In the long run what incentive does a relay operator have to host a public relay (to achieve a twitter like global feed)?
  • Pay for relaying traffic. This is an obvious use-case. Having a dumb relay for hole-punching between NATs is very useful. There is already a market developing for this.
  • Pay for storing data. This is another obvious use-case. Relays provide access to websocket native data storage with non-custodial identity. That is actually quite incredible.
  • Pay for pubkey -> name resolution services. This is already quickly becoming a thing. It's very useful for verification and routing.
  • Subscription to a curated platform. A combination of the above, where you are provided a social media experience as a service. Essentially Twitter / Mastadon / etc with a subscription.
  • Pay for API / Integrations. Also quickly becoming a thing. It's simple to setup a chatgpt bot on nostr and charge money.
  • Mining / selling data. We are all aware of this revenue model. The interoperability between clients-relays will make aggregation much simpler.
How will the relay operator cover the hosting costs? Assume, not all users are on a lightning standard. How will a normie use this system?
You don't have to use lightning.
How can we achieve a network effects if most current twitter users are not on lightning?
Nostr uses schnorr keys for identity, meaning that they also support lightning directly (with taproot channels) i.e your nostr private key can also sign lightning invoices.
Lightning invoices already have a slick integration into nostr (see zaps) and nostr profiles include lud16 payment addresses.
What happens when your relay is shut down for routing illicit content, even if its encrypted en route thru the relay, its still public from the decrypted client. (kiddy porn, etc...)? Not a great end user experience if you need to play a game of "whack a mole" and keep changing relays when they get shut down or ddos'd.
This is a common red-herring that you can bring up for any platform. Relays need better moderation tools but they are actively being developed.
How do you prevent XSS attacks for browser clients? Can we even have secure browser clients?
Same as any other key custody solution: hardware and software signing devices. See nos2x.
Do you feel comfortable having raw data coming into your phone/web browser via web sockets from random ppl on the internet without having a server virus scan it first?
This is another common red-herring framed as a nostr-centric problem. Write good code and sanitize your inputs.
How to achieve a global algorithmic feed like twitter? Will this lead to an emergence of indexing services?
Most likely.
If you argue relays will start indexing data then won't it just be a traditional client/server/database model?
With decentralized identity and client-native data replication, yes.