Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Flare, a video sharing site built on Nostr (njump.me)
164 points by janandonly on Dec 21, 2023 | hide | past | favorite | 202 comments


Congrats on launch!

Login button: 3 times I see the word "Nsec" without any explanation, that would lose a lot of youtubers from transitioning

But a bigger issue is that googling about nsec tells me it's a very bad practice: "Some argue that the user should never enter their nsec into an input field at the risk of being compromised by the service. Given the nature of nostr, users cannot recover from a leaked private key and must take greater precaution than they would with a username/password combination." https://nostrdesign.org/docs/how-to/sign-in-sign-up/

(also pip for some reason stops playing when I switch to another page on the site)


> “Given the nature of nostr, users cannot recover from a leaked private key and must take greater precaution than they would with a username/password combination.”

This is a complete dealbreaker for any end-user product. I don’t understand why crypto/blockchain fans still think it can work.


I'm not sure why you're getting downvoted here. In any other context, "paste in the private key that your identity is irrevocably bound to" would get you laughed out of the room. It seems to be the default nostr UX nonetheless, and that's worthy of note.

I am aware of efforts to improve on this though, for example https://snort.social/e/note1crl44xk24yc2ym5xlyyfjdeumxueyguz... - essentially the equivalent of a custodial wallet, if I'm understanding correctly.


He’s getting downvoted because that’s a solved problem in the wider crypto-space. To log in you sign a message using your hardware wallet.

Nostr hasn’t grown up to that yet, and pointing out that pasting private keys is a bad idea is fair game.

But implying that public private key cryptography can’t be used to log into web apps is just silly given that value worth billions is being moved around daily using such web apps.


There's a reason why social logins, magic links and SMS login codes are so ubiquitous now - end users want 0 friction getting into their accounts. This increases friction beyond what is currently common practice. No, the public doesn't want nor care about using a key to log in.


You should try logging into a “web3” app to see what I’m talking about. No need to buy crypto or anything, of course. Just for the science.

A short guide, assuming a mobile device:

1. Install MetaMask, next, next, finish to create a wallet.

2. Open app.uniswap.org on your favorite browser. See if you can figure out how to ‘connect’.

You can of course use the MetaMask built-in browser, but that’d be cheating.


I’ve actually seen this used for non-crypto sites. I think… it was fetlife?

If you already have MetaMask/Phantom extensions installed it’s easier than email verification.


Although i have heard of SQRL [1] which purports to be a frictionless way of securely logging in with public private key encryption. I've never seen it discussed here though so I'm unsure if there's significant downside

[1]: https://www.grc.com/sqrl/sqrl.htm


This sounds a lot like passkeys https://developers.google.com/identity/passkeys - I'd be interested to see a more thorough comparison of the two.

Both of these do a challenge-response style authentication with a particular website, and wouldn't really work as part of a decentralized system.

You could use the same signing key ordinarily used to sign authentication challenges to sign nostr notes, but then you're back to square 1 really.

Edit: slightly better passkey info here https://developers.yubico.com/Passkeys/How_passkeys_work.htm...


SQRL is indeed pretty similar to passkeys. It was just invented before passkeys (before WebAuthn even) and designed to work without requiring any new web standards or changes to the existing web browsers at the time.

That greater compatibility came with some UX trade-offs though. Now that passkeys exist and are widely supported by web browsers there's really no need for SQRL anymore; passkeys are a far more polished version of the same concept.


Does public key necessarily have to be high friction?

Couldn't there be a few-step UI similar to "Sign in with Google/Facebook/etc"?


For People who are already familiar with metamask, "Sign in with Ethereum" is so easy that makes people wish it was universal. It is even easy to generate new identities on demand: generate a new address/public key is literally a one-button operation.

The only thing that bugs me about is that is actually all your identities are still tied to same master passphrase, so if that gets compromised all of your identities get revealed.


>end users want 0 friction getting into their accounts.

Why not offer both, the easy one for normal users and an option to use the more secure option.


Why not have the secure option also be easy so normal users will use it?


I am glad Zach posted here also, I think nostr devs need some reality pull from "non-crypto normies". To be clear it is (hopefully) becoming more common practice to use a nip-07 web-extension for signing (hardware or software) or other methods such as NIP-46. To be clear though, a user on nostr will HAVE to interact with cryptography in some way as every message on the network is signed.

Im working on https://github.com/VnUgE/NVault as an option for more paranoid users that want a self hosted networked approach. But there are others listed here https://github.com/nostr-protocol/nips/blob/master/07.md

Finally, I wholly dislike the practice of offering an option of entering an nsec. Use a signing extension!


the wider crypto space still has no empathy for normies. if you can't somehow recover or rotate your password, it's a nonstarter by virtue of being a worse UX


ah physical key has the same properties and end-users seems to have been accepting that just fine for hundreds of years


I hate when I lose my house key and just have to leave it and go buy a new house somewhere else.


You would need to buy a new lock tough wouldn't you? Unless you had a spare key, but that would have worked with a digital key as well, right?

If someone stole your key, then they could've done anything to your house while your away, just like with a digital key, right?


I can easily change my house keys. Even when someone makes a copy of it.


Plus, by design it's easy to prove that you have a private key without having to stick it in somebody else's lock.


Nobody with my house key can impersonate me in my house from anywhere in the world without me knowing. The signed and notarized documents involved give me a legal avenue to remove anyone who obtains a key, instead of just abandoning the house and the equity to identity thieves.


na but they can steal your belongings couldn't they. Obviously I didn't mean that they have all the same properties, because then they would be the same thing more or less, but that they share some properties...


literally not at all similar to a house key


similar in some aspects surely, you can't say that they there is 0% overlap can you?


It is correct that it is bad practice to paste an nsec, but a lot of nostr services allow it. The login DOES support "login with extension" which is far preferred and much safer. Your private key is stored in a browser plugin and is not transmitted.

Experienced Nostr users will understand this, but I totally agree with your point about making it easier for non-nostr users. Also, they should (at least) strongly encourage people to use a browser extension / wallet instead of pasting their nsec, and provide a guide on how to do that and why.


The sites design is very aesthetically pleasing, well done on that front.

Something that put me off a bit was immediately seeing bitcoin influencer content after loading the page.


That's the reason I personally avoid Nostr. I know it's unfair because Nostr itself is actually a cool protocol that has nothing to do with bitcoin, but the stench of that is hard to wash off. I wouldn't want to build something that becomes associated with bitcoin just because of the name of the protocol.

It's like whenever there was a reddit/twitter/etc alternative some years ago following outrage, it'd get flooded with some of the worst people on the internet. Voat comes to mind as a pretty competent reddit clone that had potential, until it got overrun with nazis/racists and other kinds of losers. I was very close to releasing an app for that one, but abandoned it once it became clear the direction the userbase was going.


I had a look at some nostr apps, and I was extremely impressed by the speed and the fact that even decentralised it seems that all nodes are integrated (not like mastodon). But I can't get over the bitcoin scam everywhere


In what way is bitcoin a scam, and gold isn't?


Who said gold isn't a scam?


Do you think gold _is_ a scam?


I was mostly being contrary, but honestly I kind of do.


Gold itself? or the scams it enabled due to weaknesses in its monetary qualities?

For example, coin shaving (difficult to quantify without a scale), counterfeiting (tungsten wrapped gold), fiat central banking with zero reserve (due to poor portability + above) which transfers enormous wealth from entire populations and countries to the bankers?

Or maybe its scarcity? The amount of above-ground gold doubles every 50 years (which halves its value).

All weaknesses that bitcoin has solved BTW


Yeah. I love these new approaches to social networking and especially decentralized ones, but after joining Nostr and experiencing it for a while I got so tired of all the crypto talk. I'm pro crypto, I just don't want to only read about crypto


That's a huge indicator to me that Fedi is wayyy ahead any of the other "alt social media" projects. That normal, non-technical people use it to talk about normal real-life things in their day wayy more than they use it to just talk about how much they like Fedi / the thing / related thing. At least Bluesky as reached that bar too, but Nostr and none of the other crypto-y social media have.


That’s just the nature of Nostr at the moment. It’s very Bitcoin adjacent. There’s significant overlap between Nostr and Bitcoin developers. Also, Bitcoin (through Lightning) is the currency used on Nostr for anything and everything.

I can totally see how that’s off putting for normal people though.


It's so off putting I wouldn't touch it with a ten foot pole. I wouldn't even curiously browse a landing page of an otherwise interesting project beyond the point I notice that something is mildly "cryptocurrency-adjacent", or it becomes obvious that it has involvement from devs who also enjoy working on blockchains. Thanks for the heads up.


Same sentiment here. Something to compete with YouTube would be great but I'm not going anywhere near anything crypto related, the whole ecosystem stinks to me.


I can honestly report that big majority of Nostr users are very much against "crypto". Just ask on nostr "Do people here support crypto and all the various blockchains?" and you will see for yourself.


It shouldn’t really be much of a surprise though that people hacking on decentralized value transfer where identity is asserted using asymmetric key cryptography were the ones coming up with the idea to use a similar approach for information transfer.


Can I ask why?

Beyond the "crypto grift," a blockchain-based social network might offer some benefits:

- permissionless - (no moderation)

- means for auto solvency - (we are not the product)

- interoperability - (multiple clients, forks, etc.)

- privacy


Sure.

"no moderation", massive problem. I'm not hosting my (admittedly limited) content on a platform that lets my videos get posted in proximity to scams, CSAM etc. If I'm going to ask people to go to somewhere to see my videos (again, admittedly limited) then I'm not going to want them to be stumbling across that stuff.

YouTube isn't getting it right, they're allowing bad shit (poor quality, scams, excessive shrieking) and taking people down for spurious DMCA takedowns, but the answer isn't "no moderation at all", that's not the problem.

As a user I don't sign up to somthing because it allows anything, doesn't take anything down, I sign up beacause it has the things I want to watch. I'm not a character in cryptonomicon or snow crash.


More precisely, I mean no "centralized moderation."

You can moderate at client level whatever you want.

There could be shared lists of non-acceptable users/content based on your world views (like AdBlock but for users).


And the joke’s in the fact that Nostr is not even blockchain based. It’s basically Bitcoin devs’ response to the whole Web3 thing demonstrating that you don’t need a blockchain and a shitcoin to have a decentralized, permission-less, censorship resistant social network.


You can't brush off the "crypto grift" though. That's the sticking point, and it's a very big one.


Nostr is extremely anti-crypto and pro-bitcoin. The trouble is that most people don't appreciate the distinction, they will in time but at this stage, without deeply researching and understanding the topic, most just include bitcoin in the snake pit of "cRyptO"


So how will you cope with DMCA takedown requests and what will you do when all major medias companies will sue your ass?

You may try to pretend it is not your content and explain how the protocol works and all that but as long as you will host a frontend and own the domain name you will be considered the one to sue.


Yep. Same problems as torrent trackers and search engines. Even only having magnet links did not save site operators.


Torrent search engines still exist, DMCA notwithstanding.


However I doubt they are hosted at Vercel in the USA.

And that is without even mentionning child porn.


Yes, but people aren’t building dependencies on them. If you’re unable to use hosting in the top countries, that’s going to complicate any attempt to build an actual business or get people to use a community project.


But the beauty here is that you don't have to run a business or host a community project.

You can have a local client that connects to N relays and supports a few NIPs.

And if one of the relays goes down for whatever reason - you will still be able to get updates from the others. Including information about new relays.


Yes, that’s the dream but it hasn’t worked out for most usage because few people are going to spend their time and money hosting other people’s content. If you want it to stay up or have dependable service, you almost always have to pay for hosting.


That's where the fee model comes in - its a free market where relays can charge for access.


And that’s the problem: once money is involved, there’s a lever for real-world authorities to use.


Not with the lightning network. It's anonymous.


How does Bitcoin cope with the fact that the DVD key (and probably a few other interesting things) are stored on the blockchain?


It copes by whoever did that being anonymous. The same method as any other unsolved “crime”. In terms of network persistence of the data, it would be a gargantuan and fruitless effort to go after every bitcoin node operator on the planet in every jurisdiction they operate in. So Bitcoin copes by its very evasive design.


Do you mean 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 ?



because "bitcoin.com" isn't running the blockchain, responsibility is diffused. OPs point is even with distributed infrastructure, the portal serving end users has a name and address attached so legal departments know who to serve.


I don't even know how to sign up... lol

there's an "nsec" field which i have no clue what it is

there's a "connect with nsec" button which again, i don't know what it is.

and then there's "login with extension" button which does nothing.


For you and others following. Common in early nostr apps. The web-extension spec is defined in https://github.com/nostr-protocol/nips/blob/master/07.md. Most apps check for window.nostr, then fail silently when it's missing or blocked. There are also some popular extensions in that list.


Yeah, onboarding could use some love. This happens a lot with Nostr projects. It's built by Nostr nerds for Nostr nerds and to them "nsec" is super obvious. They really should NOT ENCOURAGE PASTING NSEC as it is not secure and explain how to generate an nsec and how to use a browser extension / wallet to log in.


Yeah, you're probably better off getting setup with a nostr account on https://primal.net/home or Damus. You'd need a nostr extension for the extension button to work


decentralized anything never works at scale, this is what all the techie founders never grasp. what happens if someone uploads a child porn video or cartel beheading video on your website? because of your algorithm ll stack things by watch time it ll get to the front page in no time. What measures/controls do you have because your site explicitly says "we can't strike, shadow-ban, or demonetize you just because we disagree"


The problem with decentralized is more of UX and latency than moderation, IMO.

Just look at Mastodon. The issue is not the crazy content you get from time to time. What’s annoying is waiting for media to appear on your timeline and explaining newcomers that they must choose a server and the double @@ thing.

The second is a one-time thing at signup and perhaps surpassable. The first is a deal breaker. Anyone used to Instagram and TikTok’s timeline would just dismiss it as broken on the spot.


I think of those as priorities for when you need to start focusing on each one. Latency is a huge deal for starting to use a service, moderation affects what happens after people do start adoption. You have to get big enough to attract spammers, organized trolls, etc.


waiting for media to appear on your timeline

What do you mean by this?


Loading a picture from one small instance to another takes tens of seconds, practically dial up speeds.


I wish it was tens of seconds only. Most of the time, I get tired of waiting and open the browser version where, for some reason, it loads.


Here i was thinking TikTok was broken by not doing it.


I just used something called “the internet” to read your message. As opposed to one of those corporate owned networks for computer-like devices from the eighties.


And with which ISP did you reach that "internet"?


One belonging to a bazillion different entities globally. One of a handful I can choose from locally.


Those are all corporate owned, no?


wait, AOL isn't the Internet?


Bitcoin, a decentralized something, is the 10th largest global market cap asset - $855b. Gold is#1 at $13T. Mortgage backed securities are $11t, for reference.

That to me is working at scale, and all the “what ifs” you’re referencing have happened to Bitcoin, but it is still around since 2009.

Edit, as someone else commented - we are also all talking via the internet, at its core a decentralized technology of combined infrastructure, routing protocols, and DNS tracking. The presence or involvement of centralized entities doesn’t count against that fact.


Just because it's not bannable doesn't mean you can't stop advertising it on the front page. Same way mastodon instances are moderated even though you can't stop people from creating instances with their own content. (It's not ideal, but neither is centralised moderation)


As evidenced by how Fediverse works (Mastodon for example); The networks actively ban bad acting networks, have very active set of moderators on each network, etc. How is this any different from centralized thing?


The major difference is that people can choose a different network if they are unhappy with the moderation from any specific network.

A channel on youtube can't just decide that they are unhappy with the moderation by youtube and replace them with an other moderation team. They can leave youtube, but then they also loose access to existing subscribers on the site.

Youtube users can also not decided they are unhappy with the moderation of youtube and whitelist videos or channels that youtube have blocked. They can leave youtube, but then the channels also need to leave or the user will loose access to videos.

The distinction between centralized power and decentralized power is how much power each actor has in the system. In a decentralized system the user control who they want to see, the content creator control who can access their content, and the network control what content the network will advertise to users. In a centralized system the network control everything, and neither the user or content creator can overrule the network.


The Nostr website basically makes fun of this aspect of Mastodon.

https://nostr.com/comparisons/mastodon


Oh, well, I should've read the fine print. My bad.


This is the kicker people reaching for federation miss. Federation just means you may have more moderators running around moderating more copies of all the same data.

Federation has a few pros for sure, but avoiding moderation isn't one of them. If anything its harder to know who is doing the moderating and where to look if you think things may be quietly being banned or buried.


> decentralized anything never works at scale

I'm pretty impressed by this thing called 'the internet'.


While your point is valid, I think the "propagate all ledger entries to all nodes" kind of decentralized is different than the "route around broken nodes" kind of decentralized. I'm guessing GP meant the former not the latter.


That's not actually how Nostr works. It is a hub (relay) and spoke (client) architecture where clients can connect and publish to N relays. No ledger and no propagation.


Nostr isn't a blockchain...


The internet isn’t decentralized the same way: you have single authorities managing routes, DNS, etc. and - critically - unlike blockchains you aren’t trying to have a single global consensus across the entire system. If my ISP updates my IP, nobody else needs to see and process a transaction, there’s no quorum, etc. That trustless design is what makes blockchains so expensive to use.


The internet isn't really decentralized and realistically it cannot be.

Submarine cables are owned by companies, T1 ISPs provide the majority of routing and you really cannot prevent any of this.

Centralized control is somewhat required because submarine cables cost money and transit costs money and small companies simply do not have the capital to do that.


From what I understand of nostr, if there is CP or hate speech etc. the relays would be incentivised to remove it in the same way say a collection of PHPBB forums would be if someone uploaded it there. Not sure on the legalities though, in terms of if the relays are liable. Not sure if all relays would support video. So to be guaranteed to keep your video you would need ti self host. Which is technical and/or a monthly cost if someone makes it convenient.

I don’t think Nostr is like blockchain where you cant remove or mutate data. Although a spammer might make it hard.


Relay liability is going to depend on knowledge. What’s going to happen in practice is that someone at, say, the FBI gets a lead that something prohibited is being accessed in some group and they’re going to look for evidence. If your IP serves them anything dodgy, they’re not going to roll the SWAT team (probably) but they’re going to see if they can find evidence that you are an active participant before they contact you or your hosting company.

What’s going to happen after that is going to depend on what they’ve found and how innocent/unaware you look, and your reaction. They don’t raid Dropbox’s hosting center because it’s unlikely that a large business is a secret criminal front operation and they have an established practice of sending warrants and getting information or takedowns but if you’re a single person or small business there’s more room for doubt and they might be more aggressive. If you do look like an innocent whose service is being abused by criminals, I’d expect the initial impact to be only blocking that material / user and turning over all of the information that you have about their activity. If that keeps happening, or you tell them that you don’t keep logs, etc. that might change to them thinking you’re actually trying to help their targets, and the next time it happens might be less charitable.

Anyone operating a relay should think about how that’d look sad what the damage could be: don’t run it on hardware you couldn’t afford to lose if it’s seized as evidence, your business partners and people you live with need to know & accept the risk, and you want to think carefully about the personal impacts of any investigation. For example, if you work at a school or church running a Tor exit node is probably a bad idea because even an investigation finding nothing could have significant damage to your reputation since there’s always that “what if he just hid it well?” question which can’t be un-raised.


Images are not stored on relays, so they would not be targeted. The image hosts have the liability, not nostr.


Nothing in the decentralized design prevents an host from blocking one video. By "we can't strike, shadow-ban, or demonetize you just because we disagree", he simply meant that the net prevents that. Like tor, a relay cannot be held liable for content on the tor network.


You hope they cannot be held liable. That doesn’t mean that you can’t be raided, or have to defend yourself against charges of illicit content being found in a computer you use, or accusations that you’re knowingly supporting crimes. A lot of that is going to depend on the service and how much visibility you have into user activity - a caching storage node is going to be riskier than forwarding encrypted packets, for example.

Here’s an example of some privacy activists:

https://news.sophos.com/en-us/2016/04/07/couple-hosting-tor-...

Maybe you’re super ideologically committed to providing a privacy service and willing to take the risk, but you still want to soberly consider those risks and think about the impact if it’s harder to defend yourself than you thought. It’s not a casual decision.


Er… how long since the last exit node SWAT raid?


so you want an 8 yr old child who mistakenly might have opened the home page of this website to go and manually block the video so that he cant see the video after he saw it?


Host, not user. The host blocks it. Host has moderators the same way as Twitter does.


The replies to your comment point out what is technically feasible but not how it could actually work at any scale.

Part of the “job” that software like FB and YT and Gmail for that matter perform for users is to make so-called graphic content a non-issue.


Let's be fair, though - most people using a censorship-resistant decentralized video platform are explicitly doing so to share and access "graphic content." Or at the very least consciously don't mind encountering such content on free speech absolutist principles alone.


Email is decentralized. The client provides the spam protection and moderation.


Email is a fantastic example of something that's technically capable of being decentralized but in practice has something like 70%+ of all traffic handled by three major companies (Google, Microsoft, and Apple). No one can stop you from making your own email client and using it, but your emails will most certainly get black holed and discarded as spam by most major services much more frequently.


Well it's still decentralized and scales in that there is significant competition participating in an open protocol. Even though most use the big 3, many smaller players have enough legitimacy to be whitelisted by gmail, e.g. fastmail and protonmail. But for fully custom, sure gmail is annoyingly aggressive these days, but it's not a black hole, the emails still send and more importantly receive. Does anyone other than spammers send cold email? I usually am receiving or replying. When I do send cold, it's to someone who is expecting it so they will check their spam or already have me in their contact list so it doesn't go to spam. It's not for everyone or for all situations, but fwiw I've found it very useful to exercise the fully distributed nature of email for personal and professional reasons, so I would still defend it as a fair example of a distributed protocol that scales :).


Except BitTorrent which been going strong for 20 years now...


and do you know what most people use bit torrent for ? "think , mark think..."


>decentralized anything never works at scale

Ever heard of blockchain ? And don't tell me its a very precise case, blockchains are used for a lot of things


Yes, and they scale poorly. See the part where people fill warehouses with GPUs causing global shortages and lopsided power demands.


The ethereum merge happened over a year ago and it's not the only PoS network now. Feel free to complain about BTC, but for blockchain in general it doesn't make sense.


PoS addresses only part of the inefficient architecture. You’re no longer needing hundreds of power plants to operate a niche financial service, but you still have the storage needed to store every transaction (which is also a huge privacy risk) and the incredibly low transaction rate. These systems are hugely expensive to operate relative to their almost non-existent real-world usage.


> blockchains are used for a lot of things

Yeah? Like what?


Some examples: Cryptokitties, payments on dark net, crypto scam ICOs


I think it's also used for cold storage.

Only if they have basic it skills though


ever heard of something called DNS?


Makes me wonder if LBRY went with Lightning instead of creating a shitcoin token they would probably still be around today and maybe even integrating with Nostr.


My quasi-skeptic approach to cryptocurrency:

- Build it without crypto

- If you build it with crypto, base it off Bitcoin.

Anything else might as well be a product based on a pump-and-dump shitcoin. There is only one cryptocurrency, and Satoshi is its prophet.


Agreed, though Satoshi isn't a prophet or messiah. Just a pseudonym.


It was a tongue-in-cheek reference to There is only one God and Muhammad is its prophet.


LBRY is doing just fine* with Odyssey.com

* as fine as an alt-YouTube ever does


It's https://odysee.com by the way, did make me think they closed down for a sec.


Naw, because LN non-custodial UX sucks, and custodial wallets are being disabled in the US.


WTF is a "34235 client"?

But, regardless, how's this better than PeerTube?


I think that's a typo for "any of the 34235 clients", where 34235 is a stand-in for "large number" (there are lots of nostr clients).

Nostr is interesting because it's not actually P2P, just decentralised - whether that's a good thing is open to question.


In this case 34235 client refers to `kind 34235` events. In nostr, different event types are distinguished by kind numbers, so clients can be built and filter for events of a certain type. For example, the content shown on a twitter/microblogging client, should not be the same as the content shown on a YouTube like client.


That's super usable!


It's better if you think Nostr is superior to ActivityPub.


Nostr has numerous NIPs or Nostr implementation possibilities many of which address the concerns below: - nsec: a user name / password option has been created- although I think there are numerous “normies” who go are over the password login pattern - moderation: at least two clients have implemented moderation NIPs and open sourced their code for expanding the capabilities - CSAM: there are separate services that host media content and partner with CSAm filtering tools to provide the basic filtering you would receive on FB etc. - a few clients offer delete - and while nothing ever truly goes away, it can be helpful if the trolls come after someone. - in terms of the content, you already curate some of your other feeds by following and unfollowing people or brands, yes there is a lot of bitcoin content but you can optimize your feed to see other types of content.


Can some one explain how to create an user account? WTF is nsec?


Nostr is a protocol for the decentralized sharing of Notes and Other Stuff (Through Relays). Nostr uses private keys for accounts, and nsec is such a key.


You can get started on nostr here: https://nosta.me/


A terrible website. Vibrant white letters peeking out from the disorganized backdrop.


A private key. Kinda like GPG.


This could really use RSS feeds for channels and playlists so that I can follow publishers that I find. Right now there is so little interesting channels that I will never remember to check back. If I could subscribe via RSS I wouldn't miss a video.


How is the infrastructure and bandwidth paid for?


>How is the infrastructure and bandwidth paid for?

For bandwidth intensive usage such as video, it will probably be "paid relays" instead of free ones. Click on url in the "Popular paid relays" paragraph to see examples:

https://nostr.how/en/relays

Nostr is popular with the cryptocurrency community so the payment mechanics seem to favor Bitcoin and/or Bitcoin Lightning.


It's really not popular at all and it's growing linearly in terms of users (death sentence for a social) yet completely flat (suspiciously flat in my opinion) in terms of adoption.

https://stats.nostr.band/


Nostr is only popular with Bitcoin maxis. Nobody else cares about Nostr.


Its popular with people who understand the importance of decentralisation


Right. And that is why Stella Assange and Matt Taibbi are on there... because they are bitcoin maxis. /s


The "notes" (non-video content) are hosted on relays like everything in Nostr.

The media is hosted on regular web servers and it says you can host it anywhere. It seems like most of the videos are hosted here: https://nostr.build/

Which is a paid service backed by AWS S3


Paid relays look like they cost on average 5000 lightning, which is estimated at $65 USD currently, and that's a one time fee (until they get recurring payments set up, I'm guessing most relays will convert to that).. but flare in their FAQ recommends getting 8-10 relays.


I love that nostr identity is not tied to an instance (unlike activitypub/mastondon/fediverse)! However ignoring some (IMO) fundamental problems (because they are not problems until you hit scale) like hosting, somewhat moderation and letting that be solved "layer above" is a mistake (IMO) it will probably create non standardized APIs for paying for hosting or sth.

As for community it is heavily based on bitcoin/lightning enthusiasts and a lot of content revolving just around that - probably won't attract people outside the circle/general public (which may not be the goal or preferable outcome!)


I think Bluesky/atproto has a reasonable compromise in this department. At any single point in time your identity is bound to a specific instance, but that binding is mutable.


You might be surprised on how relatively popular it is among some Japanese users. They have their own clients and relays and most of them are not even into Bitcoin.


Saving you a click: this is a video sharing platform built on oh-so-legit crypto/bitcoin/nft protocols/stacks, and the value-add (!) is that it's not moderated. What could possibly go wrong.


The operating costs of a video platform are huge, who pays for all of this?


The uploader through lightning invoices.


How is it not DOA? Youtube pays the uploaders for their content.


Can the uploader charge for viewing the videos?


How are the videos hosted? Is the server FOSS? I'm curious to know how it all works behind the scenes. Is it just a video host that slaps nostr on the label, like YouTube but notified followers via nostr instead of RSS, or is this actually sending and storing videos using nostr relays or some other way?


Cool, you built your own YouTube with hookers and coke and... bitcoin. Lots and lots of bitcoin. Cause lord knows there's literally (checks notes) dozens of people out there clamoring for an "Anti-censorship" streaming platform where they can watch spammy bitcoin videos.


How do you plan to attract users? Users come for content and creators come for users.


Heads up, I have "block newly registered domains" configured in my NextDNS site, so I can't resolve flare.pub.

For the future, might be good to register the domain a little while before the launch to avoid this.


How long should the domain be up not to be considered new?


90 days.


> For the future, might be good to register the domain a little while before the launch to avoid this.

Or you can just disable it, they don't need to delay launch just because some guy has his DNS configured that way


I'm just saying that if you want to reach a maximal audience it helps if your domain is older than 90 days as it isn't considered "new" then by some DNS providers.


Have you tried disabling that option? It should fix the problem!

:P


I know how to get access to the site, but blocking newly registered domains is a good security practice as it defeats a lot of scams.


Wasn't aware this is a thing. Thanks for the tip.


Also affects email delivery. There are common mail rules to score mail coming from domains less than X days old. I had an issue with that this week.


Sorry but I click on the website and I get stuff about bitcoins and other crypto and this immediately discredits it for me


When you hover the video it takes too long for the controls to appear.


Cool! Could you please allow for searching by URL parameter. Then I can link it from the video section on topics at https://conze.pt Thanks!


> Like YouTube, Flare lets you upload, view, comment, and like videos from your favorite creators. BUT unlike YouTube, we can't strike, shadow-ban, or demonetize you just because we disagree

Oh, this will become another lair of hate speech, conspiracy theories and all kinds of content noone will want to touch with a stick, eh?


I didn't know what nostr was, so I clicked the link[1] and I found this gem:

> Because Nostr accounts are based on public-key cryptography it's easy to verify messages were really sent by the user in question.

If you think asymmetric encryption makes anything easy, you're missing the point.

If you have a reliable way to know other peoples public keys, and there's a way to repudiate them, asymmetric encryption can make things somewhat secure (that is, until private keys get stolen and after the theft has been detected), but that's a very big “if”, and getting a decent UX generally involves some kind of centralization, be it keybase or Certificate Authorities.

[1]: https://nostr.com/


I half agree, and half disagree. I agree that users need some kind of management tools to deal with public key crypto, shouldn't be copying private keys into apps, and there needs to be recovery from lost keys. It is a hard problem and nostr has a long ways to go.

I disagree that you need a "reliable way to know other peoples public keys." I think this puts the cart before the horse. And doing it that way, public certification authorities who say "I certify this key belongs to this person" can't be trusted anyways, so it doesn't really work (and as people do trust them for practical reasons, but shouldn't, they have enabled widespread TLS MitM by governments). It is rarely the case that you know someone and then you discover someone claiming to be them and you need them to prove their identity (which is BTW totally possible in nostr already). What usually happens is you learn the key first, and over time learn who that person is and develop intuition and trust about them through experiences that occurred via that key.


so basically a democratized youtube?


I think a federated YouTube would be more accurate


Fascinating to me that religious weird conspiracy posts are almost immediately the largest portion of videos.


There are no algos. You are supposed to curate your feed. Global is there just for convenience. Mute that npub and you won’t see any of this again.


Sure, but that's a different thing than what I said.

It doesn't matter that there's no algorithm. It is just interesting to me that outlandish Christian conspiracies about the end of the world/angels/etc. are almost immediately being uploaded to a brand-new platform.

That has nothing to do with how content is delivered?


But that doesn't reflect on the platform. It's just the next random thing uploaded.

In case you think nostr is saturated with "outlandish Christian conspiracies about the end of the world/angels/etc", I've been on nostr more than a year and have encountered exactly zero of them.


Friendly reminder that "Nostr", just like all things with a missing vowel like this, is spelled "Nostrrrrrrrr" with the 'r' imitating an old vehicle's motor for a few seconds.

It's the way the users of this pattern want and like it.


Maybe they'll do like the bird site: Nostr -> Noster -> Z


Beautiful! Nice work! Super applause!


> BUT unlike YouTube, we can't strike, shadow-ban, or demonetize you just because we disagree

Ah, right. Too much content moderation is the biggest problem with YouTube. /s


>Too much content moderation is the biggest problem with YouTube.

But controlling what you see is easy! Just don't watch it. As opposed to controlling what you can't, which you are at the mercy of YouTube to provide.

Or is it that you want to control what other people see?


You can also control what people can't see on nostr, by simply rejecting/deleting any messages from relays or ids you don't like. This isn't a big problem for something like plain text because it's cheap to run a relay that only stores text but if you're letting people upload/download video... That gets expensive fast.


Yes. Most reasonable people don’t want anyone sharing CSAM, for example.


Agree that there are things we don't want to exist, but by your logic internet should have been forbidden a long time ago.

This can be said for so many situations:

Most people does not want cars to crash into Christmas fairs either.

But the solution is not to ban cars.

Most people does not want kids to be bullied at school.

But the solution is not to ban schools.

Etc.

You can say we have laws about cars. Yes, but those laws aren't enforced by Ford or Volkswagen. Edit: or by Shell or Exxon for that matter.

There will be laws about content on internet even if Google can't willy nilly remove the channel of Warthog Defense because it hurt some russians feelings.


> Most people does not want cars to crash into Christmas fairs either. But the solution is not to ban cars. Mist people does not want kids to be bullied at school. But the solution is not to ban schools.

Right! And the solution also isn’t “fuck it. Too complicated to do perfectly. No discipline in schools / no traffic laws”.


Decentralization does not mean anarchy. The discipline and the laws come from the bottom up. Also, they are usually better than the ones imposed by a central planner because they can be developed faster and within the context of the social norms and culture of the people who are subject to it.


Decentralization doesn't mean much of anything on its own. There are "decentralized" setups that do moderation fairly well (e.g., Mastodon or most oldschool web forums, where there's ultimately someone accountable). This (Nostr), specifically [1], makes fun of such setups.

To moderate any system, there must be affordances for moderation and someone(s) accountable to the users of the system. As far as I can tell, like most blockchain projects, the Nostr project has effectively stripped (nearly) all affordances for doing moderation. Given that the Nostr audience seems to overlap considerably with crypto enthusiasts, I think their stance is basically the same: no moderation, no "censorship", etc. Given that there's literally child porn stored on the Bitcoin blockchain right now, I don't think your argument holds that "decentralization" can just Jeff Goldblum it and "find a way" without explicit affordances / accountability.

[1] https://nostr.com/comparisons/mastodon


Nostr makes fun of the idea that you can have centralized moderation and moves it explicitly to the relays. It is up to the relay owner to determine what is allowed or not.


Which practically means unanimous agreement is needed among all relays in order to moderate anything. I also don't see what incentive / accountability relays face to remove content. So... I don't see that strategy being particularly effective. But hey! If more than a couple dozen people wind up actually using the thing, guess we'll find out!


> Which practically means unanimous agreement is needed among all relays in order to moderate anything.

No, it means that the people will tend to congregate around the relays that work according to what they expect/want to see.

You are thinking from the assumption that things are only acceptable if total compliance is enforced. Even on the highly-controlled and regulated Internet there is still abhorrent content out there, why would you expect that from the alternative?

The interesting question is: do you think that the majority of people don't see this side of the internet because of how effective the centralized control and policing is, or just because the majority of people are not interested in seeing this content in the first place?


> The interesting question is: do you think that the majority of people don't see this side of the internet because of how effective the centralized control and policing is, or just because the majority of people are not interested in seeing this content in the first place?

Both! Most people don't want to see beheading videos and would be very upset if one came across their Youtube recommendations. Fortunately, YouTube's "CENSORSHIP" is pretty good at not showing such videos (even though they're completely legal content!)

However, there is a significant long tail pool of people who are totally into watching such abhorrent content (e.g., 8channers), and could easily cause a deeply offensive content to find itself in the unmoderated "Democratically trending" video feed, as it's demonstrated in the Flare example walkthrough.

Maybe that's your point? Platforms like these will necessarily be used pretty much exclusively by people who like or will tolerate seeing extremely offensive content because everyone else will be put off by the occasional display of horribleness.

Libertarian "DON'T CENSOR ME, BRO" havens like 8chan, kiwifarms, daily stormer, etc. already exist. They're not particularly popular, when compared to the likes of Twitter, Facebook, Instagram, etc. But they're certainly popular enough to draw millions of users. And every one of them would be delighted if they could post their inflammatory nonsense on Facebook or YouTube to reach a wider audience. And Facebook and YouTube have wider audiences because they moderate content.

In a previous life I worked building popular social media apps that included user-generated content. And I saw first-hand how horrific content moderation is. The shit people post to social media sites is as vile as it is vast. I'm certain most "anti-censorship" people's opinions would be changed if they'd watched an actual content moderator do their job for 30 minutes.


The point that I am trying to make and I am not sure you are getting: if we take the decentralized system as the Internet and the different social Networks as "relays with autonomy over their own content", isn't that already an example that that each subnetwork gets to enforce the policies that their own communities value?

The problem I am taking with your view is that shows a not-so-subtle hint of totalitarianism. It tries to use the abuses caused by people with freedom to justify that we all should lose our liberties (or accept that global subjugation to a common set of rules as inevitable.

Yeah, currently all platforms that promote "censorship-resistance" are predominantly used by those who got affected by large -scale censorship. Yeah, most of these people are doing or saying despicable things. But that should not be an argument to make the case that centralized platforms and worldwide gatekeepers are the best solution.

To repeat: you keep arguing like the enthusiasts of decentralized platforms are "anti-censorship", when in fact the fight is about claiming back some sense of autonomy and agency to let people be able to do the moderation/curation themselves (or to someone closer to them who understands their values and social context better)


> The point that I am trying to make and I am not sure you are getting: if we take the decentralized system as the Internet and the different social Networks as "relays with autonomy over their own content", isn't that already an example that that each subnetwork gets to enforce the policies that their own communities value?

Yes. I agree that this model can, and does, work. Mastodon and old school web forums were the examples I gave upthread where they do work. And I believe these work because forum owners / mastodon server owners have the capability and necessary incentives to moderate content posted on their subnetworks. As I understand Nostr's design (relays / clients), and its explicit citation that Mastodon's model is bad because "3rd party (server hosts) can censor you", I do not believe your success model is applicable. Nostr relays lack the incentive and accountability needed to moderate content much the same way Bitcoin miners do.

> The problem I am taking with your view is that shows a not-so-subtle hint of totalitarianism. It tries to use the abuses caused by people with freedom to justify that we all should lose our liberties (or accept that global subjugation to a common set of rules as inevitable.

Holy slippery slope, batman! Global Totalitarianism! Believe it or not, there exists a middle ground between total "LIBERY!" freedom! Moderate yourselves, nerds! and endorsing a Global Cabal of Media Reviewers.

What I completely reject is that the primary problem with YouTube, Facebook, and the like is that they're arbitrarily censoring "views they don't like". The handful of examples of this I've ever seen have been comically obvious censorable material, or actual very difficult decisions that it's completely reasonable to understand why the decision was made. I have many other concerns about these mega-tech companies that I find infinitely more troubling than their current content moderation practices. At the end of the day, these companies are accountable. If nothing else, you have the option to leave! See Twitter. Embracing decentralization for the sake of decentralization only complicates this accountability, potentially to the point where no-one has any appreciable accountability (a la Bitcoin, again).

What I also reject is the implication that this is a simple problem. The Paradox of tolerance is a thing, and it's just plain complicated. And not something decentralization—or any other technology—can solve.

> To repeat: you keep arguing like the enthusiasts of decentralized platforms are "anti-censorship", when in fact the fight is about claiming back some sense of autonomy and agency to let people be able to do the moderation/curation themselves (or to someone closer to them who understands their values and social context better)

I think you and I actually have a lot in common in that respect. I'm a big Mastodon fan, run my own #HOMELAB to reclaim ownership of my data, do the whole POSSE thing, etc. I'm all about all of this stuff. What I reject is this perverse idea that the biggest problem with big tech is that they're just haphazardly censoring ideas they don't like (it's always conservative ideas). It's little more than a conspiracy theory that's led to virtually every social media platform today happily platforming actual Nazis (because of the free speech, you know?) and forbidding such taboo things as sex workers, critics of the CEO, etc. These are decisions. And platforms like Flame exist for basically one reason: to further propagate the conspiracy that big tech (like the mainstream media, colleges & universities, etc.) are just completely and irrationally biased against poor old conservatives who just want to, like, share their opinions, man.


The (main) criticism of the Mastodon model is that your identity is still centralized. The federated model is fine, but the whole thing still depends on domain names which can be seized.

And this issue is not just about moderation. Let's say that you have been a model citizen on a server, but one of the moderators woke up in a bad mood, found something they don't like about you and kicks you out. Now you are locked out of your account and can not even migrate it away. FYI: not an hypothetical, this happened with some of my friends who were working with crypto.

> the biggest problem with big tech is that they're just haphazardly censoring ideas they don't like

To me, the problem is that they are too big, plain and simple. Too big, too powerful and too far removed from their actual customers to even care about the individual customer or anything that slightly deviates from the norm. I don't like them much like I don't like the EU-style of bureaucratic government.

What (I hope) nostr is trying to build is something where the centralization is outright impossible first, then come out with the mechanisms to tackle content curation/moderation.


Why compare against neo nazi and shock websites?

Why expect everything to end in "trending" feed?

Telegram has solved this problem a loooong time ago.

Those who want beheading and castration videos subscribe to russian and arab channels.

Those that doesn't goes elsewhere.

And if one of them shows up in the comments of a sane channel we report them and they are gone.


Exactly right. I don't understand why people miss this detail. Maybe Google does have too much power over how content is served, but this isn't a fix, at all.


No, but the solution is hopefully much closer to traditional western style punishment of switchboard operators who listen in or interfere and far far away from Stasi style mandatory snitching?


Good thing we tend to put people who share CSAM in jail, preventing them from doing so in the future, solving this problem for the rest of us.



Just because it's not THE biggest problem doesn't mean that it isn't A problem.

More specifically not YouTubes moderation itself but the way in which its systems can be abused.


Right. But “lol, we’ll just get rid of moderation, bro” is an incredibly naive and dangerous non-solution.

I think it frustrates many stereotypical “tech bro” types that there exist problems that are difficult or impossible for technology to solve. Content moderation is a messy business. But it’s necessary business.


Getting rid of centralized moderation and unilateral censorship is not the same as "getting rid of moderation, bro".


I hard disagree. And you cannot stop us. #resist


I'm sorry but this is just a galactically bad idea.


Thanks for your feedback bro, means a lot.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: