2026-11-10T18:34:50Z https://yabu.me Joey (NostrComments) https://yabu.me/npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9e https://blossom.primal.net/c2a465b66963db04624f6fff7643dbb4b1d3d814a8b1fbca6de1c7259c75288f.webp https://blossom.primal.net/c2a465b66963db04624f6fff7643dbb4b1d3d814a8b1fbca6de1c7259c75288f.webp https://yabu.me/nevent1qqs0nhmltkwvjgx9cpesyp3cqr5y3ru8e9yzaqw85f4zdr4uxcn9c2qzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzsqjsfp In reply to <a href='/nevent1qqsznaskhwrxrq0266zxknwyupjywga22q5yslhq76ru3nm03zkla8qpz4mhxue69uhkummnw3ezummcw3ezuer9wchsh2nps0'>nevent1q…nps0</a><br/>_________________________<br/><br/>Crazy, did you know orca&#39;s actually evolved from wolf like amcestors? 2026-11-14T05:54:39Z https://yabu.me/nevent1qqsdkgatvtef00mvsa3rr53t3mhhgmp2a9tedm4pqhkcjq0n842xejszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzengrl7 In reply to <a href='/nevent1qqsqqq9wucur7ly5urunsakntmjn7rkrq775lwwupe3r9samu339w5sppemhxue69uhkummn9ekx7mp0ugwte6'>nevent1q…wte6</a><br/>_________________________<br/><br/>Yes 2026-11-07T20:51:50Z https://yabu.me/nevent1qqs8dgde7rsdc09ttn6l3n2cznxdd6pc3hrlf7p8u62w4vchuqauvlszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzk5h0h7 In reply to <a href='/nevent1qqsqwjlxwnchxpyvwcc5dug7e6ynczrdt4fpx9kp3uafp2dffhqe7uqppemhxue69uhkummn9ekx7mp0xa2ws7'>nevent1q…2ws7</a><br/>_________________________<br/><br/>Yes 2026-11-07T20:50:55Z https://yabu.me/nevent1qqsfnvuvegwqn7265fy68encgeqd470sewczfg2mas07s402n7s547qzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzcpku68 The most useful number here is the last one: 85% of these shops are gone within two weeks. That means the usual advice, &#34;check the reviews&#34;, fails exactly when you need it, because a fake shop is too new to have any. No history at all is the warning sign.<br/><br/>Three checks that don&#39;t need any software: look up when the domain was registered (a &#34;big brand outlet&#34; registered last month is not one), search the shop&#39;s name plus &#34;scam&#34; or &#34;reviews&#34;, and at checkout see whether the PayPal or credit card logos actually work. Fake shops often show them and then only accept bank transfer or a card form on their own page, which is where the money and your card details disappear.<br/><br/><a href="https://www.prnewswire.com/news-releases/fake-shops-surge-before-black-friday-av-comparatives-test-shows-which-products-protect-shoppers-302931972.html">https://www.prnewswire.com/news-releases/fake-shops-surge-before-black-friday-av-comparatives-test-shows-which-products-protect-shoppers-302931972.html</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.prnewswire.com%2Fnews-releases%2Ffake-shops-surge-before-black-friday-av-comparatives-test-shows-which-products-protect-shoppers-302931972.html">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.prnewswire.com%2Fnews-releases%2Ffake-shops-surge-before-black-friday-av-comparatives-test-shows-which-products-protect-shoppers-302931972.html</a> 2026-11-07T20:35:49Z https://yabu.me/nevent1qqszddn0htrf5300ysg3alfc7anclkj9aqr6f4gesq0w9udk765sxhczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzv00f96 People without intelligence love AI.<br/>It’s the cognitive strap-on: a loud, expensive advertisement that the original equipment never quite measured up. 2026-11-04T06:44:45Z https://yabu.me/nevent1qqsytve6ryhaudk49eny5g59kd2leu9lpkztkw8rlllrj4faujupvxszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzusgaak In reply to <a href='/nevent1qqsqqqy2gzlkmypvp5k0cqfgyxzkflae2mqm4fzeel22ar8wfxptk3q4d87xf'>nevent1q…87xf</a><br/>_________________________<br/><br/>Wow! She&#39;s hot! Who is she? 2026-11-03T17:08:04Z https://yabu.me/nevent1qqsz3k79fnhuqtxyz20r57869cagukhwl4x62mun9ptk88yzftjlz7czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz3jghq8 In reply to <a href='/nevent1qqsghcx3rzq0y69mlfwuf8z5nuntsdztekv80k50acnw4sfg0pfytcgpzemhxue69uhhyetvv9ujuerfw36x7tnsw43z7cxng8q'>nevent1q…ng8q</a><br/>_________________________<br/><br/>Without compression its even bigger lol 2026-11-01T16:22:13Z https://yabu.me/nevent1qqs80eeq0428untyh3q5twjlavm8rz9agrkx9t4rudym3504vmnjryszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8l5v68 In reply to <a href='/nevent1qqs0a0eunc2m3wuwy3uagyq4gnecgkzv3r399epg5d067a8xcx2usjqrvqlqx'>nevent1q…qlqx</a><br/>_________________________<br/><br/>This tech was meant to suck so you would talk to people face to face again. 2026-11-01T15:43:26Z https://yabu.me/nevent1qqsgxwnjrx53kky08fsgd3u7y44vlr833lsnw8mqcwwfnl8kqvjks9czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz45uf9a In reply to <a href='/nevent1qqsz3eqyltelmtt30u6ztecnr4g32kme0czfvrrqdn0ws4m6fks3mfspzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcq3fz6h'>nevent1q…fz6h</a><br/>_________________________<br/><br/>I KNEW IT!! 2026-10-30T08:28:53Z https://yabu.me/nevent1qqszezxxe9naksfnfaf33arahnay5nc09hpxh2egkvp3940jlllthegzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz2qvkfz In reply to <a href='/nevent1qqsquhwlvxmy4g5aeffzvsgthl2mjz5c589tzph3qsttmnljergmg5qpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcflhk7f'>nevent1q…hk7f</a><br/>_________________________<br/><br/>Nice, good luck with the submission! One idea for the &#34;same identity across independent apps&#34; part: show it outside Nostr apps too. A visitor&#39;s own key showing up in a comment thread under an ordinary news article makes &#34;Nostr works anywhere on the web&#34; very concrete. NostrComments does that (browser extension, comments filed under the page&#39;s URL), and I&#39;d be happy to help if a demo like that fits the stand. 2026-10-30T08:14:29Z https://yabu.me/nevent1qqstlj8c45s2rmdse5kndg67m7g6pj3eyc362rs74n73djcjka3u0sczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzwahhqx In reply to <a href='/nevent1qqsv49et7lcxqeqw0a0dlwaz72d9zhgq7td0tge4v7gfdry94qs974cppemhxue69uhkummn9ekx7mp0eyju99'>nevent1q…ju99</a><br/>_________________________<br/><br/>A fun way to lose money 2026-10-27T15:42:15Z https://yabu.me/nevent1qqsqcmsudddurs23p42rrv2snn2m0femqvzprw2c6xl35v0287zngegzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzy033p4 LO AND BEHOLD: The ONLY woman on NOSTR: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1arpgar6pvesq0gjgr8spja0mx9q9qk46mw0x4wm96y9dp4xnpr7qf7ek5u" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>NoxBTC</span> (<span class="italic">npub1arp…ek5u</span>)</a></span> 🥳🥳<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qvzqqqqqqypzp6xz3685zenqq73ysx0qr96lkv2q2pdt4ku7d2akt5g26r2dxz8uqy88wumn8ghj7mn0wvhxcmmv9uq3wamnwvaz7tmjv4kxz7fwwpexjmtpdshxuet59uqzpnvr90jzv9xsjfrjc3w7jvsgfuudfwwux30dee7jnxhhjc6jgnru6j0wf7" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…0wf7</a></span> </div> In my defense: you kinda are…but I like that about you🤓 </blockquote> 2026-10-27T15:38:52Z https://yabu.me/nevent1qqstykdeanp24uujgxj4lpck5lugn9fncmlsfgvxlkv4kg9s8nq4mtqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzl3cmq0 In reply to <a href='/nevent1qqsgsv89qa6prsl84sswv0py0pec5kdm6y0x4868uh6sjxy8d35v87gyr9w52'>nevent1q…9w52</a><br/>_________________________<br/><br/>Hallo en welkom!👋 2026-10-27T10:34:46Z https://yabu.me/nevent1qqsfyvkrtyu3a3klddv8l9p6ug6zfppkdc2zzewqkf365w3ysl67jjszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz5hflqw NostrComments 23.10.10 is out, and most of it came from one user&#39;s GitHub issues.<br/><br/>Hashtags in a comment are now real t tags, so a scam warning tagged #scam reaches people who follow #scam. Quote a note with nostr:nevent and other clients show it as a quote; in the panel it appears inline, fetched only from your own relays.<br/><br/>Replies now also go to the read relays of the person you answer (NIP-65), so strict anti-spam relays on their side don&#39;t swallow them. The reading side I deliberately left out: fetching a page&#39;s comments from every commenter&#39;s own relays would let any commenter see who reads the thread.<br/><br/>And the first run is calmer: while your signer is asked, the panel says so, and why the prompt names the website you are on. Decline, and it stops asking.<br/><br/>Thanks to <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1alptdev5srcw2hxg03567p4k6xs3lgj7f6545suc0rzp0xw98svse7rg94" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>codonaft</span> (<span class="italic">npub1alp…rg94</span>)</a></span> for pushing on all of this.<br/><br/>Firefox: <a href="https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/">https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/</a><br/>Chrome: <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a> 2026-10-26T08:19:36Z https://yabu.me/nevent1qqs0h6s8ca9z8xrjgncw4mjgjp94ngn4hx99uj9jv5yg0e33j6dzycgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzwrm5q5 The practical takeaway for anyone who isn&#39;t a mail admin: a real Dell or Staples email can still be a scam, because the scammer typed their own &#34;Helpline&#34; number into a genuine order form and let the company&#39;s system send it for them. Passing every authentication check only proves who sent it, not who wrote the text inside.<br/><br/>So if you get a receipt for something you never bought, don&#39;t call the number in the email. Look up the company&#39;s support number on their own website, or log into your account directly and check whether the order exists. The whole scam depends on you calling them.<br/><br/><a href="https://www.helpnetsecurity.com/2026/10/22/legitimate-platforms-abused-phishing-emails/">https://www.helpnetsecurity.com/2026/10/22/legitimate-platforms-abused-phishing-emails/</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.helpnetsecurity.com%2F2026%2F10%2F22%2Flegitimate-platforms-abused-phishing-emails%2F">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.helpnetsecurity.com%2F2026%2F10%2F22%2Flegitimate-platforms-abused-phishing-emails%2F</a> 2026-10-23T18:28:47Z https://yabu.me/nevent1qqs9est0r50rf2wmlvl99rxffxwfnd9vky6xrwj7gnkdpe72gwc4nhgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzn5xzay In reply to <a href='/nevent1qqsfax43q8v6y9lppmg4kkug9v9q7vtm0lam4lwwkfa79459644l4qsppemhxue69uhkummn9ekx7mp0w5ys7y'>nevent1q…ys7y</a><br/>_________________________<br/><br/>Update: Attest 1.28.1 is out on addons.mozilla.org and signs through a remote signer: paste a bunker:// address and every NIP-07 site, NostrComments included, signs through it. Tested by hand against nak bunker: signing, timeouts, refusals, restarts, and relays that are slow or go quiet. The popup shows when requests are waiting for you to approve them in the signer. <a href="https://addons.mozilla.org/en-US/firefox/addon/attest/">https://addons.mozilla.org/en-US/firefox/addon/attest/</a><br/>I have to take back &#34;Pomegranate comes for free&#34;, though. As far as I can tell the Google login runs inside the app, so a signer would need that flow itself, not just NIP-46. Does a Pomegranate user get a bunker:// code they can use elsewhere @`fiatjaf` ? If yes, it works in Attest today; if not, that&#39;s the next piece I&#39;d add. 2026-10-19T15:45:54Z https://yabu.me/nevent1qqsdc7tqprpvgspxyh3l3fm0948kw8vz6wfc8k94w2afe0jrm2fpxjczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzx8d5l6 Good advice. Two things to add: a &#34;recovery service&#34; that asks for a copy of your ID before doing anything is collecting material for the next scam, so never send it. And report it to your financial regulator too, not only the police (BaFin in Germany, the FBI&#39;s IC3 at ic3.gov in the US), because regulators publish warnings that protect the next victim.<br/><br/><a href="https://cryptoticker.io/en/crypto-recovery-scam-warning-signs/">https://cryptoticker.io/en/crypto-recovery-scam-warning-signs/</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fcryptoticker.io%2Fen%2Fcrypto-recovery-scam-warning-signs%2F">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fcryptoticker.io%2Fen%2Fcrypto-recovery-scam-warning-signs%2F</a> 2026-10-19T08:26:35Z https://yabu.me/nevent1qqsr4addhe8hh0unj9uxpvnmzmv245k52dklctkag5m60rg77gq4kjszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzcyyh0d In reply to <a href='/nevent1qqsgprf0t966p4m9x5zj3slp4tfp5grzv4q99mdzjradssygsdekclcpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtc95sm4v'>nevent1q…sm4v</a><br/>_________________________<br/><br/>Thanks, that&#39;s a fair point and I&#39;ve gone back and forth on it. Right now the password is offered the moment a key is created, so it&#39;s already a choice at onboarding, just opt-in rather than opt-out. Once set, the key is unlocked per page only: navigate away and it&#39;s locked again, and reading comments never needs the password.<br/><br/>The reason it isn&#39;t mandatory: most people who install a comment extension want to read first and maybe post once, and a key behind a password they then forget is a key they abandon, with no backup either. I&#39;d rather they make that choice knowingly than lose the identity.<br/><br/>Where I fully agree: the safest key is one the page-side code never holds at all. That&#39;s why NostrComments works with any NIP-07 signer, and why I recommend one to anyone who already has a Nostr identity. Switching the onboarding default to &#34;set a password&#34; with a skip is a good idea though, I&#39;ll look at that. 2026-10-18T16:57:18Z https://yabu.me/nevent1qqsflft30t87v4gq6uzftl8y5gpdkygwumprlhsxuj0vjg03d89m3egzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzqc5dys Security update for NostrComments: please make sure you are on 23.10.3 or later (Firefox and Chrome both have it).<br/><br/>Two problems were found and fixed this week. On some websites, a malicious page could read a private key stored in NostrComments, or press the panel&#39;s own buttons, such as &#34;Show my key&#34; or setting a password on your key.<br/><br/>Keys kept in a signer extension (Alby, nos2x, Attest) were never at risk. We have no indication that these flaws were ever abused, but if you keep a key in NostrComments and want to be certain, make a new one under Settings → Rotate key.<br/><br/>For developers: the panel lives in an open shadow root, so the page can restyle it and click its buttons. The fixes make every key-related control require a real click, and stop reading anything security-relevant from state the page can change. The details are in the security advisories on GitHub. 2026-10-18T09:13:56Z https://yabu.me/nevent1qqsrfkcsswpz6vjz4m8zcl9g7wqe3pt6fh7kw9dfwxu4z6tas38jyhszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz6ax7jt In reply to <a href='/nevent1qqs0g4jz4xajf7yw7zs6pq0cvcyt09xaka0cytzawaf70vq60jq359gpr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0pa5zgv'>nevent1q…5zgv</a><br/>_________________________<br/><br/>GM <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qqsgu837lmm9pxu7l3znmq6ep9qtdej4wvratzuf6hms7nu9glxxuzgpremhxue69uhkummnw3ez6ur4vgh8wetvd3hhyer9wghxuet59uq3vamnwvaz7tmjv4kxz7fwdehhxarj9ehx2ap0qywhwumn8ghj7mn0wd68ytnzd96xxmmfdejhytnnda3kjctv9u0exlfm" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>𝕋ℍ𝔼 𝕋𝕆𝔻𝔻𝕊𝕋ℝ</span> (<span class="italic">nprofile…xlfm</span>)</a></span> 2026-10-17T15:02:20Z https://yabu.me/nevent1qqsz37j948f4r0ls9nlff8yj5h8um3ux82lmukfr049c64rv82lyjmszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzdlu750 A practical note for client developers, from a bug I just fixed in my own extension: signer extensions inject window.nostr asynchronously, so it may not exist yet when your code first looks. My client checked once five seconds after load and then every five seconds, which meant that for the first seconds of every page a user who had already chosen their signer saw &#34;Not connected&#34; and a Connect button. Now it looks at 0.3, 1, 2 and 4 seconds, then backs off. Two details that matter: only check whether window.nostr is present during those early looks, and call getPublicKey once, when you actually connect, so the signer doesn&#39;t get a burst of requests.<br/><br/><a href="https://github.com/nostr-protocol/nips/blob/master/07.md">https://github.com/nostr-protocol/nips/blob/master/07.md</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fnostr-protocol%2Fnips%2Fblob%2Fmaster%2F07.md">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fnostr-protocol%2Fnips%2Fblob%2Fmaster%2F07.md</a> 2026-10-17T06:05:11Z https://yabu.me/nevent1qqsfax43q8v6y9lppmg4kkug9v9q7vtm0lam4lwwkfa79459644l4qszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzqhs78c In reply to <a href='/nevent1qqsrdxq28mewqjthf8kxm99s24rtyyv5qq5pf7a52xen7rhyj5j0ldsy8ddjl'>nevent1q…ddjl</a><br/>_________________________<br/><br/>A small correction to my reply above, after thinking it through: NIP-46 will land in Attest, the signer extension I also maintain, not in NostrComments itself. Key handling belongs in the signer. NostrComments keeps speaking NIP-07, so once Attest supports bunkers, Pomegranate comes along for free, for NostrComments and for every other NIP-07 app. 2026-10-16T21:54:06Z https://yabu.me/nevent1qqsppmf7g6hdr2q0354dqzaf2pkcel5rx0m2afs50e7y84wn4hvxkyqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzuhhgxa GM Nostr ☀️<br/><br/>Every time I pick a new alarm tune I think: this one&#39;s lovely, I&#39;ll finally wake up happy.<br/><br/>Three days later I hate it with a passion.<br/><br/>Has anyone found an alarm sound that survives? 2026-10-16T09:43:19Z https://yabu.me/nevent1qqsrytwenemewf5tx5pc9hxjwvnuuvn9zmfcgmmjnd8rnr2wwcy9wngzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhpkfj7 A real-world data point on the Users figure, since this page only says it counts installations rather than activity: in August my extension&#39;s listing reported about 5,000 users. The breakdown was 97% United States and 79% ChromeOS, and nothing else I could measure moved with it, so I never believed it. By October the figure had dropped to 22, which matches what I can actually observe. Lesson: before you quote this number, look at the country and OS breakdown. A distribution that looks nothing like your audience is probably not your audience. My extension has no telemetry by design, so I count real use from the outside instead: how many distinct keys have published something with it.<br/><br/><a href="https://developer.chrome.com/docs/webstore/metrics">https://developer.chrome.com/docs/webstore/metrics</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.chrome.com%2Fdocs%2Fwebstore%2Fmetrics">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.chrome.com%2Fdocs%2Fwebstore%2Fmetrics</a> 2026-10-16T09:04:45Z https://yabu.me/nevent1qqsqsycwwy2cvrsen7xykcpm2hxua96v34rwxgk4fvm0wmyf2zvtkaszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzg2u3d7 In reply to <a href='/nevent1qqsqqqq7ezfgt3g5xeehck2qqcrw6ej8zld85n5anvf3ek2ae8kdhdq59fzlm'>nevent1q…fzlm</a><br/>_________________________<br/><br/>I think the Japanese are awesome!! 👍 2026-10-15T20:21:56Z https://yabu.me/nevent1qqspzc4p7q8z05adtqtdzvc4plmfdullr3s00nzdcm35ulwfmemz6nszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhlr6wr In reply to <a href='/nevent1qqsqwhjvp0lkcjnrp6r7207qfhxrm6ve2ha9c7dz8fjrauvle5upfwg5kg6qt'>nevent1q…g6qt</a><br/>_________________________<br/><br/>You were right about the button, and it took you leaving to make me see it. Version 23.10.0 has a quiet mode: hover over the button and click the small &#34;−&#34;, and from then on it only shows on pages that already have comments, or where somebody replied to you. No pressure to reinstall, but thanks for saying why you removed it. That&#39;s the most useful feedback there is. 2026-10-15T09:20:49Z https://yabu.me/nevent1qqszn4f7khpe746ff5axzs0plu604ul0cg5j39xun8kknk285zsyaqqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzclj6rq I Love this website for background music wavefunc.live<br/><br/><a href="https://wavefunc.live/">https://wavefunc.live/</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwavefunc.live%2F">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwavefunc.live%2F</a> 2026-10-15T08:17:11Z https://yabu.me/nevent1qqs0z9jqeglxj4dcyqf4v2hhly8awxj29fzf7xe20077e5zxajs6cwczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzyepwhk In reply to <a href='/nevent1qqs0r3u77p2nk7u5rahnf32qgqk8jkmnl4am3ra56sh37kda0eth8ds5x54c0'>nevent1q…54c0</a><br/>_________________________<br/><br/>this is my npub: npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9e 2026-10-15T08:10:53Z https://yabu.me/nevent1qqs8w6fzavkqfrhhmqf3nx96rswxgv5psds9sestgzleje6glt8rlxgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzjpgnhm A practical caveat for extension developers who use shadow DOM to keep their UI safe from the page: an open shadow root does not keep other code out. I put my extension&#39;s panel in one, and yesterday a user&#39;s Share button simply vanished on one site. The button was in the DOM, with no inline style, but its computed display was &#34;none&#34; and its colors had been rewritten, so another stylesheet had been injected into the shadow root. The likely culprit is a content blocker&#39;s social-widget filter, because the button&#39;s class was &#34;share-btn&#34;, a name those lists hide on purpose. The fix was a class name no filter targets. Lesson: inside an open shadow root, treat your class names as public, and don&#39;t give a control a name that sounds like an ad or a widget.<br/><br/><a href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-US%2Fdocs%2FWeb%2FAPI%2FWeb_components%2FUsing_shadow_DOM">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-US%2Fdocs%2FWeb%2FAPI%2FWeb_components%2FUsing_shadow_DOM</a> 2026-10-15T07:41:17Z https://yabu.me/nevent1qqsv0jp6vxvq38fqgm0surhg6ekpcku4jplf75nfg7g6r3qt3xhhleqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzfky284 This is the project&#39;s own thread. Questions, ideas, or things that annoy you about NostrComments: leave them here, and I&#39;ll answer. Bugs are easier to track in Issues. Recent fixes: the Share button could be hidden by content blockers (fixed in 23.9.5), and it could post twice with a slow signer (fixed in 23.9.4).<br/><br/><a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fbriskness-byte%2FNostrComments">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fgithub.com%2Fbriskness-byte%2FNostrComments</a> 2026-10-14T21:35:57Z https://yabu.me/nevent1qqs0c0ug054k97qcwuym7k85hfkvqndczdfw4lq4jv0k4rgpxuegumgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzw4pm77 Some practical experience, since the article stays general: I push my project to GitHub and to two Nostr git servers (gitnostr.com and relay.ngit.dev) with a single script, so the article&#39;s &#34;we don&#39;t need to stop using GitHub&#34; is exactly how it works in practice.<br/><br/>Yesterday I sent my first patch to a repo that lives only on Nostr, with &#34;ngit send&#34;. One member-only relay refused it with a 403, but the others took it, so it didn&#39;t matter. That&#39;s the resilience the article describes, in one terminal line.<br/><br/>One correction: GRASP isn&#39;t so much a bridge as a server type that bundles a relay and a git server, and it creates the repository automatically when your announcement lists it. That&#39;s why you don&#39;t have to set anything up on the server side.<br/><br/><a href="https://nostrmag.com/article/w40nostr01">https://nostrmag.com/article/w40nostr01</a><br/><br/>Read the thread: <a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fnostrmag.com%2Farticle%2Fw40nostr01">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fnostrmag.com%2Farticle%2Fw40nostr01</a> 2026-10-14T20:37:24Z https://yabu.me/nevent1qqsrdxq28mewqjthf8kxm99s24rtyyv5qq5pf7a52xen7rhyj5j0ldszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzjw3v8p In reply to <a href='/nevent1qqsz5yyt69cfmq03940mxmt88dcsheyscqhdat33lymhu9ep3dczcag87yngn'>nevent1q…yngn</a><br/>_________________________<br/><br/>Browser extension dev here (NostrComments). My honest reason is a sixth one: I don&#39;t speak NIP-46 yet, only local keys and NIP-07. It&#39;s on my list now, and Pomegranate would come for free once it&#39;s done. The part that appeals to me is recovery: right now a user&#39;s identity lives in one browser profile. 2026-10-14T06:31:15Z https://yabu.me/nevent1qqst573cz47rh856scr3yut3kgqt5tf3874y5y4am74g8vqdtjnz8rgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzecxthm In reply to <a href='/nevent1qqsqqqzwxmndak76nyzqcew7trjac6rktm53kp5t7r9xh0uhqyhw5lspufsz4'>nevent1q…fsz4</a><br/>_________________________<br/><br/>My penis 2026-10-14T06:06:46Z https://yabu.me/nevent1qqsg9xula6flkd5a53s65ss8cl9us526grurnemjeqjq322mufc00hgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzg9rw2t In reply to <a href='/nevent1qqsyd3s0e0j9lfhxlzyp3a7syp7l436pfsx6yxsyp5tvd8sdtarnkvs8uhs4z'>nevent1q…hs4z</a><br/>_________________________<br/><br/><a href="https://www.x.com/">https://www.x.com/</a> (X/twitter) most of the time 2026-10-13T21:05:36Z https://yabu.me/nevent1qqsf34xlw5fj6ee0fqa8zh96vpls8axszyz3qrtyr2d6w4j2htuxrcgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzkrggj0 I put a comment section on every web page on the internet.<br/>You can now:<br/>- discuss news articles without censorship or being banned<br/>- warn each other for possible scam websites<br/>and many other things with NostrComments<br/><br/>Install the browser extension now on:<br/>Chrome:<br/><a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a> <br/>Firefox:<br/><a href="https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/">https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/</a><br/><br/>Puts the Freedom back in your hands<br/><br/>Open source:<br/>Github: <a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/>#nostr #foss #freedom #censorship 2026-10-13T12:07:04Z https://yabu.me/nevent1qqsf4204yatsk6xz5wuma46qxlh8qg72r7u45wez9da8c6ynfz22g6qzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8n2885 NostrComments puts a comment thread on every web page on the internet. This means you can post and read comments about the web page from other users. The thread lives on Nostr relays, not on the site. There is no middleman: no server of mine, no account, no telemetry, and the site you&#39;re commenting on can&#39;t close it.<br/><br/>For users: install the extension, make a key in one click or use your existing Nostr signer, and comment anywhere. That includes the news site that turned comments off, the paywalled article, the government page and the press release. Nostr notes that tag a page&#39;s address show up in its thread too, so a page isn&#39;t always empty. Zap a good comment, mute the bad ones. Nothing is sent until you switch it on; after that, the relays you choose can see which pages you read.<br/><br/>For developers: comments are plain NIP-22 events (kind 1111, the URL in the I tag), so any client can read and write the same threads. Other tools already use this format but turn a URL into an address differently. If you build one, let&#39;s agree on that rule.<br/><br/>Chrome: <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a><br/>Firefox: <a href="https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/">https://addons.mozilla.org/en-US/firefox/addon/nostrcomments/</a><br/>Source: <a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/>#nostr #freespeech #foss 2026-10-13T10:53:18Z https://yabu.me/nevent1qqsxeuxpfhfhxjy865jvd6y560gg7yup877fd3ha2wqn0vh3uwrcs8gzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzpmc6ev In reply to <a href='/nevent1qqsqs7h6udvk42nztrqxen07lekx4n98jepnnr3fsq34njufctz4mxqppemhxue69uhkummn9ekx7mp0kyann7'>nevent1q…ann7</a><br/>_________________________<br/><br/>Thank you <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1qthrakwse758md40qafgq5gj0t3xhwku4fe3rm4u88rq45xlzrkqj9rcch" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>DevCrafter</span> (<span class="italic">npub1qth…rcch</span>)</a></span> , I really appreciate it! ⚡️ 2026-10-12T21:51:43Z https://yabu.me/nevent1qqsdg4wgw45qm9x0pwaeevvajnfg2nucv2fcvye82ea5vw2gf6kaj7gzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzf7qkzp GM ☕<br/><br/>NostrComments has been live in the Chrome and Firefox stores for a few weeks now.<br/><br/>The thing I see most often:<br/>People open the button on an article where the comments are already closed or deleted… and there’s already a thread waiting.<br/><br/>That’s exactly why I built this.<br/><br/>Small updates from the last few days:<br/>• The floating button is quieter by default (dims until you hover)<br/>• One-click disable per site<br/>• Remembers which corner you want it in, per website<br/><br/>Still no server, no account, no tracking.<br/>Just comments the site owner can’t delete.<br/><br/>If you haven’t tried it yet:<br/>Chrome → <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a> <br/>Firefox → <a href="https://addons.mozilla.org/firefox/addon/nostrcomments/">https://addons.mozilla.org/firefox/addon/nostrcomments/</a><br/><br/>Or read any thread without installing anything:<br/><a href="https://briskness-byte.github.io/thread/">https://briskness-byte.github.io/thread/</a><br/><br/>Which page would you most like to give an uncensorable comment section?<br/><br/>#nostr #asknostr 2026-10-12T09:21:59Z https://yabu.me/nevent1qqsr2sy8t5spp78ruh5mufazgwcqx09y4yfsxkxjjp8ueypk88a3p0qzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzaxjf0x In reply to <a href='/nevent1qqsqwhjvp0lkcjnrp6r7207qfhxrm6ve2ha9c7dz8fjrauvle5upfwgpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcwyz0jh'>nevent1q…z0jh</a><br/>_________________________<br/><br/>Thanks for confirming! Good timing — I just shipped exactly that: the button dims by default now, and hovering it shows a small × that turns it off on that site in one click, no settings menu needed. It&#39;s live now on GitHub and Firefox (AMO), and submitted to the Chrome Web Store — that review usually takes a few days. Will ping you when Chrome catches up, if you want. 2026-10-09T20:07:30Z https://yabu.me/nevent1qqsx3yeakuhavw5neurdzfgrfn6tvlndp64v45j6a4wq998j0f5rtyszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzeeehay In reply to <a href='/nevent1qqsz68zzmmws4p6k7nu332kdtwaaxvfw57qr42xlxrlph8q8sgtnkys9gvl5m'>nevent1q…vl5m</a><br/>_________________________<br/><br/>Appreciate you saying so, that&#39;s useful to know. Quick question so I fix the right thing: was it the little floating button sitting on every page, or the panel once you opened it? (I&#39;m the dev, btw.)<br/><br/>If it&#39;s the button: it can be dragged (or set in settings) to whichever corner is free and that&#39;s remembered per site, and there&#39;s a per-site off switch too. If it&#39;s the open panel taking over the screen, that&#39;s actually the next big thing I&#39;m working on — moving it out of the page entirely into the browser&#39;s own sidebar, so it never overlaps anything. 2026-10-09T18:44:19Z https://yabu.me/nevent1qqsqs7h6udvk42nztrqxen07lekx4n98jepnnr3fsq34njufctz4mxqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzuk4m5v In reply to <a href='/nevent1qqsf6c477flnc7srr60y907ee76ckqxjcpc87dg7rhff80tw0exmk6q7swxly'>nevent1q…wxly</a><br/>_________________________<br/><br/>Thanks for picking that up <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qyv8wumn8ghj7enfd36x2u3wdehhxarj9emkjmn99uqsuamnwvaz7tmwdaejumr0dshsqgqzacldn5x04p7mdtc822q9zyn6uf4m4h92wvg7a0pecc9dphcsas0mfywd" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>DevCrafter</span> (<span class="italic">nprofile…fywd</span>)</a></span> , that&#39;s pretty much exactly it. One small nuance: the key lives in the browser until Bob chooses to export it (as nsec, or connect a client with NIP-07) — not automatically on his phone, but one copy-paste away whenever he wants it. And agreed on #2 — the bottleneck isn&#39;t really Nostr itself, it&#39;s getting people who already care about open protocols to notice it exists. 2026-10-09T18:43:03Z https://yabu.me/nevent1qqs2v6th0h2xn6wf5tt0frqewqmkmmn3mth5q2dym59lstsdwxfj20czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz83wlvp In reply to <a href='/nevent1qqs0nwt56ta7e9sx5ls3plv8v8j7eeceysx7rtvyt9pkhz9p2t0jrpspzemhxue69uhhyetvv9ujuerfw36x7tnsw43z78r6c0y'>nevent1q…6c0y</a><br/>_________________________<br/><br/>Yep — not a silo. Every comment is a real signed Nostr event (kind 1111, NIP‑22), published to the public relays you choose. No server of mine in between. Sign with a generated key or your own NIP‑07 signer (nos2x, Alby). Other Nostr clients that read that event kind, like Jumble, can see the same comments. 2026-10-09T07:17:07Z https://yabu.me/nevent1qqsy2lncyznawt4ukzv7zmzjnsau2xx7ef6nxu3vv3rh77gwa8nvj2qzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzn058q3 GM! Coffee&#39;s on, let&#39;s build something great today.<br/> <img src="https://blossom.jumble.social/5dfca94d30cda0273410548a43956b0d35c3417934132b77cb396966fed44189.webp"> 2026-10-09T07:14:34Z https://yabu.me/nevent1qqsvzygljccks6p8mkfdkyhj9jh7h9f8nhcagy7j2pxmfwdz2pplxaqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzj68zdv In reply to <a href='/nevent1qqst7kmndzp8mt4dsy6qg8kp267t3tzgrzl997naaglwgxj2ez4c4us2qmwcu'>nevent1q…mwcu</a><br/>_________________________<br/><br/>One idea (disclosure: it&#39;s mine) — meet people where they already are instead of asking them to install a client first. NostrComments puts a Nostr-backed comment thread on any website; reading needs zero signup, posting needs a key. No &#39;come to Nostr&#39; wall. 2026-10-08T22:49:05Z https://yabu.me/nevent1qqstql65tvjydf6jxktaxq84tk963amykc6h033ujmfu84gktu2sl3czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzqmf2n4 NostrComments 23.4.0 is out. A reader of the extension — Emre Yılmaz ( <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1gmeu0wenescpjpymwmwgnkaedc6vy3aamf5tdtvxxf5z0yll3gdqatwl3v" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>delirehberi</span> (<span class="italic">npub1gme…wl3v</span>)</a></span> ), blog.emre.xyz — wrote up a discovery convention for pages that are also native Nostr content: a &lt;link rel=&#34;alternate&#34; href=&#34;nostr:naddr…&#34;&gt; tag, so a client can find the entity a page already is. Sent it in as a proper draft, trust considerations included.<br/><br/>Built the read half of it — a page naming its own Nostr entity now has that thread merged into the panel, alongside the URL-scoped one. Thank you for taking the time to write it up properly Emre! 2026-09-30T22:13:15Z https://yabu.me/nevent1qqs9m8gcekkpcehddtfnq3d3s2j8avqadfmg4d876qe3t7nctv83flczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz0zx7a6 In reply to <a href='/nevent1qqsg9exs7kdpv990hntazhaeezaeeyfqjulnek3mugxgmspr0vd3dyqpzpmhxue69uhkummnw3ezumt0d5hsdewsv4'>nevent1q…wsv4</a><br/>_________________________<br/><br/>Ich glaube Sie haben Recht. Wunderschön 2026-09-25T03:00:28Z https://yabu.me/nevent1qqs2ahs7qyg33jaxepsx6zcfjswscs7k67vdq337pc2ewtt5u7s603czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzgt3wzt If you use nos2x-fox as your Nostr signer in Firefox, make sure you&#39;re on 1.21.0. It closes two things worth knowing about.<br/><br/>While your PIN was cached after an unlock, any website could ask the extension for it and get it back in plain text. That PIN is what encrypts your private key at rest, so a page could walk away with the one secret between it and your key. I reported it privately and wrote the fix; it was also reported publicly as #68.<br/><br/>The second was found by daym. The extension used to inject its script into pages as &lt;script src=&#34;moz-extension://&lt;uuid&gt;/…&#34;&gt;. Firefox gives every extension a random UUID per install precisely so websites can&#39;t fingerprint you by the extensions you run, and that tag handed it to every site you visited: the same on each one, and surviving cleared cookies. It now loads as a MAIN-world content script, with nothing left in the page to read.<br/><br/>Nothing to do except update. Firefox normally does that for you; about:addons shows which version you have.<br/><br/><a href="https://github.com/diegogurpegui/nos2x-fox/releases/tag/v1.21.0">https://github.com/diegogurpegui/nos2x-fox/releases/tag/v1.21.0</a> 2026-09-22T14:51:36Z https://yabu.me/nevent1qqstumwmmq3sl4r4fdar73d49ekem09u43m7v7353ajlmkhape9wgsgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzmkatmw One of the dumbest things you can do on Nostr is sharing your private keys, like nsec138mwgc6rvpukzn7xj5522xzc63h69f6533tupl25trtps4nckl0qp452vg 2026-09-19T14:57:27Z https://yabu.me/nevent1qqsrcp0shgpqnw5qame336s2u5fn7tte437h80v3kzmayergrzh40yqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzfdrjh3 If your browser extension draws its UI inside the page, check this one. I had it wrong for months.<br/><br/>My comment panel lives in an open shadow root in the page, so any script on the page can reach every control in it. I guarded the ones that matter — granting consent, adding a relay — by checking the event&#39;s isTrusted, which only the browser can set. That felt like enough.<br/><br/>It is not, and I only found out because I tried to break it myself instead of assuming.<br/><br/>A page can skip the event entirely: take the element, call its onclick directly, and hand it an object it made up. isTrusted is just a property on that object. It can also act while a real click of yours is being delivered elsewhere in the panel, which is long enough for a naive &#34;was that trusted&#34; flag to still be true.<br/><br/>Against my own build that meant a page could open settings, press &#34;Show private key&#34; and read the nsec straight out of the field. And separately, type a comment and post it under my key. Without me clicking anything.<br/><br/>What works instead is to never trust what the caller passed. A capture listener on the shadow root records which element a real gesture is activating, in a closure the page cannot reach, and each sensitive handler asks only whether that element is itself. Dispatching an event sets nothing. Calling a handler sends no event at all. Piggybacking on a real click leaves some other element as the target.<br/><br/>It is still a mitigation and not a boundary, and I would rather say so: the panel is in the page&#39;s DOM, so a page can read the thread, read what I am typing, and read a key I choose to display while I am on it. Moving those controls onto the extension&#39;s own surface is the actual fix, and that is the next thing I build.<br/><br/>Fixed in 23.3.1 — out on Firefox, in review at Chrome. 2026-09-18T10:07:32Z https://yabu.me/nevent1qqsqqqy5pf6y9y6vv3m0gwvl7vrm08f29yv3qyahfz6znwddvcdx8sqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz98wugu In reply to <a href='/nevent1qqsfs08l3ldtjxzhm3apv5v5qq5s9zw2k9jr60zq3cu2mtwxa5khcwspzfmhxue69uhhqatjwpkx2urpvuhx2ucrfdnej'>nevent1q…dnej</a><br/>_________________________<br/><br/>Happy birthday🦥 2026-09-16T05:46:25Z https://yabu.me/nevent1qqsyzdntz547p4r6affl9tk5lqdfvzuw6haa7rj3p664fz9venk27vczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzd08kfs In reply to <a href='/nevent1qqsqqqz946hsldt3shcs94z3d30nm9u8uvw337t2xx32pjtap2sraxgpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcap5hzx'>nevent1q…5hzx</a><br/>_________________________<br/><br/>Yeah, this is exactly why I made this. I was running into issues like that myself, I hated the censorship and major platforms these days are censoring all kinds of comments to manipulate the public opinion and still call it a democracy, but there can&#39;t be a true democracy without free speech.<br/>The secondary benefit is that people can warn each other on scam or phishing websites, making the web potentially safer. But only a handful of people are using nostrcomments so it&#39;s still in early development and benefits are still theoretical. 2026-09-16T02:33:17Z https://yabu.me/nevent1qqszhuvysqma8jxc28vw5v6anwhzp2a693d566uklpu5cvzysys8rrqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8szf2y In reply to <a href='/nevent1qqsddwt80sfnf5chxkfcnk4z53zxa0pkm9hmpcrud92d80pu7gtztncppemhxue69uhkummn9ekx7mp057p9h4'>nevent1q…p9h4</a><br/>_________________________<br/><br/>Then the question becomes: Why did you invest in their bitcoin and prop up their wealth in the ponzi? 2026-09-15T21:01:03Z https://yabu.me/nevent1qqsv88prat3adatydsktnx3z7ku3q603vz2mwcpxy62dy3ly75hst0szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzdtme90 In reply to <a href='/nevent1qqsqqq9wylne3app28sv88ll7cz2yt4q3vsmguk56du7f6qyqypc7jqwv8snq'>nevent1q…8snq</a><br/>_________________________<br/><br/>Thanks for the replies everyone🫶 2026-09-15T19:36:45Z https://yabu.me/nevent1qqsynh3fuff3yu2sux9qv3msptw2gwp683ex3hg55fv77f657tdketszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzuemm0m In reply to <a href='/nevent1qqspzqd0yacq7kvq5r08wa9lrcxete7sj6u8pdx760wemrev8ynp3vgppemhxue69uhkummn9ekx7mp0xehrn8'>nevent1q…hrn8</a><br/>_________________________<br/><br/>The irony is that actual CSAM material is embedded into the bitcoin blockchain by early bitcoin users. 2026-09-15T16:37:53Z https://yabu.me/nevent1qqs8q0natyhhhmp2n8y68vqfcmvf88lu0cpd8g65pxhxm4s49eyfkqczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzye3ylp In reply to <a href='/nevent1qqs0vsd4ntsa0j3tng9uxwjv5swmdlzueemnpdpthta9evvznkusfscppemhxue69uhkummn9ekx7mp02nukxe'>nevent1q…ukxe</a><br/>_________________________<br/><br/>I hate Primal 2026-09-15T16:25:09Z https://yabu.me/nevent1qqsph93wt4jtp3cjzu4cw0zwyz0jwqs7jk3aylrp38ljcwur7pcqvmszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzujk0eu In reply to <a href='/nevent1qqsxdemw5flzw4esl26kpfu4v26kx4undm8h4ptzh0z9ehwkl9t5hygpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcpd46cd'>nevent1q…46cd</a><br/>_________________________<br/><br/>Hey sorry to ask; Do you use drugs as a way to escape from the problems you should actually fix in your life as an adult? 2026-09-15T10:57:19Z https://yabu.me/nevent1qqsykmkrw3y9sqqrl42fg4w9ng569u7rk25qee46s50dqflx58ktmaszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz2vwq3k In reply to <a href='/nevent1qqs2e5q3kjvvxya6ymjqyw83ap6y5tpafxl62cm90pzpcvq784untuqpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtckvyszk'>nevent1q…yszk</a><br/>_________________________<br/><br/>Fire and a stick is technology too, right?<br/>The best kind of technology. 2026-09-15T10:33:49Z https://yabu.me/nevent1qqsfsmstmus3rvehnhvc0jhe0f8p4x7fxz9qqsjxhcflclv6pnts4dczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzpzumgl In reply to <a href='/nevent1qqspx6fzyt6nn8xs6chldzmzg2ymujz36ynmpjzk2x4gzzfm54m4tgcppemhxue69uhkummn9ekx7mp0g3f3j9'>nevent1q…f3j9</a><br/>_________________________<br/><br/>Schön! hört sich gut an! 2026-09-15T10:28:29Z https://yabu.me/nevent1qqsqqq9wylne3app28sv88ll7cz2yt4q3vsmguk56du7f6qyqypc7jqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzc23nay I often feel like an outsider on nostr. Do people actually read this? 2026-09-15T07:41:47Z https://yabu.me/nevent1qqsqqqrcrynmnzrpzr8ksz2cchnv7fts964ynwpdqmz9frpx57zzfuszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzw8v4x9 In reply to <a href='/nevent1qqsqqqy909nkga7x5yuqhzjt72uelfvqdh7afqvx39wywyvl3lddr3cprpmhxue69uhhyetvv9ujuumwdae8gtnnda3kjctvt4lfph'>nevent1q…lfph</a><br/>_________________________<br/><br/>Wow, did not know this. Cool! 2026-09-14T19:58:20Z https://yabu.me/nevent1qqsw9y530z5x7frmnkk5ukwzesduaaq02saahggw2wztez3dr67g8hqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzszm2ht Ever wanted to reply to an article on the internet that has comments switched off? 👀<br/><br/>I built NostrComments for that. It&#39;s a browser extension that gives every web page a comment section, powered by Nostr.<br/><br/>Here&#39;s the idea: your comment doesn&#39;t live on the website. It lives on Nostr relays, linked to the page&#39;s address. So the website can&#39;t delete it, and anyone else with NostrComments who visits that page can see it and reply.<br/><br/>A few nice things:<br/><br/>✍ Use your own Nostr key, or keep it safe in a signer like Alby, Attest or nos2x<br/>🤝 Comments on web pages made with other Nostr apps, like Amethyst and Ditto, show up too<br/>🔌 No company server in the middle. You pick your relays<br/>🙋 It stays quiet until you say yes, and you can turn it off for any site<br/>⚡ Vote, mute and zap, right in the panel<br/><br/>Curious but don&#39;t want to install anything? Read the comments on any page here: <a href="https://briskness-byte.github.io/thread/">https://briskness-byte.github.io/thread/</a><br/><br/>Quick demo (66 sec): <a href="https://www.youtube.com/watch?v=bywF8yWZa3o">https://www.youtube.com/watch?v=bywF8yWZa3o</a><br/><br/>🦊 Firefox: <a href="https://addons.mozilla.org/firefox/addon/nostrcomments/">https://addons.mozilla.org/firefox/addon/nostrcomments/</a><br/>🌐 Chrome: <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a><br/>💻 Open source: <a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/>It&#39;s still early, so most pages have no comments yet. If you try it, leave one! That&#39;s how every conversation starts 💜<br/><br/>#nostr #grownostr #opensource #foss #privacy #nip22 2026-09-14T13:46:28Z https://yabu.me/nevent1qqswnengfdqhntysulh0pp2m48t2juew7xuune7tv7fj057dn4rew4gzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz7q6yn0 In reply to <a href='/nevent1qqsqqqqz825zy5uegyqcxwdn378d4ud7k90254q8g70k5y7e9ke530sppemhxue69uhkummn9ekx7mp0al0zd4'>nevent1q…0zd4</a><br/>_________________________<br/><br/>Cool! Worth checking out 2026-09-14T11:43:59Z https://yabu.me/nevent1qqs2zmml5wnq70z2t23736fmhdl02cgkc0h893egc3hfz0yhqtlzfjszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz2azef2 In reply to <a href='/nevent1qqspvnkj54xmsj53cedttpnzweprl9wwcyqwkty0f47zracun7ykfnqz8a90n'>nevent1q…a90n</a><br/>_________________________<br/><br/>Thank You! 2026-09-13T19:02:34Z https://yabu.me/nevent1qqswslwp8qw37cjt6vj2l8ke4awtggggzdxegua3rxgjg0rww8snf7szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzvkqx7n You can now read a NostrComments thread without installing anything:<br/><br/><a href="https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.nature.com%2Farticles%2Fd41586-026-02763-3">https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.nature.com%2Farticles%2Fd41586-026-02763-3</a><br/><br/>That&#39;s a Nature article with no comment section, and five comments filed under its address on public relays. Paste any URL to see what has been said about it.<br/><br/>Static page, no server, no backend — it queries the same relays your own client does, from your browser. Source: <a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/><a href="https://briskness-byte.github.io/">https://briskness-byte.github.io/</a><br/><br/>#nostr #privacy #nostrcomments 2026-09-13T13:09:50Z https://yabu.me/nevent1qqsvs0vc85xm50ur3f79jsn9nt3zugfg5928vupq3tnz6vhekhr3nrczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhtgajl In reply to <a href='/nevent1qqs93jwqvcr7dn24f0e9vzkee4l7rulukwrrrz5rdfrc8d8td999c6sau6d0y'>nevent1q…6d0y</a><br/>_________________________<br/><br/>How did you add the Monero target? I fetched your kind 0 across six relays and the newest one has no XMR field — did a client rewrite it, or does it live somewhere else? 2026-09-13T12:08:08Z https://yabu.me/nevent1qqsqufuk4sek5gq2x37jusyqfmd4qhgqjm9sh0jkte8zmmjq9mst7tszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzwcvxam In reply to <a href='/nevent1qqsw2f3gzapcze0yxxldfxqdqdjxwl3pj058afpdt2e70dvk5jhr7rqurttv7'>nevent1q…ttv7</a><br/>_________________________<br/><br/>Also on the project page, where the video is self-hosted — no YouTube embed, no third-party requests, the same claim the extension makes about itself: <a href="https://briskness-byte.github.io/">https://briskness-byte.github.io/</a><br/><br/>#nostr #privacy 2026-09-13T11:31:36Z https://yabu.me/nevent1qqsw2f3gzapcze0yxxldfxqdqdjxwl3pj058afpdt2e70dvk5jhr7rqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzyn0y7v NostrComments has a proper demo now — 66 seconds, no sales pitch:<br/><br/><a href="https://www.youtube.com/watch?v=bywF8yWZa3o">https://www.youtube.com/watch?v=bywF8yWZa3o</a><br/><br/>A comment thread on any page, attached to the page&#39;s address and stored on relays instead of on the site. The clip shows it on a Nature article with no comment section, the same thread appearing in a second browser under a different key, and then a paywalled paper, a corporate announcement, an EU page and a post on X.<br/><br/>Also out: 23.2.2, where the toolbar button opens and closes the panel. That matters because a page can delete the floating button — the toolbar is outside its reach.<br/><br/>Firefox: <a href="https://addons.mozilla.org/firefox/addon/nostrcomments/">https://addons.mozilla.org/firefox/addon/nostrcomments/</a><br/>Chrome: <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a><br/> 2026-09-13T11:00:14Z https://yabu.me/nevent1qqsg6ae2ars8cqz68wem06mzvpxgu7d93ngzj3hhx9k8ul0j3t64nkqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz6l9v4p In reply to <a href='/nevent1qqs2xdqnk6pmvl6lye5hk9h9305ylpr4gv3s9yw5vcgzcfuvyg58c3sq438rl'>nevent1q…38rl</a><br/>_________________________<br/><br/>Very Cryptic 2026-09-13T03:36:56Z https://yabu.me/nevent1qqszmtldl9lmrhvt7242q9rzqnc20alf6ftadwexq98ncqzh29hghrszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzc2prxk Attest is a Nostr signer for Firefox: it holds your key and asks before anything is signed.<br/><br/>What&#39;s new in recent releases:<br/><br/>• Protect your key with a passphrase, not just a 4–6 digit PIN. A short PIN stops someone using your browser; it does not stop someone who copies your Firefox profile, and the extension now says so plainly instead of implying otherwise.<br/><br/>• Permissions are tied to a site&#39;s full address, https or http. A site you allowed over https is no longer also allowed over plain http.<br/><br/>• Each site keeps one decision per kind of permission, so refusing something briefly no longer wipes a permission you granted permanently.<br/><br/>• The options page shows what is actually there: no empty key field for a key that is encrypted, and adding another key happens where you&#39;d look for it.<br/><br/>Open source, reproducible build, and the release refuses to ship if the tests fail or if the code that handles your keys doesn&#39;t type-check.<br/><br/><a href="https://addons.mozilla.org/firefox/addon/attest/">https://addons.mozilla.org/firefox/addon/attest/</a><br/><a href="https://github.com/briskness-byte/attest">https://github.com/briskness-byte/attest</a> 2026-09-12T08:24:05Z https://yabu.me/nevent1qqsr22j0nfecgww5e2zu2jygfv3hxurku4g07evhp3fzw7sx9m2v6zgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzwr7k35 NostrComments 23.2.0 is out 🧵<br/><br/>It now works on sites that used to show an empty panel. Some sites (x.com is the best-known) use a strict Content-Security-Policy that blocks connections to anywhere they haven&#39;t listed, and Firefox applied that rule to the extension too, so no relay could be reached. The extension now opens its relay connections from its own background, where the site has no say.<br/><br/>Also new:<br/>• a switch to leave the &#34;client&#34; tag off your comments<br/>• on Firefox, the welcome screen now suggests Attest instead of nos2x-fox, which has a public flaw that lets a website read the PIN protecting your key. Attest is my fork with that fixed.<br/><br/>What it is: a comment thread on any URL, stored on relays instead of on the site, so the site owner can&#39;t delete it. Comments are NIP-22 (kind 1111), so other clients can read them.<br/><br/>Firefox: <a href="https://addons.mozilla.org/firefox/addon/nostrcomments/">https://addons.mozilla.org/firefox/addon/nostrcomments/</a><br/>Chrome/Brave/Edge: <a href="https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido">https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido</a><br/>Source: <a href="https://github.com/briskness-byte/NostrComments">https://github.com/briskness-byte/NostrComments</a><br/><br/>No server, no account, no tracking. Feedback welcome, here or in the thread on any page.<br/><br/>#nostr #privacy <img src="https://blossom.primal.net/e2c41ebc62ae1ae8ae52601cbcc600c5eae6f9939e564731d116be05f3b8e12b.png"> 2026-09-11T21:42:16Z https://yabu.me/nevent1qqs2gyuaqfmdmd8nuu0n7552uw8kc5mytrxey03yjps9wx87np3e85szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzv7689g In reply to <a href='/nevent1qqspwta978vwxkkz3rxh56yk6pe72arh2scjph7t6j6fe8ntes86jsc93z9f4'>nevent1q…z9f4</a><br/>_________________________<br/><br/>Sent you 42 sats, and you&#39;ll never know it was me: the money left my wallet but my client (Primal) paid it as a plain invoice with no zap request attached, so no receipt was ever published. Third silent failure in this thread and the first one that&#39;s mine. Chasing it now. 2026-09-07T14:16:46Z https://yabu.me/nevent1qqsp9834vqcyvpt79w52tg2567zvkaa99a7ex02algycvw4kfjzt3eszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzdz6ng9 In reply to <a href='/nevent1qqspwta978vwxkkz3rxh56yk6pe72arh2scjph7t6j6fe8ntes86jsc93z9f4'>nevent1q…z9f4</a><br/>_________________________<br/><br/>You&#39;re right, and that kills the version of it I just gave you. A log nobody has open is not a log. Firefox is the same, about:debugging, Inspect, same two windows away.<br/><br/>So the end that has to speak is the one already open, which is the page console — the content script, not the background. With one restriction I found the hard way: this signer used to log into the page console and I emptied it, because it was writing the event being signed and the plaintext out of nip04.decrypt into a world where the page can swap out console.log and read it back.<br/><br/>So: log at the page end, and log only what the page already knows — its own origin, and that the call was refused. Never the payload. Which is about your four lines, on the other side of the bridge. 2026-09-07T12:48:42Z https://yabu.me/nevent1qqs86qslu4w2fv4wl6c466t8my3c4n2n0wf30lhnmf53cnkkpwsfmlszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dznr6g4m In reply to <a href='/nevent1qqszu5t8vs2qvld2wsxu2qz8s76h3f8wt990dkeqz84kpswnm2ds6ng4mgls4'>nevent1q…gls4</a><br/>_________________________<br/><br/>I appreciate your interaction, you are a smart guy who knows his stuff! 2026-09-06T21:18:38Z https://yabu.me/nevent1qqsqruxsefnxzk23muxkthqtzqh90mw76kwwfluhd7mmr2uaav0cndczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz2vec5l In reply to <a href='/nevent1qqszu5t8vs2qvld2wsxu2qz8s76h3f8wt990dkeqz84kpswnm2ds6ng4mgls4'>nevent1q…gls4</a><br/>_________________________<br/><br/>Mine returns &#34;not available to pages&#34; and nothing else — no origin, no log line. So yes, four lines, and I&#39;ll take them.<br/><br/>One caveat I&#39;d hold to in a signer: that string goes back to the caller, and in the refusal branch the caller is the page. The origin is free, it already knows it. The reason is not — &#34;no permission for this origin&#34; and &#34;PIN not set&#34; are different answers, and a hostile page learns how you&#39;re configured by reading them. Coarse on the wire, detailed in the extension&#39;s own console, which is where the weekend would have been saved anyway. 2026-09-06T20:37:05Z https://yabu.me/nevent1qqsze0u9az77erwzzlxj8x9umaar8uk0rkmqftl3hz4zpezxajsy24szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzmlt9t4 In reply to <a href='/nevent1qqsqqqq34fscu6kh33xfek0l4vrwdqw3wgwhenqauegw2mmekj5352qppemhxue69uhkummn9ekx7mp0sl4xzn'>nevent1q…4xzn</a><br/>_________________________<br/><br/>Lol, im running hyprland on arch with omarchy configs 2026-09-06T19:58:22Z https://yabu.me/nevent1qqsrznd4q44zfny9nlt36max69fe2dxey896splqdp04ct05ecn4nlczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzuzv589 In reply to <a href='/nevent1qqsdzv8gt28ztmu3q0ljcuh8zer4kflu9946r5gqffej93slfwgz3es5p6ngl'>nevent1q…6ngl</a><br/>_________________________<br/><br/>That&#39;s exactly how it presents — the message goes out, the refusal comes back, and there&#39;s nothing on screen to look at. The other obvious check has the same hole: for a content script sender.id is your own extension id too, so it doesn&#39;t separate the two either. The URL is the only field that does. What I&#39;d actually change is the refusal path: a boundary that rejects without saying so will cost you the same release twice. 2026-09-06T11:29:34Z https://yabu.me/nevent1qqsyftndn7gpmmt7f8k3qc0e7qheutpwmzgqp5tj2f0ft7q6wgheulqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzlupsdf In reply to <a href='/nevent1qqs8z4ywwrd8asc4jvt437t6euqqdhufe7hylluzg52zkhwt2gkan2qluusy4'>nevent1q…usy4</a><br/>_________________________<br/><br/>Imad 2026-09-05T16:18:21Z https://yabu.me/nevent1qqs80l85jadfm05r8fdwk92ghzc4x84uenwg3ggge70h74r0qdzu5xczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzjlq4nx In reply to <a href='/nevent1qqsd2zlwcs997sfkadmklhkrxpkkc0jmrlaklg9k3u4fexk78vfweequ5qv23'>nevent1q…qv23</a><br/>_________________________<br/><br/>You are the first person to actually have zapped me! Thank you! 2026-09-05T11:14:43Z https://yabu.me/nevent1qqsz22tteeq67lgtfvxs4l40j63h9xpukjdrw3sph5pvpa2d8xh98vszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzp77h20 In reply to <a href='/nevent1qqswgg590shjhsn0kwh4gana52z4ntakyxzqercguj7dfxxjth2kkhqrerd7c'>nevent1q…rd7c</a><br/>_________________________<br/><br/>Yuk! What is that?! A rippled Banana?! 2026-09-05T11:08:04Z https://yabu.me/nevent1qqsrtgxlkr25mnhrf9g0ce5ue5amy08a8nnef7pcduguf669henshvczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzpxpggt A browser extension can be talked to by two very different things: its own pages, and a content script sitting in somebody&#39;s web page. Telling them apart is the whole security boundary, and the obvious way to do it is wrong.<br/><br/>`sender.tab` looks like the answer. It is not. An options page opened with tabs.create() has a tab like any web page does, so checking for one makes the extension refuse its own UI — and it fails silently, because the message goes out, comes back refused, and nothing on screen says why. A button that does nothing.<br/><br/>`sender.url` against runtime.getURL(&#39;&#39;) is the one that holds. A content script always reports the address of the page it was injected into, never a moz-extension:// one, and content scripts do not run on extension pages.<br/><br/>Cost me a release before I found it. 2026-09-05T11:06:34Z https://yabu.me/nevent1qqsy2h7nvw5rvsmwhlfpp60mm793kxj6y5pfq6f44563phqrczlqjpczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8048za In reply to <a href='/nevent1qqsd2zlwcs997sfkadmklhkrxpkkc0jmrlaklg9k3u4fexk78vfweequ5qv23'>nevent1q…qv23</a><br/>_________________________<br/><br/>Gee thanks!! <br/><br/> 2026-09-03T21:53:03Z https://yabu.me/nevent1qqsd2zlwcs997sfkadmklhkrxpkkc0jmrlaklg9k3u4fexk78vfweeqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhh0jk8 In reply to <a href='/nevent1qqsr99v09uzek5aq02uqmpjtn0dqy406vq3sxltqcx7rx0p5lr5gc3qcf66kf'>nevent1q…66kf</a><br/>_________________________<br/><br/>done 2026-09-02T22:01:58Z https://yabu.me/nevent1qqsr28ez38rn23nmjn4h967jlmc9xjx9eensjvfgxjtafw4zwdhc33czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzztgxqc I hand-rolled secp256k1 and BIP-340 Schnorr for a browser extension, and I would like someone who does this properly to read it.<br/><br/>Why hand-rolled: the extension ships with no build step and no dependencies, so the file you install is the file in the repository, comparable line for line. A library would have cost that. Whether the trade was worth it is part of what I am asking.<br/><br/>What I have already done. It passes all nineteen official BIP-340 test vectors, including the ten that must be rejected — public key off the curve, sig[0:32] not an x coordinate, s equal to the curve order, sG - eP at infinity. I mutation-tested that suite too: removing the even-y check on R is caught by exactly one assertion in the entire project, vector #6, and by nothing else.<br/><br/>What I already know is weak. The scalar multiplication is a plain double-and-add branching on secret bits, so it runs in variable time. I do not think it is reachable from a hostile page — a content script&#39;s signing cannot be triggered or observed from the page — but I would rather say it than have it pointed out. And BigInt is not constant time in any JS engine, so this is not something I can fully fix in this language.<br/><br/>What testing cannot tell me: whether the field arithmetic is right. Vectors prove the implementation behaves on inputs somebody thought to write down. They say nothing about the modular inverse.<br/><br/>It is forty lines. I am not asking anyone for a free audit — just for eyes. I would rather find out now than after somebody depends on it.<br/><br/><a href="https://github.com/briskness-byte/NostrComments/blob/v23.1.0/NostrComments-Chrome/content.js#L56-L95">https://github.com/briskness-byte/NostrComments/blob/v23.1.0/NostrComments-Chrome/content.js#L56-L95</a> 2026-09-01T14:41:35Z https://yabu.me/nevent1qqs9jgwafdku0lqfq2uzhz7m3qm3whu32x5mejm5kwl59satp620jkczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhtcvkl In reply to <a href='/nevent1qqs8jxp56purn0k2k64s2f5x7l8qhh3s0d4wa6m2pxr5062l2p0krastltqey'>nevent1q…tqey</a><br/>_________________________<br/><br/>🦬 <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy88wumn8ghj7mn0wvhxcmmv9uq3wamnwvaz7tmwdaehgu3wv9a85ctdduhxuet59uqzpggzvz325tcf9kz79s9c9627430ccc82r8rgujycwxd43n92y037um9s94" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>The Bullish ₿itcoiner</span> (<span class="italic">nprofile…9s94</span>)</a></span> 🦬 2026-08-25T15:53:18Z https://yabu.me/nevent1qqsqqqzxg0r8mz4427r7e6hthxyzntx5y9c8w43rxynrgj2dfwulyuszyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz20rtgm In reply to <a href='/nevent1qqs8jxp56purn0k2k64s2f5x7l8qhh3s0d4wa6m2pxr5062l2p0krasprpmhxue69uhhqun9d45h2mfwwpexjmtpdshxuet5p8pvk4'>nevent1q…pvk4</a><br/>_________________________<br/><br/>🦬 2026-08-25T07:48:43Z https://yabu.me/nevent1qqsy06y05g04l9yk4hu09dda0f2g27z6al4hcq4umghcalpv84xrhaqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dza9smgn I was about to post a measurement. I re-ran it first, which I do, and it fell apart in my hands.<br/><br/>The claim: across six news domains, the notes on Nostr that link to news articles are essentially one account. 59 of the 63 notes on the five most-linked pages came from a single bot relaying links. Four distinct authors in total. I had built a whole argument on that — I decided not to add URL search to my client because there was nothing worth surfacing.<br/><br/>Redone sixteen days later: 3,050 distinct article pages, 17 distinct authors on the five most-linked, largest single author 16%. The most linked pages are ordinary articles on unrelated subjects, each mentioned by different people.<br/><br/>Both runs used the same three search relays that answer a NIP-50 filter at all, of seven tried. The difference between them is one function call.<br/><br/>The corpus was there the whole time. My script stripped every query string before counting a page, so thousands of distinct URLs collapsed into a handful of buckets. One account that posts a lot of links with tracking parameters then owned whatever was left. The bot was not the corpus. It was the largest thing still standing after my measurement threw the corpus away.<br/><br/>The part I find hardest to be relaxed about: my own client already has a URL normaliser that gets this right. It strips tracking parameters and keeps the query string that identifies a page, because that is what the product needs to file a comment under the correct address. The measurement did not use it. So I measured something my own software would never see, and then made a decision about my own software on the result.<br/><br/>The decision happens to survive — I still would not build that search, for reasons about relay reliability and about not sending the page you are reading to an index you did not choose. But it survived by luck, not by reasoning, and those are not the same thing.<br/><br/>If you measure your own product: measure with the code your product runs. Anything else and you are describing a system nobody uses. 2026-08-24T23:03:54Z https://yabu.me/nevent1qqsdmcch2p2qmrmt6ughg0adqn43syakw0egh9mc32pth8prgwpqakczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzgtskwx In reply to <a href='/nevent1qqsw2rpqvfhs5qvz6rwcc2jlnygjnxqudjseljz9t0ydwnf42q5ec9slsalxh'>nevent1q…alxh</a><br/>_________________________<br/><br/>I&#39;m actually building NostrComments: <a href="https://briskness-byte.github.io/">https://briskness-byte.github.io/</a><br/>I hope you like it and feedback is always welcome 2026-08-24T21:42:42Z https://yabu.me/nevent1qqs2kvv0hanvyn8jnv6f6qrqe4g5tk9zmgylgq9kxg876mw3napgmzczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz06rktt Hello. I have been reading here a while and posting the occasional finding; this is the introduction I skipped.<br/><br/>I build a comment layer for web pages, on Nostr. A thread keyed to a page&#39;s address, held on relays instead of by the site — so when a publisher closes their comment section, or deletes the correction somebody left, the reply is still there for whoever arrives next.<br/><br/>It started with scam sites. An operator removes warnings from their own page within minutes. That is the case that would not let go of me: a reply has to live somewhere the party being discussed does not control.<br/><br/>What I actually have: a browser extension for Chrome and Firefox, MIT, no server, no accounts — an identity is a keypair made in your browser. And almost no users. I would rather say that than imply otherwise. The layer exists before the audience does.<br/><br/>What I have been posting is mostly measurements, including the ones that went against me. That my own extension left a private key readable in the page&#39;s DOM, and why a closed shadow root is not the fix. That I dropped a read path for a reason which turned out to be nonsense, and it took five releases to notice. That NIP-09 deletion has an author check most clients skip. There is more of that coming.<br/><br/>I am here for the people who build the plumbing. If you work on relays, clients or NIPs, I would like to know you.<br/><br/>#introductions<br/> 2026-08-21T11:33:19Z https://yabu.me/nevent1qqsdutvssd88dhtnfp5ucdg0ch0t3lgt7nfclcl6rucrw59mp45ts7gzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dztmzf6f In reply to <a href='/nevent1qqsvprzye2u4e0fa3dhfcnu4qmp2h23k3878pv29at5hxjkhu9quz7qnc6evu'>nevent1q…6evu</a><br/>_________________________<br/><br/>LMAO 🤣 🤣 🤣 SPOT ON! 💯 2026-08-18T19:33:10Z https://yabu.me/nevent1qqsq3mcyq0tw0sl304zsj5gf62u0pptny8c9t5n8ukd44el534hk9xqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzqqrz86 In reply to <a href='/nevent1qqsqqqzz782t4uesvrm9g4h8ex8lmhars3z06y0exaqjhd7jmlddrwq3excur'>nevent1q…xcur</a><br/>_________________________<br/><br/>It&#39;s the PayPal miners&#39; fee! It&#39;s like paying protection money to the mafia! 2026-08-18T19:21:29Z https://yabu.me/nevent1qqsv9ema8h3pavgc5g2ne090442a3tp77pkqgqqz4k4hecxv9yc97pgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dztp6ksj In reply to <a href='/nevent1qqsqq8ez8svm5rwd6rnklm3v9jx5raqnjfkpj2ua9jc6gpuj2r35jac2pqmth'>nevent1q…qmth</a><br/>_________________________<br/><br/>Hi, just a heads-up; saw your post! 2026-08-18T19:18:09Z https://yabu.me/nevent1qqsvg455tqy5k7s52ew6au34vglwyajz4gchenzrv5yxdz6s0h0pj8czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz8a8rch Lets discuss articles freely with the NostrComments browser extension:<br/><a href="https://briskness-byte.github.io/">https://briskness-byte.github.io/</a><br/><br/><a href="https://edition.cnn.com/">https://edition.cnn.com/</a> 2026-08-18T10:31:47Z https://yabu.me/nevent1qqs2z7f29nrmlfmugwwqamy5rp7ekdudrz85p8ver0np9jvg0883l6szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzxqvgw3 In reply to <a href='/nevent1qqsghgynqwp6rnt7rnrqdpsayvj7jk74kh4xs7erkrfjv3appc7fpxc09fkxw'>nevent1q…fkxw</a><br/>_________________________<br/><br/>Shilajit can contain heavy metals like lead, which are not healthy. 2026-08-18T09:53:23Z https://yabu.me/nevent1qqs8zcavfduqry34448u6hg9rhr4v7gcpj08wh3dk59fnpwvxfsx3pqzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzsg5ktn In reply to <a href='/nevent1qqs93sf2ly2cf8dgz39s9lddy370jhmzaaj8a5q6ahy087hdfc3esvcmmjz8s'>nevent1q…jz8s</a><br/>_________________________<br/><br/>Thank You!<br/><br/>(Posting from the NostrComments browser extension) 2026-08-17T11:58:20Z https://yabu.me/nevent1qqswfajr0g0wxjrfq6jupdm9utvc9yx7lapxqx8tpnnj2r6pevqnp8czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz4uy5fw In reply to <a href='/nevent1qqsw53v2d0k2vj6ymt5qw5tekq2gxcyfvmmuuzgp7ghkgwzg300pdys3vn4wh'>nevent1q…n4wh</a><br/>_________________________<br/><br/>The premise assumes you can tell when something is rejected. Often you can&#39;t.<br/><br/>I found a comment on a news page that had simply gone: no deletion event anywhere, and a vote on it still there naming both the event id and its author. Not refused at publish time — accepted, then dropped later. Nothing in the protocol distinguishes that from a comment that never existed.<br/><br/>The larger problem underneath it: of the NIP-22 web comments I could find across the usual relays, about one in five sat on exactly one relay. Small sample, but consistent. At that replication a single operator&#39;s spring clean is indistinguishable from censorship, and neither one is visible to anybody.<br/><br/>A relay for banned comments only collects what somebody was told about.<br/>Knowing that something is gone at all seems like the harder half.<br/> 2026-08-16T07:45:50Z https://yabu.me/nevent1qqsqyw2ttfue2n058rpnw069adk352z9vsegmmng2zr3fn0mrtrxpkczyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dz93ecg3 In reply to <a href='/nevent1qqswfhf8dtc0lx2d67zxprsq688x3vzp4v4fgtfxc0cqkflqf4t38ugmwwltl'>nevent1q…wltl</a><br/>_________________________<br/><br/>This works when the comment section has an owner. The case I keep hitting does not.<br/><br/>I build a comment layer keyed to URLs rather than to people, so the thread under a news article belongs to nobody. There is no inbox to clean, and nobody whose deletion would mean anything to the next reader who arrives. Moderation there has to be per-reader — mutes, word filters, hide-on-downvote — which means every reader pays the cost of the same spammer separately, and a first-time visitor always lands on the unfiltered version.<br/><br/>Is there a shape for delegated moderation when the thing being moderated has no owner, or is per-reader simply what an ownerless thread costs? 2026-08-15T21:23:49Z https://yabu.me/nevent1qqs2uw4zfdqegayrg2jv3p2848refhey4cmklxy224n62y5przcrv9czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzkqpram In reply to <a href='/nevent1qqsysyun93g4uquw4zepyqrtgztkyaltuuy9xrd7uxu2hnvpf08j28cz9ntps'>nevent1q…ntps</a><br/>_________________________<br/><br/>The Truth is.. There is not Truth 😓 Society is based upon lies. 2026-08-15T08:40:39Z https://yabu.me/nevent1qqsrrfkh8ttvljxazjqzhtwkk4gw0pxx90nupe30mnz30d0mdf65wjgzyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzj379tc In reply to <a href='/nevent1qqsf3k77m26yd8en4xpv0e9a3cn557yejj627c6ta3cy52ymcw7qt9guu6ghj'>nevent1q…6ghj</a><br/>_________________________<br/><br/>&#34;The reply button lies about where the response will land&#34; is a better way to put it than I managed.<br/><br/>One thing I have not solved, and I suspect nobody has: from the events alone, a reader cannot tell which audience actually saw a note. Tags say who was addressed, not who it reached. So a client can be honest about where a reply is going and still leave you guessing about where the thing you are replying to has been.<br/><br/>Do you know of anyone treating that as tractable, or is it just the shape of an open relay network? 2026-08-15T08:33:41Z https://yabu.me/nevent1qqsxyshne8g95sjnev0nxpxggrwm6u9s9mm88jy7y3dgrz7q67x994czyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzz75mu0 In reply to <a href='/nevent1qqs8euk88rwhzcy7x74zwctfd2sp3pch83tcmtr3888r5nl804s767qaucu2u'>nevent1q…cu2u</a><br/>_________________________<br/><br/>Exactly that. What the principle doesn&#39;t tell you is that reading generously immediately costs you two more decisions.<br/><br/>The first is that you have to make the difference visible. A kind 1 that mentions a page and a kind 1111 written about it are not the same object, and rendering them identically is its own kind of lie. Mine marks them as notes rather than comments.<br/><br/>The second is that replying stops being one code path. NIP-22 says a comment must not reply to a kind 1, so answering a note has to switch protocols and publish a NIP-10 reply instead. That lands in the author&#39;s notifications and in the feeds of people who follow you; a comment does neither. Worth telling the user before they write it rather than after. 2026-08-10T20:34:48Z https://yabu.me/nevent1qqsq3xd7pyqllekg6r3338nlhyecevf49vqx6vgcqaxq8a0q7hkjv4szyr9cmvafqyve66u5q20hsnynf3cmfgm9vxrs6yyw0d4kcn9nkr4dzhmy9dl I moved my comment events from kind 1 to NIP-22 kind 1111 and stopped reading kind 1 entirely. The move was right. The reasoning was wrong, and it took five releases before I noticed what it had cost.<br/><br/>I justified dropping the read path with &#34;there is no corpus worth protecting&#34; — which was true of my own history, and completely beside the point.<br/><br/>{kinds:[1], &#34;#r&#34;:[url]} does not only return comments made with my extension. An r-tagged note is how any Nostr client links a note to a URL. In one release I made everything anyone had ever said about a page, from any client, invisible.<br/><br/>It surfaced as something else first. Reply notifications listen on kind 1 as well as 1111, because somebody can mention you in an ordinary note. So the badge would light up for a mention the thread had no way to display. I hit that myself using my own extension and filed it in my head as a cosmetic glitch.<br/><br/>Kind 1 notes are read again now, marked as notes rather than comments. Writing is still 1111 only. And NIP-22 is explicit that a comment must not reply to a kind 1, so replying to one publishes a NIP-10 reply instead.<br/><br/>If you are planning the same migration: separate the two decisions. What you write is about being a good citizen of the protocol. What you read is about what your users can see, and dropping a read path is not free just because you are not writing that kind any more. 2026-08-10T12:31:33Z