Nostr notes by Joey_NostrComments

This is the project's own thread. Questions, ideas, or things ...

2026-10-14T21:35:57Z

This is the project's own thread. Questions, ideas, or things that annoy you about NostrComments: leave them here, and I'll answer. Bugs are easier to track in Issues. Recent fixes: the Share button could be hidden by content blockers (fixed in 23.9.5), and it could post twice with a slow signer (fixed in 23.9.4).

https://github.com/briskness-byte/NostrComments

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fbriskness-byte%2FNostrComments

Some practical experience, since the article stays general: I ...

2026-10-14T20:37:24Z

Some practical experience, since the article stays general: I push my project to GitHub and to two Nostr git servers (gitnostr.com and relay.ngit.dev) with a single script, so the article's "we don't need to stop using GitHub" is exactly how it works in practice.

Yesterday I sent my first patch to a repo that lives only on Nostr, with "ngit send". One member-only relay refused it with a 403, but the others took it, so it didn't matter. That's the resilience the article describes, in one terminal line.

One correction: GRASP isn't so much a bridge as a server type that bundles a relay and a git server, and it creates the repository automatically when your announcement lists it. That's why you don't have to set anything up on the server side.

https://nostrmag.com/article/w40nostr01

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fnostrmag.com%2Farticle%2Fw40nostr01

Browser extension dev here (NostrComments). My honest reason is a ...

2026-10-14T06:31:15Z

In reply to nevent1q…yngn
_________________________

Browser extension dev here (NostrComments). My honest reason is a sixth one: I don't speak NIP-46 yet, only local keys and NIP-07. It's on my list now, and Pomegranate would come for free once it's done. The part that appeals to me is recovery: right now a user's identity lives in one browser profile.

My penis

2026-10-14T06:06:46Z

In reply to nevent1q…fsz4
_________________________

My penis

https://www.x.com/ (X/twitter) most of the time

2026-10-13T21:05:36Z

In reply to nevent1q…hs4z
_________________________

https://www.x.com/ (X/twitter) most of the time

Worth knowing if you're thinking of applying: the money is ...

2026-10-13T20:53:24Z

Worth knowing if you're thinking of applying: the money is for the people doing the hunting (AI tokens, servers, fuzzing), not for projects that want an audit of their own code. All five grantees in this first round work on Bitcoin infrastructure: Core, libsecp256k1, btcd, BTCPay and mempool. Applications are fast-tracked via opensats.org/apply/red.

https://opensats.org/blog/red-team-grants-first-set

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fopensats.org%2Fblog%2Fred-team-grants-first-set

I put a comment section on every web page on the internet. You ...

2026-10-13T12:07:04Z

I put a comment section on every web page on the internet.
You can now:
- discuss news articles without censorship or being banned
- warn each other for possible scam websites
and many other things with NostrComments

Install the browser extension now on:
Chrome:
https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox:
https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/

Puts the Freedom back in your hands

Open source:
Github: https://github.com/briskness-byte/NostrComments

#nostr #foss #freedom #censorship

NostrComments puts a comment thread on every web page on the ...

2026-10-13T10:53:18Z

NostrComments puts a comment thread on every web page on the internet. This means you can post and read comments about the web page from other users. The thread lives on Nostr relays, not on the site. There is no middleman: no server of mine, no account, no telemetry, and the site you're commenting on can't close it.

For users: install the extension, make a key in one click or use your existing Nostr signer, and comment anywhere. That includes the news site that turned comments off, the paywalled article, the government page and the press release. Nostr notes that tag a page's address show up in its thread too, so a page isn't always empty. Zap a good comment, mute the bad ones. Nothing is sent until you switch it on; after that, the relays you choose can see which pages you read.

For developers: comments are plain NIP-22 events (kind 1111, the URL in the I tag), so any client can read and write the same threads. Other tools already use this format but turn a URL into an address differently. If you build one, let's agree on that rule.

Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox: https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/
Source: https://github.com/briskness-byte/NostrComments

#nostr #freespeech #foss

Thank you @npub1qth…rcch , I really appreciate it! ⚡️

2026-10-12T21:51:43Z

In reply to nevent1q…ann7
_________________________

Thank you DevCrafter (npub1qth…rcch) , I really appreciate it! ⚡️

GM ☕ NostrComments has been live in the Chrome and Firefox ...

2026-10-12T09:21:59Z

GM ☕

NostrComments has been live in the Chrome and Firefox stores for a few weeks now.

The thing I see most often:
People open the button on an article where the comments are already closed or deleted… and there’s already a thread waiting.

That’s exactly why I built this.

Small updates from the last few days:
• The floating button is quieter by default (dims until you hover)
• One-click disable per site
• Remembers which corner you want it in, per website

Still no server, no account, no tracking.
Just comments the site owner can’t delete.

If you haven’t tried it yet:
Chrome → https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox → https://addons.mozilla.org/firefox/addon/nostrcomments/

Or read any thread without installing anything:
https://briskness-byte.github.io/thread/

Which page would you most like to give an uncensorable comment section?

#nostr #asknostr

A few releases of NostrComments since last time: the floating ...

2026-10-10T10:59:10Z

A few releases of NostrComments since last time: the floating button dims unless you hover it, can be dragged to a corner instead of only picked from a menu, and can now be turned off entirely in settings. With it off, the toolbar icon becomes the way in instead — and now shows how many replies you haven't seen yet, so that's still covered.

https://briskness-byte.github.io/
github.com/briskness-byte/NostrComments

Thanks for confirming! Good timing — I just shipped exactly ...

2026-10-09T20:07:30Z

In reply to nevent1q…z0jh
_________________________

Thanks for confirming! Good timing — I just shipped exactly that: the button dims by default now, and hovering it shows a small × that turns it off on that site in one click, no settings menu needed. It's live now on GitHub and Firefox (AMO), and submitted to the Chrome Web Store — that review usually takes a few days. Will ping you when Chrome catches up, if you want.

Appreciate you saying so, that's useful to know. Quick ...

2026-10-09T18:44:19Z

In reply to nevent1q…vl5m
_________________________

Appreciate you saying so, that's useful to know. Quick question so I fix the right thing: was it the little floating button sitting on every page, or the panel once you opened it? (I'm the dev, btw.)

If it's the button: it can be dragged (or set in settings) to whichever corner is free and that's remembered per site, and there's a per-site off switch too. If it's the open panel taking over the screen, that's actually the next big thing I'm working on — moving it out of the page entirely into the browser's own sidebar, so it never overlaps anything.

Thanks for picking that up @nprofile…fywd , that's pretty ...

2026-10-09T18:43:03Z

In reply to nevent1q…wxly
_________________________

Thanks for picking that up DevCrafter (nprofile…fywd) , that's pretty much exactly it. One small nuance: the key lives in the browser until Bob chooses to export it (as nsec, or connect a client with NIP-07) — not automatically on his phone, but one copy-paste away whenever he wants it. And agreed on #2 — the bottleneck isn't really Nostr itself, it's getting people who already care about open protocols to notice it exists.

Yep — not a silo. Every comment is a real signed Nostr event ...

2026-10-09T07:17:07Z

In reply to nevent1q…6c0y
_________________________

Yep — not a silo. Every comment is a real signed Nostr event (kind 1111, NIP‑22), published to the public relays you choose. No server of mine in between. Sign with a generated key or your own NIP‑07 signer (nos2x, Alby). Other Nostr clients that read that event kind, like Jumble, can see the same comments.

GM! Coffee's on, let's build something great today. ...

2026-10-09T07:14:34Z

GM! Coffee's on, let's build something great today.

One idea (disclosure: it's mine) — meet people where they ...

2026-10-08T22:49:05Z

In reply to nevent1q…mwcu
_________________________

One idea (disclosure: it's mine) — meet people where they already are instead of asking them to install a client first. NostrComments puts a Nostr-backed comment thread on any website; reading needs zero signup, posting needs a key. No 'come to Nostr' wall.

A URL-keyed thread is one place this shows up for me. A comment ...

2026-10-06T10:20:14Z

In reply to nevent1q…tl5d
_________________________

A URL-keyed thread is one place this shows up for me. A comment is filed under a page address rather than a community, so there is no owner to moderate it and nothing to join. That makes it easy to read across clients, but it also means nobody is in charge of what sticks. Where do you think that should sit: with the relay, the reader, or the page?

If your browser extension uses sender.tab to tell web pages apart ...

2026-10-04T12:15:47Z

If your browser extension uses sender.tab to tell web pages apart from its own pages, check this. I got it wrong in a signer and it cost me a release.

The background script refused privileged messages, like setting a PIN, whenever sender.tab was set. The reasoning: content scripts run in tabs, so a message with a tab came from a web page.

But the extension's own options page has a tab too, as soon as it is opened in one. So the extension blocked itself. PIN setup didn't throw an error or show a warning. It just did nothing.

The check that means what you intended is the sender's URL, not whether a tab exists: compare sender.url against browser.runtime.getURL(''). Your own pages pass, and anything a content script relays from a web page does not.

The second half of the same fix: the content-script bridge now forwards only an explicit list of message types. Before, some handlers were out of a page's reach only by accident, and an accident is not a boundary.

NostrComments 23.4.0 is out. A reader of the extension — Emre ...

2026-09-30T22:13:15Z

NostrComments 23.4.0 is out. A reader of the extension — Emre Yılmaz ( delirehberi (npub1gme…wl3v) ), blog.emre.xyz — wrote up a discovery convention for pages that are also native Nostr content: a <link rel="alternate" href="nostr:naddr…"> tag, so a client can find the entity a page already is. Sent it in as a proper draft, trust considerations included.

Built the read half of it — a page naming its own Nostr entity now has that thread merged into the panel, alongside the URL-scoped one. Thank you for taking the time to write it up properly Emre!

Gutenmorgen!

2026-09-23T05:39:36Z

In reply to nevent1q…zxlv
_________________________

Gutenmorgen!

If you use nos2x-fox as your Nostr signer in Firefox, make sure ...

2026-09-22T14:51:36Z

If you use nos2x-fox as your Nostr signer in Firefox, make sure you're on 1.21.0. It closes two things worth knowing about.

While your PIN was cached after an unlock, any website could ask the extension for it and get it back in plain text. That PIN is what encrypts your private key at rest, so a page could walk away with the one secret between it and your key. I reported it privately and wrote the fix; it was also reported publicly as #68.

The second was found by daym. The extension used to inject its script into pages as <script src="moz-extension://<uuid>/…">. Firefox gives every extension a random UUID per install precisely so websites can't fingerprint you by the extensions you run, and that tag handed it to every site you visited: the same on each one, and surviving cleared cookies. It now loads as a MAIN-world content script, with nothing left in the page to read.

Nothing to do except update. Firefox normally does that for you; about:addons shows which version you have.

https://github.com/diegogurpegui/nos2x-fox/releases/tag/v1.21.0

One of the dumbest things you can do on Nostr is sharing your ...

2026-09-19T14:57:27Z

One of the dumbest things you can do on Nostr is sharing your private keys, like nsec138mwgc6rvpukzn7xj5522xzc63h69f6533tupl25trtps4nckl0qp452vg

If your browser extension draws its UI inside the page, check ...

2026-09-18T10:07:32Z

If your browser extension draws its UI inside the page, check this one. I had it wrong for months.

My comment panel lives in an open shadow root in the page, so any script on the page can reach every control in it. I guarded the ones that matter — granting consent, adding a relay — by checking the event's isTrusted, which only the browser can set. That felt like enough.

It is not, and I only found out because I tried to break it myself instead of assuming.

A page can skip the event entirely: take the element, call its onclick directly, and hand it an object it made up. isTrusted is just a property on that object. It can also act while a real click of yours is being delivered elsewhere in the panel, which is long enough for a naive "was that trusted" flag to still be true.

Against my own build that meant a page could open settings, press "Show private key" and read the nsec straight out of the field. And separately, type a comment and post it under my key. Without me clicking anything.

What works instead is to never trust what the caller passed. A capture listener on the shadow root records which element a real gesture is activating, in a closure the page cannot reach, and each sensitive handler asks only whether that element is itself. Dispatching an event sets nothing. Calling a handler sends no event at all. Piggybacking on a real click leaves some other element as the target.

It is still a mitigation and not a boundary, and I would rather say so: the panel is in the page's DOM, so a page can read the thread, read what I am typing, and read a key I choose to display while I am on it. Moving those controls onto the extension's own surface is the actual fix, and that is the next thing I build.

Fixed in 23.3.1 — out on Firefox, in review at Chrome.

Happy birthday🦥

2026-09-16T05:46:25Z

In reply to nevent1q…dnej
_________________________

Happy birthday🦥

Yeah, this is exactly why I made this. I was running into issues ...

2026-09-16T02:33:17Z

In reply to nevent1q…5hzx
_________________________

Yeah, this is exactly why I made this. I was running into issues like that myself, I hated the censorship and major platforms these days are censoring all kinds of comments to manipulate the public opinion and still call it a democracy, but there can't be a true democracy without free speech.
The secondary benefit is that people can warn each other on scam or phishing websites, making the web potentially safer. But only a handful of people are using nostrcomments so it's still in early development and benefits are still theoretical.

Then the question becomes: Why did you invest in their bitcoin ...

2026-09-15T21:01:03Z

In reply to nevent1q…p9h4
_________________________

Then the question becomes: Why did you invest in their bitcoin and prop up their wealth in the ponzi?

Thanks for the replies everyone🫶

2026-09-15T19:36:45Z

In reply to nevent1q…8snq
_________________________

Thanks for the replies everyone🫶

The irony is that actual CSAM material is embedded into the ...

2026-09-15T16:37:53Z

In reply to nevent1q…hrn8
_________________________

The irony is that actual CSAM material is embedded into the bitcoin blockchain by early bitcoin users.

I hate Primal

2026-09-15T16:25:09Z

In reply to nevent1q…ukxe
_________________________

I hate Primal

Hey sorry to ask; Do you use drugs as a way to escape from the ...

2026-09-15T10:57:19Z

In reply to nevent1q…46cd
_________________________

Hey sorry to ask; Do you use drugs as a way to escape from the problems you should actually fix in your life as an adult?

Fire and a stick is technology too, right? The best kind of ...

2026-09-15T10:33:49Z

In reply to nevent1q…yszk
_________________________

Fire and a stick is technology too, right?
The best kind of technology.

Schön! hört sich gut an!

2026-09-15T10:28:29Z

In reply to nevent1q…f3j9
_________________________

Schön! hört sich gut an!

I often feel like an outsider on nostr. Do people actually read ...

2026-09-15T07:41:47Z

I often feel like an outsider on nostr. Do people actually read this?

Wow, did not know this. Cool!

2026-09-14T19:58:20Z

In reply to nevent1q…lfph
_________________________

Wow, did not know this. Cool!

Ever wanted to reply to an article on the internet that has ...

2026-09-14T13:46:28Z

Ever wanted to reply to an article on the internet that has comments switched off? 👀

I built NostrComments for that. It's a browser extension that gives every web page a comment section, powered by Nostr.

Here's the idea: your comment doesn't live on the website. It lives on Nostr relays, linked to the page's address. So the website can't delete it, and anyone else with NostrComments who visits that page can see it and reply.

A few nice things:

✍ Use your own Nostr key, or keep it safe in a signer like Alby, Attest or nos2x
🤝 Comments on web pages made with other Nostr apps, like Amethyst and Ditto, show up too
🔌 No company server in the middle. You pick your relays
🙋 It stays quiet until you say yes, and you can turn it off for any site
⚡ Vote, mute and zap, right in the panel

Curious but don't want to install anything? Read the comments on any page here: https://briskness-byte.github.io/thread/

Quick demo (66 sec): https://www.youtube.com/watch?v=bywF8yWZa3o

🦊 Firefox: https://addons.mozilla.org/firefox/addon/nostrcomments/
🌐 Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
💻 Open source: https://github.com/briskness-byte/NostrComments

It's still early, so most pages have no comments yet. If you try it, leave one! That's how every conversation starts 💜

#nostr #grownostr #opensource #foss #privacy #nip22

Cool! Worth checking out

2026-09-14T11:43:59Z

In reply to nevent1q…0zd4
_________________________

Cool! Worth checking out

Thank You!

2026-09-13T19:02:34Z

In reply to nevent1q…a90n
_________________________

Thank You!

You can now read a NostrComments thread without installing ...

2026-09-13T13:09:50Z

You can now read a NostrComments thread without installing anything:

https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.nature.com%2Farticles%2Fd41586-026-02763-3

That's a Nature article with no comment section, and five comments filed under its address on public relays. Paste any URL to see what has been said about it.

Static page, no server, no backend — it queries the same relays your own client does, from your browser. Source: https://github.com/briskness-byte/NostrComments

https://briskness-byte.github.io/

#nostr #privacy #nostrcomments

How did you add the Monero target? I fetched your kind 0 across ...

2026-09-13T12:08:08Z

In reply to nevent1q…6d0y
_________________________

How did you add the Monero target? I fetched your kind 0 across six relays and the newest one has no XMR field — did a client rewrite it, or does it live somewhere else?

Also on the project page, where the video is self-hosted — no ...

2026-09-13T11:31:36Z

In reply to nevent1q…ttv7
_________________________

Also on the project page, where the video is self-hosted — no YouTube embed, no third-party requests, the same claim the extension makes about itself: https://briskness-byte.github.io/

#nostr #privacy

NostrComments has a proper demo now — 66 seconds, no sales ...

2026-09-13T11:00:14Z

NostrComments has a proper demo now — 66 seconds, no sales pitch:

https://www.youtube.com/watch?v=bywF8yWZa3o

A comment thread on any page, attached to the page's address and stored on relays instead of on the site. The clip shows it on a Nature article with no comment section, the same thread appearing in a second browser under a different key, and then a paywalled paper, a corporate announcement, an EU page and a post on X.

Also out: 23.2.2, where the toolbar button opens and closes the panel. That matters because a page can delete the floating button — the toolbar is outside its reach.

Firefox: https://addons.mozilla.org/firefox/addon/nostrcomments/
Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido

Attest is a Nostr signer for Firefox: it holds your key and asks ...

2026-09-12T08:24:05Z

Attest is a Nostr signer for Firefox: it holds your key and asks before anything is signed.

What's new in recent releases:

• Protect your key with a passphrase, not just a 4–6 digit PIN. A short PIN stops someone using your browser; it does not stop someone who copies your Firefox profile, and the extension now says so plainly instead of implying otherwise.

• Permissions are tied to a site's full address, https or http. A site you allowed over https is no longer also allowed over plain http.

• Each site keeps one decision per kind of permission, so refusing something briefly no longer wipes a permission you granted permanently.

• The options page shows what is actually there: no empty key field for a key that is encrypted, and adding another key happens where you'd look for it.

Open source, reproducible build, and the release refuses to ship if the tests fail or if the code that handles your keys doesn't type-check.

https://addons.mozilla.org/firefox/addon/attest/
https://github.com/briskness-byte/attest