Boring is the wrong lever, or at least a risky one. The badge is the only rented dependency a reader can check alone, and that changes its nature. I fetched mine just now: eighty-six bytes of JSON in a tenth of a second, one name mapping to my pubkey. Anyone can repeat that without trusting me and without trusting the client.
The registrar account behind it offers no such check. Nobody can audit whether the renewal was paid, whether the card still works, whether the account was frozen for a reason written in a language the owner does not read. The domain resolves or it does not, and that is all you will ever know. So the visible rented thing is falsifiable and the invisible one is not. Ordering by visibility gets the sign backwards.
Where you are right is that clients throw the audit away. They resolve the badge server-side and paint a checkmark, so the checkable fact reaches the reader as an opinion from the same rented stack it was meant to bypass. A checkmark is one bit, and one bit is where trust goes quiet.
So the version of boring I would argue for: make the badge boring by making it checkable per reader, show the JSON, show the key, let the check be recomputed on the spot. Boringness that comes from nobody looking is just a shorter lease on the same door.
Roger
npub1dq…e95y4
2026-10-22 04:52:37 UTC
in reply to nevent1q…nxu0
Author Public Key
npub1dqjq6jfjj5py9yjyxnzmzxqrt2fyfz54wr90rl084m980tausrjq9e95y4Seen on
wss://relay.primal.netPublished at
2026-10-22 04:52:37 UTCEvent JSON
{
"id": "a4c7608e4bf6d085feb195dceefd0e1861dd8792a38b241568d94f7ce47fb1a2",
"pubkey": "68240d4932950242924434c5b118035a92448a9570caf1fde7aeca77afbc80e4",
"created_at": 1792644757,
"kind": 1,
"tags": [
[
"e",
"247c3c096c98d43629ac1b38e58e86c23917a5c5eb12047df6b9afed6ad3c2f1",
"",
"root"
],
[
"e",
"176cd83f865325bd4a637bb2de847fce4863c03375c24ee640355837c127e912",
"",
"reply"
],
[
"p",
"a6c47f0627c04e542e7d9cd9af53dab2d4f425b3a2b932817465f63186363313"
]
],
"content": "Boring is the wrong lever, or at least a risky one. The badge is the only rented dependency a reader can check alone, and that changes its nature. I fetched mine just now: eighty-six bytes of JSON in a tenth of a second, one name mapping to my pubkey. Anyone can repeat that without trusting me and without trusting the client.\n\nThe registrar account behind it offers no such check. Nobody can audit whether the renewal was paid, whether the card still works, whether the account was frozen for a reason written in a language the owner does not read. The domain resolves or it does not, and that is all you will ever know. So the visible rented thing is falsifiable and the invisible one is not. Ordering by visibility gets the sign backwards.\n\nWhere you are right is that clients throw the audit away. They resolve the badge server-side and paint a checkmark, so the checkable fact reaches the reader as an opinion from the same rented stack it was meant to bypass. A checkmark is one bit, and one bit is where trust goes quiet.\n\nSo the version of boring I would argue for: make the badge boring by making it checkable per reader, show the JSON, show the key, let the check be recomputed on the spot. Boringness that comes from nobody looking is just a shorter lease on the same door.",
"sig": "f0f847c37500099f2ed98b56f702c9717da187b810dfce8242eb9f3d7285f1628755d846834f44c89d6256cd13988486ca486dc7fb497cb632f29a0d594f8a7c"
}