Your First Code Review.

Highlights

1Nostr with Alex

A Nostr identity in one command. Alex installed Gigi’s nihao and created a “Code Orange” account live. One command made the key pair, a profile, a relay list, a Lightning address and an ecash wallet. No company, no sign-up, no permission.

$ go install github.com/dergigi/nihao@latest
$ nihao --name "Code Orange"
✓ key pair         npub1… (share this)  nsec1… (never share this)
✓ profile          kind 0 → 4 relays
✓ follow list      kind 3
✓ DM relays        published
✓ lightning address lud16 set
✓ ecash wallet     mint validated
# done. no company, no sign-up, no permission

Simplified from the live demo.

Your npub is your account number and your nsec is your password, just like a Bitcoin key. You sign once and publish to several relays, so no single relay can silence you, and any Nostr app can read your posts.

Everything on Nostr is an event, and every event has the same shape. The kind number says what it is. The NIPs, like BIPs for Bitcoin, say what each kind means.

2Peer Observer with Razor

Reviewing a real Bitcoin PR, live. Bitcoin nodes talk to each other over the peer-to-peer network. Peer Observer runs honeypot nodes that watch that network for anomalies and attacks, like a security team for Bitcoin. It has already helped spot LinkingLion: nodes that connect to you and only listen.

Razor then reviewed a pull request that adds integration tests to Peer Observer’s eBPF extractor, hitting the same walls any beginner hits along the way.

# 1. get the PR branch
$ git remote add b10c https://github.com/0xB10C/peer-observer
$ git fetch b10c && git checkout <pr-branch>
# 2. build it (as your normal user)
$ cargo test -p ebpf-extractor --no-run
# 3. run it (eBPF tests need root)
$ sudo -E <test-binary> --ignored
✗ 4 failed: NATS server binary not set
$ export NATS_SERVER_BINARY=$(which nats-server)
✓ test result: ok. 4 passed
# 4. break it on purpose: assert!(false)
✗ test result: FAILED. 1 failed  (line 301: now you know where to look)

Simplified from the live review. Stuck at any step? Razor pasted the PR link into Claude’s free plan and asked.

Key takeaways

1. Nostr is to X what Bitcoin is to a bank. On X a company owns your account. On Mastodon your account lives on someone’s server, and if they shut it down it is gone. On Nostr you hold the key.

2. Ecash makes money as easy as a message. With Lightning you have to ask for money with an invoice. With ecash someone can drop sats on your npub like a note on your desk. That opens up paying for content in sats instead of selling attention to advertisers.

3. Review before you code. You don’t need to be a maintainer to review. Running the tests and saying they pass on your machine is a valid review, and so is asking a question about something unclear. For a small fix, just open the PR. For a bigger change, open an issue first so nobody wastes their time.

“The more you learn about it, the more you realize how little you know.”

Razor, on Bitcoin

4. LLMs: useful, but you still own the review. The room was split. Some let agents write and review most of the code; Razor still drives by hand. His rule: a contributor should put in at least as much effort as the person reviewing their work.

Resources shared

Reading

• Nostr NIPs: the Nostr Implementation Possibilities, like BIPs for Nostr, with the list of event kinds
• Blossom: spec for storing media on servers you choose, tied to your Nostr key
• Bitcoin P2P network reference: how nodes talk: message headers, magic bytes, block and getblocks messages
• LinkingLion: An entity linking Bitcoin transactions to IPs?, 0xB10C: suspicious nodes that connect and only listen, spotted with Peer Observer

Tools

• nihao, Gigi: one command sets up a Nostr identity, relays, Lightning address and Cashu wallet, and health-checks an npub
• nak, fiatjaf: command-line tool to sign, publish and query Nostr events
• Peer Observer, 0xB10C: monitors the Bitcoin P2P network for anomalies and attacks with honeypot nodes; the PR we reviewed adds integration tests to its eBPF extractor
• NATS: the message queue Peer Observer’s tests need (set NATS_SERVER_BINARY)
• Claude: the free plan is enough to paste a PR link and ask how to build and test it
• Cashu: ecash protocol behind the wallet nihao sets up
• Minibits: Cashu ecash wallet and mint
• Coinos: web wallet that runs a Cashu mint
• Arkade: Bitcoin project an attendee contributes to, where LLMs do most first-pass reviews

Nostr apps

• Jumble: Nostr web client used in the demo
• Primal: Nostr client and relay
• Damus: Nostr client for iPhone
• Amethyst: Nostr client for Android
• Mastodon: the “half-decentralized” comparison: your account lives on someone’s server

Code Orange

• Privacy Developer Track: every 1st and 3rd Tuesday; PayJoin is next
• Decoding Bitcoin cohort: 10-week study cohort starting Monday 16 November (announced on the call as Mastering Bitcoin)

Ideas from the call: a monthly Nostr workshop (several people asked for it), and one topic per Code Review Club instead of two.

Browse every resource from every session →