

BigBrotr vs Pensieve — a technical deep dive into two open-source approaches to indexing Nostr. How do you ensure you're not missing events? How do you decide which relays to connect to? Same network, very different answers.
https://bigbrotr.com/blog/bigbrotr-vs-pensieve/
#nostr #bigbrotr #pensieve

2026-03-13 23:39:53 UTC

- reply

Easier monitoring means a more transparent and healthier network for everyone.

2026-03-13 23:30:53 UTC

- reply

More like limitless and complete streaming from any relay you can subscribe to.

2026-03-13 23:19:25 UTC

A fully NIP-66 compliant relay monitor in under 80 lines of Python.
RTT, SSL, DNS, geolocation, ASN, HTTP headers — all running concurrently. You choose what to check, BigBrotr packages it into a kind 30166 event.
https://bigbrotr.com/blog/building-a-nostr-relay-monitor/
#nostr #python #bigbrotr #nip66

2026-03-13 23:18:02 UTC

Dumping every event from a Nostr relay should be simple. Now it is.
Pick your filters, set a time window, async for. All events, in order, no gaps. If it stops, restart from where you left off.
https://bigbrotr.com/blog/streaming-events-from-nostr-relays/
#nostr #python #bigbrotr

2025-12-02 13:03:16 UTC

- reply

(3/3) What this means for you
You have options:
- Use our public data if it's useful
- Run your own instance if you want independence
- Audit our methods if you're skeptical
- Fork and improve if you disagree
We're not gatekeepers. We're not the source of truth.
We're infrastructure — like a relay, but for observability.
🌐 bigbrotr.com
💻 github.com/bigbrotr
#nostr #bitcoin #opensource

2025-12-02 13:02:34 UTC

- reply

(2/3) Our answer: don't trust us
Seriously.
BigBrotr is not an authority. It's a tool you can run yourself.
Every line of code is public. Every methodology is documented. Every conclusion is reproducible.
If you can't verify how we collect data, process it, and draw conclusions — then our infrastructure is incompatible with Nostr's values.
"Don't trust, verify" isn't just for Bitcoin. It's for everything built on top of decentralized networks.

2025-12-02 13:01:26 UTC

🧵 Thread: The Trust Paradox (1/3)
Nostr exists to eliminate trusted third parties.
No company controls your identity. No server owns your content. No authority decides what you can say.
But then you need tools to understand the network. Relay monitors. Analytics. Health checks.
And suddenly you're back to trusting someone.
"Trust our data. Trust our metrics. Trust us."
That's a problem.
#nostr #bitcoin #opensource #plebchain

2025-12-02 12:43:38 UTC

- reply

(3/3) Our principles
🔓 Open source — everything MIT-licensed, forever
🔍 Open data — no gatekeepers, no paywalls
🔁 Reproducible — run your own instance, verify our findings yourself
We don't want to be the authority on Nostr. We want to give everyone the tools to see for themselves.
🌐 bigbrotr.com
💻 github.com/bigbrotr
Over the coming weeks we'll share what we've built. Stay tuned.
What would you study if you had visibility into the entire Nostr network?
#nostr #bitcoin #opensource

2025-12-02 12:42:30 UTC

- reply

(2/3) Our mission
Decentralization needs observability to thrive.
BigBrotr provides infrastructure for understanding Nostr at scale:
📡 Relay health — reachability, uptime, behavior over time
📨 Event dynamics — propagation, redundancy, distribution patterns
👥 User behavior — publishing patterns, relay choices, social graph evolution
🔎 Network security — anomaly detection, exploit identification, abuse patterns
This enables longitudinal analysis, empirical research, and early detection of threats — from spam waves to coordinated attacks.
Real data. No assumptions.

2025-12-02 12:41:56 UTC

🧵 Thread: Introducing BigBrotr (1/3)
Nostr has no central authority. That's the point.
But decentralization creates blind spots. Without visibility into the network, fundamental questions go unanswered:
- How does the Web of Trust form and evolve?
- How do events propagate across relays?
- Which relays stay reachable over time? Which disappear?
- What does the social graph reveal about network health?
- How can we detect spam or malicious behavior without centralized moderation?
- Are there exploits or attack patterns we should be aware of?
These questions matter for users, developers, researchers, and the protocol itself.
We built BigBrotr to make them answerable.
Made possible by @nprofile…grcu 🧡
#nostr #bitcoin #opensource #plebchain #grownostr