[wmf]

P2P with end-to-end encryption over relays existed in 2001 (e.g. Groove, Mojo Nation) and wasn't invented by Nostr.

Nostr is so simple because it handwaves away the fact that everybody seems to use the same small set of relays and there's nothing stopping them from censoring the network. I'm also not aware of any incentives for the relay operators either.

[eykanal]

This exactly. Worth mentioning that "censoring" can occur in any of a number of ways; blocking select traffic, slowing select traffic, "forgetting" specific nodes, redirecting other nodes at will, performing MITM attacks (if the protocol isn't secure), etc etc.

Also, beyond just no positive incentives, there are nontrivial negatives... they're hubs for an entire network, which can be a lot of traffic and bandwidth if peers are sharing anything other than text. That's a potentially significant cost for literally just being a dumb router. The idea of charging for this doesn't make sense... you don't choose a router, it's automatic based on location, so there's no incentive for quality. That ends up being a race to the bottom, which there's no room for arbitrage; prices are driven down to near-zero profit.

Abuse-wise, the model is fundamentally flawed. Economically, the idea kinda works so long as hub traffic is low enough to be swallowed in background noise for whoever manages the hub. Beyond that the model breaks pretty quickly.

[shark_laser]

Read up on the outbox model and zaps. Also check out Bitchat for a real world example of Nostr being effectively used without even requiring Internet connectivity.

You cannot censor Nostr.

Also, check out how zaps work, and relay authentication. You can charge for relays if you want.

[acdha]

Can you summarize how those prevent the listed problems? Tossing around absolutes like “you cannot censor Nostr” sounds like a religious assertion rather than technical analysis.

[shark_laser]

I have posted very similar replies to other messages in this thread and don't want to repeat myself too much at the risk of being considered spam.

But... Outbox model prevents censorship because you push your (cryptographically signed and so impossible to impersonate) messages to multiple relays. To your own preferred relays, as well as to the preferred relays of others who are involved in the conversation, as well as to a couple of global relays for easy discoverability.

These global relays are useful, but are interchangeable and totally replaceable. As soon as you've connected with someone you can retrieve their updates, because you know their preferred relays, and can query them directly.

In this way Nostr has the benefits of centralised networks for discoverability, federated networks for communities, and private individual web site for p2p and archival purposes. As well as making it impossible to censor.

And if you take down THE ENTIRE INTERNET in order to censor Nostr? Well, Bitchat is Nostr via Bluetooth Mesh Networks. Do a quick search and find out where and when it has been used (Nepal, Indonesia, and elsewhere)

And as for zaps fixing the economic problem, I'm not sure what else to say other than you can give and receive value directly using the Lightning Network. It is seamless in most Nostr clients, and built into the Nostr protocol. If you don't believe in Value For Value (v4v) then you can just charge a fee, and the economics problem is solved.

[shakna]

Encrypted but not always leak proof. [0] There have been viable attacks for relays to perform.

[0] https://eprint.iacr.org/2025/1459

[nunobrito]

NOSTR is a protocol that doesn't detail all implementation details so it wouldn't be fair to point HTML as culprit for flaws of web browsers.

That is a good paper, the leaks are mentioned the app Damus (notes browser) which wasn't really much worried about verifying the authenticity of the notes. The details: https://crypto-sec-n.github.io/

These are apps developed on free time and made available for free so these issues are bound to exist and be repaired.

[pjc50]

> You cannot censor Nostr.

A government could make it illegal to run or connect to nodes. It could DPI traffic in and out of the country, and block known nostr relays. Or it could just mandate that smartphone manufacturers block it, which would take out a large fraction of potential users.

(How does nostr avoid hosting known CSAM? Because that is the one thing that law enforcement will definitely come after)

[supermatt]

> You cannot censor Nostr.

Sure you can. A relay operator absolutely can censor what goes through their relay. More to the point, you cant even prove that such censorship has occurred.

Nostr is censorship resistant in that you can publish to multiple relays, but that is far from censorship-proof.

[MangoToupe]

Could this be run by, say, a public library or are there concerns about liability?

It also seems like this is sort of reinventing email.

[nunobrito]

The concept of public library are the "super-relays", which are always available and basically accept any note you send their way.

It is "kind of" like reinventing email with PGP. Main difference is that you can choose to send the message in plain text with a cryptographic signature that proves it was sent from you or full encrypted like PGP.

There is still (in my opinion) a disadvantage when compared to PGP: key rotation. Once you create a key pair in NOSTR it is your identity forever, whereas in PGP you have mechanisms to declare a key obsolete and generate a new one.

In overall PGP failed over the last 30 years, sharing public keys with other people was always the biggest difficulty for real adoption. With NOSTR this process is kind of solved but we are yet to see about adoption.

[attila-lendvai]

signing and encryption are separate operations also in PGP.

and yes, one of the hardest parts of this domain is the implementation of the web of trust (key management).

[nunobrito]

You are correct that it existed well before, the difference is that it was always complicated to use. Heck, we have been able to send PGP emails since almost 30 years ago.

The innovative concept is that npub/nsec along with sending notes is trivially simple. The content does not need to encrypted, there is a huge value on publishing clear text messages that are crypto-verifiable. You also didn't had this feature on groove and others. I'd argue that NOSTR has indeed pioneered them into mainstream.

[wmf]

there is a huge value on...

You could say that if Nostr was successful but it isn't. Nostr has <1% the DAU of Bluesky.

[nunobrito]

And yet here we are talking about NOSTR, again. :-)

[attila-lendvai]

PGP can also sign clear text messages.

[treyd]

Email is currently more decentralized than Nostr is in practice.

[telephone3]

"I have been self-hosting my email since I got my first broadband connection at home in 1999. I absolutely loved having a personal web+email server at home, paid extra for a static IP and a real router so people could connect from the outside. I felt like a first-class citizen of the Internet and I learned so much.

Over time I realized that residential IP blocks were banned on most servers. I moved my email server to a VPS. No luck. I quickly understood that self-hosting email was a lost cause. Nevertheless, I have been fighting back out of pure spite, obstinacy, and activism. In other words, because it was the right thing to do.

But my emails are just not delivered anymore. I might as well not have an email server.

(After self-hosting my email for twenty-three years I have thrown in the towel, Carlos Fenollosa, 2022)"

From the article, quoting this other article

https://cfenollosa.com/blog/after-self-hosting-my-email-for-...

[camgunz]

If you do all the stuff (DKIM etc) AND you're not on a banned IP, you're fine. It seems like this person couldn't find a non-banned IP. I know plenty of people who self host email and successfully send to Gmail.

[abc123abc123]

Yep. Know plenty of selfhosters who run email successfully. In fact, with all the email in a box packages out there, it's never been easier to self-host emails. One recommendation for those who are interested, is to choose a reputable VPS host with clean IP:s.

[dahrkael]

considering most people today only use 3 or 4 big email providers i can see the exact same happening for nostr, the p2p part seems more like a gimmick than a protocol requirement

[digitalbase]

It's actually advised to use 3/4 relays in your clients

Using NIP-65 (https://github.com/nostr-protocol/nips/blob/master/65.md) you can broadcast a note to the network to mention your preferred relays.

Most clients fetch that note when you first sign in and make sure you connect to your preferred relays

[shark_laser]

Nostr has the benefits of centralised networks for discoverability, federated networks for communities, and private individual web site for p2p and archival purposes.

As I have said in other replies to this post, read up on the outbox model. Global relays are useful, but are interchangeable and totally replaceable. As soon as you've connected with someone you can retrieve their updates, because you know their preferred relays, and can query them directly.

And there are incentives to running a global or community relay. Read up on Zaps. With Nostr, you can give real value via the lightning network, and it is built into the protocol. This allows you to charge for usage if you so desire. And then there's all the other reasons why people run community web sites or global services.