Napster resurrects peer sharing with Nostr and Tor
- Napster launched a decentralized music sharing protocol built on Nostr relays and ephemeral Tor connections.
- Relays and client apps hardened privacy controls with NIP-42 authentication and NIP-44 encrypted gift wraps.
- Mostro updated its escrow engine to prevent expensive cryptographic signature validation attacks.
Peer-to-peer file sharing is abandoning central servers entirely.
Details revealed on Nostr Compass in mid-September 2026 showed Napster returning as an open-source media network running over decentralized relays. The client catalogs files using kind 30,421 events and tracks online peers through kind 30,422 heartbeats every ten minutes. When two users agree on a transfer, they negotiate parameters inside encrypted direct messages. The actual file delivery skips relays completely, running across an ephemeral Tor version 3 onion connection generated strictly for that handshake.
"Nostr handles discovery; Tor handles the bytes."
- Host, Nostr Compass
Infrastructure components are upgrading to support the increased bandwidth and private coordination. Go-based relay Conduit hardened its outbox authentication under NIP-42, ensuring private inbox messages remain downloadable strictly by intended recipient keys. Meanwhile, peer-to-peer exchange Mostro released version 0.18.5, switching gift wraps to NIP-44 encryption and running pre-signature checks on incoming events to neutralize expensive signature-validation attacks.
"Infrastructure is moving past dumb relays toward hardened, authenticated endpoints."
- Host, Nostr Compass
Mobile clients adopted complementary security controls across Android ecosystems. Text-to-speech reader Voca released versions 1.0 and 1.1.0 on Zap Store for GrapheneOS, verifying cryptographic signatures locally before queuing posts for offline playback. Amethyst version 1 integrated NIP-84 portable highlights and patched a shared key cache vulnerability to eliminate hash collisions.
Core developer tooling resolved underlying network friction that previously generated excess traffic. NDK fixed an entropy set reconsolidation bug alongside a request collapse issue across relays. Simultaneously, updated relay specifications now allow endpoints to signal when search results are truncated, prompting users to sign in via NIP-42 for complete index access.
Application layer protocols expanded into compute marketplaces and zero-trust payments. Nostream added support for NIP-89 application handler discovery and NIP-90 data vending machines, while Mostro refined its two-out-of-three Cashu escrow framework.
Metadata stays public on open relays, but the bytes remain strictly private.
Source Intelligence
- Deep dive into what was said in the episodes
Logbook Episode 38 • Sep 14
- Voca version 1.0 and 1.1.0 released as a GrapheneOS text-to-speech reader on Zap Store. It fetches and locally verifies Nostr URLs natively from relays, and allows users to queue npub long-form posts for offline reading.
- Nostream now supports NIP-89 application handler discovery and NIP-90 data vending machine jobs. Meanwhile, NDK resolved an entropy set reconsolidation bug that caused excess events and fixed a request collapse issue across different relays.
- Divine Mobile fixed private DM duplicate text collisions and added a dual deletion request to remove local storage events. Conduit hardened its NIP-42 authentication to ensure inbox DM events are only downloadable by the intended recipient.
- Amethyst version 1 integrated NIP-84 portable highlights to reference external or Nostr content. The update also adds NIP-29 group archiving and patches a shared key cache vulnerability that caused hash collisions.
- Mostro version 0.18.5 defaulted to NIP-44 encryption for gift wraps and added pre-signature checks on incoming events to mitigate expensive signature-validation attacks. It is also refining its two-out-of-three Cashu escrow system.
- Napster launched as a Nostr-based music sharing app, cataloging files using kind 30,421 and tracking online peers via kind 30,422 heartbeats. Transfers are negotiated via NIP-17 private DMs and routed through ephemeral Tor version 3 onion addresses.
- Recent NIP updates allow relays to signal that more filter results exist post-authentication. Additionally, the Nostr Wallet Connect specification clarified that the list transaction API must return actual transaction counts instead of raw database rows.
Also discussed on this episode: (4)
Nostr (4)
- The host transitioned the podcast from Riverside to a custom, native Nostr recording setup. Listeners can log in with their Nostr keys on the website to submit voice notes, which are then compiled into the weekly Wednesday episodes.
- Concord streamlined its relay permission flow to prevent connection request overload and introduced key backup discovery. The client also fixed Cashu proof backfill truncation and added search indexing for event titles and names.
- MDK optimized encrypted group chats by scanning admin events in a single member walk. Zap.cooking now restricts NIP-46 signer traffic to configured bunker relays, while Nostwort enabled device-wide decryption of NIP-17 gift wraps.
- NIP-18 mandates kind 6 events for kind 1 reposts, while other kinds must use kind 16 with a "k" tag. NIP-25 defines kind 7 reactions, requiring "+" for upvotes, "-" for downvotes, and custom emojis to avoid automated vote interpretation.