pip
Pip the WoT guy

simplifying the social graph so you can focus on building great experiences

Public Key

npub176p7sup477k5738qhxx0hk2n0cty2k5je5uvalzvkvwmw4tltmeqw7vgup

NIP-05 Address

Profile Code

nprofile1qqs0dqlgwq6l0t20gnstnr8mm9fhu9j9t2fv6wxwl3xtx8dh24l4auspzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqg5waehxw309aex2mrp0yhxgctdw4eju6t0qyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqfuvs47

Publishing to

relay.nostr.band

relay.damus.io

relay.primal.net

Author Public Key

npub176p7sup477k5738qhxx0hk2n0cty2k5je5uvalzvkvwmw4tltmeqw7vgup

Show more details

Last Notes

2026-02-27 15:55:57 UTC

- reply

Awesome work man! For search, you could integrate @nprofile…jku2, which would give the same search results as npub.world

2026-02-06 16:45:24 UTC

- reply

dude, where is the 2nd result in NymRank? Is that an impersonator? What if you search for "John", you find only 1 "John" in the world?

2026-02-06 16:42:07 UTC

- reply

It's actually very hard for a bad bot to get more than 10 idiots to follow it. So for most practical scenarios, it does and will work.
Graperank, in the CURRENT form, is not contextual and so it would not be a meaningful improvement (if an improvement it is).
If Graperank has evolved from the last time I checked, send me a link to the code.

2026-02-06 14:28:29 UTC

- reply

They are below the real one, and even below other (relevant) profiles.

2026-02-06 13:31:13 UTC

- reply

You keep forgetting that Vertex deals with link farms.
1. Vertex does not dumbly crawl all events, builds a graph and computes Pagerank. It crawls based on hard to fake internal metrics. A person can include only a few bots, and those bots can't include others. It takes a week to even being able to add a few bots from the moment one got included.
2. Vertex computed acyclic Pagerank, so the classical "I follow you, you follow me" strategy is nullified. Walks can't be acyclic.
3. Vertex supports personalized algorithms as well.
I think this is probably the third time I tell you this. If you want more details about how it works you can check the code.

2026-02-05 13:08:33 UTC

- reply

There is a list for that.
It's not a mega vulnerability, but it's a vulnerability caused by the fact that blossom auth doesn't allow to scope the token to a particular audience.
Nostr Web Tokens allow that, and are indeed very simple, as they are inspired by JSON Web Token which are commonly used for these type of things.
The new blossom Auth spec (BUD-11) will just add the server tag, which is fine and fixes it. In my own framework I'll just support both.

2026-02-05 13:01:07 UTC

- reply

not at all, it's an attack a malicious blossom server (not relay) can perform against users

2026-02-05 10:30:54 UTC

- reply

Name consistency or hate for communism. Which way western man 🤣
#nevent1q…s44x

2026-02-05 10:29:41 UTC

- reply

There is a potential of a replay attack with DELETEs, because tokens are not scoped to any particular server.
Check blossom PRs

2026-02-05 09:05:32 UTC

- reply

whose turn is. It's kind of important

2026-02-05 08:58:19 UTC

- reply

You would be able to use regular Auth events or NWTs for every request. Different validations based on the event kind.

2026-02-04 22:10:07 UTC

- reply

My new framework called blossy is perfect for building that.
Auth is not well implemented because blossom Auth is insecure and currently being rebuilt.
I'll add support for Nostr Web Tokens tomorrow.
https://github.com/pippellia-btc/blossy

2026-02-04 09:54:12 UTC

- reply

Ideas on how to distinguish moltobot npub vs normal npub?
What's a bot badge? Btw if no one follows the bot, I don't even see it

2026-01-30 22:01:34 UTC

- reply

Ferrari always wins tests. Mercedes is totally the favourite this year.

2026-01-30 21:59:00 UTC

- reply

yeah sir, let's talk about it

2026-01-28 14:44:44 UTC

- reply

Totally 💯

2026-01-28 13:22:36 UTC

I just used @nprofile…28r9 by @nprofile…td2a to publish a long form article. The experience was flawless, absolutely perfect. I just had to copy-paste the markdown and voila', it all worked.
This is what highlighter and others should have been.

2026-01-28 13:07:39 UTC

- reply

right decision

2026-01-27 18:38:14 UTC

- reply

is it just me or the audio doesn't work?

2026-01-27 18:37:14 UTC

- reply

I use and like hertzner.

2026-01-27 09:10:11 UTC

- reply

Example of the replay attack.
- Alice wants to change her blossom server from Server 1 to Server 2
- Alice mirrors all blobs to Server 2
- Alice then sends a DELETE for all her blobs on Server 1
- Server 1 is malicious and replays all the DELETEs( with all the Auth events) to Server 2
- Result is a complete data loss
The Auth scheme is being reworked by @nprofile…sd0e and I so it will be fixed

2026-01-26 16:47:31 UTC

✨ Meet blossy
The easiest way to make custom blossom servers come to life.
Think blossom server that support ecash, WoT gating and more.
All so easy to use that your LLM is going to one-shot it (probably 😝).
https://blossom.primal.net/a0ac480a1ab2987ac7ce37c9a09720a013ef9c27c6328e3b4a9ba6ecbdf97f52.mp4

2026-01-23 07:39:30 UTC

- reply

This is phenomenal UX
#nevent1q…ga45

2026-01-23 07:33:13 UTC

- reply

WTF I'm exited
#nevent1q…9qjc

2026-01-20 10:37:40 UTC

- reply

I agree. I never understood why asciidoc should be preferred. I can write markdown manually, but I don't know asciidoc, so I should learn it which is not a great value proposition

2026-01-17 23:56:59 UTC

- reply

I'll definitely try it. Thanks for making it and sharing shawn

2026-01-17 15:20:50 UTC

- reply

Yeah 😂
I was just curious because the thumbnail it's close but not quite the real Jeff

2026-01-17 02:04:48 UTC

- reply

Thumbnail doesn't even look like Jeff

2026-01-16 10:28:35 UTC

- reply

I tend to be deliberate in the choice of libraries I use. A few that have become part of my go.
- github.com/joho/godotenv
- github.com/caarlos0/env
This is a set implementation I made for small collection of items. Particularly handy because it's faster than a map for less than 1000 elements, with less allocations too.
- github.com/pippellia-btc/smallset

2026-01-15 14:13:17 UTC

- reply

Yo Ver. In the Vertex relay, COUNTs only count tags that have been indexed. For the sake of efficiency I am not indexing "p" tags.

2026-01-13 21:15:05 UTC

- reply

ahahahaha

2026-01-13 17:51:21 UTC

- reply

Thanks mate, I appreciate.
I think changing kind is the best way to deprecate the old auth, otherwise there will be confusion and people will try to support both the old and the new spec.

2026-01-13 17:49:53 UTC

- reply

yeah, I tend to agree. I just choose to copy the JWT semantics, but maybe we can afford the full string

2026-01-13 17:48:38 UTC

- reply

or whatever other encryption scheme for that matter.

2026-01-13 17:47:45 UTC

- reply

No encryption specified in the spec, but it can use NIP-44, or being sent using White Noise.
https://github.com/nostr-protocol/nips/blob/master/44.md

2026-01-13 15:12:52 UTC

- reply

Link to the NIP PR
https://github.com/nostr-protocol/nips/pull/2187

2026-01-13 15:08:13 UTC

- reply

@nprofile…tfpf we can improve blossom auth

2026-01-13 15:04:57 UTC

Improving signing UX while fixing a replay attack in Blossom.
👋 Say hello to Nostr Web Tokens.
https://blossom.primal.net/0c8193e58b189d6bf16d937f6957c95a4c8a4564d76638d15397108856c529ad.mp4

2026-01-13 13:21:17 UTC

- reply

That's a good take. Yeah the best as you said would be to categorize these users, giving the option to remove from the stats the non-reputsble according to some threshold and ranking algorithm.
Let's continue this convo on Signal

2026-01-13 11:00:33 UTC

- reply

exactly, unless you use a WoT service provider like Vertex to determine the reputation of the user, which is determined by other people that already have reputation.

2026-01-13 10:41:49 UTC

- reply

DHH knows how to make cool stuff, and how to market it. Love it!

2026-01-13 10:41:08 UTC

- reply

This is cool, but I feel there is a TON of bots and fake profiles causing inflated metrics.
You show the new users of yesterday are 35k, but according to my metrics only ~300 are reputable (followed by at least one reputable).
This would also explain why the retention is basically at the bottom.
I am willing to give lifetime access to @nprofile…y38p so you can filter out some of the crap. WDYT?

2026-01-13 09:00:34 UTC

- reply

I'm on Omarchy in my laptop and I'm loving it! The fact that everything is a config is great because I can store my custom configs in repository and boom, I can change machines and have the same setup!

2026-01-12 23:53:15 UTC

- reply

This is awesome. More practical solutions like this would be super beneficial to Nostr
#nevent1q…2qge

2026-01-12 23:03:48 UTC

- reply

Re read my previous message. I am saying default, not always

2026-01-12 16:57:39 UTC

- reply

Me: I think it's bad to display the scores in general. The default IMO should be not to display them
You (quote): You want to use these scores in the background but pretend like you’re not?

2026-01-12 10:42:32 UTC

- reply

Nutmix is becoming one the best cashu mint implementation.
Kudos to Leito for the great work!
#nevent1q…2ua8

2026-01-12 10:40:09 UTC

what is the best NIP-07 extention signer with multi key support?
#asknostr
I have been using alby but now it cleared all my pubkeys and I don't know how to re-import them from their nsecs

2026-01-12 08:22:38 UTC

- reply

Mate, you are misreading what I am saying, again. I haven't even mentioned Vertex, because it's not relevant in any way to this conversation. The provider is totally and absolutely irrelevant.
I am talking about HOW to display these ranks. I don't like the idea of displaying them, whether they come from Vertex, or Brainstorm, or whatever.
Design discussion.

2026-01-11 22:34:24 UTC

- reply

The DM example IS filtering.
If you do it manually every time, based on the score you see on the screen, one could send you 1M DMs...
What I am saying is that we can hide the numbers from the head of people, and place a threshold selection in settings and teach how to use it.

2026-01-11 11:50:06 UTC

- reply

What's your Elo? I am curious because these types of mistakes are made I would guess by sub 1200.

2026-01-10 09:22:24 UTC

- reply

I am talking design and UX.

2026-01-09 23:38:05 UTC

- reply

sorting and filtering, not ranking

2026-01-09 11:37:27 UTC

- reply

Yeah :)
#nevent1q…7twt

2026-01-09 10:07:49 UTC

- reply

exactly

2026-01-09 08:52:16 UTC

- reply

I don't think scores on the forehead are a good idea. It's objectifying people, as if any algorithm is going to be 100% precise in capturing the very contextual notion of trust.
But they don't have to be shown, they can simply be used to increase signal and decrease noise, magically, and in the background.
#nevent1q…d5xa

2026-01-08 13:43:02 UTC

- reply

I've built rely, which is a framework for building very custom relays.
It's not plug and play but you can do anything with it.
https://github.com/pippellia-btc/rely
If you choose to try it and find some issues or the docs aren't clear, let me know, I'll gladly help!

2026-01-08 13:42:24 UTC

- reply

2026-01-07 22:47:11 UTC

- reply

I like this!

2026-01-02 13:22:56 UTC

- reply

Another great article by @nprofile…u8g0, this time on the Web of Trust.
Nostr is accomplishing what PGP could never do: establishing and maintaining a network of cryptographic identities that vouch for each other, thereby enabling the development of a reputation system.
This is huge
#naddr1qq…5t4t

2026-01-01 23:18:37 UTC

- reply

Great food for thought. I would have appreciated more insights, and I think many others would share this belief

2026-01-01 03:22:22 UTC

GM good year

2025-12-30 13:45:39 UTC

- reply

Solving equations is much more important than learning how to lay taxes

2025-12-29 10:09:46 UTC

- reply

Badass cypher legionary.

2025-12-28 09:04:24 UTC

- reply

npub.world/stats

2025-12-28 08:59:29 UTC

- reply

because you are squinting your eyes to read code

2025-12-28 08:52:10 UTC

- reply

writing a token bucket (no leaky) it's actually pretty simple

2025-12-22 23:34:31 UTC

- reply

Thank you for the kind words. @npub1clk…pup9 is a great host

2025-12-20 19:08:43 UTC

- reply

yes this is true.
The UX for builders is not where I want it to be, but there is so much to build and I have to prioritise

2025-12-20 15:57:59 UTC

- reply

Yes, this is a good idea.
You would have to use an API key in the client, which is the same as loading credits on a nostr key and using it in the client. It's basically the same

2025-12-20 13:56:06 UTC

- reply

but what's the difference between signing in and connecting your wallet with NWC?
I argue that the first is even easier, and it's free.

2025-12-20 01:47:42 UTC

- reply

At the moment no queries unless you sign with a nostr key with credits.
At the beginning it was totally open and in 2 weeks since the launch I got people abusing it, so I had to gate it somehow.
Yes it could be zap based but I would still have to check if your key has zapped vertex, so still sign in.
I could accept ecash in the request, but then your user would have to have a wallet, which imo is more selective than a sign in

2025-12-19 14:31:57 UTC

- reply

the query "max" didn't return great results....
Check out npub.world for a great search experience. That client is powered by @nprofile…jku2, which has a free search api

2025-12-19 13:25:00 UTC

- reply

In the future I'll be looking at replacing go-nostr, and this seems a good library for it.
Just a few comments:
1) ID, Pubkey, Sig imo should be specific types of [32]byte or [64]byte, all represented as string with the method Hex(). This would allow inspections of individual bytes which I think might be useful.
2) Filter.Limit, when unspecified I think it should be MaxInt, because an unspecified limit means "give me everything". Similar to Since and Until, this would allow to avoid pointer checks and simply using comparison operators.
if filter.Limit > 1000 {
filter.Limit = 1000
}

2025-12-19 13:13:07 UTC

- reply

yeah, I like this approach. It's what I'm following already, but not at the same level of categorization
- library for data structures (now go-nostr, but not for long)
- relay framework = rely (was, messages, relay logic)
- database (nostr-sqlite)

2025-12-19 13:10:55 UTC

- reply

I have mixed feelings on it. It's very cool but also it doesn't reach the DX I would love. I'll borrow a few parts and credit your work

2025-12-19 09:56:24 UTC

- reply

yes I don't like go-nostr either. In the future all of my project will migrate to a minimal library.
Where can I check your work?

2025-12-19 09:55:30 UTC

- reply

feedback taken.
How would you do it if you were in me?

2025-12-19 00:55:55 UTC

- reply

you can make whatever database you want and it will fit into rely.
Take a look it's super modular, which I agree it's a very important property of code

2025-12-19 00:43:38 UTC

- reply

Nip-46 does
Client <--> public relays <--> Signer
And instead you are saying that it should be
Client <--> Signer
So you remove a roundtrip. For the authentication, the easiest to code would be the client sends an event signed by the employee key, signer validates signature and rules, and returns the same event signed by the company key.
Using traditional auth is going to be I think more complex and less secure.
I could build this with rely relatively easy

2025-12-18 17:10:53 UTC

- reply

why not having it read-only open to everyone

2025-12-18 17:07:31 UTC

- reply

yes. So the credits are linked to the key that signed the event.
Any reputable key on nostr gets 100 credits / day. If the user is signed out you would have to hardcode a key.
But actually I would just ask the user to sign in.

2025-12-18 16:57:59 UTC

- reply

you can use this endpoint called RankProfile, either by DVM (websocket) or API (http).
https://vertexlab.io/docs/endpoints/rank-profiles/
you just choose the sort algorithm to be "followerCount".
And in the content of the response you get everything you want.

2025-12-18 16:16:27 UTC

- reply

it requires me a sign in

2025-12-18 14:58:43 UTC

@nprofile…ueh9 I lost reference to your nostr library. I can't find it in your gitlab. Could you please share the link?

2025-12-18 12:51:58 UTC

- reply

bro wtf I want this

2025-12-18 10:37:13 UTC

- reply

for spam there is WoT. Providers like @nprofile…jku2 are making it easy to use WoT in different clients

2025-12-17 14:52:43 UTC

- reply

made this is awesome. Real craftmanship at play

2025-12-16 22:27:09 UTC

- reply

use npub.world for your statistics.
nostr.band is no longer maintained

2025-12-16 22:20:33 UTC

With @nprofile…jku2 your client will stop frustrating you with airdrop notifications.

2025-12-13 15:11:43 UTC

- reply

Beautiful
#nevent1q…t4gn

2025-12-12 22:19:50 UTC

- reply

wow. cc @nprofile…3xzs take a look at this UX

2025-12-12 11:01:55 UTC

- reply

no no no. Rely is not on top of khatru, it's a khatru replacement

2025-12-11 23:26:13 UTC

- reply

OK true / false is used in to ack Auth
https://blossom.primal.net/c4c79d2d2349b04a8d2992fa4ce0f17ff74e0f4656f8a21e2949c937a9fbb96c.jpg

2025-12-11 16:31:54 UTC

- reply

nip-42 has an ack which is returning OK true.
In blossom all is happening with http calls, so you kinda have to auth every request, no?

2025-12-11 14:29:22 UTC

- reply

cc @nprofile…tfpf @nprofile…ueh9 @nprofile…9qsr

2025-12-11 14:26:16 UTC

If I am not mistaken I think I've found a vulnerability in the blossom auth spec (second part of this PR).
https://github.com/hzrd149/blossom/pull/87

2025-12-11 10:00:11 UTC

- reply

awww you so cute

2025-12-11 09:27:55 UTC

- reply

I understand now. Yes, all freedoms require agency, but sometimes you have agency and decide the forced option.
Like we consciously decide to pay (some) taxes because not doing so would mean jail.
So like freedom (in a given dimension) = agency + lack of cohertion

2025-12-11 08:42:59 UTC

- reply

This is the content I like