Gzuuus

Forever learning, continuously buidling⚡
cryptoanarchism student
https://nostree.me/gzuuus
#noderunner#Bitcoin | #technology | #art | #electronics

Public Key

npub1gzuushllat7pet0ccv9yuhygvc8ldeyhrgxuwg744dn5khnpk3gs3ea5ds

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsypwwgtll74lqu4huvxzjwtjyxvrlkujt35rw8y026ke6ttesmg5gpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqg4waehxw309ahx7um5wfjkc6t5v4ejummjvueu7r8m

Publishing to

relay.nostr.band

nostrelites.org

wot.nostr.net

Author Public Key

npub1gzuushllat7pet0ccv9yuhygvc8ldeyhrgxuwg744dn5khnpk3gs3ea5ds

Show more details

Last Notes

2026-02-05 19:13:42 UTC

> 341 OpenClaw skills distribute macOS malware via ClickFix instructions
https://cyberinsider.com/341-openclaw-skills-distribute-macos-malware-via-clickfix-instructions/
#nevent1q…4j0m

2026-02-05 19:12:55 UTC

> What I found: The top downloaded skill was a malware delivery vehicle
https://1password.com/blog/from-magic-to-malware-how-openclaws-agent-skills-become-an-attack-surface
#nevent1q…t65h

2026-02-05 10:35:47 UTC

> An AI Toy Exposed 50,000 Logs of Its Chats With Kids to Anyone With a Gmail Account
https://www.wired.com/story/an-ai-toy-exposed-50000-logs-of-its-chats-with-kids-to-anyone-with-a-gmail-account/
#nevent1q…9fay

2026-01-28 09:30:52 UTC

🍿🍿🍿🌋🌋🌋
> But the optics are rough. A 3-month-old viral open-source project with 60K+ stars just got:
- Legal pressure from an $18B AI company
- Account-jacked by crypto scammers
- Exploited for millions in fake token scams
- Outed for serious security vulnerabilities
All in 72 hours.
---
https://dev.to/sivarampg/from-clawdbot-to-moltbot-how-a-cd-crypto-scammers-and-10-seconds-of-chaos-took-down-the-4eck

2026-01-24 10:54:38 UTC

Hey! posting from grimoire

2026-01-22 07:34:25 UTC

GM🌞

2026-01-21 07:55:05 UTC

GM🕊

2026-01-17 10:47:21 UTC

- reply

Draft wraps? Maybe

2026-01-17 10:26:33 UTC

- reply

Provably yes, what's that spec, is just giftwraps?

2026-01-16 14:27:02 UTC

AI slop will do to your computer the same that mass media propaganda did to your brain
#nevent1q…dwkx

2026-01-16 10:31:27 UTC

nak + grimoire is my nostr dev environment, and it is delightful 🤌

2026-01-15 13:25:10 UTC

- reply

Corre paco, corre corre https://youtube.com/watch?v=dMtEbKCqLxM

2026-01-15 12:42:03 UTC

https://youtube.com/watch?v=cAVMHhxapyg

2026-01-15 08:15:56 UTC

- reply

Well, you are right, but there is a trend of small models that are more and more capable, specially around tool calling and browser use, so they might not be smart, but they can work

2026-01-15 08:05:11 UTC

GM 🌞

2026-01-14 22:17:24 UTC

- reply

Supposedly yes, but haven't tested

2026-01-14 15:17:21 UTC

- reply

Jeje I'll wait you here, send me there if you can 🤣

2026-01-14 13:30:53 UTC

- reply

GM Pete 🤙

2026-01-14 10:15:30 UTC

Woo almost forgot... GM 🌞

2026-01-13 17:42:02 UTC

- reply

If it's free you are the product 😏

2026-01-13 10:03:47 UTC

GM 🌞

2026-01-12 18:24:21 UTC

https://youtube.com/watch?v=mrg5C9eUhZc

2026-01-12 10:58:30 UTC

LFG 🔥 remote login on grimoire 🔥
#nevent1q…8h74

2026-01-12 10:57:31 UTC

- reply

Lfg 🔥

2026-01-12 09:08:21 UTC

- reply

Hey wen in grimoire? My pr still waiting there

2026-01-12 08:11:42 UTC

- reply

GM frann 🫂

2026-01-12 06:58:42 UTC

- reply

Anything would be helpful :) Join the channel https://signal.group/#CjQKIOgvfFJf8ZFZ1SsMx7teFqNF73sZ9Elaj_v5i6RSjDHmEhAB3wO1Rg-0gLNdusnb3wLR

2026-01-12 06:48:45 UTC

- reply

GM🫂

2026-01-12 06:48:32 UTC

- reply

Hey! You mean with coding? There are loads of work to do in contextvm, let me know if you want to contribute and we can chat 👌

2026-01-12 06:31:07 UTC

GM🌞

2026-01-11 21:11:47 UTC

https://youtube.com/watch?v=rHqIKQwrxbw
#nevent1q…dr7j

2026-01-11 21:08:07 UTC

The whole album is 👌
#nevent1q…hz4z

2026-01-11 21:03:54 UTC

🫰 https://youtube.com/watch?v=GxW3Ed7GrhQ

2026-01-11 16:51:42 UTC

- reply

It doesn't support NIP-86, but it could be a good feature to add. On the other hand, the key of this relay is to try not to do manual management, as it is intended to be handled by social dynamics, at least not for all cases, just for refinement and handling of edge cases. The BTC bot is there because some people follow it, and that gives the bot a rank, so for them the bot deserves to be there, which is fine from my pov.

2026-01-11 16:10:57 UTC

Come and hang out at wss://wotr.relatr.xyz ☕Now it should feel way less restrictive. There were some unhandled edge cases around cache refreshing 🤙
#nevent1q…aqgt

2026-01-11 15:09:43 UTC

- reply

The one you create 😏

2026-01-11 10:15:23 UTC

- reply

GM from the next day 🫂

2026-01-11 10:14:55 UTC

- reply

hahaha I don't know if the future, but for sure it's cool

2026-01-11 09:38:04 UTC

- reply

There is one you missed, the bots, but it can be a bit difficult to interpret 🤣

2026-01-11 09:35:37 UTC

- reply

Maybe @npub1hlr…sjwf ?

2026-01-10 10:34:47 UTC

- reply

2026-01-10 10:02:26 UTC

- reply

GM pete 🫂

2026-01-10 09:31:59 UTC

GM 🌞

2026-01-09 18:20:19 UTC

The new version of Relatr features Trusted Assertion capabilities. It is already live on the public Relatr instance, and you can add it to your list of trusted providers through relatr.xyz. We would love to hear any feedback, as this is a new feature. Even though we've tried to make it as complete as possible, it may have some rough edges
#nevent1q…5lme

2026-01-09 08:04:44 UTC

- reply

That's about right. I just use light mode if there is more light around than from the screen. Dark mode under the sun doesn't work

2026-01-09 08:03:01 UTC

GM 💛

2026-01-09 08:02:16 UTC

- reply

The latter. The former is a possibility, but the only way to achieve that is to control the relays where the users publish. So, if you run your own relay and adopt privacy measures, no one that you don't want would be able to psyop you.

2026-01-09 07:56:04 UTC

- reply

Yes, as I mentioned, reject signing these events. The good part about Nostr is that users retain agency; no one can get a signature out of you if you don't allow it.

2026-01-08 15:52:40 UTC

If you care about your privacy, bug the devs of your client to consider better ways to manage this
#nevent1q…kypv

2026-01-08 15:48:10 UTC

- reply

You are right, but I cannot avoid sharing this, as users might not know and it impacts their privacy directly.

2026-01-08 15:40:06 UTC

- reply

hahaha lmao

2026-01-08 14:19:58 UTC

- reply

Hey, that's interesting. I've never heard about this one-shot ECDH. I was digging a bit and thinking about how apps can respect user privacy more. AFAIK, the one-shot approach generates a new derived key each time, which is great. However, for app-specific data where a long-term relationship is expected and it should be possible to recover data without knowing the previous key used, for example, while jumping between different platforms in a multi platform app, this approach might not be ideal.
So, maybe something interesting is that users and apps can generate a stable 'channel' to use for this kind of thing. One initial idea is to use DH where the app exposes a public key, for example, the same one used to sign NIP-89 events. Then, the user, each time the app needs to persist settings or whatever, derives the key using DH and publishes the encrypted data using that key. In this case, the DH secret can be taken as the secret key, and the public key can be derived from it. The only entities capable of knowing where the key comes from are the user and the app.
However, this might work but present some limitations. Instead of a pure DH approach, it could be a deterministic KDF. This way, the app itself can have a stable identifier and use it as a salt, so the user can generate a key pair deterministically without requiring the app to maintain a stable public key.
I don't know, just rambling here, but I think it's a topic worth exploring.

2026-01-08 13:29:44 UTC

GFY != GFY
#nevent1q…w8em

2026-01-08 12:33:01 UTC

- reply

Definitely, or even obfuscated with a derived key. It would be nice if signers came with a 'derive' method so that apps could request derived keys. Of course, this is nuanced and would require the user to set some policies, but in general terms, I think it could be interesting for obfuscation.

2026-01-08 11:30:23 UTC

- reply

People tend to have wrong conceptions about what they don't understand. Some see devs as gatekeepers, others like magicians hahaha

2026-01-08 11:27:09 UTC

- reply

And that's a pretty good from my point of view. Engineers retain agency and can focus on technical challenges without being burdened by minor, mechanical, and repetitive tasks. Dialogue is also a big feature, as figuring out balanced decisions is really good.

2026-01-08 11:22:44 UTC

There is a generalized over reliance on plain text application specific data published by Nostr clients, which is really concerning. Loads of apps publish this data every time you read notifications, set settings, check your home feed, or manage a premium subscription, among other things. All of this is normally published in plain text to your relays. This data is quite revealing, and the current default behavior of some signers is to sign these events by default, so they get published without the user noticing it. I don't know if you realize this, but it's pretty leaky. I would say it's even worse than centralized platforms collecting data because all of this information is public and in plain text. It's a privacy concern that exposes usage habits and other metadata to everyone, and all of this data can be used by anyone. Are you interested in the last time someone checked Nostr, or profiling an user? Just query for their latest events with kind 30078. This has to improve. Developers should be conscious of how this harms user privacy, and users should recognize how exposed they are. The first thing you can do if you care is go to your signer and disable signing these events automatically. The apps you use might feel a bit broken, and you'll have to sign these events manually, but at least you wouldn't be publishing these leaky events automatically. Now, I'm going to share a little list of what you can find out there... for free
- YakihonneAppSettings
- store-settings
- seen_notifications_at
- ride_request
- routstr-chat-api-keys-v1
- plebs/watch-history
- plebs-settings
- Primal-Android-App
- Primal-Web App
- Primal-Web App | get_app_settings
- Primal-Web App | get_membership_status
- nym-settings
- nym-shop-active
- lumi-settings
- ghostr-publish-history
- ghostr-processed-submissions
- fanfares/purchases
- AmethystSettings
And this is just some of them. If you want to inspect this yourself, you can use and modify this `nak` command:
```sh
nak req -k 30078 wss://relay.nostr.net wss://relay.damus.io wss://relay.primal.net wss://nos.lol | jq -r '.tags[] | select(.[0] == "d") | .[1]' | sort -u
```

2026-01-08 10:39:28 UTC

- reply

Gracias, si creo que es importante reflexionar sobre todo esto por de momento borrachos no nos estamos dando cuenta de como esto esta incluyendo en todo incluso en infra crítica

2026-01-08 10:29:22 UTC

- reply

What are your trepidations? I would like to hear them, all of this is an experiment. And thank you :) There are a couple of md documents in the repo explaining the bucket algo, specially this one https://github.com/ContextVM/wotrlay/blob/master/wotrlay-v2-analysis.md

2026-01-08 10:09:18 UTC

- reply

Cualquiera para a la musa XD

2026-01-08 09:56:21 UTC

- How do you code these days?
This is a common question these days. I've been evolving my way of coding since LLMs came into play, before the term vibe code was issued. I've been exploring the different paradigms and shiny new approaches that appear almost every week, but to be honest, it is not really for me how the industry and devs are leaning into these new tools and framing. Fully autonomous development is not for me. I use the tools, I test the tools, but I don't fully embrace the whole vibe coding propaganda campaign that big AI labs are shilling. I use LLMs to assist in my work, not to fully delegate it to them. By doing that, I can maintain a consistent mental model of the software I'm writing. I can make critical decisions on the architecture, security considerations, and everything related to crafting sustainable software. By using LLMs to assist during my work, I can delegate tedious tasks, assert spec compliance, iterate and polish parts of the code without introducing breaking changes, and make maintainability easier, while effectively being more efficient and performant in my work. I avoid embracing the fully autonomous paradigm because we are not there yet, and tbh I think we will never be. By observing the current trends in companies, we can see that a handful of them are firing people, not just devs or engineers, but also salespersons, technical assistance, etc. The result now days is very low to zero benefits and a perceptible degradation of their services, together with an horrifying generalized burst of CVEs, attacks, and instability. Humans with knowledge and expertise are very competent and they cannot be replaced without sacrificing quality, scrutiny, critical attitude, and the capacity to make aligned and informed decisions.
Why am I writing this? I think we are at a tipping point, and since last year things have started to change drastically. I think it is really important to talk and reflect on these things. I conceive LLMs and these new tools as enhancements, but not as fully autonomous entities with the capacity to take critical decisions in long term scenarios. They are like the Iron Man suit or a Mecha suit, an exoskeleton. They provide you with new skills and empower you with new tools and capabilities, but good luck with letting your agent run free for hours, days, weeks... as the industry is claiming, this is just my Pov, but I think it can also be a bit misleading for new people who haven't ever coded before, as they are finding loads of frustration when maintaining or just after coming out of the first MVP. Don't get me wrong, I love to see people who haven't touched any line of code before developing apps that serve them and their community, discovering the power and freedom that comes with creating your own software. But I think the approach should be to keep using LLMs to assist you, to learn and accompany you, and to dialogue, instead of fully detached development. This is a great opportunity to learn new things. It has never been so easy to get answers to your coding questions and learn. If you reject seeing a line of code, you'll end up with a mess, and if you don't know how to deal with that mess, you'll get really frustrated. And yes, it's true that LLMs are going to get better and more capable, but so is the mess they create, as they are delegated to perform bigger and more critical tasks due to the assumed competency. The bigger the mess, and again, of course, these things can be mitigated with guardrails, evaluation loops, etc., but there are no real solutions, and there never will be perfect solutions.
So just final words: Use the tools and don't let the tools use you. Take advantage of them; it has never been so easy to learn new things. There is no such thing as a free lunch, but all of this doesn't mean that you cannot embrace the fully vibe coding experience, especially with something like Shakespeare.dyi that already paves the way and reduces the 'free wheel' risk or 'hallucination' tendencies. But once you have a shiny new thing, good luck maintaining it

2026-01-08 09:02:47 UTC

Joooo tbh, I was thinking this conversation was going to be more interesting... or at least offer some entertainment. But there are no more answers. 🦗
#nevent1q…pgpy

2026-01-08 08:49:56 UTC

2026-01-07 15:04:02 UTC

- reply

Yes, you are right, regular users currently have an 'spammy' behavior because some Nostr clients act like a machine gun of events. And yes, rate limiting schemes can be a bit restrictive, but from my point of view, it is still a pretty valid approach. It also 'protects' the relays from receiving a ridiculous amount of events every time a user opens an app. That said, I am already thinking about how the bucket algo can be improved so that regular users are not punished. Maybe a dual bucket approach could work: one bucket for notes (just kind 1s, 1111s, and social interactions like kind 7) and another bucket for 'the other stuff,' such as replaceable, addressable events, and so on. I am just thinking out loud here and need to reflect on it more. The first mitigation might be to simply increase the bucket size for reputable users

2026-01-07 12:53:07 UTC

- reply

I think mainly primal, and amethyst are pretty spammy. Jumble also spams my signer with clients auth, but these shouldn't be published to relays

2026-01-07 12:17:09 UTC

- reply

Hahaha

2026-01-07 11:23:12 UTC

- reply

Rough numbers are provided in the repo but, it might be worth adding a checker on the relay page so users can see the current usage and limit
https://github.com/ContextVM/wotrlay

2026-01-07 10:41:27 UTC

- reply

Hahaha well... there are other relays...

2026-01-07 10:24:23 UTC

- reply

What? Notes are not deleted just rate limited

2026-01-07 10:23:33 UTC

- reply

Dale, claro, seria de ayuda :) también si ves algo raro por el feed o así puedes decírmelo, se esta comportando bien, pero nostr siempre puede sorprendente jajaja

2026-01-07 10:17:57 UTC

This relay has been running for more than two weeks now, and despite being a free and public relay with no NIP-42 auth, or nothing stopping anyone from attempting to publish. The feed is clean of spam/scam bots or p*rn. Looking at its metrics, it has already rate limited more than 40k events or attempts of publishing, so this proof of concept is working pretty nicely. I just need to tweak the bucket tiers a bit since I've been rate limited myself as well xD Even though my bucket allows me to publish more than 400 events a day, it's incredible how spammy some clients are with publishing events for everything all the time. Anyways, great success! 🚀 #wot #relay
#nevent1q…lndd

2026-01-07 09:29:19 UTC

Come and hang out at wss://wotr.relatr.xyz/ 🤙

2026-01-07 08:33:26 UTC

GM🌞

2026-01-07 08:28:46 UTC

- reply

Yes man took me a day to set everything in order to publish 🥲

2026-01-06 21:16:21 UTC

- reply

Sure, *decentralized*, sure *immediate consistency*, sure **strict ordering**... Eth is POS, consistency is stochastic, not immediate. The chain has had multiple reorgs during its history... But you are right, the immense amount of money poured over it has attracted very naive devs. Not all, there are very respectable people working on it, but also loads of script kiddies. Anyways, what I'm proposing here is a PoC. The model presented in the spec allow for multiple validators. Eventual consistency can be mitigated through agreement on a relay or group of relays. Unordered event log? nostr events have timestamps, unique IDs, and we also have open timestamps. All of this can create a pretty ordered event log...

2026-01-06 20:13:09 UTC

- reply

I'll love to go with @nprofile…q2qv

2026-01-06 10:32:31 UTC

- reply

Bd 🫡

2026-01-06 10:32:09 UTC

- reply

2026-01-06 09:57:31 UTC

GM🫂

2026-01-05 15:41:14 UTC

- reply

Unless your business is violence, then the more the better 😏

2026-01-05 09:46:52 UTC

- reply

GM✨

2026-01-05 09:46:42 UTC

- reply

GM 🫂

2026-01-05 08:14:07 UTC

GM🌞

2026-01-04 16:19:16 UTC

Learn about request response patterns over nostr, the differences between a DVM and a CVM, and how to use them. Let's keep building 💪
#nevent1q…w69n

2026-01-04 15:33:35 UTC

- reply

Yes, it's one of the layers of btc that supports push payments where the payment is the string. Cashu also gives you spending conditions, "Offline payments", and custom denominations which can be interesting for different use cases

2026-01-04 10:58:04 UTC

- reply

Hahaha a yea? What? Probably a genius idea

2026-01-04 10:57:15 UTC

- reply

Some writing 👌

2026-01-04 10:23:13 UTC

- reply

Waa it have to be beautiful 👀✨

2026-01-04 10:17:22 UTC

Genius https://sqlnet.cc

2026-01-04 10:10:50 UTC

- reply

Snowy in your side 👀

2026-01-04 10:07:28 UTC

- reply

In the case of Relatr, anyone can run an instance, and each instance represents a different point of view because they are configured with a source pubkey and a set of validations. You could run your own Relatr instance and set yourself as the source for the computations, and you'll have a tailored algorithm outputting ranks from your perspective

2026-01-04 09:38:34 UTC

GM☕

2026-01-03 10:31:47 UTC

https://youtube.com/watch?v=GnlIWMN02Pw

2026-01-03 10:29:01 UTC

cashuBo2FteCJodHRwczovL21pbnQubWluaWJpdHMuY2FzaC9CaXRjb2luYXVjc2F0YXSBomFpSABQBVDwSUFGYXCCpGFhAmFzeEBjODhlMmFlMWQzNDVmNjFlYjI1YjgyNzczZmQ0ZjI5MmJkMjAxMTc3MTljNjMyYTIyM2NkMWVhY2NkNmI2ZjM2YWNYIQLo13XG35vGT-6ap_5kAD-ukUnfBHAbaXHh8ZNk8nw0MmFko2FlWCATVfk7xtdzM40b86F3NveURigGSeeN_JRyqaq9LbjX4mFzWCCVBR3wKSCau8-cd35YOD0Vn0odXtOyO7yHpMkXY0FLAmFyWCBXerzN_0gVwFcl0oq4pkhH4tsahe9FxFb-CHSBVAGMVaRhYQJhc3hAYzJhMjA0OTI4Yzg0ZTJjYjk3MTYzNDc3MDY3NjMyM2E1MDBkMTg3MDMzZWNhNGMwNmQ5MzNmNDkzYzkzY2Q5NWFjWCED01dJGFBkJHKYwzleQwL4l_ukOdNdS7vqIycDopsEDUlhZKNhZVggFxj6T2Dkfg3Nq3EAS3mX8oixtaVoJ_QkagyFSJIAGXhhc1gg1ejG_BvDeZGcbMsFt4yuVwe6VB9lWQkOR0beLiprljdhclggDQ0nZ6uil-Xq5CKrsGDz2Bvk4G8RBZaPHnHNuXxUi1k

2026-01-02 17:05:14 UTC

Spring brings the rain,
With winter comes pain,
Every season has an end.

2026-01-02 11:22:18 UTC

- reply

I tried to remove it and that added it again 🤣

2026-01-02 11:20:15 UTC

- reply

Sorry about the pepe reaction, fat finger 😅

2026-01-02 11:19:41 UTC

- reply

Gm gigi 🧡

2026-01-02 08:27:10 UTC

- reply

I'm using https://github.com/LeanderBB/you-have-mail

2026-01-02 07:43:16 UTC

- reply

Hahaha seems that bubbles have some work to do