A not-so-short note on spam and the outbox model:
TL;DR: Even if spammers can’t write to your inbox relays, you will still see spam in the replies to other users’ notes in Nostr clients that have implemented the outbox model.
Not so long ago, it used to be pretty easy to hide spam from view. Back then, Nostr clients only ever read from the relays that the user had set as their "read relays." That meant a user could simply select relays that restricted who could post to them, such as WoT and paid relays, and remove any public relays from their read relays to have a spam-free Nostr experience.
However, this resulted in users missing a lot of posts and replies from other legitimate users, because they weren't reading from the relays that those users were writing to. It also had a centralizing effect on relay selection, because you needed to be writing to one or more of a few popular relays to have any hope that people would see your posts, even if they were following you. You might write to a few other relays as well, but they acted primarily as a backup for your notes.
In answer to this, the outbox model was developed, in the hopes of encouraging relay decentralization. Under this model, Nostr clients no longer just connect to the relays you have listed as "read relays," now called "inbox relays." Instead, they connect to relays that other users you are following have listed as their "outbox" or "write relays" in order to fetch their notes and populate your feed. This means all users can select a variety of relays and expect that their followers will still see their notes. There is no advantage to writing to popular relays, because Nostr clients will pull your notes from any relay listed in your “outbox” relay list, even a very small personal relay, to populate your followers’ feeds with your notes.
The outbox model also inspired the creation of the additional relay list for “blocked relays” so that users could retain some level of control over what relays the client was connecting to.
That’s all well and good for populating a user’s main feed, since the Nostr client is still only reading from relays that were selected by the user’s follows. But what about replies? If Alice posts a short text note, and Bob replies to her note, but Alice is not following Bob, how will she see that there is a reply? The answer is, assuming that Bob is using a Nostr client that has implemented the outbox model, his reply will be written not only to his own “outbox” or “write relays,” but also to Alice’s “inbox” or “read relays,” that way Alice will see the reply, despite the fact that she is not following Bob.
This on it’s own does not result in a loophole for spammers, because Alice can still set inbox relays that don’t allow just anyone to write to them. As long as her Nostr client is ONLY looking for replies to her notes on her own inbox relays, and she has only selected relays that spammers can’t write to, then she will not see spam replies to her own notes.
Here’s where the spam issue creeps back in again, though: What about Charlie, who follows Alice, and wants to see the replies to her latest note? What relays will Charlie’s Nostr client connect to in order to find those replies, assuming he is using a client that has implemented the outbox model? It won’t be his own inbox relays that he has selected himself, because there is no reason to expect that replies to Alice’s post will have been written to Charlie’s inbox relays. Rather, Charlie’s client will fetch replies to Alice’s post from her list of inbox relays. If Alice has selected quality relays that don’t let spammers write to them, then Charlie won’t see any spam replies. However, if Alice has any public relays in her list of inbox relays, then Charlie will see any spam replies that were sent to those relays, even though he has no public relays in his own relay list.
So, you can still pretty easily control whether you see spam replies to your own notes, but it is very difficult to control whether you see spam replies to other users’ notes. Your primary recourse is to make liberal use of the “blocked relays” list to prevent your Nostr client from reading from relays that are known to house spam.
There are a few issues with this approach, though. First, not all Nostr clients support the blocked relays list, so you will still see spam on those clients. Second, some clients encrypt the entries that are added to this list, and most other clients don’t support that encrypted data, even if they support blocked relays lists. Third, this becomes a game of whack-a-mole, where you have to keep adding more and more relays to the list when you discover they contain spam.
Perhaps the better way forward for reducing spam is for clients to have their own spam mitigation features. Wisp and Dark Wisp have this in the form of the nspam filter, which often needs to be retrained to be able to identify the latest forms of spam. Other clients take a bit more straightforward approach by allowing users to hide any posts from anyone outside the user’s Web-of-Trust. The downside to this is it disadvantages new users who have not yet made it inside other users’ social graphs. Another option that could be used in conjunction with this, now that more clients offer the option of adding proof-of-work to your posts, is to hide any posts from anyone outside the user’s WoT, unless the post contains at least X amount of PoW, that the user can adjust to their preference.
The downside to this is that the client would still be downloading the spam posts and just not displaying them to the user, which uses unnecessary bandwidth and likely cellular data for users on mobile phones. But as has often been said, there aren’t really any solutions; only trade-offs.
