- Published on
An impact report from the front-lines of nostr relay development.
Web of Trust
WoT, NIP-85, trust rank, PageRank
Reputation as a graph rather than an authority-managed list. On Nostr, scoring the social graph turns it into a per-user filter for events.
Web of trust is the idea that reputation is a graph rather than a list kept by an authority. The term comes from PGP in the early 1990s, where people signed each other's keys at "key-signing parties" so a recipient could decide to trust an unknown public key once someone they already trusted had signed it. Variants of the same model show up in other permissionless systems where there is no admin to hand out reputation.
Nostr applies the idea to events. Every user already publishes a follow list as a signed event. A client can read the follow lists of the people you follow, score every other pubkey by how close it sits in that graph, and apply the score as a filter: notes, replies, zaps, and DMs from accounts inside your circle pass through, the rest gets muted or downranked.
The result is per-user moderation that does not need a central authority. Two people reading the same relays see different feeds because their graphs are different. A spammer who buys ten thousand fake follows still cannot reach a user whose own contacts have not vouched for any of them.
The relay-level version of this is pyramid by fiatjaf, a relay built around a hierarchical invite tree. Each member can invite a fixed number of others, every member is responsible for their descendants, and the root admin can drop entire branches. Membership becomes the WoT, enforced when reading and writing rather than after the fact in each client. Pyramid's inbox sub-relay further filters at the second-degree social graph of its members, so unsolicited replies from outside the extended network are dropped before they reach the user.
Scoring services do the graph work outside the client and return a number. Vertex computes (Personalized) PageRank over the nostr social graph and exposes the result as a query API; clients use it for spam filtering, follow recommendations, and ranked profile search, and every response is signed so a client can verify it without trusting the host. Relatr computes a per-perspective trust score by combining social-graph distance with profile validations like NIP-05 and Lightning addresses, and every instance runs from the perspective of one source pubkey, so the same target user can end up with different scores from different operators. Relatr ships as a deployment of ContextVM, a protocol for running services over nostr, so anyone can run their own from a Docker container or an Umbrel/Start9 one-click install.
NIP-85 is the publishing format that lets these scoring services hand their numbers back to clients without each client recomputing the graph. It defines kind 30382 "trusted assertions". Relatr emits NIP-85 events; Vertex keeps its API outside the event format. Clients are also free to compute scores locally, and many do.
Client-side WoT filtering is shipped by Amethyst, Damus, Coracle, NDK, Flotilla, and others.