Damus
fiatjaf · 154w
Please do not accept invalid events in your client. Do not accept non-integer "created_at" values, do not accept non-string-array on "tags", do not accept bech32-encoded keys as tag values. Every time...
Hafeez profile picture
Your article doesn’t really capture how bad it gets. It assumes good intent - but there is an adversarial scenario that comes about the same way. I have bad memories from the browser wars, where ms did the same thing with IE. The problem is you need one well funded party with malintent to cause convergence on the client and pass the overhead on to others who simply can’t keep up. We have to protect the protocol and adherence as religiously as bitcoin.
fiatjaf · 154w
Yes, but how?