Last Notes
Yeah the encryption is what protects the raw share data from the transport infrastructure. Each key (Shamir share) is gift wrapped to the intended steward's private key. The invitation link dance when inviting stewards (which does use a horcrux url, but doesn't have to) is essentially setting up an authorized set of keys so when your app sees a recovery request it's easy to discard bad actors.
So Nostr is a peer to peer transport layer but it's also the identity layer. The nostr events only need to stay on the relay long enough for the stewards to fetch the latest ones, so in most cases just a few days. And yeah I think being able to choose your own server is a big deal for something you want to last a long time. If I had used p2panda or iroh or ssb instead of Nostr I would still need a store-and-forward server.
@npub107j…ncxg I've been using fragua for a couple weeks now and I quite like it. Some feature requests:
- i want tool steps to have structured output (for example i have a tool to compute branch name). Right now only llm steps can provide structured output? I've hacked around this by having an llm call my tool, but it's not ideal.
- I wish the webui had some more contextual actions (i.e. approve/decline changes) on the run's detail page
- I wish there were more timestamps in the run list and detail pages.
- I want some control over worktree creation. I have a workflow that I use for feature work or if I pass it a PR url it looks at my review and addresses it. This leads to worktree collision where sometimes the initial run for that branch left tree dirty or the branch checked out and fragua fails to account for this. I've worked around it temporarily by creating a new branch for every run.
I'm not asking you to implement all this. Just letting you know in case it dovetails with feedback from other users. I am not using it as intended where I want to apply the changes to my local git worktree at the end of a run. I am running fragua on a remote sandboxed machine and most of my workflows open or update a PR that I review elsewhere. Which makes the Approve/Discard step at the end of the run kind of unecessary. I'm thinking about building my own webui that is beads-aware but still uses fragua to drive workflows under the hood.
Hah. I don't understand. Are you suggesting I just like give people a file and tell them to email it to their stewards? How would the encryption work? I think a big part of making social backup usable is creating assurances that your stewards do in fact still have the data and can access it when needed. You need some reliable machine to machine communication for that. It doesn't have to be Nostr (in fact I am thinking about adding iroh as an alternative transport), but Nostr has the pieces I need and is also built from simple building blocks that will likely still be understandable in 50 years.
Do you have any favorite stories/videos/articles of Bitcoin serving progressive ends?
Now it works (without --fpa) thanks!
https://youtu.be/LJKDF0BwepI
CC @npub10np…tl5h auth.nostr1.com seems to only give me events since July, is that the expected behavior?
CC @npub1nlk…jm9c I think nos.lol is having some auth bug? In any case I can't fetch 1059s with nak like: `nak req --prompt-sec -fpa --auth -k 1059 -p @npub16zs…92l7 nos.lol`
I tried with and without --fpa and --auth.
What are some good inbox DM relays? I think mine are borked.
Just dropped Horcrux 1.0.1 with fixes for a few bugs I found in my final testing before 1.0. Still collecting questions for the FAQ - if you have any ask away. https://horcruxbackup.com
I can't imagine what that must feel like. Praying for you and your family to get home safe.
Run `pnpm install`. Some weird error about versions.
Run `pnpm install` again. Different error.
Run `pnpm install` a third time. Magically succeeds.
I hate javascript.
Ah that makes sense. Horcrux couldn't take advantage of that path as it doesn't interact with the blockchain at all. It's much more about local trust. In fact I've been thinking about making it fully p2p because the data model is already there (as it is with most Nostr apps).
The main levers you have to work with are the number of keys you create and the number required to open the vault. So if you are worried about two key holders colluding you can set the required threshold for decryption to 3, or whatever number you want.
It's not a traditional dead man's switch, but it's a tool you could use to set up a social version of the same thing. You'd instruct your key holders not to open until you are dead, and then choose people you trust to honor that. That's exactly my primary use case actually.
I've never heard of decaying key requirements. Is there existing cryptography for that? This is build on Shamir's Secret Sharing algorithm and NIP-59 gift wraps.
Today marks the 1.0 release of my app Horcrux 🥳 Horcrux is an app for backing up data like digital wills, passwords, and cryptographic keys. The cool part is that it backs them up to the devices of your friends and family and recovering the data requires their consent. So nobody has the whole secret and even if one or two people lose their piece recovery is still possible. This adds a social layer to your security stack that is highly secure but also highly resilient. You can read more about it at https://horcruxbackup.com.
Of course it's free, open-source, and built on top of Nostr. I'm putting together a FAQ page for the website now, so post your questions in the thread below.
I'd love any feedback you have to give, here or through the contact form on the website. And I'm trying something a bit different. If you are trying to figure out if this tool is right for you and would like to just chat about it you can book a call with me here: https://cal.com/matt-lorentz/horcrux-onboarding
I burned several days over the last few months jumping through Apple and Google's App store hoops - DUNS numbers, identity verification, encryption documentation, half a dozen wizards about content in the app, privacy, and of course then the days long review process itself.
I've never published anything to https://zapstore.dev before and I just did it in 20 minutes. That includes me reading through the documentation and futzing with my Android keystore for several minutes which I had previously misconfigured. Absolutely delightful experience.
I'm hopeful that Google's blocking of third party apps and app stores is going to cause a flourishing of third party stores like Zapstore (and de-googled Android). The old systems are broken. I have to assume the deluge of vibe-coded apps is why my Apple review took 18 days. I want an app store where I pay security auditors to compile the apps themselves and go over the code with a fine-toothed comb. F-droid already has some custom repositories that more or less work this way. Zapstore has better infrastructure for this with the Vertex web-of-trust and app catalogs.
I submitted the release build of Horcrux to Apple for review on July 31st. Today, 18 days later, I got my first review. But they approved it! So I guess that makes tomorrow launch day 🍾
weird it's always free for me.
I saw that downtime you had 20 minutes ago though
TLDR; I think your approach is probably superior but prior experience makes me afraid to try it.
Interesting. You don't have a meta workflow shuffling things back and forth between review and fixes? I found myself doing so much busywork shuttling tickets manually between planning -> implementation -> (ai) verification -> (ai) code review -> back to implementation -> back to ai review -> finally to human review, etc.. I really just want to focus deeply on planning something and when I'm done have another high quality thing ready for me to deeply review. I have tried a few DAG things (have you seen Archon?) but they have all been too buggy - agents getting stuck, gates not completing. Or too expensive, like gas town or loa (https://github.com/0xHoneyJar/loa). This drove me towards lighter weight orchestration and having a managing agent that observes and nudges others.
If you don't mind sharing how much does your setup cost per month or per day? I see "12" as the default limit on the review PR, is that $12? I feel quite token constrained atm. While I'd love to fan out 6 lenses in parallel for a PR review I don't think I can afford to do that everyday as a solo dev.
I will get around to this at some point. Already running pomade so what's another key sharding thing.
https://github.com/fiatjaf/nak
nak is such a good command line tool it makes me question whether it exists to support the Nostr protocol or if the Nostr protocol is just an excuse to ship nak.
I wrote about the broad strokes in this note: #nevent1q…m7tp
No mine's just my own thing. I've tried many others but none of them quite fit. I'm happy to share the code with you though if you want. I'm not sure the best way to do that but I'll figure something out if you are interested.
Hey glad you are back. Is this something you can share? I have made something similar but I don't have great deterministic gates.
I gave it a short try but didn't find anything that excited me. I'm working mostly solo so the idea of sharing agents with other team members, while really interesting, isn't immediately useful. And they don't have any architecture to enable the type of swarming I'm talking about.
I canceled my Cursor subscription today. It has felt for a while that they stopped building for the way I want to work with AI. Then the bugs keep getting worse, and the SpaceX acquisition doesn't give me a lot of hope that things will get better.
I spent yesterday using VSCodium and my homebrew agent orchestration system in tmux. I also tried emdash (https://emdash.ai/), and retried Archon (https://github.com/coleam00/Archon).
I'm still feeling like small agent swarms with a mixture of models that pass work between themselves is the sovereign AI stack of the future. The manager of the swarm can paper over a lot of the small issues with LLMs. Plug in whatever cheap source of tokens you can find, mix in local models if you want, your interface stays the same. Put it all in a decent sandbox and dangerously skip permissions.
Yes we went through a few. Flotilla, zap.stream, routstr, maybe some others. But we actually spent more time discussing some of the tradeoffs of the Nostr protocol than I had planned. Which was nice, maybe I should've organized the session more around that.
Has anyone tried https://buzz.xyz yet? Thoughts? How does it compare to something like gas town?
I finally finished my security audit of Horcrux, the last major project before release. It was a ton of work and honestly no fun at all, but I'm glad I did it as it gives me the confidence to finally open the app up for real world use. I've got a couple last bugs to fix and some marketing materials to write. Hoping to submit binaries to the app stores next week! If you want to check it out the audit it's published here: https://github.com/mplorentz/horcrux/blob/main/docs/security-audit-july-2026.md
The answer, unfortunately, is no.
#nevent1q…e0ul
Sweet. I would love a kind 1 client to order comments by one of these algorithms (mainly Most Relevant). I love browsing replies in the reddit-like tree of Nostrudel but often there are spam or off topic comments at the top. @npub1ye5…knpr @npub176p…vgup
#nevent1q…eyvq
Any other Nostr apps you would like me to plug?
#nevent1q…vgqr
@nprofile…gnen @nprofile…nj27 I just tried creating a new account and using the promenade bunker and got an error when it was trying to "activate the bunker".
Is anyone hosting a version of https://use.nsec.app that still works? It seems like it's trying to do some NIP-05 allocation that is broken and I can't skip, and brugeman is gone.
I'm hosting a session at DWeb Camp next week for folks to interactively try Nostr. What apps should I encourage people new to the protocol to try? What is the best app to show first?
I just published my Q2 report as part of my grant from OpenSats, if you are curious what I have been up to recently. TLDR; getting horcrux into a public beta and preparing for the initial release. https://mattlorentz.com/2026/06/25/opensats-q2-grant-update.html
I'm making a push to release version 1.0 of Horcrux this month. Not sure if I will make my deadline but it should be close. There is so much left I want to do in terms of UX, marketing, and sustainability, but it's delivering on its core promise of being a secure way to store secrets with friends and family.
I'm currently in week two of my security audit and I found my first critical issue today. It's humbling but also satisfying to be reviewing all the hard work I've put in over the last year.
TIL about Neo Cypherpunks. More power to them.
Pomegranate is another step forward for key management. Glad to see it shipping already!
#nevent1q…94sj
Https://flotilla.social cc @nprofile…dgdk
This is the type of marketing material I want for Nostr.
Claude Fable when I ask it to fix my regex: https://youtu.be/-UYgORr5Qhg?t=55
Looks like you managed to fix it? In any case, it wasn't a big deal for our community. Bugs happen.
We are legion @nprofile…ac8d