bopjesvla / hitch

https://hitchmap.com
GNU Affero General Public License v3.0
8 stars 2 forks source link

nostrify hitchmap? #65

Open guaka opened 4 months ago

guaka commented 4 months ago

(relates to #64)

just putting this out here, feel free to close the issue

nostrify:

bopjesvla commented 4 months ago

We currently don't have any auth whatsoever. As long as we don't get spam I don't think user accounts are worth it. Even if we do get spam, iOS support would be necessary.

Out of curiosity, how do nostr clients handle private keys on Android? In general, private keys should not be on phones, right?

guaka commented 4 months ago

re keys: I'm no expert here. But various types of private keys are in all kinds of places, definitely also in phones. Phones can actually be better than laptops because they have secure enclaves.

I have some experience with using https://addons.mozilla.org/en-US/firefox/addon/nos2x-fox/ This extension is storing your nsec, and can sign and do other things that a specific website requests. I am assuming it's very similar with the Android app. And I'm confident enough that someone will find a way to do something like this on iOS.

People have been losing nsecs and this hasn't been a big deal so far. As nostr progresses it will become a bigger deal, but I also expect good ways to handle this will be figured out. For now I think we can tell people the npub is like a username and the nsec is like a password that you have to store really well (because there's no password reset!), ideally in password manager.

Since there is no auth or user names in hitchmap now it could simply be an additional feature, where a user that wants to can (verifiably) claim to have a specific identity (npub). This can also include a claim of being specific user on Trustroots as soon as we have nip-05 there https://github.com/Trustroots/trustroots/issues/2692

guaka commented 3 months ago

Various thoughts, slightly based on experience writing https://github.com/guaka/nostrhitch

Spots would probably be various notes tied together

Drivers:

iframe/embed hitchmap.com:

There was someone who asked about a hitchmap.com api but then didn't really say what they were building, I pointed out that by going the nostr way there's no need for an api, @tillwenke agreed.

There are probably 100s if not 1000s of local/national/continental rideshare groups on telegram and facebook, but IMHO they all suck for providing and getting rides. And then there's blabla and other commercial platforms, but I didn't like using them (compared to the hitchhiking experience), neither as a driver nor as a rider. It should be doable to build something that is easier to use than chat groups. It's harder to get enough people to use it, but I think we have a chance by pushing it thru hitchwiki, hitchmap and trustroots. (Obviously I believe the rideshare experience is better when there's no money changing hands.)