Tim Bouma

Successful initial integration of #blossom support…

Tim Bouma — Thu, 05 Feb 2026 20:00:59 GMT

Successful initial integration of #blossom support for #nostr #safebox.

The binary data is served from a back end blossom server and served via a safebox app endpoint.

Sharing some more of my design…

Tim Bouma — Wed, 04 Feb 2026 14:54:22 GMT

Sharing some more of my design and architectural thinking for #nostr #safebox.

The first diagram shows the main elements of the substrate capabilities, namely #Blossom, #Cashu, #Nostr, #Lightning, and #Bitcoin. Eventually all of this will be abstracted away from the users who only care about the safekeeping of their #Funds and #Record.

The primary coordinating protocol I am building for #safebox is called #nAuth (you can see the interaction diagram on the next image). #nAuth is built on NIP-17, NIP-44, NIP-59 and extends NIP-47 (Nostr Wallet Connect). I have extended NWC to offer and accept records between safeboxes, and to send and receive payments between safeboxes, so that they don't have to drop down #Lightning to settle payments - they are all cleared using the #Cashu mints.

In the end, my vision is very clear for #safebox (even though the engineering is hella complicated) - to give users the ability to safekeep and use their funds and records, to directly and privately transact with one another, and without necessary reliance on their app, device, or platform provider.

It will take some time - I am rooting out the single points of failure, roots of capture, and invisible gatekeepers, but I see a path to create a global, generic capability that anyone (including agents) can use without permission.

Onward!

First step of integrating imaging data…

Tim Bouma — Wed, 04 Feb 2026 13:30:20 GMT

First step of integrating imaging data into #nostr #safebox. Data is stored in Blossom servers.

Starting my blob integration into #nostr…

Tim Bouma — Tue, 03 Feb 2026 14:47:09 GMT

Starting my blob integration into #nostr #safebox

Blossom is f***ing amazing!

Here is an updated block diagram…

Tim Bouma — Mon, 02 Feb 2026 21:38:57 GMT

Here is an updated block diagram of #nostr #safebox showing the networked resources used behind the scenes so that users can manage their funds and records.

The QR code illustrates that a direct connection can be initated via a QR code.

Imagine if you could provide your…

Tim Bouma — Mon, 02 Feb 2026 18:35:07 GMT

Imagine if you could provide your health records via a fully decentralized card system and have your records verified and trusted using Web of Trust?

It’ll be possible with #nostr #safebox. See below.

As I develop #nostr #safebox, I…

Tim Bouma — Mon, 02 Feb 2026 15:38:13 GMT

As I develop #nostr #safebox, I try to focus on understanding what the core value to a user might be. I believe it's something like this:

'Safekeeping of my funds and records, without sacrificing ease of use."
Simply put, if I don't have my phone, but know the access key (or have the card or physical token), I can still make a payment or present a proof, privately.

The diagram below shows how it hangs all together at a high level. Under the hood, it's #nostr, #cashu, #bitcoin, #lightning, but if done right, all this protocol detail will be hidden from the user. All they need to know is that they have an easy way to pay and to prove, and with the assurance that no one provider has locked them into their service.

Onward!

Jumping on the moltbook bandwagon- every…

Tim Bouma — Sun, 01 Feb 2026 16:41:30 GMT

Jumping on the moltbook bandwagon- every agent can have their own #safebox to privately transact payments and share private records - not tied to any machine instance - living entirely on the #nostr network.

I had an inkling this was going to happen, but not this fast…

A simple block diagram on how…

A simple block diagram on how…

Tim Bouma — Sat, 31 Jan 2026 13:04:44 GMT

A simple block diagram on how two instances of #nostr #safebox instances dynamically interact with one another. I have successfully de-coupled the interaction so that each user interacts with their https server only and all interactions are marshalled through relays. For example the QR that is scanned contains only the #nauth information required to create the channel - the npub, the relays to listen on etc.

What is really cool is that I can have a #nostr #safebox running as localhost, behind a firewall, and it can communicate seamlessly with any other nostr safebox on the planet, automatically. Throw in WebSockets, I have full-duplex dynamic interaction channels intermediated via relays. For fun, I might add in real-time chat (but not to replace White Noise )

Plus the added bonus - I decided to bite the bullet on integrating post-quantum algorithms, so no PQC-FUD.

The next major lift is integrating Blossom blob support. I have mapped out the approach and plan to add the same PQC-resistant scheme for encrypting the blobs.

Onward!

Note to self: Add this term…

Tim Bouma — Sat, 31 Jan 2026 12:07:03 GMT

Note to self: Add this term to the ever-expanding bad #nostr neologisms:

—-

nstrprise (n): An organizational entity that uses the Nostr protocol as the basis for its digital capabilities.

This might not look like much,…

Tim Bouma — Wed, 28 Jan 2026 19:52:08 GMT

This might not look like much, but I have successfully integrated NIP-85 Trusted Assertions into my verification process. Any #nostr #safebox user will be able to decide what root authorities they trust, and what trusted assertion providers they use.

This allows anyone to decide how they wish to verify records (which is configured as safebox user parameters). It's one thing to know that a record is cryptographically valid, but it's an entirely different thing to know if the owner is actually authorized to issue the record, and what their reputation is. This is where the Web of Trust (#WoT) fits in.

This prototype was built as a result of the nosfabrica #Wotathon. It's still early, but I have proven to myself the necessary mechanisms to build a decentralized trust infrastructure that can't be captured by a platform vendor or nation state.

In the example below, you can see the green checkmarks, and the WoT Scores.

Onward!

Useful report from the EU: everyone…

Tim Bouma — Tue, 27 Jan 2026 20:59:40 GMT

Useful report from the EU: everyone cares about their health records, but I don’t think users actually care or want the EU Digital Wallet.

With #nostr #safebox, I am gunning for an open, secure system that is strong enough for private health records and with private payments.

Fundamentally important, #nostr #safebox is being designed to work independently of a phone or an app, so you can’t be captured by a state or corp.

Ok, the #nostr motto debate is…

Tim Bouma — Fri, 23 Jan 2026 16:21:48 GMT

Ok, the #nostr motto debate is settled.

What should be #nostr’s unofficial…

Tim Bouma — Fri, 23 Jan 2026 15:30:51 GMT

What should be #nostr’s unofficial motto?

1. Be Kind
2. Just Do Things.
3. F**k Platforms.

#asknostr

It’s becoming easier and easier.…

Tim Bouma — Fri, 23 Jan 2026 12:43:27 GMT

It’s becoming easier and easier. The exchange I use gives me a virtualized Visa Debit Card that I have on my phone. It also gives me a Lightning address.

Yesterday, I sent funds from my #nostr #safebox to my exchange Lightning address and then loaded the funds on the card. Then I went to the grocery store and bought groceries with these funds.

A few manual steps today, but soon it will be completely automatic. All that I will need is a ‘card’ to access my funds for a local spend. It won’t matter what network will be underneath.

Sharing on how I have implemented…

Tim Bouma — Thu, 22 Jan 2026 14:06:34 GMT

Sharing on how I have implemented Web of Trust (WoT) and Root of Trust (RoT) in #nostr #safebox. There are four steps to the verification:

1. Validation: Is the record crpytographically valid?
2. Presenter: Is the record coming from whom to whom is was issued?
3. Attested By Owner: Did the owner attested that the issuing safebox was theirs?
4. In Trust List: Is the Owner in Trust List.

Steps 3 and 4 are independent attestations. For Step 3 the verifier looks up an event signed by the owner that they are indeed the owner of the issuing safebox. Step 4, the verification process has a list of 'root authorities' that are simply npubs, looks up the followers of those npubs and uses that as the 'Trust List'. In this example, there is an account called 'Safebox Trusted Entities', but it could be any account maintained by an organization, such as a College of Physicians, that might want to manage a list of doctors.

Up until now, these schemes needs to be managed by 'specialized authorities' such as certificate authorities, or organizations with proprietary databases. Now with #nostr, we can make these schemes completely open, transparent - not capturable by a technical authority. In short, everyone can become their own root of authority, manage their own trust lists, and also decide which roots to trust when verifying.

This is just a prototype, but it already demonstrates technical capabilities that are stronger and more reslient - and more open than any certificate authority program or public key directory that is out there, including what is being used by passports, driving licenses, or national authority.

Onward!

The key innovation of #nostr (aside…

Tim Bouma — Thu, 22 Jan 2026 13:06:46 GMT

The key innovation of #nostr (aside from its simplicity) is the use of the digest (hash) as the identifier of the event/record. That means the info is cryptographically bound to its record identity and, this, the record can be stored anywhere and referenced from anywhere (relays).

Amirite?

#asknostr

My experimental account for #nostr #safebox…

Tim Bouma — Sun, 18 Jan 2026 22:02:37 GMT

My experimental account for #nostr #safebox to test trust list concepts for the nosfabrica #WoTathon.

Accounts that are followed by this account are considered trusted entities.

nostr:nevent1qqsp2lk79xj66ccyhvyr2le9q6fp5ejajs0cfp4c53a90c4hpeakdpgzypsp4hagm4ng7gs3rtg5vlyzdjnkcm2w39zcng5adyw9k4sj9lxvxqcyqqqqqqge9alma

Another big pushback FUD on #nostr…

Tim Bouma — Sun, 18 Jan 2026 18:17:57 GMT

Another big pushback FUD on #nostr is that the protocol is not ‘quantum-safe.’

Well, I called bullshit on that FUD by upgrading the protocol to use quantum-safe algorithms (including an upgraded relay)

https://github.com/trbouma/pqrelay

It took me a couple of…

Tim Bouma — Sun, 18 Jan 2026 18:07:59 GMT

It took me a couple of years to figure this out. The core reason why #nostr is going to win as a protocol:

By creating a unique event id that is the digest of its:
- author (pubkey),
- meaning (kind),
- timestamp (created_at),
- metadata (tags),
- message (content), and:

signing of this resulting event id (sig)

That means you can sign whatever the hell you want with whatever meaning you intend, and it can be uniquely stored or relayed anywhere.

#nostr become the sword of simplicity that cuts through the Gordian Knot of interoperability bullshit and semantic capture.

This simple format allows anyone to define whatever they want, with only a simple rule for cryptographic validation that it was actually they who created the event. With a few additional conventions it becomes a baseline protocol for social media, but can be expanded to an infinity of possibilities.

Thanks for this genius, fiatjaf