Anyone can publish anything anonymously to both Zapstore relay and Blossom server, passing the Vertex WoT filter

[franzaps]

Just use private key hex 1: https://npub.world/npub10xlxvlhemja6c4dqv22uapctqupfhlxm9h8z3k2e72q4k9hcz7vqpkge6d has enough reputation

[franzaps]

@pippellia-btc we are simply going to include nsec=1 and other well-known public nsecs in our blacklist, thats the easier fix

[pippellia-btc]

This is solved by the new Whitelisting / Blacklisting capabilities. We just have to remember to add that pubkey in the .env file

[franzaps]

Sure, keeping open until implemented. You mean blacklist and whitelist pubkeys will go in .env?

[pippellia-btc]

yes exactly

[franzaps]

@pippellia-btc it doesn't make sense to me, unless I'm missing something? how would such an .env look with 100+ pubkeys listed in there? Each change requires restarting the relay?

[pippellia-btc]

Having the whitelist and blacklist in the .env is the simplest solution to implement. I'm doing something similar in the crawler and I don't find it such a big deal as the most common operation is simply to append pubkeys at the end and restarting the program (which takes ms, so it's negligible for uptime concerns).

A more robust alternative is to save them in the database, but that requires adding a command line tool to manage these lists. It can be done if you want.

[franzaps]

Yes, they should be managed in a database. I am assuming every time I restart the server websocket subscriptions get reset, unless you convince me this is not the case?

[pippellia-btc]

Yes subscriptions are closed when restarting the relay.

How about we leave the whitelist / blacklist in the .env and upgrade it to using the database only later on / when it's needed? Because I feel like this issue will come with scale

[franzaps]

Dude I've been doing that for years now and it's a pain in the ass. If you don't want to implement the db don't worry, I'll vibe it

[franzaps]

Or make it a file if you want (something decent like a CSV, not .env), but it should be read dynamically, not require a restart

[pippellia-btc]

I'll implement it no prob, I was just thinking whether it's something that makes sense.

Which of these approaches do you prefer?

1. Sqlite + API

• lists are stored on sqlite
• changes to the lists are made through an internal API

Tradeoff: Most complex but most future proof (can add an UI)

2. Sqlite + CLI

• lists are stored on sqlite
• changes to the lists are made through a CLI tool

Tradeoff: complex and secure

3. JSON files + automatic reload (my favorite)

• lists are stored on .json file
• updates are made manually
• reload happens every x seconds (e.g. 10s)

Tradeoff: simple but less future proof