Nostr is a stupid simple P2P protocol that works, built by builders

248 points by kdragon 3 years ago | 128 comments

I have been seeing a lot of shilling for mastodon lately, so I thought I would step in and shill Nostr for a bit.

https://github.com/nostr-protocol/nostr

Fun facts about Nostr:

* Nostr stands for "Notes and Other Stuff Transmitted by Relays". It is an odd acronym, but I like it.

* Nostr uses websockets and relays to build a really simple P2P network. We also steal a few ideas from bitcoin (ECDSA ids, schnorr-signed events).

* Relays are simply dumb data stores for events that clients publish and subscribe to.

* Clients don't trust relays to be honest, so all events are self-signed. Your pubkey is your userid.

* It is stupid simple to build a Nostr client. You can easily do it in less than 400 lines of JavaScript. And it runs in the browser.

(shameless self plug) https://github.com/cmdruid/nostr-emitter

* Nostr is powerful enough to host chat apps very easily. Here is a rip of Telegram, running on Nostr:

https://anigma.io

* There's a lot of fun things you can do with Nostr. Check out all these cool projects!

https://github.com/aljazceru/awesome-nostr

* We are constantly discussing how to improve the protocol. Come join the conversation here:

https://t.me/nostr_protocol https://anigma.io https://damus.io https://github.com/nostr-protocol/nips

Thank you for reading my nostr shill post. I did not create nostr, nor do I get any monies for promotion. I just think it's really cool and I have a lot of fun building stuff that punches though nats.

If you have any questions about nostr please feel free to ask.

Also, Happy Thanksgiving to everyone! I hope we're all feeling fat and sassy today. :-D

egypturnash 3 years ago |

So how does nostr propose to solve the problem where there is, in fact, quite a lot of content that you want to filter out, whether because it makes for a better experience for the people using this protocol to talk to each other, or because there are some pretty solid laws about things that various governments require people to filter out?

https://abovethelaw.com/2022/11/hey-elon-let-me-help-you-spe... is a pretty decent rundown of a mix of these things; it is specifically pointed at Elon Musk's decision to buy Twitter and make it a haven for "free speech" but it is a glimpse at what is in the future for anyone setting up a "free speech" platform.

My experience as someone who has been running a Mastodon server since 2017 is that while "we are all for FREE SPEECH, we only block what the government ABSOLUTELY requires us to block!" sounds noble, in practice nodes of the Fediverse that say this become havens for people who are only there to be assholes to other people, and any sane admin will sigh and block the whole server, because it's just going to be a continual source of rude nasty bullshit.

imiric 3 years ago | |

That's a great article, and balancing free speech with censorship is a difficult problem. But it becomes a constant headache only on centralized platforms, where no amount of resources can realistically monitor and filter all content. This scales in complexity as the platform grows, which is the goal of any centralized service. And if the business model depends on advertising, it becomes even messier and crucial to its existence.

P2P services OTOH work on a decentralized and pull model. Users share and only subscribe to the content they're interested in. Censorship is distributed, and it's a problem for people who don't wish to see specific content. It's the way the internet works, and the existing approach of removing sensitive content applies to P2P services as well. Since there are no advertisers to appease, it's not an existential problem.

salawat 3 years ago | | |

You didn't answer the question.

The question was, to wit, >How do you keep CP off it?

Your answer was: >I don't, just don't look at the CP.

The problem really in question here is:

You've just created a new distribution method for this type of thing and punted the consequences for someone else to deal with.

(Which is totally cool imo, but newsflash, expect to be the subject of a hit piece some time in the forseeable future. It shouldn't take long; either for actual criminals to set up on it, or for LE to do it to "snare unsophisticated actors").

Welcome to the Internet, where we can't have/make nice things anymore.

Cameri 3 years ago | |

Nostr lets you specify who and what you subscribe to, so unless you subscribe to everything and everyone this isn't really a problem. You can also subscribe to followers' followers and expand that way.

fiatjaf 3 years ago | |

Unlike what OP says Nostr relays are not dumb, they can have their own policies and to me they look like a better version of Mastodon servers. They can have identities, "themes" and policies as they wish. On Nostr it's totally fine for one relay to only allow certain kinds of content and block everything else. Users can just connect to multiple relays if they want to read/write about different things.

deaddodo 3 years ago | | |

What bugs me about it is their naivety to solved technical problems. For instance, they answer the question of “why this hasn’t been done?” with:

> I don't know, but I imagine it has to do with the fact that people making social networks are either companies wanting to make money or P2P activists who want to make a thing completely without servers.

Except it has been done. In fact, that’s literally what KaZaA was with its “superpeers”. And what they realized was that by making a semi-decentralized system, they just introduced the weaknesses of both systems (slow downloads via peer-latency and network limits + easy censorship by killing relays/nodes). In addition, this is exactly how IRC works, despite the fact that it’s mostly used with a few nodes these days.

I’m not against semi-decentralized systems. They’re great and help deal with some scalability problems; but they don’t solve for the number one issue most people moving to decentralized are seeking (anonymity, privacy and free speech), so it’s not fair to compare it to platforms/protocols that do offer those features.

jonstaab 3 years ago | |

Relays can censor as much as they want, since they're only stewrding a small part of the network, likely replicated elsewhere. As to building in ways to curate/moderate content in a distributed way, there are lots of ideas out there as to how that might happen. Here's an issue I opened just the other day: https://github.com/nostr-protocol/nips/issues/75

kdragon 3 years ago | |

Yes this is the crux of any social media application. I don't know if there will ever be a perfect solution.

I like that nostr abstracts this problem away from the relays. Relays only focus on storing data and handling subscriptions. They can choose to censor and/or curate content if need be, but it's not their concern.

It's up to the client to come up with a solution, and that client can be a platform or a protocol of its own.

edit it also feels really great to work on that problem from the application layer. I can come up with a solution that isn't confined to the parent protocol.

barnabee 3 years ago | |

I'd like such a protocol to be designed so servers, relays, etc. are unable to censor content at the protocol level (if someone creates it, it is available) and the filtering is done on the client side.

Commonly filtered things (account block lists, post flag lists, filter rules, etc.) could be shared via the same system — indeed there could even be competing versions and everyone could follow their preferred filter source.

Users would also likely run statistical and machine learning based spam and content filters locally (perhaps on a personal relay/server of some sort, or an account on a shared one) configured to their preferences.

I would expect the infrastructure running such a network to be in the same position as Signal, who do not know the content of messages and can't censor them, leaving individual clients to figure out blocking etc. (albeit the client side options as well as ways to share configurations etc. would need to be much more advanced for a social network or similar than for a messaing app).

assetlabel 3 years ago | |

Just mute them. Or just follow who you follow with no suggestions of other people. Or relays can have a censorship policy based on the law or community standards or anything else they want... and the people will use whatever relays work for them (typically multiple relays to follow multiple crowds). Some people want censorship, some don't, the protocol is totally agnostic on this point.

cf 3 years ago | | |

I noticed you haven't shared your email address in your profile. Surely if muting is sufficient you would accept that it's a risk-free action?

ekianjo 3 years ago | |

> r because there are some pretty solid laws about things that various governments require people to filter out?

There are solid laws protecting copyright everywhere yet it is stilm trivially easy to find copyrighted content available for free online. Laws dont mean anything unless they are or can be enforced.

Cameri 3 years ago |

I don't agree Nostr is P2P since clients must connect to relays and there's no provision at the time for client to client connectivity. I found out about Nostr and due to the simplicity of the protocol I was able to start building right away. I implemented a relay using Typescript: https://github.com/Cameri/nostr-ts-relay I also wrote this dead simple SMTP to Nostr gateway: https://github.com/Cameri/smtp-nostr-gateway

nobody9999 3 years ago | |

How does your client (or any nostr client) deal with discoverability?

I'm not piling on nostr here, that's an issue with ActivityPub as well as most decentralized platforms/protocols?

assetlabel 3 years ago | | |

You can look someone up like bob@example.com and if he publishes his nostr information in a well-known file, you'll know where to follow him and what his public key is: https://github.com/nostr-protocol/nips/blob/master/35.md

Of course this doesn't work for people wishing to remain anonymous.

Cameri 3 years ago | | |

I'm not working on a client. But some of the ones I've used have a Global Feed/Explore section like Astral.ninja and Damus.

I wrote a simple directory you can use to find users and channels here: https://nostr-fzf.netlify.app

tazjin 3 years ago | |

A bit disappointed about that actually. For a moment I thought someone had done a sane version of Scuttlebutt, but alas :)

Though at this point I probably wouldn't use that either.

null0pointer 3 years ago | | |

Which part of Scuttlebutt do you find not sane?

olah_1 3 years ago |

I'm beginning to think that ActivityPub will never add anti-censorship features into the core protocol (for example, independent IDs that don't live on a relay server). Because I spoke with a core developer on ActivityPub stuff a couple of years ago about the issue of servers going offline and losing your account and he said that he was working on it.

But I wouldn't be surprised if he was discouraged from continuing this work because ultimately people like ActivityPub because server admins can be little dictators that censor and ban at will.

bawolff 3 years ago | |

> because ultimately people like ActivityPub because server admins can be little dictators that censor and ban at will.

ActivityPub isnt the only distributed thingy to learn that lesson. There are a reason the various ultra-free-speech hosted on the dark web, things never take off.

olah_1 3 years ago | | |

I think the architecture is the issue. Nobody wants their account owned by a random guy running a server as a hobby.

fiatjaf 3 years ago | |

Of course they won't add anything, and if they add no one is going to implement.

Mastodon, Pleroma et al. are not really ActivityPub implementations. Each of the fediverse clients implement some random 10% of AP and just try to get compatible with each other using dirty hacks.

StillBored 3 years ago |

A huge advantage to many large projects is separations of concerns, particularly in the case of protocol (or API/etc) vs policy.

From the sounds of it, you have the protocol but not the policy. Which is by itself huge that they are separate, but now the clients (?) needs flexible policy, no? Otherwise its just going to turn into a billion people all talking in the same room, or your going to have a ton of tiny rooms with no activity. The discoverability of interesting rooms will be difficult. Its sorta the IRC problem in a nutshell (or discord/etc). Balancing the noise, vs the quiet is the difficult part (AFAIK).

leke 3 years ago | |

Still trying to understand how it all works but maybe there could be some agreed way of creating rooms, like naming them after sub Reddits.

bawolff 3 years ago |

So reading the github page this sounds basically like a variation on RSS.

There are a number of web servers that host content (either for free or for money) [called relays].

Clients download recent posts

Identity is based on public key, allowing users more control and the ability to easily change relays.

So is RSS + pubkey based identity the right way to think about this?

defanor 3 years ago | |

That's roughly my first thought too: the project seemed like pubsub with message authentication and without federation. Was about to bring up "Atom and RSS, mailing lists, NNTP, XMPP, ActivityPub, Matrix" as examples of existing protocols capable of that (to a different extent, and usually with more functionality), thought to add Mastodon to the list of examples too, but the README already mentions that Mastodon is undesirable because of the dependence on domain names/administrators (and elsewhere mentions undesirability of running servers by users, of having many servers, while considers simplicity from the point of view of in-browser JS, apparently), that the servers aren't run well, and so on; seems pretty opinionated and enthusiastic about this protocol, so I guess those existing protocols won't satisfy all those requirements either.

Initially restrained from posting it, since it's possibly rather grumpy, and the authors seem to have fun with the protocol, but here it is.

bawolff 3 years ago | | |

The story around relays seems to me like the most suspect part of this when it comes to scaling.

The protocol doesnt want users to run their own servers, but there also aren't really any incentives to run relays, so what happens when it gets big enough that running a relay is expensive or non-trivial? I feel like it would just fall back to users running their own servers like in mastadon.

assetlabel 3 years ago | |

That is how I think of it. RSS with user-created public key identities. Lots of client fan-out to lots of relays. And a straightforward way for anyone to post (unlike RSS)

Relays have to figure out how not to get smashed with too much data. I predict they will require an account/login at some point. But you can post to multiple relays and drop relays that don't serve you well at any time.

westhom 3 years ago | |

I like to think of it more like (old) Usenet with pubkeys. It gets more at the distributed database factor.

klabb3 3 years ago |

Not saying this is the future, but something like it is. All of the core decisions here are solid (pub key identities, signed events, dumb relays).

There are still features that many apps will need such as tying multiple devices to an identity, abuse prevention for relay operators, etc.

chromatin 3 years ago |

Link to nostr NIPs (nostr improvement proposals): https://github.com/nostr-protocol/nips/blob/master/README.md

One of the neat things about nostr is that while it has already been used to build a decentralized Twitter like social network, the protocol could also be used to build encrypted P2P chat, traditional discussion forum, alerting/push style notifications, and numerous other applications.

remram 3 years ago | |

Might be worth going with "enhancement proposal" instead so you don't call your governance documents "nips".

encryptluks2 3 years ago | | |

They should go all in to find an acronym for the full word.

akkartik 3 years ago |

Last year: https://news.ycombinator.com/item?id=29749061

Cameri 3 years ago | |

I was pretty bullish on Nostr back then, and still am.

ilaksh 3 years ago |

If everything goes through relays then is it really P2P? Why not even try to have a direct connection of any sort, such as WebRTC?

kdragon 3 years ago | |

You can argue that it is not true P2P, since you rely on a public-facing intermediary.

A lot of p2p protocols cheat with relays, it is really hard to traverse nats otherwise.

Nostr can be used for peer discovery to bootstrap a direct p2p connection.

You could also use a client/relay hybrid application, similar to other p2p networks. That would be fun to build. :-)

nine_k 3 years ago | |

Is email p2p? Can you configure multiple relays like MX records for email? Can a receiver be its own relay?

Relays are important for two reasons: peer discovery and communicating when one of the parties is offline. Same as with other p2p networks.

bawolff 3 years ago | | |

I mean, the pure P2P solution would be supernodes.

Edit: i RTFA. Sounds like relays can be run by anyone. That sounds p2p enough to me.

rgbrgb 3 years ago |

Cool! How do you discover users to follow on nostr?

kdragon 3 years ago | |

Great question! Relays aren't involved in curation or discovery, so it fall on the client.

You can request very broad subscriptions from relays! For example, here is a site that subscribes to everything, showing you a gods-eye view of events streaming into a relay:

https://nostr.info/relays

Events have different "kinds", so you can filter this based on the type of traffic you are looking for (like public posts or user profiles).

Platforms like damus.io are more user-friendly, and offer better tools for discovering users and content.

You can subscribe to a user's feed via their pubkey, so discovery methods typically revolve around learning pub keys.

rgbrgb 3 years ago | | |

Makes sense, thank you!

fiatjaf 3 years ago | |

How do you discover users to follow on Twitter?

I doubt anyone has ever been successful into signing up on any social platform and just followed the big names that are suggested automatically at the beginning or based on some "key interests" you select.

But hey, if you want that, it's easy for a third-party website to grab a ton of public Nostr data and build custom recommendation lists and whatnot.

TheSkyHasEyes 3 years ago | |

https://github.com/nostr-protocol/nostr

See FAQ, second question.

stonogo 3 years ago |

What does "built by builders" mean?

ffggffggj 3 years ago | |

Crypto people talk like this to distinguish real projects from ones that were purchased off the shelf and launched by marketers/hustlers. I’m guessing the guy who wrote this is a crypto person who doesn’t realize the slang is so local.

kdragon 3 years ago | | |

Guilty >_>

It feels nice when a protocol has its core devs on the same wavelength as application devs. That's the feeling I get with nostr.

umanwizard 3 years ago | | |

Even if you bought something off the shelf, it was still built by someone (presumably “builders”), even if that someone isn’t you.

jasonlotito 3 years ago |

shill: One who poses as a satisfied customer or an enthusiastic gambler to dupe bystanders into participating in a swindle.

It's not shilling. It's recommending. Shilling is a bad thing. It's a simple thing.

kdragon 3 years ago | |

I was being a bit dramatic with my choice of words but you are absolutely right :-D

eps 3 years ago |

> A relay doesn't talk to another relay, only directly to users.

Can you elaborate on this point? It would seem that meshing relays would've facilitated the dispersal of updates.

assetlabel 3 years ago | |

People generally post to 5 or so relays for censorship resistance. If you want to follow them, you need to query at least 1 of those 5 relays.

Nothing in the protocol specifies relay-to-relay communication, but nothing stops them either.

Reventlov 3 years ago |

The inability of people to spell Mastodon correctly will always surprise me. Also, isn't « nips » a slang for nipples ?

googlryas 3 years ago | |

It is, but it also means other things too: nip in the bud, a nip of alcohol, to nip off with something, to nip by, etc.

kdragon 3 years ago | |

fixed >_<

usgroup 3 years ago |

I don’t understand —- this isn’t a P2P protocol since it isn’t peer to peer by definition. And the “relays” don’t even relay anything … a “relay” is a server acting as a Dropbox that you have to query.

fiatjaf 3 years ago |

https://github.com/nostr-protocol/nostr literally says "it is not P2P".

quickthrower2 3 years ago |

How do I discover people and follow on https://branle.netlify.app/ ? I can’t figure it out

redshark03 3 years ago | |

Try astral.ninja it has support for a global view

yjftsjthsd-h 3 years ago |

So, Usenet built out of modern tech? Nice:)

Cameri 3 years ago | |

Check out more-speech (a Nostr client) being built by Robert C. Martin (Uncle Bob).

huimang 3 years ago |

At this point I don't see much point in adopting something that doesn't support ActivityPub. I'd rather just use Mastodon/Pleroma/Akkoma with some heavy blocklists.

remram 3 years ago | |

I've been looking at alternative implementations since I don't want to run the entire Mastodon app for just myself. The fact that every single ActivityPub implementation runs into so many interoperability issues, such that they have to be fixed to work with each other system one by one, is a sign to me that the protocol is either too complicated or not robust enough (probably both).

There is tremendous value in a much simpler protocol, especially if it can deal with the identity migration issues that Mastodon has faced since day one.

zimpenfish 3 years ago | | |

> so many interoperability issues [...] the protocol is either too complicated or not robust enough

From what I've read, it sounds like the interoperability issues come from not implementing AP the same way as Mastodon rather than anything specifically protocol-related. Hence, e.g., Pleroma going out of its way to be Mastodon compatible as a design goal and GoToSocial having lots of issues because it hasn't yet gone that route[1]

[1] e.g. they have an issue where some client apps don't work with GTS because GTS doesn't advertise a version number sufficiently high enough - because the apps are looking for "v > 2.10 because that's when Mastodon introduced feature Z".

nine_k 3 years ago | |

A stupid simple message relay protocol can be used for stuff other than social media.

OTOH websockets are hard outside the browser :(

Cameri 3 years ago | | |

Maybe years ago but now Websockets are dead simple to use in virtually every language. Heck you can even pipe to a websocket server using websocat using the shell.

eternityforest 3 years ago | | |

Websockets are almost trivial now if you just use a library

terminal_d 3 years ago |

Isn't this just Urbit with extra steps?

jesusixos 3 years ago |

Cool