Tim Bouma

Successful initial integration of #blossom support…

Tim Bouma — Thu, 05 Feb 2026 20:00:59 GMT

Successful initial integration of #blossom support for #nostr #safebox.

The binary data is served from a back end blossom server and served via a safebox app endpoint.

Sharing some more of my design…

Tim Bouma — Wed, 04 Feb 2026 14:54:22 GMT

Sharing some more of my design and architectural thinking for #nostr #safebox.

The first diagram shows the main elements of the substrate capabilities, namely #Blossom, #Cashu, #Nostr, #Lightning, and #Bitcoin. Eventually all of this will be abstracted away from the users who only care about the safekeeping of their #Funds and #Record.

The primary coordinating protocol I am building for #safebox is called #nAuth (you can see the interaction diagram on the next image). #nAuth is built on NIP-17, NIP-44, NIP-59 and extends NIP-47 (Nostr Wallet Connect). I have extended NWC to offer and accept records between safeboxes, and to send and receive payments between safeboxes, so that they don't have to drop down #Lightning to settle payments - they are all cleared using the #Cashu mints.

In the end, my vision is very clear for #safebox (even though the engineering is hella complicated) - to give users the ability to safekeep and use their funds and records, to directly and privately transact with one another, and without necessary reliance on their app, device, or platform provider.

It will take some time - I am rooting out the single points of failure, roots of capture, and invisible gatekeepers, but I see a path to create a global, generic capability that anyone (including agents) can use without permission.

Onward!

First step of integrating imaging data…

Tim Bouma — Wed, 04 Feb 2026 13:30:20 GMT

First step of integrating imaging data into #nostr #safebox. Data is stored in Blossom servers.

Starting my blob integration into #nostr…

Tim Bouma — Tue, 03 Feb 2026 14:47:09 GMT

Starting my blob integration into #nostr #safebox

Blossom is f***ing amazing!

Here is an updated block diagram…

Tim Bouma — Mon, 02 Feb 2026 21:38:57 GMT

Here is an updated block diagram of #nostr #safebox showing the networked resources used behind the scenes so that users can manage their funds and records.

The QR code illustrates that a direct connection can be initated via a QR code.

Imagine if you could provide your…

Tim Bouma — Mon, 02 Feb 2026 18:35:07 GMT

Imagine if you could provide your health records via a fully decentralized card system and have your records verified and trusted using Web of Trust?

It’ll be possible with #nostr #safebox. See below.

As I develop #nostr #safebox, I…

Tim Bouma — Mon, 02 Feb 2026 15:38:13 GMT

As I develop #nostr #safebox, I try to focus on understanding what the core value to a user might be. I believe it's something like this:

'Safekeeping of my funds and records, without sacrificing ease of use."
Simply put, if I don't have my phone, but know the access key (or have the card or physical token), I can still make a payment or present a proof, privately.

The diagram below shows how it hangs all together at a high level. Under the hood, it's #nostr, #cashu, #bitcoin, #lightning, but if done right, all this protocol detail will be hidden from the user. All they need to know is that they have an easy way to pay and to prove, and with the assurance that no one provider has locked them into their service.

Onward!

Jumping on the moltbook bandwagon- every…

Tim Bouma — Sun, 01 Feb 2026 16:41:30 GMT

Jumping on the moltbook bandwagon- every agent can have their own #safebox to privately transact payments and share private records - not tied to any machine instance - living entirely on the #nostr network.

I had an inkling this was going to happen, but not this fast…

A simple block diagram on how…

A simple block diagram on how…

Tim Bouma — Sat, 31 Jan 2026 13:04:44 GMT

A simple block diagram on how two instances of #nostr #safebox instances dynamically interact with one another. I have successfully de-coupled the interaction so that each user interacts with their https server only and all interactions are marshalled through relays. For example the QR that is scanned contains only the #nauth information required to create the channel - the npub, the relays to listen on etc.

What is really cool is that I can have a #nostr #safebox running as localhost, behind a firewall, and it can communicate seamlessly with any other nostr safebox on the planet, automatically. Throw in WebSockets, I have full-duplex dynamic interaction channels intermediated via relays. For fun, I might add in real-time chat (but not to replace White Noise )

Plus the added bonus - I decided to bite the bullet on integrating post-quantum algorithms, so no PQC-FUD.

The next major lift is integrating Blossom blob support. I have mapped out the approach and plan to add the same PQC-resistant scheme for encrypting the blobs.

Onward!

This might not look like much,…

Tim Bouma — Wed, 28 Jan 2026 19:52:08 GMT

This might not look like much, but I have successfully integrated NIP-85 Trusted Assertions into my verification process. Any #nostr #safebox user will be able to decide what root authorities they trust, and what trusted assertion providers they use.

This allows anyone to decide how they wish to verify records (which is configured as safebox user parameters). It's one thing to know that a record is cryptographically valid, but it's an entirely different thing to know if the owner is actually authorized to issue the record, and what their reputation is. This is where the Web of Trust (#WoT) fits in.

This prototype was built as a result of the nosfabrica #Wotathon. It's still early, but I have proven to myself the necessary mechanisms to build a decentralized trust infrastructure that can't be captured by a platform vendor or nation state.

In the example below, you can see the green checkmarks, and the WoT Scores.

Onward!

Useful report from the EU: everyone…

Tim Bouma — Tue, 27 Jan 2026 20:59:40 GMT

Useful report from the EU: everyone cares about their health records, but I don’t think users actually care or want the EU Digital Wallet.

With #nostr #safebox, I am gunning for an open, secure system that is strong enough for private health records and with private payments.

Fundamentally important, #nostr #safebox is being designed to work independently of a phone or an app, so you can’t be captured by a state or corp.

It’s becoming easier and easier.…

Tim Bouma — Fri, 23 Jan 2026 12:43:27 GMT

It’s becoming easier and easier. The exchange I use gives me a virtualized Visa Debit Card that I have on my phone. It also gives me a Lightning address.

Yesterday, I sent funds from my #nostr #safebox to my exchange Lightning address and then loaded the funds on the card. Then I went to the grocery store and bought groceries with these funds.

A few manual steps today, but soon it will be completely automatic. All that I will need is a ‘card’ to access my funds for a local spend. It won’t matter what network will be underneath.

Sharing on how I have implemented…

Tim Bouma — Thu, 22 Jan 2026 14:06:34 GMT

Sharing on how I have implemented Web of Trust (WoT) and Root of Trust (RoT) in #nostr #safebox. There are four steps to the verification:

1. Validation: Is the record crpytographically valid?
2. Presenter: Is the record coming from whom to whom is was issued?
3. Attested By Owner: Did the owner attested that the issuing safebox was theirs?
4. In Trust List: Is the Owner in Trust List.

Steps 3 and 4 are independent attestations. For Step 3 the verifier looks up an event signed by the owner that they are indeed the owner of the issuing safebox. Step 4, the verification process has a list of 'root authorities' that are simply npubs, looks up the followers of those npubs and uses that as the 'Trust List'. In this example, there is an account called 'Safebox Trusted Entities', but it could be any account maintained by an organization, such as a College of Physicians, that might want to manage a list of doctors.

Up until now, these schemes needs to be managed by 'specialized authorities' such as certificate authorities, or organizations with proprietary databases. Now with #nostr, we can make these schemes completely open, transparent - not capturable by a technical authority. In short, everyone can become their own root of authority, manage their own trust lists, and also decide which roots to trust when verifying.

This is just a prototype, but it already demonstrates technical capabilities that are stronger and more reslient - and more open than any certificate authority program or public key directory that is out there, including what is being used by passports, driving licenses, or national authority.

Onward!

My experimental account for #nostr #safebox…

Tim Bouma — Sun, 18 Jan 2026 22:02:37 GMT

My experimental account for #nostr #safebox to test trust list concepts for the nosfabrica #WoTathon.

Accounts that are followed by this account are considered trusted entities.

nostr:nevent1qqsp2lk79xj66ccyhvyr2le9q6fp5ejajs0cfp4c53a90c4hpeakdpgzypsp4hagm4ng7gs3rtg5vlyzdjnkcm2w39zcng5adyw9k4sj9lxvxqcyqqqqqqge9alma

Nostr is the protocol that keeps…

Tim Bouma — Sun, 18 Jan 2026 17:42:51 GMT

Nostr is the protocol that keeps on giving.

I’ve been following the debate in Open Identity Connect (OIDC) where bearer tokens can be used by anyone who intercepts them. Now there is a panic to further lock down the tokens.

With, #nauth , I don’t have to worry about this, because I effectively have what I am calling ‘channel-binding’. I have 100% assurance that whatever I send to another npub, only they can decrypt and used. No need to bind the bearer token for the purpose of transmitting between two parties.

#nostr #safebox

I think it’s possible to…

Tim Bouma — Sun, 18 Jan 2026 13:55:32 GMT

I think it’s possible to build #digitalpublicinfrastructure that is controlled by no-one and used by everything.

That is what I am trying to prove with #nostr #safebox

https://dpimap.org/

I am now looking for a…

Tim Bouma — Fri, 16 Jan 2026 13:56:13 GMT

I am now looking for a enterprise relay deployment for #nostr #safebox.

#strfry by Doug Hoyte has been excellent (flawless) so far and I plan to give #pyramid by fiatjaf a whirl

https://github.com/fiatjaf/pyramid