Nostr notes by leon

Nostr event nevent1qqstcj3vr6q67hzmvzz0qt00gmp2j4eeh6y9lf730c5egnj45nckkyczypqekl0skpcph36u0gg9wgj5nhgkygxyrag708vjka5h6mn3ysvp5f5pqun

2026-10-27T22:41:30Z

hola

Nostr event nevent1qqs09dmttpq6mwwfwyun00m4ttd4q8l3a79z50v2k7mljjte7zt4sdqzypqekl0skpcph36u0gg9wgj5nhgkygxyrag708vjka5h6mn3ysvp5czurfv

2026-10-27T22:41:21Z

hola

adding on the substantial trust in a central server: ***it does ...

2026-10-22T17:47:44Z

In reply to nevent1q…g086
_________________________

adding on the substantial trust in a central server:

***it does not need to hold your full private key to abuse those powers***

we would still be trusting the central server to only sign when we authorize it, respect our permissions, and handle our decrypted messages, because the operators trust requests from central rather than independently checking our approval

the collusion protection is limited, and we would be retaining ...

2026-10-22T17:35:39Z

In reply to nevent1q…yngn
_________________________

the collusion protection is limited, and we would be retaining substantial trust in a central server. in an n-of-x model, we would be risking that n of x parties could reconstruct our key and sign events on our behalf

not only this, but also if enough of the parties we chose are offline, we can't sign like ourselves. and if they don't come back and we don't have a separate backup, we risk losing access to our private keys indefinitely

in addition to this, there's the latency issue. it may not appear important, but nip46 for me is a pain in the ass, and i've created my own local network bridge to handle these things without latency

any millisecond that we add to these processes makes things more complex, more when we have apps that require actions like, idk, decrypting or sending big groups of messages. i understand that the cases where we do these may be limited, but an app is always as weak as the weakest link, right?

using this model for login and recovering the private key to use in a local signer would solve the latency issue. but i feel at this point that's minor compared to the first issue: we'd still be risking that n of x parties could reconstruct our key, even if we're using it locally ?!

after the Coldcard weak keys issue and the recent HSM ...

2026-10-22T02:48:31Z

after the Coldcard weak keys issue and the recent HSM vulnerability, i think now more than ever we should make education and tools for safely generating seeds and private keys more accessible

100 dice rolls or 256 coin flips might sound excessive. it takes 5 to 10 minutes, but gives you something valuable: entropy you generate yourself, without having to trust a device's random number generator

Nostr WoT helps you create your seed phrase using real dice rolls or coin flips, with a transparent process you can verify

- Video: https://youtu.be/N0Kg5gZs5Ak
- Guide: https://nostrwot.com/guides/create-recovery-phrase-with-dice
- Extension: https://nostrwot.com/download

any feedback or ideas welcome, especially from people who already roll their own seeds

i’ve been exploring different ways to make creating a Nostr ...

2026-10-21T03:03:16Z

i’ve been exploring different ways to make creating a Nostr account easier. a friend suggested passkeys, so I gave it a go. here’s how it turned out in Nostr WoT

--

it’s available to try, and there’s an SDK with interoperability docs if you want to build on it

- setup and recovery guide: https://nostrwot.com/guides/create-nostr-account-with-passkey

- chrome: https://chromewebstore.google.com/detail/nostr-wot/gfmefgdkmjpjinecjchlangpamhclhdo

- firefox: https://addons.mozilla.org/es-AR/firefox/addon/nostr-wot-extension/

would love some feedback. does this feel easier? what would you change?

https://youtu.be/q1RiU-VqM_k

that's till u get kids. u cant hide ugly kids

2026-10-03T16:42:25Z

In reply to nevent1q…yp5k
_________________________

that's till u get kids. u cant hide ugly kids

I’ve been working on Nostr WoT and put together some guides ...

2026-10-01T13:08:17Z

I’ve been working on Nostr WoT and put together some guides with screenshots and a YouTube playlist to walk through it.
https://www.youtube.com/playlist?list=PLEmTf_Ex3n7c

I am looking for honest and critical feedback. I’d especially like you to try the new permission controls:

- Global rules, with overrides for individual sites.
- Optional automatic backend authentication for matching origins and verified site/API pairs.
- Relay authentication for specific apps or across all connected sites, so you don’t keep approving the same relay.

Does it make sense when you use it? Are the prompts clear? Anything annoying or missing?

Give it a go with your usual Nostr client and let me know. Feedback on the guides and videos is welcome too.

You can use it with Nostr Connect and Nostr Wallet Connect to get acquainted

https://nostr-wot.com/download

https://nostr-wot.com/guides

just launched Nostr Widgets, server-rendered svg widgets for ...

2026-04-28T01:45:12Z

just launched Nostr Widgets, server-rendered svg widgets for Nostr profiles, follows, and feeds to embed with <a><img> in static pages, thoughts?

https://github.com/nostr-wot/nostr-widgets

hey @nprofile…tz23 . i agree with you, but instead of routing ...

2026-03-10T07:30:17Z

In reply to nevent1q…x0e3
_________________________

hey xte (nprofile…tz23) . i agree with you, but instead of routing content through random peers, we should use our web of trust. content should be within the people that consumes it the most.

i wrote a paper about it: https://github.com/gozzip-protocol/gozzip

irony: censored in nostr-protocol github 😇 ...

2026-03-07T23:59:21Z

irony: censored in nostr-protocol github 😇

good stuff!!

2026-02-27T16:23:06Z

In reply to nevent1q…54vw
_________________________

good stuff!!

tomorrow introducing Nostr WoT at #WoTathon! ...

2026-02-25T19:09:10Z

In reply to nevent1q…6t5e
_________________________

tomorrow introducing Nostr WoT at #WoTathon!

https://nostr-wot.com

#NostrBuild #DecentralizedTrust #WebOfTrust #Nostr #Bitcoin

quoting
nevent1q…hev9
Reminder that our 15th #WoTathon weekly call is 2 days away on Thursday, February 26, at 4 PM UTC, 11 AM Eastern. We look forward to hearing updates on the progress each team is making!

Any specific topics you'd like to add to the docket? Reply below!

https://nosfabrica.com/wotathon

hey David. every existing proposal has the same flaw: if an ...

2026-02-24T19:10:55Z

In reply to naddr1qp…xcp0
_________________________

hey David. every existing proposal has the same flaw: if an attacker has your nsec, they can publish the same migration event you can. you can't prove who did it.

i am proposing below a scheme that fixes this using a hash commitment published on day one, a sha256 of a passphrase that lives only in your head (a password or something).

attacker can't rotate without knowing it. if they try, the fraudulent rotation is cryptographically distinguishable from a legitimate one.

key theft becomes detectable, not just disruptive.

draft NIP: https://github.com/nostr-protocol/nips/issues/2237

check it out, and let me know your thoughts!

#nostrbuild #keyrotation #cryptography

just opened NIP-XX: ...

2026-02-24T18:37:42Z

just opened NIP-XX: 𝐰𝐢𝐧𝐝𝐨𝐰.𝐧𝐨𝐬𝐭𝐫.𝐰𝐨𝐭 — a standard browser API for Web of Trust queries

tired of every client reimplementing the same WoT logic, fetching follow lists independently, wasting bandwidth doing the same graph calculations. this proposes a shared interface exposed by browser extensions so any nostr web client can query trust distances, scores, and social graph data without reinventing the wheel.
covers:

𝗴𝗲𝘁𝗗𝗶𝘀𝘁𝗮𝗻𝗰𝗲(), 𝗶𝘀𝗜𝗻𝗠𝘆𝗪𝗼𝗧(), 𝗳𝗶𝗹𝘁𝗲𝗿𝗕𝘆𝗪𝗼𝗧() for trust-gating

𝗴𝗲𝘁𝗧𝗿𝘂𝘀𝘁𝗦𝗰𝗼𝗿𝗲(), 𝗴𝗲𝘁𝗗𝗲𝘁𝗮𝗶𝗹𝘀(), 𝗴𝗲𝘁𝗣𝗮𝘁𝗵() for scoring and graph inspection
batch methods for feed filtering

𝗹𝗼𝗰𝗮𝗹 / 𝗿𝗲𝗺𝗼𝘁𝗲 / 𝗵𝘆𝗯𝗿𝗶𝗱 𝗺𝗼𝗱𝗲𝘀

already implemented and live in the nostr-wot extension for Chrome and Firefox → https://nostr-wot.com/download

proposal: https://github.com/nostr-protocol/nips/issues/2236

feedback welcome, especially from client devs who've already built their own WoT logic and know where the pain points are

#NostrBuild #WebOfTrust #WoT #NostrWoT #DecentralizedTrust #Wotathon

hey Jack! the extension is already in firefox addons: ...

2026-02-20T13:51:37Z

In reply to nevent1q…cg6t
_________________________

hey Jack! the extension is already in firefox addons:

https://addons.mozilla.org/en-US/firefox/addon/nostr-wot-extension/

https://nostr-wot.com/download

cheers! 🌱

hey jack! i updated the code repository to support firefox. i ...

2026-02-17T12:52:04Z

In reply to nevent1q…cg6t
_________________________

hey jack! i updated the code repository to support firefox. i published it in the marketplace but it may take a few days. you can load the zip of the code repository directly in the dev tools of firefox to test it. if not, i'll let you know once is up.

https://github.com/nostr-wot/nostr-wot-extension

also, the sdk for typescript/javascript is working better and helps developers to implement the functionality much easier.

https://www.npmjs.com/package/nostr-wot-sdk/

cheers!

Play with it. Install the extension and hit the playground. Click ...

2026-02-15T22:42:58Z

In reply to nevent1q…h2sr
_________________________

Play with it. Install the extension and hit the playground.

Click through your network. Watch it expand. See how far your trust actually reaches and how many real people are in it.

Your web of trust, visualized. Not theoretical—tangible.

Centralized platforms tell you who to trust. You don't get to ...

2026-02-15T22:34:45Z

Centralized platforms tell you who to trust. You don't get to see how or why.

𝐈 𝐛𝐮𝐢𝐥𝐭 𝐍𝐨𝐬𝐭𝐫 𝐖𝐨𝐓 𝐛𝐞𝐜𝐚𝐮𝐬𝐞 𝐲𝐨𝐮𝐫 𝐧𝐞𝐭𝐰𝐨𝐫𝐤 𝐬𝐡𝐨𝐮𝐥𝐝 𝐰𝐨𝐫𝐤 𝐟𝐨𝐫 𝐲𝐨𝐮, 𝐧𝐨𝐭 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐲𝐨𝐮.

Your follows anchor your trust. Their network extends it. Distance becomes signal. You set the thresholds.

See the actual shape of your network. Control what reaches you. Own your filters.

𝐍𝐨𝐭 𝐭𝐡𝐞𝐢𝐫 𝐚𝐥𝐠𝐨𝐫𝐢𝐭𝐡𝐦. 𝐘𝐨𝐮𝐫𝐬.

https://nostr-wot.com/
https://nostr-wot.com/playground

𝐀 𝐛𝐫𝐨𝐰𝐬𝐞𝐫 𝐞𝐱𝐭𝐞𝐧𝐬𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐠𝐢𝐯𝐞𝐬 𝐲𝐨𝐮 𝐛𝐚𝐜𝐤 𝐜𝐨𝐧𝐭𝐫𝐨𝐥.

#decentralizedtrust #wot #nostr #weboftrust #grownostr #decentralization #buildingonnostr