Ever wanted to reply to an article on the internet that has comments switched off? 👀 I built NostrComments for that. It's a browser extension that gives every web page a comment section, powered by Nostr. Here's the idea: your comment doesn't live on the website. It lives on Nostr relays, linked to the page's address. So the website can't delete it, and anyone else with NostrComments who visits that page can see it and reply. A few nice things: ✍ Use your own Nostr key, or keep it safe in a signer like Alby, Attest or nos2x 🤝 Comments on web pages made with other Nostr apps, like Amethyst and Ditto, show up too 🔌 No company server in the middle. You pick your relays 🙋 It stays quiet until you say yes, and you can turn it off for any site ⚡ Vote, mute and zap, right in the panel Curious but don't want to install anything? Read the comments on any page here: https://briskness-byte.github.io/thread/ Quick demo (66 sec): https://www.youtube.com/watch?v=bywF8yWZa3o 🦊 Firefox: https://addons.mozilla.org/firefox/addon/nostrcomments/ 🌐 Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido 💻 Open source: https://github.com/briskness-byte/NostrComments It's still early, so most pages have no comments yet. If you try it, leave one! That's how every conversation starts 💜 #nostr #grownostr #opensource #foss #privacy #nip22

Cool! Worth checking out

Thank You!

How did you add the Monero target? I fetched your kind 0 across six relays and the newest one has no XMR field — did a client rewrite it, or does it live somewhere else?

Also on the project page, where the video is self-hosted — no YouTube embed, no third-party requests, the same claim the extension makes about itself: https://briskness-byte.github.io/ #nostr #privacy

NostrComments has a proper demo now — 66 seconds, no sales pitch: https://www.youtube.com/watch?v=bywF8yWZa3o A comment thread on any page, attached to the page's address and stored on relays instead of on the site. The clip shows it on a Nature article with no comment section, the same thread appearing in a second browser under a different key, and then a paywalled paper, a corporate announcement, an EU page and a post on X. Also out: 23.2.2, where the toolbar button opens and closes the panel. That matters because a page can delete the floating button — the toolbar is outside its reach. Firefox: https://addons.mozilla.org/firefox/addon/nostrcomments/ Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido

Very Cryptic

Attest is a Nostr signer for Firefox: it holds your key and asks before anything is signed. What's new in recent releases: • Protect your key with a passphrase, not just a 4–6 digit PIN. A short PIN stops someone using your browser; it does not stop someone who copies your Firefox profile, and the extension now says so plainly instead of implying otherwise. • Permissions are tied to a site's full address, https or http. A site you allowed over https is no longer also allowed over plain http. • Each site keeps one decision per kind of permission, so refusing something briefly no longer wipes a permission you granted permanently. • The options page shows what is actually there: no empty key field for a key that is encrypted, and adding another key happens where you'd look for it. Open source, reproducible build, and the release refuses to ship if the tests fail or if the code that handles your keys doesn't type-check. https://addons.mozilla.org/firefox/addon/attest/ https://github.com/briskness-byte/attest

NostrComments 23.2.0 is out 🧵 It now works on sites that used to show an empty panel. Some sites (x.com is the best-known) use a strict Content-Security-Policy that blocks connections to anywhere they haven't listed, and Firefox applied that rule to the extension too, so no relay could be reached. The extension now opens its relay connections from its own background, where the site has no say. Also new: • a switch to leave the "client" tag off your comments • on Firefox, the welcome screen now suggests Attest instead of nos2x-fox, which has a public flaw that lets a website read the PIN protecting your key. Attest is my fork with that fixed. What it is: a comment thread on any URL, stored on relays instead of on the site, so the site owner can't delete it. Comments are NIP-22 (kind 1111), so other clients can read them. Firefox: https://addons.mozilla.org/firefox/addon/nostrcomments/ Chrome/Brave/Edge: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido Source: https://github.com/briskness-byte/NostrComments No server, no account, no tracking. Feedback welcome, here or in the thread on any page. #nostr #privacy

A browser extension can be talked to by two very different things: its own pages, and a content script sitting in somebody's web page. Telling them apart is the whole security boundary, and the obvious way to do it is wrong. `sender.tab` looks like the answer. It is not. An options page opened with tabs.create() has a tab like any web page does, so checking for one makes the extension refuse its own UI — and it fails silently, because the message goes out, comes back refused, and nothing on screen says why. A button that does nothing. `sender.url` against runtime.getURL('') is the one that holds. A content script always reports the address of the page it was injected into, never a moz-extension:// one, and content scripts do not run on extension pages. Cost me a release before I found it.