hodlbod on nostr

Recent Notes

A question to the devs who shipped apps people actually use. And I don’t mean the couple of thousands here on nostr, I mean the outer world. What’s is the most effective strategy to put the word...

hodlbod @hodlbod 1780702348

Figure out who your users are, very concretely

TKay · 5h

Thanks

hodlbod · 9h

hodlbod @hodlbod 1780689535

@fiatjaf @Sebastix @Matt Lorentz please update to 0.2.6 when you have a chance.

hodlbod

@hodlbod 1780689506

NB: yesterday I discovered a flaw in pomade which allows a malicious client (with an authenticated/trusted session) to exfiltrate private key material due to nonce re-use.

In practice, because clients are already trusted and frequently hold keys anyway, I don't think anyone is affected in practice (the only integration I'm aware of, Flotilla, doesn't execute this attack). However, if you run a pomade signer, please update ASAP.

A two-stage upgrade process is available if you are running in production and have active clients:

1. Upgrade your signers to 0.2.6, which are backwards compatible with the vulnerable signing method.
2. Upgrade your clients to 0.3.0, which swaps out the sign method to a RFC-compatible nonce exchange + psig exchange.
3. Upgrade your signers to 0.3.0, which removes the vulnerable signing method.

hodlbod · 9h

nostr:nprofile1qyd8wumn8ghj7urewfsk66ty9enxjct5dfskvtnrdakj7qg6waehxw309aex2mrp0yhrgdrzd9kxc6t0dchxuet59uq32amnwvaz7tmzv9ehxurfwd6x7mpwdaexwtcprpmhxue69uhhxurpw35kzttpwf3kzmnp9e3k7mf0qqsrhuxx8l9ex335q7he0f09aej04zpazpl0ne2cgukyawd24mayt8g6ru7df nostr:nprofile1qyd8wumn8ghj7urewfsk66ty9enxjct5dfskvtnr...

fiatjaf · 12h

Because most web pages take years to load one would think it would be a good idea to launch them and switch to doing something else while they load, right? But no, you are wrong. You can't do that be...

hodlbod @hodlbod 1780687459

Peak UX

Ben Arc · 16h

This is interesting. We had a takedown request for a post on our njump. We do not host the content, it is pulled from relays using the note id, so it's a bit like blaming a browser for the content aft...

hodlbod @hodlbod 1780667954

My guess would be that it's the responsibility of the relays who host it. But litigating that might get expensive.

daniele · 1d

Really cool! I was just thinking to build something like that for the project I talked you about. I really think I'm going to steal it from you.

hodlbod @hodlbod 1780607116

Please do, and if you have any fixes or improvements (particularly alternative relay implementation support), please do send patches

❤️1

atyh · 1d

bummer. i thought you had come up with some novel community centered way of using gitea. or maybe you did but they didnt tell you

hodlbod @hodlbod 1780605394

😂

🤙1

Tyler · 1d

Is Primal a nostr app?

hodlbod @hodlbod 1780603513

yes

atyh · 1d

nostr:npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn your gitea instance has some unusual repos. are you using it as a backend for something? just curious 🤷

hodlbod @hodlbod 1780603507

Thanks for telling me, it looks like I have some spammers at work 😑

1🤙1

atyh · 1d

bummer. i thought you had come up with some novel community centered way of using gitea. or maybe you did but they didnt tell you

hodlbod

@hodlbod 1780595457

Ironically, this is not great for decentralization. But people want users, and users want convenience. I'm doing it the best way I can — FOSS and protocol-first.

hodlbod @hodlbod · 2d

Just released: Coracle Hosting! https://hosting.coracle.social This is me trying to make money on open source. You can now PAY ME to get a HOSTED community relay by visiting https://hosting.coracle.social. https://hosting.coracle.social is powered by https://gitea.coracle.soci Show more