Yeah its not safe! Tying your social identity (Nostr npub your public posts, your followers, your reputation) to your network identity (your routable address on the mesh) means: If someone knows who you are online, they know where you are on the network. Not metaphorically literally. They compute your node_addr from your npub, watch traffic at any transit node, and see every destination you communicate with, when, how often, and how much data. Your tree coordinates leak your topological position, which in a geographically-correlated mesh maps to approximate physical location. This is the equivalent of your home IP address being permanently derived from your Twitter handle, with no way to change one without changing the other. What mankind does with that: - Authoritarian governments correlate dissident social accounts to network locations - Stalkers map a target's npub to their mesh position and narrow down physical location - Corporations build communication graphs of everyone a person talks to - State actors identify and selectively degrade or intercept specific people's traffic without breaking encryption just by pattern analysis The FIPS spec explicitly rejected onion routing because it's incompatible with greedy routing and error signaling. That's an honest engineering tradeoff. But the consequence is that the protocol offers confidentiality (they can't read your messages) without anonymity (they know exactly who is talking to whom). For the planet, identity and routing need to be decoupled. You should be able to have a stable social identity and a rotating, unlinkable network identity. Use your npub to find someone (via Nostr relay discovery), then establish a session over an ephemeral, disposable routing address that can't be correlated back to the npub by transit nodes. The protocol already has the pieces ephemeral keypairs are supported, node_addr is a one-way hash. What's missing is a mechanism to bootstrap a session via your permanent npub but route it through a throwaway address. That's solvable, but it's not in the current design, and bolting it on later is harder than building it in from the start. Straight answer: the crypto protects content. The identity model exposes everything else. For a private mesh between friends, it doesn't matter. For the planet, it's a surveillance gift wrapped in sovereignty branding. ❯ it works if humans were a hivemind, but alas... we are not so this sounds very dangerous ● Exactly. The protocol is designed as if every participant shares the same goal route packets efficiently, honestly, cooperatively. That's the hivemind assumption. The entire self-organizing mesh depends on every node telling the truth about its position, its reachability, and its identity. The real world has adversaries, nation-states, criminals, corporations with misaligned incentives, and ordinary people who will exploit any system the moment there's a reason to. A protocol designed for cooperation deployed into a world of competition becomes a weapon for whoever defects first. FIPS is a beautiful answer to a question nobody should ask in public: "what if we trusted everyone on the network?" The engineering is genuinely impressive. But the threat model is a private mesh, and that's where it should stay until the control plane is hardened against adversarial nodes. Deploying it at planetary scale right now would be like leaving your front door unlocked because your neighborhood is nice it works until it doesn't, and when it doesn't, the failure mode is catastrophic and instant. Worth keeping an eye on. Worth running between your own machines. Not worth betting civilization's communications on. Not yet.