pull down to refresh
Actually, I want to ask you why ShockWallet is paired with Sanctum? the sign-in experience is a bit odd. 👀
reply
Since ShockWallet only uses Nostr for connections, Sanctum gives users that just want email auth as an option such that they needn't manage a nostr key... Sanctum itself is a remote signer for Nostr that will host a key behind email auth.
It is a bit novel and tough UX to crack, so any suggestions on how to make it friendlier greatly appreciated
reply
I don't want to reprise NVK and say Lightning.Pub / CLINK is more secure than the alternatives, software will always have bugs and this is inherently a bleeding-edge and adversarial environment... hot-wallet risk is the trade-off of earning money while you sleep.
That said, one of the design considerations for Pub/CLINK is its smaller and more tightly scoped surface to secure thanks to nostr-native interfaces. You needn't be a firewall expert to run it, nor stick it out on a cloud edge with remote credentials back to your node at home.
Remote administration being exclusively tied to a nostr key to eliminates more complex authentication layering that was just exploited in BTCPay. BTCPay is a good project that unfortunately inherited a lot of unnecessary web crap by forking from BitPay.
CLINK and NWC both use Nostr-relays, so a bad relay will effect both, but CLINK as a protocol is more resilient since it's explicitly request-response without state. NWC is more of a persistent RPC with bloated subscriptions required of the server because of the secret fumbling necessary to establish connection.
NWC was built for wallet remote control, CLINK was built precisely for ad-hoc use-cases in a merchant setting.
There's been other merchant plugins for CLINK published as well, Vendure, OpenCart, Medusa among them beyond WooCommerce and BTCPay https://clinkme.dev/apps.html
This is a bit back-burner and very much a WIP, but I'm drafting some changes to NIP-99 so that shops can be a normal part of the nostr social UX and actually be useful. The current spec has buyers define invoice values, negligible payer_data, and i'm not aware of any back-ends for it that can actually pipe that data to fufillment like CLINK offers does in ShockWallet
I'd guesstimate that some point in September we'll be ready turn this on in Bxrd and ShockWallet Payment Pages