hodlbod

Christian Bitcoiner and developer of coracle.social. Learn more at info.coracle.social.

Merch is available at https://geyser.fund/project/coracle/rewards

Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

NIP-05 Address

hodlbod@coracle.social

NIP-57 Address

hodlbod@getalby.com

Profile Code

nprofile1qqsf03c2gsmx5ef4c9zmxvlew04gdh7u94afnknp33qvv3c94kvwxgsprpmhxue69uhkscnj9e3k7unpvdkx2tnnda3kjctvqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hs3jj97s

Publishing to

hbr.coracle.social

relay.damus.io

hodlbod.coracle.tools

Author Public Key

npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn

Show more details

Last Notes

2025-05-23 21:13:52 UTC

- reply

Can't really enforce it on the relay level without sharing the ability to decrypt the events, since sender metadata is obscured on nip 17.

2025-05-23 15:15:48 UTC

Are there any clients out there that have solved the NIP 17 spam problem from a UX standpoint? It would be nice to separate "requests" into requests from reputable people in your network (based on wot or pow) and requests that are unlikely to be worth your time.

2025-05-22 13:41:35 UTC

- reply

Tell your kids they can eat them

2025-05-21 20:29:18 UTC

- reply

There is a list event that gets created, but it's not really surfaced anywhere. In Coracle, pins show up at the top of your profile notes

2025-05-21 13:39:13 UTC

- reply

Yeah, it could definitely be more graceful

2025-05-21 02:43:12 UTC

- reply

The relay implementation is the main problem. But NIP 29 also requires relay support (translating group create/edit into metadata) when it could have been incidental (as it is in NIP 28 as it happens).

2025-05-21 01:55:39 UTC

- reply

Coracle v1 is so back

2025-05-21 01:55:24 UTC

- reply

#nevent1q…pmf0

2025-05-21 01:55:11 UTC

- reply

Au contraire, that's what I like most about it. NIP 28 will allow me to use less opinionated relays (that don't rely on RPC calls that have to be supported by the implementation).

2025-05-21 01:10:50 UTC

Strongly considering abandoning nip 29 for nip 28 if you can believe it

2025-05-20 19:25:48 UTC

- reply

I'll look into making it fail more gracefully. There is a trade-off between scope and trust though, and for coracle and flotilla I'm on the wide scope and high trust side of things. A lot of these approvals are used to probe relays to figure out what the user is allowed to do. I don't think every client should necessarily be sparing about signatures. "Sign everything" is a valid mode for some applications.

2025-05-20 17:41:50 UTC

- reply

No, but that is a fascinating map

2025-05-20 17:41:37 UTC

- reply

https://hbr.coracle.social/08966846b18867a509e961d562409ae7b4ed9ec22ff0c587524887a49a872758.png

2025-05-20 17:21:46 UTC

- reply

Lists should live on the user's outbox relays, the goal of compass is to have the minimum setup that allows for finding the correct relays to query based on the outbox model.

2025-05-20 15:46:49 UTC

- reply

could be

2025-05-20 15:37:44 UTC

- reply

Like SMS? Weird. But yes, fake account.

2025-05-20 01:54:17 UTC

- reply

oops, try now

2025-05-19 18:10:15 UTC

- reply

> The ideal: my life is better if I do X, and I'd want my friends and family to do or use X
My relationship with nostr is basically a quest to create software that I can justify selling to my friends and family. This is an incredibly high bar when it comes to social media which I have yet to meet.

2025-05-19 16:50:48 UTC

- reply

Just pushed an update to anchor, give it a shot

2025-05-19 16:08:30 UTC

- reply

Hash databases would definitely be better, and might help the maintainer avoid liability, but public hash databases (in particular for fuzzy hashes) can make it possible for attackers to reverse-engineer the hashing algorithm to craft payloads that avoid matching.

2025-05-19 16:02:06 UTC

- reply

Sure, I can update that

2025-05-17 13:41:55 UTC

- reply

I haven't had to deal with this yet, but my understanding is that in the US at least you're not responsible if you don't host it. Of course, cloudflare is a private company and they can do whatever they want with your account.
Implementing censorship lists in FOSS may actually be illegal (again in the US), because it can be construed as "advertising" CSAM. Same thing for 1984 reports, which can be used to find rather than avoid content. The rules are stupid and set us up for failure. IFTAS has been doing some work in this area creating resources for activity pub admins, but they mostly have to do with who not to federate with.

2025-05-17 01:37:53 UTC

- reply

@nprofile…ukn2

2025-05-17 01:07:54 UTC

I've been using regular shaving cream for years. Today I finally looked at the label and saw sodium lauryl sulfate and propane. But thanks to @nprofile…2tmg and the circle P I knew just what to do: visit soapminer.com and trade a few precious sats for pine tar tallow soap.

2025-05-16 23:52:22 UTC

- reply

Agreed

2025-05-16 16:54:07 UTC

the internet is a dog's breakfast
always on
silenced, scrutinized, leave a review
never off
abandoned, harried, simulated
authentic fakery
counterfeit living
attention absorbed, inner externalized, meaning mocked
what was is what I am
what I am is what will be
remember, in order to become
imagine, in order to act
memory stagnates
imagination wanders
inertia? or chaos
decline, decay, or
the queering of the self
or:
roots and leaves
Chesterton's fence, and new ones too
I am not alone
reality is witnessed
politics is for virtue
politics is for happiness
we build the city
and melt into its form
the rule of man
the rule of man
becoming the image
measured, weighed, wanting
the gathering of form exports chaos
inertia. nirvana. death.
just wait
spoken
nature groans
to be filled
with what?
God speaks: freedom
man answers
Man speaks: freedom
nature answers
created, redeemed
suspended, enveloped
transcendence: reality
the fire on the altar
the garden in the city
a crown on the forehead
work is prayer
a whole, burnt offering
unmade, remade, revealed
the internet
unmakes: a more perfect liquefaction
remakes: the digital native
reveals: the sovereign individual
politics, culture, community
yes, but
technology reformed

2025-05-16 15:48:29 UTC

To contextualize the adoption of cryptography:
- Public key crypto was invented in 1976
- Bitcoin was invented in 2009, 33 years later
- In 2025 (49 years later), cryptography is still a niche topic
- The printing press was invented around 1440
- By 1470 (30 years later), a handful of presses had been established in major cities
- In 1500 (60 years later), there were only 417 presses
- By the 1550s (110 years later), printing presses were in use globally
Transformational technologies go through a period of obscurity, then centralized control, then eventually become universally accessible. My hope is that we are just coming out of the centralized control phase of cryptography and the internet.

2025-05-16 15:22:50 UTC

- reply

Use backticks. Not linkifying nostr entities without nostr: prefixes is like not linkifying example.com/my/path/here. Hyperlinks aren't invasive, and they're helpful. Expecting links to always have a protocol in front of them isn't really realistic. People do copy and paste non-prefixed entities, and they often type non-prefixed domain names.

2025-05-16 14:02:34 UTC

"All the labor of man is for his mouth, and yet the soul is not satisfied."

2025-05-16 13:59:35 UTC

- reply

I have, but don't feel strongly either way. I don't know if vopyleft matters much for nostr software, since the whole idea is to have multiple implementations. But for foundational things like khatru, strfry, it might make more sense? I should take a listen.

2025-05-16 12:57:53 UTC

- reply

I tried, but it was a bad fit. Eventually switched to https://github.com/nostr-protocol/nips/pull/879

2025-05-16 12:57:28 UTC

- reply

This one is better, since it doesn't smash everything into a single kind: https://github.com/nostr-protocol/nips/pull/879

2025-05-16 04:21:19 UTC

- reply

Sad, it was so good in its prime. Of course, it was probably a result of exploiting volunteers for fake karma. But I still post questions there every so often.

2025-05-15 23:10:36 UTC

- reply

Interesting library, I might start using that

2025-05-15 23:03:33 UTC

- reply

Neat, that's what I was thinking of doing, sort of stupid but the way pnpm handles peer dependency ambiguity seems annoying (if correct)

2025-05-15 23:02:02 UTC

- reply

This doesn't solve diamond dependencies though right? Where you have multiple versions of the same library included, bloating your bundle (or worse, having multiple copies of state)

2025-05-15 23:01:25 UTC

- reply

Does this have time-based cache invalidation? The problem I've run into with checking the cache first is you don't know if there's a new version of a replaceable event

2025-05-15 22:24:56 UTC

- reply

@nprofile…yuzs

2025-05-15 22:24:37 UTC

- reply

@nprofile…v5l9 @nprofile…3pwc

2025-05-15 22:24:25 UTC

Should I use peerDependencies when writing multiple related javascript libraries, or lockstep versioning? Both seem annoying.

2025-05-15 19:41:23 UTC

- reply

Each event is about 500 bytes, so to index all 100k 10002s on purplepag.es would only take around 50 megabytes, so yeah, totally doable

2025-05-15 17:11:02 UTC

- reply

I am using router to sync with purplepag.es and relay.nostr.band, so it should be reasonably complete. I'm using supported_nips = [65] to signal this, but it wouldn't hurt to be more explicit

2025-05-15 17:09:22 UTC

- reply

Cool, sounds very good. You should add that extra info to the readme! One other question, does it mirror other relays?

2025-05-15 16:41:29 UTC

- reply

Does it store kind 10002? Because that should really be the thing that gets indexed, rather than profiles (although that's also helpful). Also, I'm not sure what you mean by lightweight, a blossom server is out of scope for what I'm trying to do. Although the fact that it's dockerized does make it easier to deploy.

2025-05-15 16:21:06 UTC

- reply

Thanks, I'll see what I can do

2025-05-15 16:20:53 UTC

New project just released: Compass 🧭
For a long time I've wondered how bad things would be if @nprofile…j6hr's wss://purplepag.es relay went down, since it's the only dedicated kind 10002 indexer I'm aware of, and is heavily relied on for bootstrapping user relay selections, which is a key part of keeping nostr decentralized.
So I stood up another one at wss://indexer.coracle.social. Regular users don't need to do anything, but I encourage client developers to add this to your list of relays you check for NIP 65 kind 10002 relay selections.
I've also open-sourced the project at https://github.com/coracle-social/compass so anyone who wants to can run their own.
The project also supports mirroring other indexers via `strfry router`, but I have left that as an opt-in feature. Unless you expect significant load on your indexer, mirroring would only increase the number of unnecessary connections made to other indexers, so please be considerate when setting up mirrors.

2025-05-15 15:52:32 UTC

- reply

Thanks, I've been playing whack-a-mole with that for a while now. Android is notoriously inconsistent with the safe insets. What kind of phone/os are you on?

2025-05-14 21:42:44 UTC

Had to use discord today, and wow it is evil. The notifications bell showed a red dot, so I clicked on it. No notifications, but a non-default "for you" tab showed a notification dot, so I clicked on it. The dot then disappeared, and I got a nice fiendly [sic] "Nothing here yet" message.
Treat your users with respect.

2025-05-14 21:10:07 UTC

- reply

Yeah, I'm switching to just a regular VPS but now it's too underpowered to build strfry 🤷‍♂️

2025-05-14 20:50:40 UTC

'nother Coracle version out (0.6.17) 🐠
* Fix reaction notifications crash
* Show web of trust badge on DM items
* Make name on messages clickable
* Remove duplicate dependencies
* Add relays to note options form

2025-05-14 20:49:40 UTC

- reply

That makes a lot of sense, and yeah, a lot of this comes from me trying to deploy strfry/lmdb on a PaaS 😂

2025-05-13 18:53:52 UTC

I'm reading a history of asymmetric cryptography right now ("Crypto" by Steven Levy), and my mind is being repeatedly blown by the origins, odds, and success of the movement. Everything we're doing with nostr started in the 1970's! And yet we somehow still don't have widely-used, decentralized electronic mail that checks both boxes of the original RSA paper:
> we must ensure that two important properties of the current “paper mail” system are preserved: (a) messages are private, and (b) messages can be signed.
The question that keeps coming to mind is this: what happened between 1996 and 2009? Once individual rights to cryptography was established, did the movement die out? Why did no one build out access to cryptography for the average internet user? Yes, SSL is ubiquitous, but it's still controlled by a cabal of root certificate issuers.
I know there was ongoing work that led to bitcoin, and XMPP is an obvious exception, but even so I am stunned that 50 years after the invention of public key cryptography we still don't have widespread, meaningful adoption. Keys are limited to technical users, and encryption is mediated and undermined by centralized platforms.
For those with some perspective on this history: are we in the midst of a cryptography renaissance? Did bitcoin kick off a resurgence of interest in digital privacy? Or is that just my own bias at play?

2025-05-01 15:26:18 UTC

- reply

Notice is more for debugging, it doesn't have the semantics or affordances necessary to create a good ux

2025-05-01 14:55:42 UTC

- reply

The UX for sure needs improvement. Unfortunately notedeck is working on a different standard (cool, but not lightweight). I am releasing something next week which will increase their utility some. I'll DM you soon

2025-05-01 14:53:39 UTC

- reply

Use a kind 3xxxx and design a subscription status thing. See my PR for notification services for how it might be done: https://github.com/nostr-protocol/nips/pull/1796/files
This fits the semantics of a "balance" or "subscription" and can be generated on demand in response to a req, or periodically and published to other relays.

2025-05-01 03:22:59 UTC

- reply

No, nips and kinds are entirely arbitrary (other than reserved ranges, like 2xxxx for ephemeral 3xxxx for parameterized replaceable, etc)

2025-05-01 01:52:19 UTC

- reply

#naddr1qv…0gdy

2025-04-30 19:57:05 UTC

- reply

Thanks, pushing a fix now

2025-04-30 16:54:27 UTC

- reply

I use several custom feeds regularly, it's not hard to build useful ones. My UX is horrible though

2025-04-30 16:12:20 UTC

- reply

I will admit it is a pain to implement

2025-04-30 14:12:21 UTC

- reply

Custom feeds have seen no adoption for some reason. I don't know if it's because I'm a poor marketer or what

2025-04-30 14:11:24 UTC

- reply

Samiz is huge, I've been wanting this since manyverse. Excited to play with it.

2025-04-30 03:58:48 UTC

- reply

Oh, also babies need more B6 than adults do

2025-04-30 03:36:16 UTC

- reply

You have a point. The nice thing about conflating the endpoints is you could reasonably assume the same access controls apply to both.

2025-04-30 01:33:31 UTC

- reply

Formula is terrible, but better than no calories. Do what's best for your kid. Goat milk (and goat milk formula if you're not sure about raw milk) are viable alternatives, although our son eventually started puking it up. If your kid stops putting on weight, that's bad, but look out for length or head circumference stalling, that's a much bigger deal.

2025-04-29 23:14:52 UTC

- reply

ah dang that's right

2025-04-29 23:09:50 UTC

- reply

Also, why the open-endedness wrt encryption algorithm? Why not just use nip44?

2025-04-29 23:07:42 UTC

- reply

Interesting spec, sort of unusual since it doesn't support embedding images inline with text as is usual with kind 1s. Or does it?

2025-04-29 23:03:03 UTC

- reply

I don't read nips sir, I only write them

2025-04-29 23:02:32 UTC

- reply

FWIW I use kind 30000 lists in coracle's onboarding

2025-04-29 23:01:31 UTC

Has anyone figured out a standard for sending private images over NIP 17 DMs? Private blossom servers with authentication? Public blossom servers with encrypted files? @nprofile…5e7v @nprofile…ql2f @nprofile…r6hs

2025-04-29 21:28:48 UTC

- reply

The only difference between our projects is key + relay vs relay + key

2025-04-29 18:41:48 UTC

- reply

I'm not aware of any specs that work that way. Coracle basically just throws away the seal if it doesn't fit NIP 59

2025-04-29 18:32:54 UTC

- reply

That would break interoperability, but you could instead sign the rumor

2025-04-29 17:58:52 UTC

- reply

I'm not sure that makes sense for my use case, since the users should already have access to the relay (iow payment would happen on the membership level rather than the storage level)

2025-04-29 17:55:35 UTC

- reply

That'll do it

2025-04-29 17:26:59 UTC

- reply

Is this the egg thing again? All is not one, pablo

2025-04-29 17:23:40 UTC

- reply

They are the future, as long as people stop setting supported_nips to a scalar

2025-04-29 17:20:35 UTC

- reply

I'm talking about the relay itself signaling support, maybe via supported_nips including BUD-01 or something

2025-04-29 17:13:30 UTC

@nprofile…3zhe is there a standard way to do feature detection for blossom support? In flotilla I'd like to ask the relay if they support blossom, and if so upload images to the community relay rather than the user's own personal blossom server (for privacy).

2025-04-29 00:33:51 UTC

- reply

The feed thing is a known problem, gotta revisit that at some point. Relay selections should be improved in the current release, but are limited by the quality of your selections (you have way too many by the way, shoot for 3-5).

2025-04-29 00:31:30 UTC

- reply

Credit to Topher Field of Battleground Melbourne for the quip

2025-04-28 16:38:17 UTC

- reply

I told you the UI needs work

2025-04-28 16:38:00 UTC

- reply

Edit feed > Network

2025-04-28 16:20:34 UTC

- reply

If the spec is the implementation, then technically they all do

2025-04-28 15:44:47 UTC

- reply

Sure enough, I can't find any lists by you, which probably means it failed to publish. It could be a result of bad relay selections (although yours look ok), but is likely a bug in Coracle. Could you try again, and check the publish status HUD (on desktop, the icons at the bottom of the side nav) for which relays accepted your list?

2025-04-28 14:04:32 UTC

- reply

Yep, DM me, email my nip 05, or go to my website (flotilla.social) and schedule a call

2025-04-28 13:09:10 UTC

- reply

This is possible with flotilla using burrow, a email/password to bunker adapter I built and never ended up using. You can enable it via env variable. I decided I didn't want to hold people's keys, and that key management is worth introducing, since it's a core value prop of nostr, which is why I then wrote my 5k word article explaining keys. @nprofile…0h0z happy to help you set up an instance if you want to explore the idea though.

2025-04-28 01:48:24 UTC

- reply

Definitely not, I'm sure the people who had all the same ideas as us 26 years ago were all dumb

2025-04-26 19:46:53 UTC

- reply

both npm and npx link resulted in multiple instances of certain libraries being in my bundle because of diamond dependencies 🤮

2025-04-26 19:45:55 UTC

- reply

and it will be done in two weeks

2025-04-26 17:49:50 UTC

- reply

No, I gave up on it for now. It seemed like the wrong paradigm for bidirectional websockets (or at least less fit for it than unidirectional data flow). I could have used it for subscriptions, but I just stuck with callbacks and promises for now.