Avoid leaking url and content to nostr relays

Giszmo commented 2 years ago

On the demo site I just made this comment:

{
  "id": "4302bf81eac6a99c74fdec46e3bf2367ca3928bbb8164de949391d2be6b6907d",
  "pubkey": "24305e75d4e6a3572006ced2cfc9dbf7f4afbe5fd5841b35f50ae7e2c8aee577",
  "created_at": 1654482018,
  "kind": 1,
  "tags": [
    [
      "r",
      "https://nostr-comments-widget-react.vercel.app"
    ]
  ],
  "content": "Ah, I see, no markdown enabled. How about html? %lt!--?\n\n<a href=\"https://nostr-comments-widget-react.vercel.app/node_modules/react/index.js\">/node_modules/react/index.js</a>",
  "sig": "d3fa3ef7f06380ce2fc6c309f2d54b1e2a296d96d3ba1f1e3c84f6eafbd8d01da94071898b5a38f3926d35edf1945b7771de138adeacb9addfdab6c264d208c1"
}

The site might not be meant to be publicly discovered, so both the r-tag and the content should be scrambled. This could be done without much impact on the users that know the site by for example:

using sha256("topic prefix $url") for the r-tag
using sha256("key prefix $url") for a symmetric key

Those who know the url can trivially receive the content while others don't learn url or content.

Using a hash of the url for the r-tag also allows to make it a constant 32 to 64B instead of the otherwise maximum 2000B.

fiatjaf commented 2 years ago

I think there could be two kinds, 52 and 53, one for naked URLs and the other for URL hashes. I was using kind 1 because I thought it would be good to have these comments show up in feeds in social nostr clients, but that only works if these clients also show the naked URL in the r tag, so we could just use another kind anyway to make that more explicit.

Giszmo commented 2 years ago

If spamming social (kind 1), somehow providing the url as context makes sense but I insist it's a poor identifier as an r tag as those firstly don't get shown on social yet and secondly have the problem of being a poor identifier for threads if those are shown in maybe dozens of pages. If using kind 1, messages might rather start with (from [1]($url):)

Imagine how cool it would be if many projects that list apps like mine would hop on the same conversation! nostr could become the default for discussing all kinds of easily identifiable things. Sure, if the sites that feed into the thread are very different (focused on security, anonymity, gaming, ...), comments spawning on other sites might get annoying but most projects would rather have user engagement at all and deal with filtering later than the reverse. For this issue, tagging could be added. Let users set tags and show only relevant tags by default.

So the options I see are:

kind 1: plain r tag and plain content
kind 52: plain r tag and plain content
kind 53: Hashed r tag and plain content
kind 54: Hashed r tag and encrypted content

I don't see a need for kind 52 if you want to blast that spam onto social nostr. Use kind 1 instead.

The least useful of those would be kind 53. Hashing would only limit the size of the r tag and prevent leaking sensitive data if the widget keeps defaulting to the url.

I would like to use kind 54 at least optionally. Projects in the know would be able to hop on the conversation if the r tag's pre-image was freely configurable and the tag/encryption defined by the widget. Sites would feed channel="android/de.schildbach.wallet" into the widget and it would create some rTag and symmetric encryption key using two static salts and a hash function: rTag=sha256("rtag:android/de.schildbach.wallet"); keyBytes=sha256("keyBytes:android/de.schildbach.wallet").

fiatjaf commented 2 years ago

Nice, I like the tag 54 idea, but I think we should do the simplest possible thing that has the biggest chance of getting some traction first and I believe that would be 52.

I thought about it and 1 is really not ideal since social clients won't be expecting the r so they won't show it and everything will be nonsensical -- and prefixing the comment with "from url" is a dirty hack that's really not necessary at this point, we can do better and having a different kind is better.

How do you see 52 being the standard for comments about things? Not only websites, but anything that can fit an r tag? This way social clients can implement support for kind 52 by just showing it as a normal text note with the value of the r tag on top and that's it. Now people can use it to comment on websites, android apps, brand names, food items, I don't know what else, all using the same r tag.

Giszmo commented 2 years ago

I fully agree with your last comment.

What is the state of hashtags? Would kind 1 with #android/de.schildbach.wallet or #android_de_schildbach_wallet work, too?

Giszmo commented 2 years ago

This way social clients can implement support for kind 52 by just showing it as a normal text note with the value of the r tag on top and that's it.

... and give users the ability to throttle or boost seeing such topics.

fiatjaf / nocomment

Avoid leaking url and content to nostr relays #4