How would that look in practice? If Bob only receives an output, he has to go through all block filters until he finds the output - every time. A heuristic to speed up this process would be to go backwards from chain tip. But this still seems impractical to me. A timestamp as a hint could make this more feasible to limit the probable range.
Why would a wallet need to go to either extreme? There are two aspects we are discussing. One being DoS resistance and the other being validation of the message. The latter is generally required in my opinion. A wallet cannot just take a notification and blindly trust that this output is spendable, or even exists. The most basic check is: “Does this output still exist and did I already receive this notification”. Most or all wallets are most likely able to run the scanning logic for that transaction at the same time. I don’t see a good reason, yet, to skip this validation. My assumption here is that during any basic validation the wallet would use it’s default backend which would be “other sources”.
Bob, despite trusting Alice, blindly adding the notification’s output as an input in a new transaction sounds like a UX nightmare to me. One just needs to consider an RBF-Scenario where the transaction’s inputs changed, consequently changing all SP outputs. Alice did not defraud Bob and can be trusted. But two notifications exist of which the first one does not point to valid transaction or output. I guess this is somewhat what you were eluding to in your previous reply to the Gist.
I directionally agree with this. I would say, though, that for very standard data, like the tweak, I don’t see a problem at all. I’d be more critical if we were talking about fringe or edge case data. The tweak is standard information which every sender has and every receiver needs. Trust assumptions referenced above.
Also about adding a tweak. I think it mainly becomes an issue if a wallet has a bad trade-off or handles a notification in a way which creates weird UX cases.
Let me rephrase/clarify. I meant Web of Trust in the wider sense not the Nostr scoring system. If I receive this notification via something like Signal or E-Mail from somebody with whom I have had a previous relationship, I have to take less protective measures compared to a completely open and unchecked input channel like random Nostr DMs.