Hacker News Reader

Comment by jeroenhd | Hacker News Reader

"Accounts" in this case are just a public/private key pair. You can host your own relay (and nobody will hear what you have to say unless they subscribe to it), but you can use the same public key ("account") on any nostr relay. You can broadcast your posts to all relays, or just some, or just your own, depending on how you feel.

You can, in theory, generate a new key for every post if you want to. The relays don't care.

This is something Mastodon etc. lacks (accounts are tied to servers, so you can't move your self-hosted Mastodon to your self-hosted Akkomo without keeping Mastodon running, and you can't move from one instance to another if your instance admin doesn't let you).

On the other hand, the complete lack of account recovery, even for sysadmins, is something many people will have an issue with.

View on HN

Yes; and because your key is your identity, losing your key or having it stolen basically means that you have to start from scratch; there is no "I forgot my password" mechanism

I don't use nostr, but this is one of those really upsetting things where technical people are utterly blinded by their dogma.

How did you register as BinaryIgor? You and ycombinator exchanged a pubkey. ycombinator registered theirs with a DNS register, while you threw yours away.

ycombinator has 100% ownership over your identity. There is no way to prove to me you are you without ycombinator.

Having ycombinator be your naming service is useful, and so any distributed system would be wise to re-implement an analog.

But what a supernet signing scheme offers is in addition to "forgot my password" it also has a "ycombinator disappeared / betrayed our trust" feature where your ID and messages exists outside ycombinator - as long as you remember your password.

What we're currently doing: throwing away our keys and let ycombinator resign our messages with theirs; is bad for the power balance between user and the admin.

That's a fair point, but as I've pointed out above, I think that the question of Identity is much broader and more nuanced than just owning a set of keys or nicknames; if you're curious I've written about it here: https://binaryigor.com/centralized-vs-decentralized-identity...

For identities to be truly decentralized, there's no one you could run to to ask permission to change your password. Either you own your identity, or someone else does.

Your identity, BinaryIgor only exists in ycombinator, and for as long as ycombinator allows it, and only ycombinator can allow you to change your password. I can't recall how accounts are created here, but likely it also depends on linking it to your email identity as well. If ycombinator disappears, your identity goes down with it.

Doesn't change the fact that Nostr doesn't have a key rotation mechanism

My Nickname on Hacker News - yes; but I own this Identity on at least one more platform and my own website, so it's not that simple :) In general, I think given Identity is more about reputation and familiarity that you gain with people by doing or delivering something under particular name in one or multiple contexts/platforms

That's where I feel ATproto strikes the right balance: it's basically “What if Nostr but the identity lives on a potentially-self-hostable server instead of the client?”, avoiding that risk of “oh no I lost my private key” while still providing the means to control where one's identity lives and move elsewhere if necessary (even if the current server is uncooperative or no longer exists).

Isn't it centralized though, thus defeating the whole purpose?

That depends on what “centralized” means (i.e. whether we're conflating “decentralized” with “federated”, as is usually the case when talking about systems like ATproto, ActivityPub, Nostr, etc.).

In any case, AFAICT it's possible to self-host every part of the ATproto stack, and people have indeed done that. Third-party PDSes, relays, and applications/clients can talk to one another and with the ones Bluesky PBC operates. That satisfies the meaning of “decentralized” as most people use it (at least as well as other federated protocols like ActivityPub and email satisfy it).

Reply on news.ycombinator.com