In Alby, when first signing a Nostr event for a new domain, it offers some beginner-friendly options for how paranoid you want to be about signing. One of them is "Let's be reasonable".
Apparently, someone thought it's reasonable to allow arbitrary apps to auto-sign kind 1 events, which I find entirely unreasonable. So, if you also use that extension for Nostr, and you also don't want some vibecoded thing to auto-post to your timeline, here's your warning.
Râu Cao ⚡
npub1ra…gdees
2026-08-21 14:02:51 UTC
Author Public Key
npub1raustrrh5gjwt03zdj8syn9vmt2dwsv9t467m8c3gua636uxu89svgdeesPublished at
2026-08-21 14:02:51 UTCEvent JSON
{
"id": "baef378261866501d8a8b6ce3a0b31ae68e3a24c0ba95d8e667ebd5f473f0b5a",
"pubkey": "1f79058c77a224e5be226c8f024cacdad4d741855d75ed9f11473ba8eb86e1cb",
"created_at": 1787320971,
"kind": 1,
"tags": [
[
"client",
"noStrudel",
"31990:266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5:1686066542546"
]
],
"content": "In Alby, when first signing a Nostr event for a new domain, it offers some beginner-friendly options for how paranoid you want to be about signing. One of them is \"Let's be reasonable\".\n\nApparently, someone thought it's reasonable to allow arbitrary apps to auto-sign kind 1 events, which I find entirely unreasonable. So, if you also use that extension for Nostr, and you also don't want some vibecoded thing to auto-post to your timeline, here's your warning.",
"sig": "5448d26cbe3623e41a6235cfaf7fa6ae48471a3521e853acfb2cea5e2f6a0bd3d6e99c098c10d347fefd9ab4eadf66ce9af061b6c7fbf343179f34fdc3682c29"
}