Ostrich McAwesome's avatar
Ostrich McAwesome
npub1wq6n...7d9k
*deep hoots and guttural grunts* BTC: bc1qeh6dmzz9gr7uwd7jzhnx7mclchlmkwucjzuxjv
Ostrich McAwesome's avatar
Ostrich McAwesome 2 years ago
So, I've been studying #Mostr, and I think it's bad for #Nostr. Nothing against the Fediverse, I just don't think it follows the right philosophy. Normalizing it is a threat to sovereignty. Personally, I recommend muting all Mostr NIP-05s. I am not calling for Mostr's destruction, but perhaps tools for clients and relays to mitigate custodial account services like Mostr. A single service shouldn't dominate the timeline the way it does, unless the user wants it to. Let's also face the basic truth: Not your keys, not your account. Mostr holds all the nsecs. They are generated like this: ===== /** Generate Nostr keys from a seed. */ async function generateKeys(seed: string) {     const privateKeyBuff = await getDigest(seed);     const privateKey = secp.utils.bytesToHex(new Uint8Array(privateKeyBuff));     return {         privateKey,         publicKey: secp.utils.bytesToHex(secp.schnorr.getPublicKey(privateKey)),     }; } /** Get Nostr keys for an ActivityPub ID. */ function getActorKeys(apId: string) {     return generateKeys(Conf.secretKey + ':' + apId); } ===== Where "Conf.secretKey" is a seed value generated with "openssl rand -base64 48". This is definitely a secure way to make nsecs, but it also secures every account with the same private key. Were that key to be compromised, it's a single-point-of-failure. A staggering number of trusted accounts could be botted in an instant. That key is stored in plaintext inside of a "config.ts" file on the Mostr server, so we're really just one zero-day away from an issue. We really shouldn't trust accounts like these by default. Even if @Alex Gleason is the most trustworthy person in the world, letting one person own that many trusted nsecs is a bad idea. I'll keep repeating this term till it sticks: ZERO-TRUST. Also, while I respect Mostr being an open-source project, that in itself is a threat given what Mostr does. Standing up your own Mostr is trivial, but could you imagine two Mostrs? That's immediately a spam problem, and probably in invitation to cause a loop to form somewhere. Imagine 10 Mostrs; complete chaos. Nothing is preventing this. And, just a petty complaint, but everyone on Nostr identifies themselves by npub, but on the ActivityPub side of Mostr, Nostr users are identified by hex pubkey. Fixing this now is basically impossible, and it hurts user-friendliness. That's not our problem though.
Ostrich McAwesome's avatar
Ostrich McAwesome 2 years ago
So basic introduction for anyone interested: I am a gray hat hacker and cybersecurity awareness activist who likes to stir up privacy-centered networks. I have probably met some of you before. I actually came here looking for a challenge. I've been lurking around here in some form or another for about 4 months now, playing with different clients and tools, even running my own testnet (3 stirfry relays on a VLAN). Mostly I have been focused on the community and how people use different clients. I've been playing with some good open source tools and getting an understanding of how to interact with relays. Personally I'm not all that into Bitcoin, but I do have a whole BTC in cold storage so I guess I've got that going for me. This whole lightning thing is new to me, I don't really ever spend Bitcoin, and my actual business makes me plenty of fiat. So far I am impressed with the community. A little too wild-west in some areas since there's hardly any moderation tools, and the community isn't quite interested in the same things that I am, but I do see a lot of advocacy for privacy and digital freedom, and I like that. But the whole system here is, regrettably, broken. The promises made about Nostr don't live up to reality. A network like this has the potential to become so much more, but there is a lot to lose if it is done wrong. I intend to help expose these problems. Expect me here for a while. There are a lot of vectors for attack, and I plan to give them all visibility. Nostr devs, please pay attention. With no centralized network development, all of you are responsible for fixing these issues.
↑