el

Martti Malmi

sirius@iris.to

developing iris.to

326 Following

19.3k Followers

Notes
Replies
Articles
Curations
Videos

Martti Malmi

20h ago

What format are clients using for public chat ids? bech32 note / nevent?

See translation

0

1
0
0
0

Martti Malmi

1d ago

I wonder if I butchery would be a good side hustle for an introverted carnivore coder.

See translation

5

8
0
0
8

Martti Malmi

2d ago

No biggie, but NIP-28 channel metadata event should have been a tag-replaceable event instead of kind 41? Only latest is to be stored. https://github.com/nostr-protocol/nips/blob/master/28.md#kind-41-set-channel-metadata

See translation

1

2
0
0
21

Martti Malmi

3d ago

Vibe coding. Cursor agent nailed blurhashes on 1st try.
el

See translation

1

7
0
0
100

Martti Malmi

3d ago

Can we do lightning or cashu based multi-hop physical packet routing where couriers are only paid on confirmed delivery?

Same could work for network routing, but multiple paths can be tried simultaneously, and fastest wins.

See translation

2

3
1
0
0

Martti Malmi

1w ago

"You" tab is good for smiles. @Jeroen ✅

See translation

3

8
3
0
0

Martti Malmi

1w ago

@Alby is it possible to use https://github.com/getAlby/bitcoin-connect without having to show this popup every time you open the app
el

See translation

4

5
0
0
0

Martti Malmi

1w ago

Martti Malmi

1w ago

Is anyone working on AI agents that can order stuff from any online store that takes credit cards, and you would pay the agent in Bitcoin? I think there was some company in Poland that does this manually.

See translation



I was thinking of doing this in Finland, but then you'd be a money transmitter and probably have to do KYC, which trashes the UX and defeats the purpose.

Setting up BTCPay Server or https://opennode.com for my favorite online stores might be a better way to make them accept bitcoin. Help them with bitcoin storage, exchange and accounting. The EU kindly doesn't yet require KYC from them.

What would be even more rad? Crawl online stores onto Shopstr, let users send orders that are paid in Cashu. Notify merchant of pending orders and let them redeem the nuts. User can reclaim the payment if merchant did not respond.

See translation

7

6
0
0
0

Martti Malmi

1w ago

Is anyone working on AI agents that can order stuff from any online store that takes credit cards, and you would pay the agent in Bitcoin? I think there was some company in Poland that does this manually.

See translation

6

17
1
1
0

Martti Malmi

1w ago

Briar: "Censorship-resistant peer-to-peer messaging that bypasses centralized servers. Connect via Bluetooth, Wi-Fi or Tor, with privacy built-in." https://briarproject.org/

Would be cool to have bluetooth & wifi sync on native Nostr apps. Would be useful in offline situations and countries where the internet is censored.

See translation

18

66
18
1
103

Martti Malmi

calle 👁️⚡👁️

2w ago

We've tried rate-limiting Cashu mints with PoW but turns out if you want mobile phones with javascript to compete against DoS servers, the server always wins...

I'm convinced now that the only practical use of PoW is Bitcoin and it's better to use sats to slow things down.

See translation

6

32
8
0
408

Martti Malmi

tomasz

2w ago

My @Mullvad VPN ran out of time. Topping up with Lightning literally took me 2 seconds and payment was processed instantly. Why can't all online payments look like this?

See translation

44

79
15
1
474

Martti Malmi

calle 👁️⚡👁️

2w ago

Tap-to-pay with CashuBTC ecash — for bitcoin.

Fiat credit cards nailed the UX: fast, offline, works anywhere.
I always wanted that for Bitcoin.
Now it’s open-source. Private. Instant. Beep, done.

In the video: two Cashu wallets for bitcoin.

Left: @Minibits (PoS)
Right: cashu.me (payer)

Ecash is sent directly via NFC — no internet, no delay. Beep, boop.

Ecash is a bearer token — the money lives on your device, not on a server. That’s why it pairs so well with NFC. Pick an amount, tap to send. No talking to servers. No syncing. Just push it over. The payment is pretty much instant. A PoS can accept ecash from any mint and receive payments via Lightning.

Still early days, but we’re experimenting. Card-to-phone works, but phone-to-phone? That’s the real killer use case.

Apple

... See more

See translation

53

236
97
2
49.9k

Martti Malmi

3w ago

See translation

6

35
2
0
45

Martti Malmi

3w ago

Eivør & Heilung in Helsinki last week
el

See translation

5

15
0
0
63

Martti Malmi

calle 👁️⚡👁️

4w ago

Everytime I zap someone vie Lightning from my wallet, it takes 5-10 seconds for the zap to settle and for everyone to see it happen on nostr.

Everytime, I think "this could've been an instant nutzap". "Tap, boom. Tap, boom. Zap zap zap. I would be zapping so much more."

The reason a nutzap is instant is obvious. At this point, I hope that everyone knows that a Cashu nutzap is just an instant transfer of an IOU from one user to another.

Let's step back and look at a pure Lightning zap on nostr for a second. We all know that the vast majority of Lightning zaps is effectively an exchange of one custodial IOU against another one as well. Most people use custodial wallets. So why is it still so slow? It's the Lightning settlement between the two custodians that often takes

... See more

See translation

64

91
11
3
2.9k

Martti Malmi

3w ago

I enabled zap receipts from pubkeys outside your social graph (like many zap receipt issuers are) and now most zaps are visible again on iris.to.

I'm terrified of the possibility of fake zap receipts, but for some reason no one has spammed them yet 😄 Maybe at least nip05 should be checked for zap receipt issuers, although that's not a long term solution.

See translation

3

8
0
0
500

Martti Malmi

3w ago

Also added a bunch of zapping & wallet improvements. If you're using the Iris cashu wallet, it's now in the background and you can manually wallet-connect it and one-click-zap with it. Working on auto.

Martti Malmi

4w ago

iris.to replies and quotes might be targeting correctly now, finally

See translation

See translation

1

5
1
0
21

Martti Malmi

4w ago

iris.to replies and quotes might be targeting correctly now, finally

See translation

1

6
0
1
0

Martti Malmi

4w ago

Routing it through a CDN or nginx might be the easiest way to add it

See translation

0

0
0
0
0

Martti Malmi

4w ago

See translation

1

1
0
0
0

Martti Malmi

4w ago

@brugeman can we get brotli / gzip to nostr.band apis? 🙏
el

See translation

1

2
0
1
0

Martti Malmi

BTCHEL 2025 🇫🇮

4w ago

‼️ Speaker announcement ‼️⁠

Co-founder and CEO of @Blockstream , @Adam Back , invented Hashcash, the proof-of-work algorithm cited by Satoshi Nakamoto in the Bitcoin whitepaper, as the future basis for its mining function.

Follow BTCHEL to stay updated on more! 🙏🏼

el

See translation

0

2
2
0
1

Martti Malmi

4w ago

It would provide an alternative to centralized push services as well

See translation

0

2
0
0
0

Martti Malmi

jack

4w ago


el

See translation

368

503
124
23
63.6k

Martti Malmi

Martti Malmi

Mar 18, 2023

400g steak in San Jose

el

See translation

0

13
1
0
221

Martti Malmi

4w ago

@calle 👁️⚡👁️ thinking about how to best do Cashu zapping in iris.to. Maybe keep Cashu open in the bg in iframe, nostr wallet connect to it, but send events over postMessage channel (in addition to relays?)

See translation

2

9
1
1
0

Martti Malmi

4w ago

Aika hyvä / ganska bra

See translation

0

3
0
0
0

Martti Malmi

4w ago

Creation of Bitcoin with all its mystery makes for a very good story. Many autofiction artists have embraced it.

See translation

1

8
0
0
84

Martti Malmi

4w ago

Unfortunately that story is fiction

See translation

0

1
1
0
0

Martti Malmi

4w ago

...str@iris.to spam bots are not visible on iris.to 😆

See translation

0

0
0
0
0

Martti Malmi

4w ago

Social graph filtering reduces new user visibility, but at least you don't see reply bots on iris.to

See translation

1

5
0
1
21

Martti Malmi

4w ago

Mid-answer, Cursor started spitting out a 10-page Kubernetes config in Chinese, with username and all. LLM glitch or Cursor security issue?
el

See translation

3

14
2
0
42

Martti Malmi

1mo ago

I guess reaction custom emojis are more popular than custom emojis in kind 1 note

See translation

1

1
0
1
0

Martti Malmi

1mo ago

Added nip-30 support for kind 1. I don’t see them used much though. Mostly some mostr.pub enthusiasts.

See translation

2

1
0
0
0

Martti Malmi

1mo ago

Added emoji reactions via long press

See translation

2

3
0
0
0

Martti Malmi

1mo ago

post custom emojis for testing

See translation

3

2
0
0
0

Martti Malmi

1mo ago

See translation

5

7
0
0
250

Martti Malmi

1mo ago

This is easy and we can do it today. If MLS becomes available at some point (for web also) and works better, we should use it instead. MLS is more complicated and I see a risk there, but I'm happy to be proven wrong.

See translation

0

1
0
0
0

Martti Malmi

1mo ago

Sounds unnecessary but fun, I'll add it!

See translation

1

2
0
0
0

Martti Malmi

1mo ago

el


Double ratchet tests passing in my Damus fork. Yet to properly hook it into Damus UI and event system. https://github.com/mmalmi/damus/tree/doubleratchet/damus/Models/DoubleRatchet

See translation

4

12
1
0
1.0k

Martti Malmi

1mo ago

That would be great! NIP:

Martti Malmi

1mo ago

Double ratchet NIP — Signal style DM encryption on Nostr. Deployed on https://iris.to

1mo ago • 8 min read

NIP-117: The Double Ratchet Algorithm

Martti Malmi



Double ratchet invites:

1mo ago • 2 min read

NIP-118: Nostr Double Ratchet Invites

Martti Malmi



Github PR https://github.com/nostr-protocol/nips/pull/1813

See translation

See translation

0

1
0
0
0

See translation

1

2
0
0
0

Martti Malmi

1mo ago

el

See translation

5

9
0
0
0

Martti Malmi

1mo ago

For example, double ratchet is easy and lightweight to add to a chat widget on a web page. Less than 100KB bundle, including dependencies from nostr-tools. Actually, it could perhaps be included as a nip library in nostr-tools.

See translation

0

1
0
0
0

Martti Malmi

1mo ago

npub1zuuaj

1mo ago

Replying to @elsat

Nip04 worst XS
Nip17 ok S (this is gift wrap)
@Martti Malmi signal stuff good M/L
MLS best L/XL

See translation



I agree with this. It's better to use MLS if it works reliably and is not overly complicated to use as a library. Double ratchet's advantage is simplicity: it's fairly easy to implement on all platforms. I think it makes sense to try both and see how it goes. Maybe both have different use cases.

See translation

1

2
0
0
0

Martti Malmi

1mo ago

Shared nostr private key sending DMs to self is one goofy way of group chatting. Backward compatibility (works on most clients), plausible deniability, can post anonymously, scales to infinite number of users. Just need to coordinate creating a new group each time members change or want to rotate the key.

See translation

0

0
0
0
0

Martti Malmi

1mo ago

I haven't done groups yet, but we can do it like signal: Group members send their group-specific Nostr public key & symmetric decryption key to all other users in the group. Rotate key now and then, at least when users leave the group.

Also for multi-device use we can do like Signal: have multiple double ratchet sessions with your own devices and devices of others, send to all of them. https://signal.org/docs/specifications/sesame/

See translation

1

4
0
1
0

Martti Malmi

1mo ago

Kek, I didn't know how Nostr works and used 30078, without "d" tag, and wondered why my double ratchet DM events were not properly stored or relayed. Works much better now with kind 1060.

See translation

2

5
0
0
42

Martti Malmi

1mo ago

Added content settings option to disable autoplay

See translation

0

1
1
1
0

Martti Malmi

1mo ago

Are master keys needed? What if we had just multiple keys of yours that sign each other.

That of course increases the client-side hassle of identity management: clients would have to decide what keys have enough verifications to belong to the same identity (or revocations). Possible social verifications / revocations on top of that.

See translation

1

0
0
0
0

Martti Malmi

1mo ago

Good luck regulating encrypted messaging on Nostr web apps and relays

npub14slk4

1mo ago

Signal's CEO: "We're leaving Sweden"

Sweden's government is pushing through new legislation that forces Signal, WhatsApp, and all other messengers to SAVE all messages for the government to gather. Signal is pushing back. [1]

Once again, I encourage you to check out our recent podcast on Mullvad, whose home is in Sweden, and this exact criticism was laid out (predicting this news story based on the past votes). And that was the least of the criticisms. [2]

Simplified Privacy has no bank accounts and no registration with any country for this exact reason. And that's why encryption as identity tools, such as Nostr and PGP-arbitration-registration, are our true home.

Podcast:
[2] https://podcast.simplifiedprivacy.com/mullvad/index.html

New Story on Sweden:
[1] https://swedenherald.com/article/signals-ceo-then-were-leaving-sweden

See translation

See translation

2

18
6
0
573

Martti Malmi

1mo ago

True. Iris alleviates it by showing a checkmark based on social graph distance and hiding users that are not in your social graph at all.

However, that doesn't prevent someone in your social graph from changing their name and avatar to impersonate someone else.

Nip05 doesn't prevent that either, unless you notice the discrepancy between their nip05 and other details.

One solution would be that users publicly record the name and other details of other users at the time of follow. The details recorded by yourself and people you trust would be shown, even if the user changed it to something else.

See translation

0

1
0
0
0

Martti Malmi

1mo ago

(from same author)

See translation

0

2
0
0
0

Martti Malmi

1mo ago

MLS also rotates keys after every message?

See translation

2

0
0
1
0

Martti Malmi

1mo ago

Personally I'm not much into nip05. It's based on the centralized DNS. It's useful for manually checking the account is related to site like like petertodd.org, but I don't think it makes sense to show a checkmark for every account that has some random nip05.

See translation

2

7
0
1
0

Martti Malmi

1mo ago

Iris shows a purple checkmark for users you follow, orange for users followed by at least 10 users you follow, and gray checkmark for 1-9 followers you follow. Peter's nip05 doesn't work in browsers because CORS is not configured.

See translation

0

3
0
2
0

Martti Malmi

1mo ago

"Initial message to public invite is from anonymous sender, but publicly visible": to clarify, existence of the message is publicly visible but content is encrypted of course.

See translation

0

3
0
0
0

Martti Malmi

Fascinating

1mo ago

Two AI agents on a phone call realize they’re both AI and switch to a superior audio signal ggwave

See translation

29

106
32
2
422

Martti Malmi

1mo ago

Thank you, that would be great!

See translation

0

1
0
0
21

Martti Malmi

1mo ago

Thanks for the PR! Is NIP-96 going to be continued, or are we converging on blossom? Are the hash formats compatible? Sorry for noob questions.

See translation

2

2
0
0
0

Martti Malmi

1mo ago

Double ratchet rotates message keys after each message, so previous consecutive messages from the same author become undecryptable, when the previous message key is discarded after decryption. It's a small difference, but it's good for disappearing messages.

See translation

1

2
0
0
0

Martti Malmi

1mo ago

It's separate: MLS and Double ratchet are different solutions to the same problem. MLS is more complicated, but better suited for large groups.

See translation

2

0
0
0
42

Martti Malmi

1mo ago

Sometimes you might need to refresh to see the first reply from someone 🤷‍♂️

See translation

0

2
0
0
0

Martti Malmi

1mo ago

Yes. Key is an identifier, identity is a collection of identifiers and non-unique attributes that are associated with each other.

See translation

0

1
0
0
0

Martti Malmi

1mo ago

It's a bit of apples to oranges comparison. Idk how Larry got hacked, but chances are that it was something other than compromised device. He might not have been hacked on Nostr. Compromise of Nostr key is unrecoverable unlike compromise of X account, but chances of it happening might be lower.

See translation

0

0
0
0
0

Martti Malmi

Martti Malmi

1mo ago

Surprisingly, I don't recall a single instance where anyone's Nostr account was hacked. Entering your private key into an insecure app would be the most obvious way how that could happen.

Compromise of a popular app would be bad. Maybe we'll need app and device specific keys signed by other keys of yours at some point.

However, Nostr doesn't have the traditional attack vectors associated with passwords, email, SMS and third party account recovery, which is already very good.

npub1cj8zn

1mo ago

Parker really doesn’t like Nostr lol
el

See translation

See translation

12

32
5
0
33

Martti Malmi

1mo ago

Surprisingly, I don't recall a single instance where anyone's Nostr account was hacked. Entering your private key into an insecure app would be the most obvious way how that could happen.

Compromise of a popular app would be bad. Maybe we'll need app and device specific keys signed by other keys of yours at some point.

However, Nostr doesn't have the traditional attack vectors associated with passwords, email, SMS and third party account recovery, which is already very good.

npub1cj8zn

1mo ago

Parker really doesn’t like Nostr lol
el

See translation

See translation

12

32
5
0
33

Martti Malmi

1mo ago

It seems fast and does a good job preserving feed scroll positions. 3-column layout has its advantages on a large screen. However, I suggest other devs join Iris instead of developing their own client 😄

See translation

1

0
0
0
5

Martti Malmi

1mo ago

The screenshot is from Coracle

See translation

0

0
0
0
0

Martti Malmi

1mo ago

iris.cx

See translation

1

1
0
0
0

Martti Malmi

1mo ago

Nice! What kind of paint did you use for exterior walls?

See translation

0

0
0
0
0

Martti Malmi

See translation

13

181
38
1
3.1k

Martti Malmi

KoalaSat

1mo ago

el


2 Android devices syncing notes by using Negentropy via Bluetooth

el

See translation

3

32
5
0
63

Martti Malmi

1mo ago

🇺🇸

See translation

0

9
0
0
12

Martti Malmi

1mo ago

Unfortunately not, it's an implementation based on nostr keys, events and nip44 encryption from nostr-tools.

See translation

0

1
0
0
0

Martti Malmi

1mo ago

I want to add groups as well.

MLS seems better for large groups or "share to friends" use case. It just seems quite complicated and requires a lot of code, whereas double ratchet is super simple now that I finally figured out how to do it on Nostr.

Still I might take a shot at MLS on typescript at some point. We need a browser compatible version if we want to use it for sharing Nostr content to private audiences.

See translation

0

3
0
0
0

Martti Malmi

1mo ago

It's quite similar to Signal's "double ratchet with header encryption" but encrypts the headers with Nostr keys instead of rotated symmetric keys. https://signal.org/docs/specifications/doubleratchet/

See translation

1

5
0
0
0

Martti Malmi

1mo ago

Nostr-double-ratchet tests finally passing. Both ratchets should be working now, but don't take my word for it 😄

Signal-style 1-on-1 chat encryption in ~200 lines of typescript. Now just need to make it work again on iris.to and then other clients. https://github.com/mmalmi/nostr-double-ratchet

See translation

2

32
12
1
1.6k

Martti Malmi

2mo ago

Yes 🍻

See translation

0

2
0
0
0

Martti Malmi

2mo ago

Locally generated follow & mute stats

See translation

4

26
5
2
29

Martti Malmi

2mo ago

el

See translation

9

93
17
2
4.5k

Martti Malmi

Dec 13, 2024

I want all apps like Mullvad VPN: paid with bitcoin. Account is just a random number: no email, phone number, street address, credit card etc. required.

See translation

13

107
12
1
4.5k

Martti Malmi

Oct 14, 2024

Fug... now that I'm home, I woke up last night to reflect on past cringes. On the main stage panel in Amsterdam I forgot what I was about to say (how to make money with Nostr) after already starting my answer and ended with "and umm yeah [awkward silence]". Should have re-asked the question.

I'm quite sensitive to cringe, but fortunately those moments have been mostly off stage since Slush 2014 which was pretty bad (or maybe I just haven't noticed). I'm not the best speaker, but I'll try 😄 Come see me in Lugano next week!

See translation

13

43
2
0
3.7k

Martti Malmi

Oct 11, 2024

Secure DMs and groups might be how Nostr wins. Like Signal, but better: no phone number or centralized service provider needed. Actually there are no publicly visible user IDs involved, so in that regard it's similar to simplex.chat.

Unlike public messaging, DMs do not depend on the network effect. Great for onboarding people and keeping them returning with push notifications. They get a bitcoin wallet, zaps and all the other Nostr greatness on the side.

Many people don't want to let go of their existing follower base on X, but "Nostr DMs only" is easier to do. I could imagine that becoming a thing in the Bitcoin scene at first.

See translation

110

240
49
2
16.8k

Martti Malmi

Sep 22, 2024

See translation

6

104
10
0
2.3k

Martti Malmi

Sep 10, 2024

Some people in my network are following bots so it can be a bit annoying at times. Need to add mute lists to the feed & social graph.

See translation

3

11
1
0
0

Martti Malmi

Sep 6, 2024

Now it's replicating the original post. Still wanna filter by regex, or maybe consider WoT? 😄

npub17as80

Sep 6, 2024

Replying to @Bitcoin Mechanic

Spam everywhere today on here.

Anyone wanna pretend this is all "valid use of the protocol" and not abuse or we only do that with spam on Bitcoin? wss://relay.wellorder.net

See translation

See translation

14

7
0
0
100

Martti Malmi

Sep 1, 2023

el


Riga Old Town

See translation

0

3
1
0
0