Episode
30: Napplets w/ Sandwich
- Podcast
- No Solutions
- Published
- Jul 22, 2026
- Duration seconds
- 5865
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/no-solutions-7206062/episodes/30-napplets-w-sandwich/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/no-solutions-7206062/30-napplets-w-sandwich.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
"You should be able to compose your clients." Sandwich & Gigi take a walk. Listen on sovereignengineering.io Sandwich and Gigi spend the first 45 minutes or so talking through napplets: composable, sandboxed Nostr apps that can run inside a host shell while the host mediates signing, storage, relay access, uploads, permissions, and user trust. What starts as a conversation about applets quickly becomes an operating-system conversation: if Nostr is flexible enough to carry many kinds of software, clients probably need to become composable runtimes instead of monolithic apps. Along the way they get into browser sandboxes, iframes, postMessage, malicious applets, Blossom uploads, NIP-5D, nsites, specialized relays, agent workflows, slop scanning, and why the AI subsidy era will not last forever. In this dialogue: why a normal Nostr client can feel too restrictive for a protocol built around maximum flexibility how napplets grew out of earlier experiments with Naps, Nap.run, nsites, Hyprland -inspired desktops, Tauri , Thorium , and iframe hardening why the host runtime handles keys, signing, encryption, relays, resource loading, storage, uploads, and user prompts why napplets should get high-level helper APIs plus low-level escape hatches instead of direct access to everything how a napplet can upload through Blossom without knowing which Blossom server the user prefers why the shell should see plaintext over the message bus, and how that helps defend users from malicious applets how applet-to-app communication starts to look like Android intents, MIME types, archetypes, and operating-system resource APIs why the browser is a practical deployment target even if the napplet protocol itself is not browser-bound what Kehto, Paja, the napplet dev tooling, and th…