The comment section no website can close

There is no account, no telemetry, no analytics and no server of ours — nothing sits in the middle of this to collect anything. What does leave your browser goes to the relays you picked, and one thing about that is worth understanding before you install.

To show a thread for a page, the extension has to ask the relays about that page. So they see the addresses of pages you read, your IP address, and your public key if a relay asks you to identify yourself. That is how a comment system attached to URLs works, rather than a choice made on your behalf.

Three things narrow it. It applies only to pages you actually read — a tab you never look at, or a page you leave within a couple of seconds, is never mentioned to anyone. The relays are yours: drop any you do not trust, or point the extension at one you run yourself. And there is a switch in the toolbar button that turns it off on every page: nothing is shown, nothing connects, and your signer is not asked for anything.

The privacy policy sets all of it out in full, before you install anything.

There is no build step. The file you install is the file in the repository — readable JavaScript, not a bundle. You can diff one against the other, and you do not have to take any of the claims above on faith.

• The source, all of it.
• Published security audits from August and October — findings, fixes, and the things deliberately left alone, with the reasoning.
• How to report a vulnerability privately.
• A dependency-free test suite that runs the shipped code: node tests/run.mjs.

You do not need one. NostrComments can create a key for you in one click and keep it in your browser, optionally encrypted with a password. A signer extension is for when you already have a Nostr identity, or would rather your key lived somewhere else.

NostrComments works with any NIP-07 signer, and much of what makes that possible is owed to two people. nos2x by fiatjaf is the signer most of us started with, and NIP-07 itself grew out of it. Diego Gurpegui brought it to Firefox as nos2x-fox and has looked after it since. Thank you, both.

• Chrome or Firefox: Alby, if you already use it for Lightning.
• Chrome: nos2x.
• Firefox: nos2x-fox, or Attest.

Attest is my fork of nos2x-fox, and almost all of its code is Diego's. It adds two kinds of things. It can sign through a remote signer (NIP-46), so your key can stay in nsec.app, Amber or another bunker instead of in the browser. And it is quieter: it can remember a refusal for a while and undo it later, authorize everything a site needs in one click rather than one prompt per capability, and stop answering anything with a single switch.

NostrComments used to ask the signer on every page you read, which is what made those prompts add up. Since 23.10.6 it asks only when you open the comments, so with any signer you are asked only on sites where you actually read or write. Most of the changes in Attest were offered upstream too. I maintain it, so I am biased — use whichever you like. NostrComments works the same with any of them.

NostrComments is free and open source, and every feature stays that way — there is no paid tier and nothing is held back. If it is useful to you, there is a one-line Support the developer row at the bottom of the comment panel — a zap or two, and an arrow that opens the rest — sending sats straight from your wallet to mine over Lightning. No account, no server in between.

If you have no wallet open and would rather just scan something, there is a payment page that shows a QR code and takes any amount. It is the same wallet as the Lightning address below, so use whichever suits you.

Or send to one of these directly:

Lightning

slurpnc@coinos.ioCopy

Nostr

npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9eCopy

On-chain Bitcoin

198yNVWJz2H8PwmNsX72URVVV9pRbxMb18Copy

Monero

87aDTPD9HQx2QenKsS7MvHDdqsziFPD7UB37X6G5XVXc2ZPhAs8DdEKUPYJijVcRjj1gU5KvxLCTfWUKWqrd1D5o8uw5EpMCopy

The same list lives in the project's README, which is the copy to check against if you ever want a second source for an address.

Reporting a bug that you can reproduce is worth as much, and often more.