Hide&Seek on Nostr: I understand your point, but this is not adversarial thinking. What I see is that ...

I understand your point, but this is not adversarial thinking.

What I see is that it's opening the door for me to run arbitrary code on juicy target (bitcoiners/developers) machines. I also have an amazing delivery vector — no need to click on a .exe, no need to open a attachment, just a client opening an event in the background.

Now, I just need to find a way to break that compartimentation, and I'm pretty sure the API, if not some implementation bug, is going to give me just that... ;)

(And to be honnest, I didn't dig into it in details so I might be wrong; I'm sharing first impressions after a quick read, but I can already see the opportunity there!)