Graham O'Nero

https://www.nosmero.com

A fan of Monero and nostr so I built Nosmero.com - a nostr client with XMR tipping

Public Key

npub1xhfclgh0klylfvdlyzjd9n0dwvd32tkcwxs24jwhydrjvhymgtvql23s4p

NIP-05 Address

Profile Code

nprofile1qqsrt5u05thm0j05kxljpfxjehkhxxc49mv8rg92e8tjx3extjd59kqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsuupvy7

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xhfclgh0klylfvdlyzjd9n0dwvd32tkcwxs24jwhydrjvhymgtvql23s4p

Show more details

Last Notes

2026-05-17 18:50:58 CEST

- reply

👇 This is the main reason I got into monero but it is often treated as a secondary feature by XMR fans.
I'm hopeful the on-chain controversy currently raging on nostr opens some eyes to the very real problem of tainted coins.
While the open ledger issue of bitcoin is mostly ignored by the bulk of bitcoin fans, the issue with on-chain zaps is providing a different scenario that does well at illustrating the need for fungibility.
If it is not fungible, it is not money. Simple as.
#note1agw…4ehh

2026-05-17 05:29:53 CEST

- reply

Plot twist of the decade has to be nostriches crashing out over using bitcoin ☠️
#note1zk5…wf2v

2026-05-16 21:18:40 CEST

- reply

I added the option of creating an account with a username and password early on to Nosmero because normies understand that process (actually just did a big refactor of this feature to harden security).
Username-password requires no explanation because that is *The Official Signup Process* for social media sites. Yes, I understand people reuse passwords and usernames and all that, but acting like a "regular" social media site on this point for new accounts, I think, makes onboarding easier. Nosmero accounts created with username-password can export their nsec from localstorage to use in another client once they grok how nostr works.
For anyone curious, here's how it works in Nosmero with the goal of the nsec (or password) never leaving the user's machine:
1. The browser generates the nsec locally (nostr-tools generateSecretKey).
2. The browser encrypts it with the user's password using NIP-49 (scrypt + XChaCha20-Poly1305) → produces an ncryptsec.
3. The browser derives a per-user salt deterministically from the username (SHA-256 of username + a public domain-separator). No "give me the salt for user X" round-trip.
4. The browser PBKDF2-hashes the password with that salt.
5. ONLY the ncryptsec and the PBKDF2 hash get sent to the Nosmero server. The user's nsec and the user's password both stay on their machine.
6. The Nosmero server bcrypt-wraps the incoming hash before storing it. So even if the database is leaked, the stored blob isn't a credential, it's a bcrypt(PBKDF2(password)) which still needs offline brute-forcing.
Login is the same in reverse: client recomputes the deterministic salt + PBKDF2, server bcrypt.compares against the stored blob, returns the ncryptsec, browser decrypts it locally with the password. The local nsec is then used to sign events.

2026-05-15 20:58:11 CEST

- reply

Back when the paywall feature was added to Nosmero I didn't see an NIP and missed the PR #2156 discussion. 100% agree on using a universal solution.
Currently Nosmero is: per-note one-time unlock. Kind-1 events carry an ['encrypted', ciphertext] tag (AES-256-GCM); the key is custodied by our backend and released over HTTPS after we verify an on-chain Monero tx_key against the receiving subaddress. Public preview text sits in the event body so the note still renders in other clients. Source: js/paywall.js + api/paywall.js at github.com/grahamonero/nosmero.
Regarding the PR discussion, I understand the current draft is focused on memberships with kind 1163 and defers individual pay-per-view content to future additions. I like the idea of subscriptions though; the goal of Nosmero has been to get content creators paid in XMR and subscriptions would be a great fit.
I can share Nosmero's production data on per-content unlock on the PR, what it looks like and how on-chain proof-of-payment fits. It did get me thinking about an optional ['proof', method, data] tag for portable proof-of-payment which survives the access list being GC'd. It works cleanly for XMR (txid, tx_key) and I think it would work for Lightning too (paid invoice).

2026-05-14 15:05:29 CEST

- reply

That was a great suggestion. Just added it. Thanks!

2026-05-13 15:39:50 CEST

- reply

Off the top of my head I can't recall, paywalls have been implemented for a few months now. In general when I couldn't get a NIP to work well with a monero part of the site then customized code was used. Nosmero went through a bunch of interations on how monero tipping was implemented and as features were added. Not a lot was plug-in-play.
I'll go through my diary and see what the issue was, but this is a timely inquiry as I want to spend the month going through the code and replacing ad hoc solutions with an NIP when possible. Standardizing the paywall is now on the roadmap.
Thanks for the feedback, I appreciate it.

2026-05-12 19:09:11 CEST

Loaded Zorin 18.1 on a 2021 17" LG Gram and it's been great. I had some trouble with pasting into terminal but a quick Brave search explained the clipboard issue and gave the command to fix.
I highly recommend Zorin for anyone looking for a daily driver distro.

2026-05-09 07:35:39 CEST

- reply

New pear address for swarmnero:
pear://y3m1mm1xxrqj9jz5jpicc57rt4dem5t5g9s78j9riqft94u4j6jy

2026-05-09 07:35:36 CEST

- reply

New pear address for swarmnero:
pear://y3m1mm1xxrqj9jz5jpicc57rt4dem5t5g9s78j9riqft94u4j6jy

2026-04-21 06:32:14 CEST

- reply

FAQ 2/2 Swarmnero
**Wallet & Monero**
*Is the wallet the same as my account?*
No. The Monero wallet is independent from your social identity. You can use Swarmnero without ever unlocking a wallet (you just won't be able to send tips or purchase paywall unlocks). The wallet has its own 25-word seed — back it up separately from your account Secret Key.
*How does tipping work?*
Each post generates a fresh Monero subaddress while your wallet is unlocked. Tippers send XMR to that subaddress; the author's wallet sees the incoming transaction and can correlate it back to the specific post. Tip events are batched with a 6-hour delay and shuffled before broadcast, so the timing of an on-chain payment can't be linked to a swarm event trivially.
*What's a paywalled post?*
The author encrypts the post body with a random key, puts a preview + price in the clear, and publishes it. A buyer pays the price to a unique subaddress, and the author's app sees the payment, verifies it, and releases the decryption key to that buyer (encrypted with the buyer's own public key). No refunds — the payment and key exchange are both peer-to-peer and irreversible.
**Network & privacy**
*Does Swarmnero work over Tor?*
No. Hyperswarm uses UDP (UDX) for peer discovery, and Tor only routes TCP. Even with Tor running on your machine, Swarmnero's P2P traffic bypasses it and your real IP is visible to peers. Use a VPN that routes UDP if you want IP privacy.
*What data is stored on a server?*
By default, nothing. All data lives on the devices of users who replicate it. There's an optional Swarmnero-run VPS feed backup for paid supporters ($12/year in XMR), which mirrors your feed so followers can still see your posts while you're offline.
**Common issues**
*I clicked a paywalled post and my wallet balance shows "locked pending confirmation" for a few minutes.*
Monero protocol locks newly received funds for ~10 confirmations (~20 min). The balance is correct and the transaction is in the wallet — the lock is at the blockchain layer, not the app. The paywall unlock happens automatically in the background, typically within 15–30 seconds of the payment being visible to the author.
*My Followers list shows a Swarm ID instead of a name.*
That follower hasn't been online during any of your sessions, so Swarmnero hasn't received their profile data yet. Once their app and yours are both online at the same time, their name and avatar will cache and show on future sessions.

2026-04-21 06:30:13 CEST

FAQ 1/2
How Swarmnero actually works — the P2P model, accounts, the wallet, and the tradeoffs.
**The peer-to-peer model**
*Do I need to be online to see posts?*
You can always see posts you've already replicated to your device — if you've followed someone and their feed has synced in the past, those posts stay local. You don't need the original author online to read them.
But new posts only arrive when either you and the author are both online at the same time, or a peer who already has their posts (a friend-of-friend who follows them, or the optional feed backup server) is online. So for a new follow who's offline, you may not see anything until the first time you're both online together or a mutual peer relays the data.
*Why can't I see an account's posts after I paste their Swarm ID?*
Following someone only tells your app who you're interested in — it doesn't instantly pull their data. You have to connect to a peer that has their feed (often the author themselves, or someone who follows them). If everyone involved is offline, you'll see their follow appear in your list but no posts until replication happens. Stay online for a minute after following and their content should start to arrive.
*What's a Swarm ID?*
It's a 64-character hex string that uniquely identifies your social feed. Share it with someone and they can follow you. It's a public identifier — it reveals no secret information and can be pasted freely.
*How does Swarmnero find people if there's no server?*
Three mechanisms:
Live Now — users who opt into discovery join a shared DHT topic; you see who's currently online and can click through to their profile.
Friends-of-Friends — when you follow someone, your app asks them for a sample of the people they follow and recent tagged posts from those people.
Hashtag search — posts tagged with #tags are searchable across your network (own feed + follows + FoF cache).
If a post has no hashtag, it stays visible only to your direct followers. That's intentional — it's the privacy floor.
**Accounts & identity**
What happens if I lose my Secret Key?
The account is unrecoverable. There is no central authority to reset it. Export your Secret Key from Accounts → Export Secret Key and store it somewhere safe (password manager, paper backup). If the account has a password, you'll need that too.
*Can I sign into the same account on two devices?*
Not simultaneously — yet. Each account's feed is a single-writer Hypercore, and two devices writing to it at the same time corrupts the feed. Swarmnero shows a warning banner and disables posting when it detects a duplicate instance. For now, sign out on one device before using the other. Real multi-device simultaneous posting requires a different underlying structure (Autobase) and is on the roadmap.
*Does importing a Secret Key on a new device copy all my data?*
Content you've signed (posts, follows, profile, DMs) replicates in as peers come online. The follower list and DM conversation list rebuild over time as those peers reconnect. The wallet is separate — it has its own 25-word seed you restore independently via the "Restore Wallet" flow.
https://image.nostr.build/9982d4738a0a8d0c52a5aae048476ed5cfbf7c77b950e366181a758deb33cdfb.png

2026-04-21 06:16:44 CEST

- reply

The app pulls a subaddress from your wallet which is then embedded in the post. The tipper's wallet detects that embedded subaddress and builds the tx from that.

2026-04-20 02:18:20 CEST

As Nosmero is pretty stable at this point, I turned my attention to a pure p2p XMR solution for social media.
**I made Swarmnero** — a p2p social network with Monero built in at the protocol level. It runs on Holepunch's Pear Runtime. Zero infrastructure. You install Pear once, then launch Swarmnero with one command, auto-updates arrive over p2p.
It shares philosophy with Nostr (your keys = your identity, no central gatekeeper) but trades relays for a pure p2p stack. Posts, follows, DMs, and media replicate directly between devices over Hyperswarm DHT. No intermediaries to censor, index, or go dark.
**What's inside:**
- Ed25519 identity, signed events — your keys never leave your machine
- Native Monero wallet (monero-ts WASM) for tipping posts and replies
- Paywalled posts: author encrypts the body, buyer pays XMR to a per-post subaddress, key auto-released after on-chain verification
- X25519 E2E DMs between mutual follows (crypto_secretbox)
- Hashtag search + friends-of-friends discovery, no algorithm
**Install:**
npm i -g pear
pear run pear://t6athit7zo98y7wb7kupmeaihxu3p5tft5s55nx5a5s634meppgy
Eventually I'll get around to making standalone download files for Mac, Linux, and Windows.
Full guide + screenshots + source: https://swarmnero.com

2026-01-17 18:03:46 CET

- reply

The nosmero nostr client I made gives you the option of keeping a monero tip anonymous or making it public to signal support. While it was obvious to me that virtually all users would want to stick to the built-in privacy of XMR, I often wonder "if more users made their tips public, wouldn't that be a nice net positive to the monero community?"

2025-12-27 15:54:45 CET

- reply

There's now a couple of nostr clients that support monero "zaps" so the sooner might be better. The one I made automatically pulls monero addresses if they are placed in a user's nostr profile and then adds a monero tip option to notes. Users have the option of tipping XMR directly to you or tipping individual notes.
I just discovered you while testing some search upgrades to the nosmero client, followed and tipped 👍

2025-12-27 15:33:20 CET

- reply

Congrats! The silver bull run has been crazy, but overdue IMO.

2025-12-27 15:01:55 CET

- reply

Exactly! The note showed up in nosmero's Trending Monero Notes tab so when I started reading it I thought it was going to be someone's elaborate joke about bitcoin's lack of privacy.

2025-12-27 01:42:34 CET

- reply

Yikes! "It may seem more difficult than Monero" is quite the understatement.
#note18za…6d4q

2025-12-27 01:31:46 CET

- reply

Eigenwallet has worked well for me

2025-12-21 04:46:55 CET

- reply

Check image

2025-12-16 14:31:40 CET

- reply

test

2025-12-16 14:23:07 CET

- reply

test

2025-12-14 01:53:49 CET

- reply

Lol, I'm a poet and I don't even know it

2025-12-14 01:35:20 CET

- reply

Test reply after logging in with Amber

2025-12-14 01:03:18 CET

- reply

Thanks for the letting me know, I'll check it out and let you know when fixed

2025-12-09 15:09:44 CET

- reply

nostr.xmr.rocks
nerostr.xmr.rocks
xmr.ithurtswhenip.ee

2025-11-16 06:30:34 CET

- reply

Check out nosmero.com

2025-11-11 23:04:44 CET

- reply

Be the change you want to see in the world:
#note1ajv…m345

2025-11-06 03:59:42 CET

- reply

As I can't replicate, I'd need to see the console log output when you click "confirm"

2025-11-06 03:40:03 CET

- reply

I just tested on linux and windows FF without issues, and had a buddy try MacOS, also without issues. Does a red bubble popup saying disclosure failed?

2025-10-25 18:55:52 CEST

- reply

Thanks for noticing this. It has been updated to include a link to the specific note that was zapped in the note for the transaction. I zapped you some XMR for the help.

2025-10-25 16:24:27 CEST

- reply

It was automatically forcing nsec.app? That was just fixed. Thanks for the feedback, I appreciate it.

2025-10-25 09:12:50 CEST

- reply

>Loads my profile properly then nukes it…
That should be fixed
>Feed doesn’t load properly.
Not sure what you mean, don't see an issue on my end
>Doesn’t use relays set up in browser extension.
It uses NIP-65 settings, is that what the extension is using?
>Doesn’t pick up previous set xmr addy that was set up in the last xmr web client (the one that was forked from nostrudel).
It only looks in the Settings location or if it's in the Profile about section
>Hopefully these issues get resolved and we get a really nice client
Me too

2025-10-21 14:35:10 CEST

- reply

Thanks for the heads up. I've been doing all the mobile testing on Android and taking for granted iOS would work the same, though the remote login update was tested on an iPhone. I'll try to get to this this week.

2025-10-21 14:31:24 CEST

- reply

I just updated so one can now copy paste the URI or individual components into a mobile wallet. Hope this helps with the mobile use of nosmero.

2025-10-19 13:52:22 CEST

- reply

I can *so* relate to this note. I don't consider myself a "monero maxi" in as much as I was just looking around to find a crypto that had privacy and monero fit the bill above all others. It just works.
#note1c8r…g7ra

2025-10-17 20:47:05 CEST

- reply

Correct. The QR method for nosmero that was implemented preserves the inherent privacy by not running a backend database or requiring users to share anything that is either potentially identifying or requires server-side protection. Only the recipient knows what note was zapped and the amount. It would be great to see stats given the social aspect of nostr but, hey, it's monero, stuff is hidden away

2025-10-17 20:33:31 CEST

- reply

Check the note for the transaction, it will say "nosmero.com NoteID xxxx"

2025-10-05 22:03:44 CEST

- reply

Me 👋

2025-10-05 21:55:11 CEST

- reply

Nice!

2025-10-05 21:54:45 CEST

- reply

👀
#note15g8…qu63

2025-10-05 05:03:47 CEST

Weird how the nation hasn't collapsed with DC shut down. Such a mystery...

2025-10-01 14:14:44 CEST

"Can you imagine a world with DC shutdown?"
https://image.nostr.build/5982ba5b056914668597b9b6aa8fa448a3740fb97a02da72e3fc4b1b000bada8.png

2025-09-29 13:46:32 CEST

- reply

You're welcome!

2025-09-28 16:15:38 CEST

Nosmero is open source by the way (of course!) and the github is here:
https://github.com/grahamonero/nosmero/
Squashed a few more bugs last night so it should be running smoothly. The $1 monero "bounty" posted on @nosmero is still open, so grab some free XMR and help me double-check stuff is working well.
https://image.nostr.build/3d34d4b875917ec790f4d7e88288a592ecfe3319d7dae5e9ec4c150cf8df7de7.png

2025-09-14 00:58:38 CEST

- reply

Nosmero, a nostr client that has monero zaps
npub135w572zryhrhu406v73fzwvg56t7sps03nzna58l23qfkpnnr3pq65nne8

2025-09-13 15:35:18 CEST

Hyperinflation is always the end result of fiat.
#monero #xmr
https://image.nostr.build/394d24bc05aacf8a5671ea04c0d9d3040f14aaa369b77e8074cf9affcd8fc9a8.jpg

2025-09-08 21:45:32 CEST

>wake up
>discover there is javascript supply chain NPM infection targeting BTC
>it doesn't target Monero
>"why didn't I keep Nosmero XMR-exclusive for zapping?"
Fortunately, it is a pretty painless patch to fix Nosmero.com and BTC zapping is needed to honor the nostr ethos. Anyway, read about it here:
https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the

2025-09-07 18:00:27 CEST

- reply

This was a monthly correlation, btw. Sources of monthly data was CoinMarketCap, Trading Economics, USAGOLD, and Yahoo Finance.
At the end of the day, I'm just curious about "money" and IMO gold (physical) and monero (electronic) fit the bill better than anything else.

2025-09-07 17:51:18 CEST

Food for thought on the "bitcoin is digital gold" bromide. Is the better idea "Monero is digital gold?"
As a long time gold bug what first attracted me to XMR was how its privacy is similar to gold. So I ran some numbers for the past year to correlate monero and bitcoin to gold. Here is the executive summary:
Average Monthly Returns: Gold 3.08%, Monero 4.73%, Bitcoin 6.23%
Volatility: Gold 4.86%, Monero 8.43%, Bitcoin 10.99% (monthly standard deviation)
1. Monero shows 3x stronger correlation with gold (0.77) than Bitcoin (0.25)
2. Bitcoin's correlation with gold is much weaker, suggesting it behaves more like a tech/growth asset than a traditional safe haven
3. While both assets appreciated significantly, Bitcoin's path was far more volatile and driven by crypto-specific factors.
4. Monero's stronger correlation with gold may reflect its use case as a privacy-focused store of value, while Bitcoin increasingly trades on institutional and regulatory sentiment.
https://image.nostr.build/5f7bbbfc4a364bf1ebf2f9f614ec201e9142f318ab61bba297e4f854330f5dfd.jpg

2025-08-31 06:33:03 CEST

- reply

I really appreciate this sentiment. The only monero client I found was garnet, but I don't have an android phone. I vibe coded nosmero.com to provide monero tipping for nostr, and I vibe coded because my day job has nothing to do with coding. Without vibe coding, it wouldn't exist.

2025-08-28 15:27:47 CEST

- reply

I saw the same thing. Because Monero fascinates me, I recently made nosmero.com in an effort to bring XMR zapping to nostr with a web app. I think a Solana client would also be attractive to the nostr community given its speed and low transaction fees.

2025-08-26 04:37:50 CEST

Hello Monero Nostr Fans:
I think Monero is pretty cool and I think Nostr is pretty cool, so I vibe coded Nosmero.com to build a client that supports XMR zaps.
Monero zapping: I decided to go as simple as possible so it uses QR codes for direct payment from your phone. The QR code for each post includes part of the post ID so the recipient can keep track of what post was zapped. There is no zap count or other record of XMR zaps given the architecture of Monero.
To receive XMR zaps, add your XMR payment address in Settings and it will be linked to each of your posts. Nosmero, also, supports Lightning zaps.
To avoid locking your wallet for each zap, there is a zap queue. You can "zap" up to 20 posts/users but then send all the zaps in a single transaction to reduce the amount of waiting and transaction fees.
Please take a look and I welcome any feedback as it's my first ever big project.
-Graham
#monero #XMR
https://image.nostr.build/5abf25db8fdd3d7a258c8cb24ff84043fc570daabbcf0c2e1823e820a9344f39.png