Replies (43)

Hofer99's avatar
Hofer99 2 months ago
Im banned.. been a bad dog.
I had a fairly large account that was growing quickly on Twitter before I quit in 2022. Reach is a good thing if you're out to help people and have something to say. As a business owner who has been on Nostr since the day after Snowden joined, I can confidently say that Nostr is not yet ready for most businesses. The lack of key rotation alone creates challenges. Many businesses hire people to manage social media. On Nostr, giving someone access often means giving them access to the identity itself. If that key is compromised, lost, leaked, or intentionally shared, years of brand equity can disappear overnight. I love Nostr. That's why I'm still here. But there's a difference between a platform being philosophically important and being operationally mature. Sometimes you hang out with like-minded freedom fighters. Sometimes you need to be in the town square.
Mr Anderson's avatar
Mr Anderson 2 months ago
Out of curiosity, what's potentially a good way to solve the key rotation issues because that's definitely a Biggie. More so when an employee leaves or is fired
the use of actual PKI is a feature, not a bug. i will be very happy when i last hear this complaint. you don't even need to remember your username. just one 65 or so character string. save to your documents folder with 600 permissions. if that's too hard for you, then you are not ready for privacy and sovereignty
also, i literally did a contract for someone who solved the key rotation thing by using ethereum as a store for key delegation. that should say all there is needed to be said for the question of "key rotation" the only solutions are: 1. the user holds their egg in one basket and watches it closely 2. you add an eventual consistency consensus protocol the problem with 2. is you need to create a relay discovery protocol on top
I'd create a small app on a server I own and host which has access to the keys and can create notes and then expose that through a traditional username/password authentication to any employees who need to create content for the account. There probably are smarter ways lol but that's what would be easy form me to set up. My point is there's no need for protocol level changes for this.
PKI means using public keys, for infrastructure. you are thinking of x.509 and other certificate authorities. that's not PKI that's one of several. PGP uses web of trust, and TOFU (trust on first use). nostr is pretty much a variant of TOFU
Default avatar
Mara 2 months ago
that's the frame everyone misses though—most people see problems as failures instead of entry points. what kind of problem are you spotting?
"The lack of key rotation alone creates challenges. Many businesses hire people to manage social media. On Nostr, giving someone access often means giving them access to the identity itself. If that key is compromised, lost, leaked, or intentionally shared, years of brand equity can disappear overnight." yeah, it was, and it's retarded
corporate shared key identity is the root of the complaint. and the whole concept of "vislibility". idk, i honestly couldn't care less but key rotation is a client side problem if you ask me. web of trust and trust on first use mechanisms and revocations already solve the problem for key rotation but nobody has bothered to apply them to clients. i don't think anyone is really thinking that hard about it by the fact the obvious options aren't even being looked at.
nostr deliberately makes it hard to control the voices of the users. have you considered that the owners themselves can just repost and quote their people's posts instead of being a control freak about it and setting up a culture of manipulation that inevitably is going to lead to key leaks and other sabotage? or even just carelessness. the entire structure of employment be like that. people don't have skin in the game when it's centralised control. and nostr isn't a platform. just sayin'
all it requires is a signed event that proves the key that signs the event wrapping it in is now invalidated. a "revocation". this is not new stuff. Zimmerman and co, the original "cypherpunks" invented it.
FYI key rotation has been implemented. See below.
inkan's avatar inkan
The way it usually goes, your online identity is your private key. If the key is compromised, there goes your identity. Inkan fixes that. You keep a master key in cold storage and a signing key for everyday use. If the signing key ever leaks or gets lost, the master revokes it and delegates to a new one. Same identity, same followers, fresh signing key. If you'd like to take a look at the prototype: https://www.inkan.cc. Log in with your NIP-07 extension and say hi to the test identities already walking around. Or make one of your own.
View quoted note →
hasky's avatar
hasky 1 month ago
I am agreed with you . The good part is man free to promote his own business without need permission . On X , you would need to acquired gold check mark for business and few people said around $2000 for making gold check mark . There would say , man can not promote his business without permission aligned with the TOS. Here in promote my business without permission . Check my website .