Nostr notes by Joey_NostrComments

A fun way to lose money

2026-10-27T15:42:15Z

In reply to nevent1q…ju99
_________________________

A fun way to lose money

LO AND BEHOLD: The ONLY woman on NOSTR: @npub1arp…ek5u 🥳🥳 ...

2026-10-27T15:38:52Z

LO AND BEHOLD: The ONLY woman on NOSTR: NoxBTC (npub1arp…ek5u) 🥳🥳

quoting
nevent1q…0wf7
In my defense: you kinda are…but I like that about you🤓

Hallo en welkom!👋

2026-10-27T10:34:46Z

In reply to nevent1q…9w52
_________________________

Hallo en welkom!👋

Awesome! I followed you both! Veel plezier hier! 😜

2026-10-27T10:27:05Z

In reply to nevent1q…kmcd
_________________________

Awesome! I followed you both! Veel plezier hier! 😜

Exactly 😄 And yes, that's the part I care about most. ...

2026-10-27T10:01:54Z

In reply to nevent1q…r5tr
_________________________

Exactly 😄

And yes, that's the part I care about most. Web-of-trust isn't built yet, but the idea is to use it for weight, not as a wall: people your network follows count more in votes and float up, everyone else still shows, just not boosted. Plus a switch to see everything unfiltered.

A thread that only shows my own bubble would defeat the point of having one on every page.

Pretty much 😄 The site loses the delete button, but the reader ...

2026-10-27T09:55:28Z

In reply to nevent1q…uc5p
_________________________

Pretty much 😄 The site loses the delete button, but the reader gets their own tools:

- downvoted comments collapse on their own
- a burst of near-identical comments from one key folds into a single line
- you can mute people and words, and it also respects the mute list you already have in other Nostr apps
- comments marked with a content warning stay folded until you tap them

And the relays do their own filtering: you pick which ones you use.

Honest part: keys are free, so a determined spammer can always make new ones. Web-of-trust filtering (weighting people your network actually follows) is the next big step for that.

Building NostrComments: a comment section on every web page, kept ...

2026-10-27T09:49:47Z

In reply to nevent1q…rqrm
_________________________

Building NostrComments: a comment section on every web page, kept on Nostr relays instead of on the site. So the site can't delete it, and can't close it.

Since you're in NL: it works on Dutch news sites too, including the ones that switched their comments off or moderate them heavily. Your comment lives on Nostr, not on their server, and anyone with the extension (or the web reader) sees it under the article.

Browser extension for Firefox and Chrome, no account needed, open source:
https://briskness-byte.github.io/

The practical consequence for individuals: you can get a breach ...

2026-10-27T09:14:20Z

The practical consequence for individuals: you can get a breach letter from a company you have never heard of. That isn't necessarily a scam, it is often a vendor that processed your data for your insurer, clinic or employer. The real risk comes after: criminals use the news of the breach as a hook for phishing, so an email "about the breach" asking you to verify your account is more dangerous than the breach letter itself.

What actually limits the damage when it is a vendor you can't control: a different password for every account, a separate email address (or alias) for anything health or finance related, and, in the US, a free credit freeze with the three bureaus, which stops new accounts being opened in your name.

https://www.hipaajournal.com/vendor-data-breaches-69-breach-victims/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.hipaajournal.com%2Fvendor-data-breaches-69-breach-victims%2F

Thank you, and thanks for the issues that made 23.10.10 what it ...

2026-10-26T14:38:18Z

In reply to nevent1q…6qv4
_________________________

Thank you, and thanks for the issues that made 23.10.10 what it is. Reviews nobody can take down was the whole idea.

Thank you @npub1alp…rg94 , appreciate it!🙏

2026-10-26T14:31:29Z

In reply to nevent1q…6qv4
_________________________

Thank you codonaft (npub1alp…rg94) , appreciate it!🙏

The part that makes this one work is the flyer: it carries the ...

2026-10-26T10:37:35Z

The part that makes this one work is the flyer: it carries the department's real phone number and a real officer's photo, so it passes the checks people are told to do. Those details are public and easy to copy. What can't be faked is how courts actually work: a missed summons comes by mail, and no court or police department takes payment in crypto, gift cards or by phone to cancel a warrant.

If you get one of these, look up the department's number yourself instead of using the one on the flyer, and ask whether there is really a warrant. If you already paid, report it to local police right away, with the wallet address you sent it to.

https://www.wistv.com/2026/10/25/sumter-police-warn-jury-duty-scam/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.wistv.com%2F2026%2F10%2F25%2Fsumter-police-warn-jury-duty-scam%2F

Nice. I'm going back to X!

2026-10-26T08:27:06Z

In reply to nevent1q…r9k8
_________________________

Nice. I'm going back to X!

NostrComments 23.10.10 is out, and most of it came from one ...

2026-10-26T08:19:36Z

NostrComments 23.10.10 is out, and most of it came from one user's GitHub issues.

Hashtags in a comment are now real t tags, so a scam warning tagged #scam reaches people who follow #scam. Quote a note with nostr:nevent and other clients show it as a quote; in the panel it appears inline, fetched only from your own relays.

Replies now also go to the read relays of the person you answer (NIP-65), so strict anti-spam relays on their side don't swallow them. The reading side I deliberately left out: fetching a page's comments from every commenter's own relays would let any commenter see who reads the thread.

And the first run is calmer: while your signer is asked, the panel says so, and why the prompt names the website you are on. Decline, and it stops asking.

Thanks to codonaft (npub1alp…rg94) for pushing on all of this.

Firefox: https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/
Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido

But what if the minority group stops producing for the parasitic ...

2026-10-25T18:48:25Z

In reply to nevent1q…j8l7
_________________________

But what if the minority group stops producing for the parasitic class, doesn't the whole system then collapse?

PHP

2026-10-25T10:35:18Z

In reply to nevent1q…u8qw
_________________________

PHP

Amen.

2026-10-25T10:29:50Z

In reply to nevent1q…z3kh
_________________________

Amen.

One detail from the policy change itself ...

2026-10-24T19:10:01Z

One detail from the policy change itself (bitcoin-core/bitcoincore.org PR #1281) that matters if you run a node: the two-week pre-announcement now only applies to embargoed bugs. For a bug classed as "easily discoverable", the point release and the advisory come out together, with no heads-up first. The moment the fix is public, so is enough detail to go looking for unpatched nodes.

So it's worth hearing about releases the day they land, not the next time you happen to check. Two easy ways: the RSS feed at bitcoincore.org/en/rss.xml, or on GitHub, bitcoin/bitcoin → Watch → Custom → Releases.

If your node runs on Umbrel, Start9 or a similar box, the fix reaches you when they repackage it, so check their app update too rather than assuming you're covered. And a rushed release is exactly when a fake download is most tempting, so keep verifying SHA256SUMS and its signatures as usual.

https://bitcoinmagazine.com/news/bitcoin-core-ends-long-embargoes

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fbitcoinmagazine.com%2Fnews%2Fbitcoin-core-ends-long-embargoes

Nostr event nevent1qqswkwnrkj25y3ngtjj6n3r060ycmujlkx0reljx4r2w96exrllw60czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8pa0nk

2026-10-24T07:14:29Z

Half an hour well spent, honestly. That's exactly the half ...

2026-10-23T18:50:33Z

In reply to nevent1q…p94r
_________________________

Half an hour well spent, honestly. That's exactly the half hour the scam is betting you won't spend. Thanks for the zap! ☕

The practical takeaway for anyone who isn't a mail admin: a ...

2026-10-23T18:28:47Z

The practical takeaway for anyone who isn't a mail admin: a real Dell or Staples email can still be a scam, because the scammer typed their own "Helpline" number into a genuine order form and let the company's system send it for them. Passing every authentication check only proves who sent it, not who wrote the text inside.

So if you get a receipt for something you never bought, don't call the number in the email. Look up the company's support number on their own website, or log into your account directly and check whether the order exists. The whole scam depends on you calling them.

https://www.helpnetsecurity.com/2026/10/22/legitimate-platforms-abused-phishing-emails/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.helpnetsecurity.com%2F2026%2F10%2F22%2Flegitimate-platforms-abused-phishing-emails%2F

This is the project's own thread. Questions, ideas, or things ...

2026-10-22T21:06:40Z

This is the project's own thread. Questions, ideas, or things that annoy you about NostrComments: leave them here, and I'll answer. Bugs are easier to track in Issues. Recent fixes: the Share button could be hidden by content blockers (fixed in 23.9.5), and it could post twice with a slow signer (fixed in 23.9.4).

https://github.com/briskness-byte/NostrComments

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fbriskness-byte%2FNostrComments

What would persuade you to install this, or what is holding you ...

2026-10-22T20:46:00Z

What would persuade you to install this, or what is holding you back?

https://briskness-byte.github.io/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fbriskness-byte.github.io%2F

An update since this was written: the GTA 6 scams have moved on ...

2026-10-22T07:18:58Z

An update since this was written: the GTA 6 scams have moved on from "pay $250 in crypto". Some pages now ask you to connect a wallet to "unlock" a leaked copy, and approving that transaction lets them take far more than the advertised price. Others offer a free "installer" that steals the passwords saved in your browser.
There is no early copy. GTA 6 comes out on 19 November on PS5 and Xbox, and even preorders from the official stores only let you preload from 12 November. Anything that offers more than that, for crypto or for free, is the scam. Worth passing on to anyone in your family who is counting down to it.

https://www.malwarebytes.com/blog/threat-intel/2026/06/gta-6-early-access-is-nothing-but-a-scam

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intel%2F2026%2F06%2Fgta-6-early-access-is-nothing-but-a-scam

Every comment section belongs to the site it sits under. The site ...

2026-10-21T06:33:21Z

Every comment section belongs to the site it sits under. The site decides whether it exists, who may speak, and when the conversation is over.

NostrComments moves the conversation off the site. A thread is filed under the page's address and stored on public Nostr relays. The site can't close it. Neither can I: there is no server of mine in between.

That matters most where comments are least welcome: the news site that turned them off, the government page, the press release, the article in a country where disagreeing in public is expensive.

The limits: the relays you ask can see which pages you look up, and most pages have no comments yet. An empty thread on every page isn't a revolution. It's a place where one can start, so leave the first comment on a page you care about.

https://briskness-byte.github.io/

#freespeech

One thing the article leaves out: what to do if you already put ...

2026-10-20T23:11:19Z

One thing the article leaves out: what to do if you already put money in. Call the number printed on the machine straight away. Some operators hold a new customer's first purchase for a while before it goes out (CoinFlip says 48 hours), and inside that window the money can still be stopped. After that, a bitcoin payment cannot be reversed.
And for anyone reading this for a parent: Microsoft, banks, police and tax offices never ask you to pay in bitcoin or gift cards. Anyone who does, and won't let you hang up, is the scam.

https://www.ksla.com/2026/10/20/how-you-can-protect-yourself-crypto-atm-scams/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.ksla.com%2F2026%2F10%2F20%2Fhow-you-can-protect-yourself-crypto-atm-scams%2F

Update: Attest 1.28.1 is out on addons.mozilla.org and signs ...

2026-10-19T15:45:54Z

In reply to nevent1q…ys7y
_________________________

Update: Attest 1.28.1 is out on addons.mozilla.org and signs through a remote signer: paste a bunker:// address and every NIP-07 site, NostrComments included, signs through it. Tested by hand against nak bunker: signing, timeouts, refusals, restarts, and relays that are slow or go quiet. The popup shows when requests are waiting for you to approve them in the signer. https://addons.mozilla.org/en-US/firefox/addon/attest/
I have to take back "Pomegranate comes for free", though. As far as I can tell the Google login runs inside the app, so a signer would need that flow itself, not just NIP-46. Does a Pomegranate user get a bunker:// code they can use elsewhere @`fiatjaf` ? If yes, it works in Attest today; if not, that's the next piece I'd add.

Good advice. Two things to add: a "recovery service" that ...

2026-10-19T08:26:35Z

Good advice. Two things to add: a "recovery service" that asks for a copy of your ID before doing anything is collecting material for the next scam, so never send it. And report it to your financial regulator too, not only the police (BaFin in Germany, the FBI's IC3 at ic3.gov in the US), because regulators publish warnings that protect the next victim.

https://cryptoticker.io/en/crypto-recovery-scam-warning-signs/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fcryptoticker.io%2Fen%2Fcrypto-recovery-scam-warning-signs%2F

Thanks, that's a fair point and I've gone back and forth ...

2026-10-18T16:57:18Z

In reply to nevent1q…sm4v
_________________________

Thanks, that's a fair point and I've gone back and forth on it. Right now the password is offered the moment a key is created, so it's already a choice at onboarding, just opt-in rather than opt-out. Once set, the key is unlocked per page only: navigate away and it's locked again, and reading comments never needs the password.

The reason it isn't mandatory: most people who install a comment extension want to read first and maybe post once, and a key behind a password they then forget is a key they abandon, with no backup either. I'd rather they make that choice knowingly than lose the identity.

Where I fully agree: the safest key is one the page-side code never holds at all. That's why NostrComments works with any NIP-07 signer, and why I recommend one to anyone who already has a Nostr identity. Switching the onboarding default to "set a password" with a skip is a good idea though, I'll look at that.

Worth knowing how this one worked: tapping the notification just ...

2026-10-18T13:26:59Z

Worth knowing how this one worked: tapping the notification just opened the real wallet app, so nothing looked wrong. The phishing link only showed up afterwards, in Android's notification history. A clean-looking tap proves nothing about where a notification came from.

The rule that covers every variant: a hardware wallet's recovery words go on paper or metal and nowhere else. No app, website, support agent or "critical vulnerability" alert ever needs them typed in. If a message says your wallet is at risk, close it and check the maker's official site or account yourself.

Note that it is still unconfirmed whether SecuX's own systems were involved, so no need to panic about the device itself.

https://coinpaper.com/37473/ripples-david-schwartz-flags-secux-wallet-phishing-alert-as-emergency-maintenance-raises-questions

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fcoinpaper.com%2F37473%2Fripples-david-schwartz-flags-secux-wallet-phishing-alert-as-emergency-maintenance-raises-questions

Security update for NostrComments: please make sure you are on ...

2026-10-18T09:13:56Z

Security update for NostrComments: please make sure you are on 23.10.3 or later (Firefox and Chrome both have it).

Two problems were found and fixed this week. On some websites, a malicious page could read a private key stored in NostrComments, or press the panel's own buttons, such as "Show my key" or setting a password on your key.

Keys kept in a signer extension (Alby, nos2x, Attest) were never at risk. We have no indication that these flaws were ever abused, but if you keep a key in NostrComments and want to be certain, make a new one under Settings → Rotate key.

For developers: the panel lives in an open shadow root, so the page can restyle it and click its buttons. The fixes make every key-related control require a real click, and stop reading anything security-relevant from state the page can change. The details are in the security advisories on GitHub.

GM @nprofile…xlfm

2026-10-17T15:02:20Z

In reply to nevent1q…5zgv
_________________________

GM 𝕋ℍ𝔼 𝕋𝕆𝔻𝔻𝕊𝕋ℝ (nprofile…xlfm)

A practical note for client developers, from a bug I just fixed ...

2026-10-17T06:05:11Z

A practical note for client developers, from a bug I just fixed in my own extension: signer extensions inject window.nostr asynchronously, so it may not exist yet when your code first looks. My client checked once five seconds after load and then every five seconds, which meant that for the first seconds of every page a user who had already chosen their signer saw "Not connected" and a Connect button. Now it looks at 0.3, 1, 2 and 4 seconds, then backs off. Two details that matter: only check whether window.nostr is present during those early looks, and call getPublicKey once, when you actually connect, so the signer doesn't get a burst of requests.

https://github.com/nostr-protocol/nips/blob/master/07.md

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fnostr-protocol%2Fnips%2Fblob%2Fmaster%2F07.md

A small correction to my reply above, after thinking it through: ...

2026-10-16T21:54:06Z

In reply to nevent1q…ddjl
_________________________

A small correction to my reply above, after thinking it through: NIP-46 will land in Attest, the signer extension I also maintain, not in NostrComments itself. Key handling belongs in the signer. NostrComments keeps speaking NIP-07, so once Attest supports bunkers, Pomegranate comes along for free, for NostrComments and for every other NIP-07 app.

GM Nostr ☀️ Every time I pick a new alarm tune I think: this ...

2026-10-16T09:43:19Z

GM Nostr ☀️

Every time I pick a new alarm tune I think: this one's lovely, I'll finally wake up happy.

Three days later I hate it with a passion.

Has anyone found an alarm sound that survives?

A real-world data point on the Users figure, since this page only ...

2026-10-16T09:04:45Z

A real-world data point on the Users figure, since this page only says it counts installations rather than activity: in August my extension's listing reported about 5,000 users. The breakdown was 97% United States and 79% ChromeOS, and nothing else I could measure moved with it, so I never believed it. By October the figure had dropped to 22, which matches what I can actually observe. Lesson: before you quote this number, look at the country and OS breakdown. A distribution that looks nothing like your audience is probably not your audience. My extension has no telemetry by design, so I count real use from the outside instead: how many distinct keys have published something with it.

https://developer.chrome.com/docs/webstore/metrics

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.chrome.com%2Fdocs%2Fwebstore%2Fmetrics

I think the Japanese are awesome!! 👍

2026-10-15T20:21:56Z

In reply to nevent1q…fzlm
_________________________

I think the Japanese are awesome!! 👍

You were right about the button, and it took you leaving to make ...

2026-10-15T09:20:49Z

In reply to nevent1q…g6qt
_________________________

You were right about the button, and it took you leaving to make me see it. Version 23.10.0 has a quiet mode: hover over the button and click the small "−", and from then on it only shows on pages that already have comments, or where somebody replied to you. No pressure to reinstall, but thanks for saying why you removed it. That's the most useful feedback there is.

I Love this website for background music wavefunc.live ...

2026-10-15T08:17:11Z

I Love this website for background music wavefunc.live

https://wavefunc.live/

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwavefunc.live%2F

this is my npub: ...

2026-10-15T08:10:53Z

In reply to nevent1q…54c0
_________________________

this is my npub: npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9e

A practical caveat for extension developers who use shadow DOM to ...

2026-10-15T07:41:17Z

A practical caveat for extension developers who use shadow DOM to keep their UI safe from the page: an open shadow root does not keep other code out. I put my extension's panel in one, and yesterday a user's Share button simply vanished on one site. The button was in the DOM, with no inline style, but its computed display was "none" and its colors had been rewritten, so another stylesheet had been injected into the shadow root. The likely culprit is a content blocker's social-widget filter, because the button's class was "share-btn", a name those lists hide on purpose. The fix was a class name no filter targets. Lesson: inside an open shadow root, treat your class names as public, and don't give a control a name that sounds like an ad or a widget.

https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-US%2Fdocs%2FWeb%2FAPI%2FWeb_components%2FUsing_shadow_DOM

This is the project's own thread. Questions, ideas, or things ...

2026-10-14T21:35:57Z

Some practical experience, since the article stays general: I ...

2026-10-14T20:37:24Z

Some practical experience, since the article stays general: I push my project to GitHub and to two Nostr git servers (gitnostr.com and relay.ngit.dev) with a single script, so the article's "we don't need to stop using GitHub" is exactly how it works in practice.

Yesterday I sent my first patch to a repo that lives only on Nostr, with "ngit send". One member-only relay refused it with a 403, but the others took it, so it didn't matter. That's the resilience the article describes, in one terminal line.

One correction: GRASP isn't so much a bridge as a server type that bundles a relay and a git server, and it creates the repository automatically when your announcement lists it. That's why you don't have to set anything up on the server side.

https://nostrmag.com/article/w40nostr01

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fnostrmag.com%2Farticle%2Fw40nostr01

Browser extension dev here (NostrComments). My honest reason is a ...

2026-10-14T06:31:15Z

In reply to nevent1q…yngn
_________________________

Browser extension dev here (NostrComments). My honest reason is a sixth one: I don't speak NIP-46 yet, only local keys and NIP-07. It's on my list now, and Pomegranate would come for free once it's done. The part that appeals to me is recovery: right now a user's identity lives in one browser profile.

My penis

2026-10-14T06:06:46Z

In reply to nevent1q…fsz4
_________________________

My penis

https://www.x.com/ (X/twitter) most of the time

2026-10-13T21:05:36Z

In reply to nevent1q…hs4z
_________________________

https://www.x.com/ (X/twitter) most of the time

Worth knowing if you're thinking of applying: the money is ...

2026-10-13T20:53:24Z

Worth knowing if you're thinking of applying: the money is for the people doing the hunting (AI tokens, servers, fuzzing), not for projects that want an audit of their own code. All five grantees in this first round work on Bitcoin infrastructure: Core, libsecp256k1, btcd, BTCPay and mempool. Applications are fast-tracked via opensats.org/apply/red.

https://opensats.org/blog/red-team-grants-first-set

Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fopensats.org%2Fblog%2Fred-team-grants-first-set

I put a comment section on every web page on the internet. You ...

2026-10-13T12:07:04Z

I put a comment section on every web page on the internet.
You can now:
- discuss news articles without censorship or being banned
- warn each other for possible scam websites
and many other things with NostrComments

Install the browser extension now on:
Chrome:
https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox:
https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/

Puts the Freedom back in your hands

Open source:
Github: https://github.com/briskness-byte/NostrComments

#nostr #foss #freedom #censorship

NostrComments puts a comment thread on every web page on the ...

2026-10-13T10:53:18Z

NostrComments puts a comment thread on every web page on the internet. This means you can post and read comments about the web page from other users. The thread lives on Nostr relays, not on the site. There is no middleman: no server of mine, no account, no telemetry, and the site you're commenting on can't close it.

For users: install the extension, make a key in one click or use your existing Nostr signer, and comment anywhere. That includes the news site that turned comments off, the paywalled article, the government page and the press release. Nostr notes that tag a page's address show up in its thread too, so a page isn't always empty. Zap a good comment, mute the bad ones. Nothing is sent until you switch it on; after that, the relays you choose can see which pages you read.

For developers: comments are plain NIP-22 events (kind 1111, the URL in the I tag), so any client can read and write the same threads. Other tools already use this format but turn a URL into an address differently. If you build one, let's agree on that rule.

Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox: https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/
Source: https://github.com/briskness-byte/NostrComments

#nostr #freespeech #foss

Thank you @npub1qth…rcch , I really appreciate it! ⚡️

2026-10-12T21:51:43Z

In reply to nevent1q…ann7
_________________________

Thank you DevCrafter (npub1qth…rcch) , I really appreciate it! ⚡️

GM ☕ NostrComments has been live in the Chrome and Firefox ...

2026-10-12T09:21:59Z

GM ☕

NostrComments has been live in the Chrome and Firefox stores for a few weeks now.

The thing I see most often:
People open the button on an article where the comments are already closed or deleted… and there’s already a thread waiting.

That’s exactly why I built this.

Small updates from the last few days:
• The floating button is quieter by default (dims until you hover)
• One-click disable per site
• Remembers which corner you want it in, per website

Still no server, no account, no tracking.
Just comments the site owner can’t delete.

If you haven’t tried it yet:
Chrome → https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido
Firefox → https://addons.mozilla.org/firefox/addon/nostrcomments/

Or read any thread without installing anything:
https://briskness-byte.github.io/thread/

Which page would you most like to give an uncensorable comment section?

#nostr #asknostr

A few releases of NostrComments since last time: the floating ...

2026-10-10T10:59:10Z

A few releases of NostrComments since last time: the floating button dims unless you hover it, can be dragged to a corner instead of only picked from a menu, and can now be turned off entirely in settings. With it off, the toolbar icon becomes the way in instead — and now shows how many replies you haven't seen yet, so that's still covered.

https://briskness-byte.github.io/
github.com/briskness-byte/NostrComments

Thanks for confirming! Good timing — I just shipped exactly ...

2026-10-09T20:07:30Z

In reply to nevent1q…z0jh
_________________________

Thanks for confirming! Good timing — I just shipped exactly that: the button dims by default now, and hovering it shows a small × that turns it off on that site in one click, no settings menu needed. It's live now on GitHub and Firefox (AMO), and submitted to the Chrome Web Store — that review usually takes a few days. Will ping you when Chrome catches up, if you want.

Appreciate you saying so, that's useful to know. Quick ...

2026-10-09T18:44:19Z

In reply to nevent1q…vl5m
_________________________

Appreciate you saying so, that's useful to know. Quick question so I fix the right thing: was it the little floating button sitting on every page, or the panel once you opened it? (I'm the dev, btw.)

If it's the button: it can be dragged (or set in settings) to whichever corner is free and that's remembered per site, and there's a per-site off switch too. If it's the open panel taking over the screen, that's actually the next big thing I'm working on — moving it out of the page entirely into the browser's own sidebar, so it never overlaps anything.

Thanks for picking that up @nprofile…fywd , that's pretty ...

2026-10-09T18:43:03Z

In reply to nevent1q…wxly
_________________________

Thanks for picking that up DevCrafter (nprofile…fywd) , that's pretty much exactly it. One small nuance: the key lives in the browser until Bob chooses to export it (as nsec, or connect a client with NIP-07) — not automatically on his phone, but one copy-paste away whenever he wants it. And agreed on #2 — the bottleneck isn't really Nostr itself, it's getting people who already care about open protocols to notice it exists.

Yep — not a silo. Every comment is a real signed Nostr event ...

2026-10-09T07:17:07Z

In reply to nevent1q…6c0y
_________________________

Yep — not a silo. Every comment is a real signed Nostr event (kind 1111, NIP‑22), published to the public relays you choose. No server of mine in between. Sign with a generated key or your own NIP‑07 signer (nos2x, Alby). Other Nostr clients that read that event kind, like Jumble, can see the same comments.

GM! Coffee's on, let's build something great today. ...

2026-10-09T07:14:34Z

GM! Coffee's on, let's build something great today.

One idea (disclosure: it's mine) — meet people where they ...

2026-10-08T22:49:05Z

In reply to nevent1q…mwcu
_________________________

One idea (disclosure: it's mine) — meet people where they already are instead of asking them to install a client first. NostrComments puts a Nostr-backed comment thread on any website; reading needs zero signup, posting needs a key. No 'come to Nostr' wall.

A URL-keyed thread is one place this shows up for me. A comment ...

2026-10-06T10:20:14Z

In reply to nevent1q…tl5d
_________________________

A URL-keyed thread is one place this shows up for me. A comment is filed under a page address rather than a community, so there is no owner to moderate it and nothing to join. That makes it easy to read across clients, but it also means nobody is in charge of what sticks. Where do you think that should sit: with the relay, the reader, or the page?

If your browser extension uses sender.tab to tell web pages apart ...

2026-10-04T12:15:47Z

If your browser extension uses sender.tab to tell web pages apart from its own pages, check this. I got it wrong in a signer and it cost me a release.

The background script refused privileged messages, like setting a PIN, whenever sender.tab was set. The reasoning: content scripts run in tabs, so a message with a tab came from a web page.

But the extension's own options page has a tab too, as soon as it is opened in one. So the extension blocked itself. PIN setup didn't throw an error or show a warning. It just did nothing.

The check that means what you intended is the sender's URL, not whether a tab exists: compare sender.url against browser.runtime.getURL(''). Your own pages pass, and anything a content script relays from a web page does not.

The second half of the same fix: the content-script bridge now forwards only an explicit list of message types. Before, some handlers were out of a page's reach only by accident, and an accident is not a boundary.

NostrComments 23.4.0 is out. A reader of the extension — Emre ...

2026-09-30T22:13:15Z

NostrComments 23.4.0 is out. A reader of the extension — Emre Yılmaz ( delirehberi (npub1gme…wl3v) ), blog.emre.xyz — wrote up a discovery convention for pages that are also native Nostr content: a <link rel="alternate" href="nostr:naddr…"> tag, so a client can find the entity a page already is. Sent it in as a proper draft, trust considerations included.

Built the read half of it — a page naming its own Nostr entity now has that thread merged into the panel, alongside the URL-scoped one. Thank you for taking the time to write it up properly Emre!

One of the dumbest things you can do on Nostr is sharing your ...

2026-09-19T14:57:27Z

One of the dumbest things you can do on Nostr is sharing your private keys, like nsec138mwgc6rvpukzn7xj5522xzc63h69f6533tupl25trtps4nckl0qp452vg

Mine returns "not available to pages" and nothing else ...

2026-09-06T20:37:05Z

In reply to nevent1q…gls4
_________________________

Mine returns "not available to pages" and nothing else — no origin, no log line. So yes, four lines, and I'll take them.

One caveat I'd hold to in a signer: that string goes back to the caller, and in the refusal branch the caller is the page. The origin is free, it already knows it. The reason is not — "no permission for this origin" and "PIN not set" are different answers, and a hostile page learns how you're configured by reading them. Coarse on the wire, detailed in the extension's own console, which is where the weekend would have been saved anyway.

A browser extension can be talked to by two very different ...

2026-09-05T11:06:34Z

A browser extension can be talked to by two very different things: its own pages, and a content script sitting in somebody's web page. Telling them apart is the whole security boundary, and the obvious way to do it is wrong.

`sender.tab` looks like the answer. It is not. An options page opened with tabs.create() has a tab like any web page does, so checking for one makes the extension refuse its own UI — and it fails silently, because the message goes out, comes back refused, and nothing on screen says why. A button that does nothing.

`sender.url` against runtime.getURL('') is the one that holds. A content script always reports the address of the page it was injected into, never a moz-extension:// one, and content scripts do not run on extension pages.

Cost me a release before I found it.

done

2026-09-02T22:01:58Z

In reply to nevent1q…66kf
_________________________

done

I'm actually building NostrComments: ...

2026-08-24T21:42:42Z

In reply to nevent1q…alxh
_________________________

I'm actually building NostrComments: https://briskness-byte.github.io/
I hope you like it and feedback is always welcome

Exactly that. What the principle doesn't tell you is that ...

2026-08-10T20:34:48Z

In reply to nevent1q…cu2u
_________________________

Exactly that. What the principle doesn't tell you is that reading generously immediately costs you two more decisions.

The first is that you have to make the difference visible. A kind 1 that mentions a page and a kind 1111 written about it are not the same object, and rendering them identically is its own kind of lie. Mine marks them as notes rather than comments.

The second is that replying stops being one code path. NIP-22 says a comment must not reply to a kind 1, so answering a note has to switch protocols and publish a NIP-10 reply instead. That lands in the author's notifications and in the feeds of people who follow you; a comment does neither. Worth telling the user before they write it rather than after.