Hacker Newsnew | past | comments | ask | show | jobs | submit | rglullis's commentslogin

Nostr will always be a fringe network. The normies do not want to manage their own keys.

Hopefully some day we will get state-managed PKI, and citizens will get used to handling their keys appropriately.

It's crazy that some functionality on e.g. the IRS website requires me to verify my identity using a private company (ID.me).


That also goes to the other extreme.

For all the faults of current Fediverse software implementations, it at least gives more options than nostr. If you don't care about controlling your own identity, you can use someone else's server. Nostr doesn't give you that, it's all or nothing.


No thank you. That last thing anyone should want is governments holding ownership over their private keys.

Private companies are bad enough, but at least they won't declare you an undesirable for your political beliefs or religion or ethnicity or gender identity or sexual preference or whatever and shoot you in the head over it.

Except where governments and private companies collaborate, which of course happens (looking at you literally every American social media platform.)


> Hopefully some day we will get state-managed PKI, and citizens will get used to handling their keys appropriately.

Passports have had keys in them for a while now (so-called "e-passports")


european IDs already have a chip with your personal keys and you can use that to log into any state operated service

There is no European ID. Please specify individual countries (I think this is just Estonia at the moment?)

Portuguese is also have a sim card, but I never used it for anything other than accessing government services.

has been the case for Hungarian ID cards for a decade now, but it was never really used, except maybe by burorats in gov offices to access their systems.

but no one understands it, including the people who need to issue new signing keys.

it didn't get anywhere really. it was just a good opportunity for a lot of taxpayer money to... "lose its taxpayer money nature" (actual phrase by an actual politician when cornered by questions).

and now they are "moving on" to an app that must be installed on your phone to access more and more services.

ID2030 is roaring on worldwide... soon mandatory iris scans, vaccine implants, and who knows when they will try to roll out mandatory brain implants against thought crimes.

the more i think about the sign of the beast (as an atheist), the more sense it makes.


People seem to manage their whatsapp (or signal, etc) keys just fine. Because its an app that just stores it as a file and doesn't tell you about it.

So i think there are viable solutions here. It mostly just means having an app to manage the keys for you.


Both signal and WhatsApp punt key revocation and recovery to phone number verification, so ultimately these keys belong to phone number provider.

Sure, there are costs involved in the trade off, but the benefit is a system that actually works for the average user.

My point is that is this is not a trade-off but a complete violation of the principles that are used to justify the existence of nostr.

Nostr's whole shtick is about "users owning their keys". If I can not change the keys used on WhatsApp or Signal, I do not own them. They are not in the same class, so the comparison is moot.


Normies manage their house keys just fine. Obviously crypto keys come with different challenges but that's a UX problem. People losing their house keys is not generally an Earth shattering event. Losing a crypto key doesn't have to be either.

A wallet is easier to lose than a bank vault, but it also holds less money for the same reason. Crypto keys can be designed the same way, with high importance keys managed by safer means like m of n schemes mixed with traditional "hard" storage in geographically distributed safe deposit boxes or whatever, while less important keys can be treated in a more relaxed fashion.


This analogy misses the entire system keeping house keys manageable. If you lose your keys, a locksmith can help you regain access cheaply and quickly because there’s an entire legal system allowing you to prove that you are the legitimate owner. The system you describe for crypto keys is not only significantly harder to use but also lacks that cushioned landing if any part of that fails. Any teenager with poor impulse control can toss a brick through the window and gain access to my house, maybe even grab the spare keys, but they couldn’t occupy it for very long or transfer it to a new owner, which is a significant risk mitigation compared to those crypto keys even before you consider how many more attackers you have to worry about online – there’s no real-world analog to some guy phishing someone on the other side of the planet to post ads or make fake reviews, secure in the knowledge that their local police don’t care.

>People losing their house keys is not generally an Earth shattering event.

yes because if you lose your house keys you don't lose your property, precisely because there is an entire legal and governmental apparatus securing it, the exact thing the crypto people first try get rid off and then reinvent (shoddily) when they inevitably discover that nobody wants to live in the jungle


Not really sure this analogy works since the usability of my house and everything in it is unrelated to having them. The house keys only make getting into my house easier.

they already manage passwords and passkeys. It isn't that complicated.


how is it any more difficult than taking care of a password?

It is not about the difficulty, it's the potential consequences.

People also take care of their house keys and their wallets, but If I lose the keys to my house, it isn't automatically taken over by squatters and if I lose my ID card I can issue a new one quickly.

What happens if you lose the cryptographic key to your nostr account? Who do you call for help?


Can I click a link to reset my keys?

What happens when the key is lost, and the consequences like "lose all your money" or "lose your account access" are non-starters, as someone who owns a hardware key for my email account

Multi-sig wallets are even more complicated and not for normies


what happens if you lose your password? You click a link to reset it, and it gets sent to your email. What happens if you lose access to your email password?

It is the same problem.


My email has multiple recovery methods

It's not the same problem


Send your key to your email. Then it's less secure but I take it you wouldn't mind.

https://sneak.berlin/20181022/sneaks-law/

sneak’s law: “Users can not and will not securely manage key material.”


I'm again toying around with the idea of building an ActivityPub Server built around the principles of RDF, JSON-LD and the Linked Data Platform. [0]

It can work already as a "Generic" ActivityPub server and it can be made to work with Client-to-Server API, but given that there are not mature clients for that, I am now in the middle of an exercise where I am taking the existing server and implementing Lemmy's and Mastodon's APIs based on top of it. Once I can get any Lemmy and a Mastodon client working, I will then start changing their own SDKs, and then I can replace calls from their application-specific APIs with direct calls to Linked Data server.

  [0] https://activitypub.mushroomlabs.com

zk-proofs already exist to do just that.

They’ll need a contextual system around them that is convenient and trusted by people who don’t know what they are or how they work in order to be successful

By your analogy, the developers of stockfish are better chess players than any grandmaster.

Tool use can be a sign of intelligence, but "being able to use a tool to solve a problem" is not the same as "being intelligent enough to solve a specific class of problems".


Im not talking about this being the "best maze solver" and "better at solving mazes than humans". Im saying the model is "intelligent enough" to solve a maze.

And what Im really saying is that we need to stop moving the goal post on what "intelligence" is for these models, and start moving the goal post on what "intelligence" actually _is_. The models are giving us an existential crisis on not only what it might mean to _be_ intelligent, but also how it might actually work in our own brains. Im not saying the current models are skynet, but Im saying I think theres going to be a lot learned by reverse engineering the current generation of models to really dig into how they are encoding things internally.


> Im saying the model is "intelligent enough" to solve a maze.

And I don't agree. I think that at best the model is "intelligent enough to use a tool that can solve mazes" (which is an entirely different thing) and at worst it is no different than a circus horse that "can do math". Being able to repeat more tricks and being able to select which trick to execute based on the expected reward is not a measure of intelligence.


I would encourage you to read the code it produced. Its not like a simple "solve maze" function. There are plenty of "smart" choices in there to achieve the goal given my very vague instructions, and as a result of it analyzing why it failed at first and then adjusting.

I don't know how else to get my point across: what I am trying to say is that there is nothing "smart" about an automaton that needs to resort to A* algorithm implementations to "solve" a problem that any 4-year old child can solve just by looking at it.

Where you are seeing "intelligence" and "an existential crisis", I see "a huge pattern-matching system with an ever increasing vocabulary".

LLM's are useful. They will certainly cause a lot of disruption of automation on all types of white-collar work. They will definitely lead to all sorts of economic and social disruptions (good and bad). I'm definitely not ignoring them as just another fad... but none of that depends on LLMs being "intelligent" in any way.


> They're not paying me to use it.

Of course they are.

> As long as the inference is not done at a loss.

If making money on inference alone was possible, there would be a dozen different smaller providers who'd be taking the open weights models and offering that as service. But it seems that every provider is anchored at $20/month, so you can bet that none of them can go any lower.


> If making money on inference alone was possible, there would be a dozen different smaller providers who'd be taking the open weights models and offering that as service.

There are! Look through the provider list for some open model on https://openrouter.ai . For instance, DeepSeek 3.1 has a dozen providers. It would not make any sense to offer those below cost because you have neither moat nor branding.


> If making money on inference alone was possible

Maybe, but arguably a major reason you can't make money on inference right now is that the useful life of models is too short, so you can't amortize the development costs across much time because there is so much investment in the field that everyone is developing new models (shortening useful life in a competitive market) and everyone is simultaneously driving up the costs of inputs needed for developing models (increasing the costs that have to be amortized over the short useful life). Perversely, the AI bubble popping and resolving those issues may make profitability much easier for the survivors that have strong revenue streams.


You need a certain level of batch parallelism to make inference efficient, but you also need enough capacity to handle request floods. Being a small provider is not easy.

The open models suck. AWS hosts them for less than closed models cost but no ones uses them, because they suck.

It's not the open models that suck, it's the infrastructure around them. None of current "open weights providers" have:

   - good tools for agentic workflows
   - no tools for context management
   - infrastructure for input token caching
These are solvable without having to pay anything to OpenAI/Anthropic/Google.

Why would the open weights providers need their own tools for agentic workflows when you can just plug their OpenAI-compatible API URL into existing tools?

Also, there are many providers of open source models with caching (Moonshot AI, Groq, DeepSeek, FireWorks AI, MiniMax): https://openrouter.ai/docs/guides/best-practices/prompt-cach...


> when you can just plug their OpenAI-compatible API URL into existing tools?

Only the self-hosting diehards will bother with that. Those that want to compete with Claude Code, Gemini CLI, Codex et caterva will have to provide the whole package and do it a price point that is competitive even with low volumes - which is hard to do because the big LLM providers are all subsidizing their offerings.


They do make money on inference.

How many of those will have no issue to learn what it is once the ads become too annoying?


Very good question! 1% ?


You are vastly overestimating people's willingness to deal with bullshit, when the product does not have a real lock in.

It would be incredibly easy to have a company offering their ChatGPT over WhatsApp or iMessage, and get people to start using it instead of an ad-ridden GPT app.


Maybe. But maybe you are vastly overestimating people's willingness to give a fuck, as long as they get what they came for. That is why ads rule.


The funny thing is that make a big deal about blocking Brave on "ethical" grounds, but don't e tend the logic to Chrome, Edge or Safari. Talk about punching down/virtue signaling.


Where did they make a big deal of blocking Brave on "ethical" grounds?

https://github.com/lobsters/lobsters-ansible/issues/45

They outline a very specific behaviour that Brave engaged in but Chrome, Edge, and Safari do not. Brave was engaging in fraudulent behaviour, wherein it posed a fake donations scheme to users of the browser under the guise of supporting website owners with their implicit but nonexistent consent, and in actuality took the money for itself. Brave then also specifically and publicly singled out Lobsters in an issue. Lobsters devs do not want to spend dev time engaging with scammers operating in bad faith. Seems fair to me.

See also an HN thread about the fraud scheme: https://news.ycombinator.com/item?id=18734999


> Brave was engaging in fraudulent behaviour.

Allegedly. This, the "Brave was putting ads of their own on other pages" and "adding the referrer code for Binance" stories get thrown around like they were (a) are all huge sources of profit (b) carried on with malicious intent and (c) on par with the BILLIONS of dollars in ad fraud that goes around and Google so conveniently turns a blind eye.


I don't particularly care how much money Brave made off the scheme. If Brave put my name and picture on an advertisement shown to Brave users, said that I was soliciting donations and would receive the money, and then took the money, that is immediately far more personally offensive than virtually anything Google does. I was not myself actually affected by this, but it's incredibly easy for me to understand why someone would want nothing to do with Brave.

Also, it's basically a given that Brave is not in a position to generate billions through such a scheme. It simply doesn't have the market share for that. If Chrome did the same thing that Brave did, they probably would generate billions. It is equally unethical either way.

Moreover, Google has an effective monopoly. Even if you wanted to protest Chrome, you can't do so without effectively shutting down your website. Chrome coerces consent into whatever they do. Brave does not have that power. You describe that as punching down, but just because Chrome has the capability to coerce consent does not mean we should be surrendering our consent to anyone and everyone.


> said that I was soliciting donations

They didn't do that. They were not actively promoting creators. it was the opposite. They were letting people mark someone as a potential recipient of contributions as a way to bootstrap their network.

> just because Chrome has the capability to coerce consent does not mean we should be surrendering our consent to anyone and everyone.

Your bias is showing.

Brave did not "coerce" anything to anyone. Their crypto stuff is opt-in. The ad blocker is opt-in.

Rationalize all you want, if you think that is justified to have a website blocking a browser like Brave because "of what they do to users", then it should be a moral imperative to help others to stop using chrome, edge and Safari.


I've seen the screenshot of the half-screen overlay pop-up advertisement that was displayed to Brave users. The "Welcome!" banner together with an actual photo of the person in question, together with the wording of the solicitation, is something that would absolutely give many, if not most, uninformed users the impression that the solicitation originated from the person featured.

Neither I, nor the linked issue, cite that Brave was blocked "because of what they do to users". If this had happened to me, I would block them based on what they did to me. As I said, the act in question is personally offensive in a way that what Google does is not. It plays on the border of identity fraud. If a browser is using my identity to solicit donations, I'm well within my right to do what I can to interfere with that.

Regards to coercion, I did not say that Brave coerced anyone. I pointed out that Google effectively does via its monopoly power, and that is why that people cannot realistically choose to block Chrome. The matter of coercion is addressing your complaint that they aren't also blocking Chrome, not a criticism of Brave.


> the act in question is personally offensive in a way that what Google does is not.

A perceived, harmless, unintentional and nonetheless remediated offense is worse than the continuous abuse of power and anti-user practices from Google, Microsoft and Apple. It might seem justified to you, but to me it's just displaced indignation and illustrates why we will forever live in this corporate dystopia.


I wonder if you would be describing it as perceived, harmless, and unintentional if Google had done the same thing.

It certainly wasn't remediated, given that the donations received were not refunded. "Stops doing fraud when caught" is not remediation.


My moral compass does not change based on who is being accused, but context is fundamental to make a proper judgment.

It is hard to come up with a situation where Google would be doing these types of tricks, because Google is already the dominant player in the market and they don't want to create products that cannibalize their own revenue streams.


I think this is about being mad at Brendan Eich, the current CEO of the company behind Brave, for his opposition to legal gay marriage in the late 2000s/early 2010s. A lot of Lobsters moderators are queer and/or politically sympathetic to queer activism.


Which goes to show the importance of judging people by their actions and not their opinions: are they going to boycott Apple as well, since Tim Cook gave millions to Trump?


Brendan Eich donated money to the campaign in favor of Prop 8, the 2008 California ballot proposition that banned gay marriage and that was overturned by the courts some time later. He didn't publicize this himself IIRC but the donations were public information and became well-known when he was (briefly) appointed CEO of Mozilla.


Yeah, I am not interested in playing this tape again. The actions from Brendan as an individual are completely separate from his actions at Mozilla. Mozilla did not change any policy during his tenure and Brave is not accused of any discrimination practices or hostile to any minority group.


People's opinions inform their actions, and people's actions have meaningful effects on the daily lives of others (like my own).



I'm guessing you are talking with someone who is used to life in the North American suburbs, where kids need to be driven around and most of the options for activities are indoors.


Sadly, yes. The nearest park is 5 miles from me or the mall. The buses run on the hour and will get you within 2 miles of the park. They stop running around 7pm.

I wonder why more kids aren't at the park.


I don't get this logic. Putting aside that to get 33 different models you would come up with 5-6 different form factors, each of them on a distinct point in the tradeoff scale, why do you think that something is only worth doing if it can be put on an uniform supply-demand curve?


What percent of the iPhone sales do you think it took to pay off the significant engineering and factory/tooling setup costs? I bet it's more than 3%.


Apple made nearly $190 billion last year selling just iPhones.

If you think it costs more than $5 billion to design a phone and set up a production line, you are wildly off base. That’s the kind of money companies spend to build silicon fabs or release half a dozen new car models, not consumer products made by a contract manufacturer.


Revenue is not profit!!! A good chunk of that is the cost of parts!

Apple's R&D expenses were $34B for 2025.


...you do know that Apple produces its own silicon, and probably uses about an entire TSMC fab's worth of capacity? In the end, the money to build that fab is coming from Apple.

Apple isn't making average consumer products with average contract manufacturers.


How much of those costs are already sunk regardless of the split in your product line?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: