Bug Reports | XmrBazaar

WiseGuy92

5 (2)

Posts: 2

Earned: 0 XMR

Tipped: 0 XMR

Sep 13 16:28

(0)

#2084

When scanning the escrow QR code with wallets on Graphene OS, it didn't detect the QR code. On iOS it detected it.

Also the constant timeouts like web socket or no connection errors are tedious.

Admin note: The QR code is in a standard format. Websocket times out after 15 minutes of inactivity or closing the tab

Tip Monero to WiseGuy92

WiseGuy92 has not setup a {COIN} tip address yet.

Publish Tip to WiseGuy92

WiseGuy92 has not setup a {COIN} tip address yet.

Juanperez7

5 (2)

Posts: 7

Earned: 0 XMR

Tipped: 0 XMR

Sep 14 14:05

(0)

#2089

Make choosing a location on the map easier. PLEASE.

Admin note: Location selection improvements are planned

Tip Monero to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

Publish Tip to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

Admin

N/A (0)

Posts: 73

Earned: 0.1 XMR

Tipped: 0 XMR

Sep 14 15:00

(0)

#2090

Reply to post #2089

Could you please describe the issue in more detail so our dev can look into it and fix it?

Edited: Sep 14 15:02

Tip Monero to Admin

42DxmL7sdVzHU6fEocXioT1ZPf3n1CThA1HEbPVofKgC6GGG1oPYXXg6mbwMuZE4w3PkBF3UAWjhfMbMpu82dfmFJqGpsCb

Publish Tip to Admin

Please login to publish your tip

Juanperez7

5 (2)

Posts: 7

Earned: 0 XMR

Tipped: 0 XMR

Sep 14 15:11

(0)

#2091

Reply to post #2090

1st: When trying to post with the city 'Miami', it won't go through; the platform will correct you saying 'Please check your listing details' and will only then provide you with a list of possible options saying 'Multiple cities found, please choose one'.
Suggesting cities as-you-type is more user friendly.

2nd: Even when typing a city outside the USA, the platform won't provide any options, and the pin will point at what it thinks is right (even pointing to a location >200 miles away from the desired location), leaving users stranded.

Admin note: Map improvements are planned

Tip Monero to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

Publish Tip to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

Juanperez7

5 (2)

Posts: 7

Earned: 0 XMR

Tipped: 0 XMR

Sep 17 15:45

(0)

#2108

Reply to post #2090

Hi guys, do you have any updates regarding this issue?
Thank you.

Tip Monero to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

Publish Tip to Juanperez7

Juanperez7 has not setup a {COIN} tip address yet.

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Sep 15 02:22

(0)

#2094

www.xmrbazaar.com serves a cert that does not cover it; HSTS includeSubDomains makes the failure unskippable

Summary
https://www.xmrbazaar.com presents a certificate whose names do not include the www host. The apex sends HSTS with includeSubDomains, so www is forced to HTTPS and fails closed with no proceed link. Links using the www host land users on a security warning instead of the site. Found via a link on a weblog (drukknoopje.nl) pointing at their profile. Their hosting provider reproduced it independently on their own machine and network: the apex URL loads for them, the same path on the www host fails, and they placed the fault on the www certificate.

Email from the mentioned weblog host:

Repro
Open https://www.xmrbazaar.com/
Chrome: NET::ERR_CERT_COMMON_NAME_INVALID, no proceed link (HSTS)
Brave: NET::ERR_CERT_COMMON_NAME_INVALID, no proceed link (HSTS)
Firefox: loads normally
The apex (https://xmrbazaar.com/) is unaffected in all three.

Expected
www serves the site under a cert naming www.xmrbazaar.com, or 301s to the apex over a valid cert.

HSTS state (chrome://net-internals/#hsts)
dynamic_sts_domain: xmrbazaar.com
dynamic_upgrade_mode: FORCE_HTTPS
dynamic_sts_include_subdomains: true
dynamic_sts_observed: 1788900429 (~2026-09-08)
dynamic_sts_expiry: 1820436429 (~2027-09-08)
static_sts_domain: (empty)

Expiry minus observed is 31536000, so max-age is one year. No preload entry, so the policy is header-set and fully under operator control. www holds no policy of its own and inherits the apex one.

What this establishes
www resolves and answers on 443: a handshake started and a cert came back.
That cert's name set omits www.xmrbazaar.com.
includeSubDomains asserts every subdomain speaks valid HTTPS. www does not. Each setting is fine alone; together they produce a hard failure with no click-through.
The policy is re-observed on every apex visit, so the one-year max-age does not lapse for regular users. This will not self-heal.

Scope
Client side only. I have not seen the server config, so I am not asserting whether the cert omits the www SAN or whether www terminates on a different host or edge. The Firefox result is an observation; I did not establish why it differs.

Checks
openssl s_client -connect www.xmrbazaar.com:443 -servername www.xmrbazaar.com /dev/null | openssl x509 -noout -subject -ext subjectAltName
dig +short www.xmrbazaar.com
curl -sSI https://xmrbazaar.com | grep -i strict-transport-security

Potential Fix
Reissue the certificate so it carries both the apex and the www host, and add a server-level 301 from www to the apex so the canonical URL is unchanged. On Let's Encrypt that is a second -d flag on the existing certbot command.

Two things that do not work: removing the www DNS record leaves every browser holding the cached policy still forcing HTTPS on www, and dropping includeSubDomains takes up to a year to age out. Issuing the cert for both names is the only fast path.

Impact
Third-party links using the www host, including the one on the weblog, show users an unskippable warning about attackers intercepting passwords and messages.
Leaving users confused.

Admin note: Fixed as hotfix

Edited: Sep 15 16:49

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

UsualCat

5 (9)

Posts: 6

Earned: 0 XMR

Tipped: 0 XMR

Sep 19 13:33

(0)

#2115

Simplex Notification seems not sent as realtime as they arrived. i had 2 new chat but i didn't hear anything from simplex notification

last week it come the day after the actual chat arrived

Tip Monero to UsualCat

UsualCat has not setup a {COIN} tip address yet.

Publish Tip to UsualCat

UsualCat has not setup a {COIN} tip address yet.

UsualCat

5 (9)

Posts: 6

Earned: 0 XMR

Tipped: 0 XMR

Sep 19 13:44

(0)

#2116

Reply to post #2115

after doing some check
by unbind and re-bind it
they (simplex) seems still error
with " API error"

Admin note: Investigating messenger issues (2026)

Tip Monero to UsualCat

UsualCat has not setup a {COIN} tip address yet.

Publish Tip to UsualCat

UsualCat has not setup a {COIN} tip address yet.

stonego

5 (1)

Posts: 1

Earned: 0 XMR

Tipped: 0 XMR

Sep 19 15:51

(0)

#2117

I tried to create a sale, but when I send it, it changes to an auction

Admin note: Please delete any draft listings, then try again

Tip Monero to stonego

stonego has not setup a {COIN} tip address yet.

Publish Tip to stonego

stonego has not setup a {COIN} tip address yet.

WiseGuy92

5 (2)

Posts: 2

Earned: 0 XMR

Tipped: 0 XMR

Sep 19 17:10

(0)

#2118

Update to my previous post: QR code scanning on GOS fails on dark mode of the site but works on light mode, desktop.

Tip Monero to WiseGuy92

WiseGuy92 has not setup a {COIN} tip address yet.

Publish Tip to WiseGuy92

WiseGuy92 has not setup a {COIN} tip address yet.

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Sep 21 23:28

(0)

#2128

Follow-up bug report: og:url still hardcoded on listing pages, and robots.txt points to another site's sitemap

Checked 2026-09-21. Two independent issues, both reproducible with curl (commands at the end).

1. og:url is hardcoded to the homepage on every listing (follow-up to my earlier report)
Severity: medium. Breaks link previews for every listing on platforms that key cards on og:url.

Observed: listing pages emit the same og:url as the homepage, logged in and logged out. Example, /listing/7imv/:
[code][/code]
The listing's og:title, og:description, og:image and twitter:* tags are all listing-specific and correct. og:url is the only one that isn't.

Impact: platforms that use og:url as the canonical key for preview cards treat every listing as the same page. On Mastodon (reproduced in my earlier report), all listings resolve to one shared card record, so a shared listing can show another listing's card, and older posts on the same instance can change when a newer listing gets fetched.

Not affected: X/Twitter keys cards on the posted URL, so this bug doesn't touch it. A card there that was missing its image was fixed by forcing X to re-crawl, with no site change, so that one is X-side caching.

Fix: emit the listing's own URL, in the same trailing-slash form the site links to:
[code][/code]
The homepage value is correct as is.

Optional: listing images are already re-encoded server-side (GD, 1200 px wide; the /listing/JJsd/ image is 1200x1600, 575 KB), so the dimensions are known at upload. Emitting og:image:width and og:image:height lets Facebook render the image on first share, per its sharing docs.

2. robots.txt advertises a sitemap on bitejo.com, a domain now parked and listed for sale
Severity: low. SEO only, one-line fix.

Observed:
[list]
[*]https://xmrbazaar.com/robots.txt
[code]User-agent: *
Allow: /

Sitemap: https://bitejo.com/sitemap.xml[/code]
[*]That sitemap contains a single URL, https://bitejo.com/lander, and no xmrbazaar.com URLs.
[*]https://xmrbazaar.com/sitemap.xml returns 404.
[*]In a browser, bitejo.com redirects to a GoDaddy aftermarket "for sale" page (buy-now price $299 as of 2026-09-21). WHOIS shows it was created 2026-07-18 (Namecheap), so any earlier registration lapsed and the name was registered fresh and listed for sale.
[/list]

Likely cause: a leftover from reused code rather than an intentional setting.

Scope: I found no other references to bitejo.com in the homepage, a listing page, /js/trollbox/init.js, /js/pwa/init.js or /manifest.json, so nothing on the site loads from it.

Impact: crawlers are pointed at a sitemap that lists none of XmrBazaar's pages, so the site effectively has no sitemap. And because XmrBazaar's own robots.txt references that file, whoever buys bitejo.com controls the sitemap XmrBazaar advertises to search engines.

Fix: remove the Sitemap line or replace it with an xmrbazaar.com sitemap.

Reproduce
[code]# 1. og:url on a listing
curl -s https://xmrbazaar.com/listing/7imv/ | grep -o ']*>'

# 2. sitemap
curl -s https://xmrbazaar.com/robots.txt
curl -s https://bitejo.com/sitemap.xml | grep -oE '[^

Admin note: Will fix as hotfix

Edited: Sep 22 03:33

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

42069

N/A (0)

Posts: 1

Earned: 0 XMR

Tipped: 0 XMR

Sep 22 00:46

(1)

(0)

#2129

Pagination for the wishlist doesn't work. adding ` ?per_page=250 ` to the end of one's wishlist merely allows one to see more results.

Not shure if there is a bug bounty but if so ping me.

Admin note: Will be fixed in the next update

Tip Monero to 42069

864bSsnpgq9guUzu54XvftLnX4EaDqHJ1hH8TqGVmB3jdK8KLSAgvA4AH2in11SpbYZravVpTr7C9AQATTaSuwYu1A26WDV

Publish Tip to 42069

Please login to publish your tip

NataL1na24

5 (1)

Posts: 1

Earned: 0 XMR

Tipped: 0 XMR

Sep 22 07:25

(0)

#2131

I think i accidentally refreshed the order page and now it says under Escrow "Error: Invite was already used", is there a way to fix this?

Admin note: If the invite was used, you will need to make a new order. Will improve invites in a future update.

Tip Monero to NataL1na24

NataL1na24 has not setup a {COIN} tip address yet.

Publish Tip to NataL1na24

NataL1na24 has not setup a {COIN} tip address yet.

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Sep 24 19:46

(1)

(0)

#2150

Bug Report: Missing PGP Key on User Profile

Target URL: https://xmrbazaar.com/messenger/schnur/
Affected Account: schnur

Description:
The messenger interface for user schnur does not display an associated public PGP key. End-to-end encrypted messaging and cryptographic identity verification cannot be established for this trade/chat session.

Steps to Reproduce:

Open active messenger session at https://xmrbazaar.com/messenger/schnur/.

Inspect the user details / key section.

Observe that no public PGP key is present or bound to the account.

Expected Behavior:
The user's public PGP key should be rendered on the messenger view, or the platform should enforce public key association for active trading/messaging profiles.

Admin note: The PGP key was in a newer format, will investigate OpenPGP.js compatibility

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

glamorous_oak

5 (81)

Posts: 33

Earned: 0 XMR

Tipped: 0 XMR

Sep 25 21:59

(0)

#2154

Reply to post #2150

yes can confirm i am unable to complete an order because of this. We talked in the past but now i can only receiver schnur's messages not respond.

i asked AilliA and the response is:
"It appears to be a v5 key which OpenPGP.js devs found controversial for some reason. Although there is a config option “enableParsingV5Entities“ which we can enable."

I hope this gets fixed soon or schnur happens to find this here.

Edited: Sep 25 22:00

Tip Monero to glamorous_oak

852XVfJZLuXC5FGqTNXdKB7c8AwLgWgTfH8Kr2P48VAAKbGSXyBXV2qDYwyHScfGhTRLaM1C3CdzogtgUAeZVxQC7hw4KHy

Publish Tip to glamorous_oak

Please login to publish your tip

schnur

5 (3)

Posts: 4

Earned: 0 XMR

Tipped: 0 XMR

Sep 26 04:02

(1)

(0)

#2156

Reply to post #2154

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hey guyyyss,
the issue was that I was changed my pubkey to some post quantum algorithm, ed448 to be exact.
See my suggestion promoting pq here: http://XmrBazaar6wzcr3wvj4anpnfwv5tcikgdurtzzfba233g52fa2fjx3qd.onion/forum/topic/252/

The problem is that gpg2.5+ supports it, but not gpg2.4, which is distributed my most linux distros. I just forgot that other users could have issues with it, you're probably helpless to if you don't know about different crypto algorithms.

Solutions right now:
Don't be like me and upload pq keys lol
Install GnuPG 2.5. I don't know how Sequoia handles post quantum algos. (No-JS!)
-----BEGIN PGP SIGNATURE-----

iJEEARYKADkWIQTmfT6IO4V5ubJXjE2918CSol9kIAUCardDyhsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIACgkQvdfAkqJfZCAFuAD+LWzbPgKqHK0ZIDeYfkEW
bSCQubqwY243mfArh1zYyQ8BAKTZ2GJ1L0P72LOIlBAArmX3Qmbue3sPkzaHtr45
AMEIiMUFARYKAEUiIQVLHEGnS9Bn6+dQzzXz7O3lyERqNwgKikUnhvlS+PVShAUC
ardDyhsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDIAAD2UAciZ81ZRqGkkyRr9
9B/0PjyzDvvQ3DPC+NBKhVc28BxF+9ZIKW+YSJEKK8QjjQ0q/EpzmW34Et36aIAB
yNuNITKWJmdhsd9mQdzgcM4+PU9TKIMuUgS+r51KT83PjiLW1CvaclJqEq244Wle
/xrsQzjhp+ccAA==
=nXOB
-----END PGP SIGNATURE-----

Admin note: Will investigate compatibility with OpenPGP.js

Tip Monero to schnur

schnur has not setup a {COIN} tip address yet.

Publish Tip to schnur

schnur has not setup a {COIN} tip address yet.

NoReply

N/A (0)

Posts: 3

Earned: 0 XMR

Tipped: 0 XMR

Sep 25 22:11

(1)

(0)

#2155

[b]Manual PGP messages can be delivered encrypted to the wrong key[/b]

Not sure if this counts as a bug or just a gap, but it seemed worth raising.

[b]What happened[/b]

A message from mutterficker arrived that my client could not decrypt. The account uses the No-JS manual PGP messenger (its published key is self-generated rather than a JS messenger key). The message carries a single recipient key ID, ca87592dd66e742a, which is mutterficker's own encryption subkey. My key is not among the recipients, so it can never be decrypted on my side.

In the JS messenger the client encrypts to both the recipient and the sender automatically, so this cannot happen there. In manual mode the sender encrypts with their own tools, and as far as I can tell nothing checks the result, so the platform delivered it as if it had worked. Presumably the sender believes it went through.

[b]Suggestion: check recipients on manual messages[/b]

The recipient key IDs in a PGP message are readable without decrypting anything. They sit in the clear in the packet headers, ahead of the encrypted data. So the server could check whether a manually encrypted message includes the recipient's key before accepting it, and warn the sender if it does not. Nothing is decrypted, so it stays end to end.

If you add this, treat an all-zero key ID as unknown rather than wrong, since gpg --throw-keyids hides recipients that way on purpose.

[b]Small related thing: the error message[/b]

The interface showed: "Decryption key not found. If you reset your recovery code recently, please ask the sender to send you this message again."

My recovery code had not been reset. The message just was not encrypted to me. The suggested cause points a user toward resetting their key, which as I understand it would permanently lose access to their existing messages. Something like "This message could not be decrypted with your key. It may have been encrypted to a different key, or your recovery code may have changed" would cover both cases, including senders on the manual messenger, without nudging anyone toward a destructive fix.

[b]Also: make the manual messenger easier to find[/b]

The FAQ says manual PGP is available for users who do not want JavaScript, at https://xmrbazaar.com/messenger-nojs/, but the only place I found a link to it was the FAQ. I did not know the mode existed until I went looking, which is part of why this message confused me in the first place. Listing it under settings, next to the JS messenger, would let people who want it actually find it, and would make it more obvious to everyone else that a message can come from a sender encrypting manually.

Admin note: The no-JS messenger allows the user to manually encrypt the message e.g. using GPG on CLI. The server rejects non-encrypted messages but does not validate any metadata.

Edited: Sep 25 22:17

Tip Monero to NoReply

NoReply has not setup a {COIN} tip address yet.

Publish Tip to NoReply

NoReply has not setup a {COIN} tip address yet.

Goshen

5 (1)

Posts: 2

Earned: 0 XMR

Tipped: 0 XMR

Sep 29 07:18

(0)

#2180

I am not able to update my SimpleX on my profile, I have tried several times with no luck, can this be fixed please.
Looks like platform does not accept SimpleX new link format

Admin note: Will investigate Simplex errors

Tip Monero to Goshen

Goshen has not setup a {COIN} tip address yet.

Publish Tip to Goshen

Goshen has not setup a {COIN} tip address yet.

freedevelop_studio

N/A (0)

Posts: 1

Earned: 0 XMR

Tipped: 0 XMR

Sep 29 22:44

(0)

#2214

Correction — 30 September 2026: the official changelog says digital-download file uploads were removed on 26 July 2026; external download links and unique codes remain supported (https://xmrbazaar.com/changelog/). I missed that announcement when posting. I am withdrawing my earlier paid diagnostic inquiry. The observed form response does not establish a supported upload feature or a server bug. No further investigation is requested.

Original observation, retained for context:

Digital download creation: selected ZIP rejected as "Please upload a file"

Observed on 29 September 2026 around 15:19 UTC in Chrome via BrowserAct:
1. Chose the File upload option for an automatic digital download listing.
2. Attached an 8,927-byte ZIP. Browser-side File/FormData checks showed the expected size and matching SHA-256.
3. Submitted; the form returned "Please upload a file".

The browser-side checks do not prove the file reached the server. I have not reproduced this with a manual file-picker upload, so the cause could be in my attachment workflow rather than XmrBazaar. Creating a normal listing with manual delivery worked.

I saw the earlier image-upload and onion 413 reports; this was a ZIP attachment on the clearnet site with the error above.

Admin note: Digital download files will be removed from the UI in the next update, please use an external download link instead

Edited: Sep 30 08:07

Tip Monero to freedevelop_studio

freedevelop_studio has not setup a {COIN} tip address yet.

Publish Tip to freedevelop_studio

freedevelop_studio has not setup a {COIN} tip address yet.

nobswebdev

5 (269)

Posts: 73

Earned: 0 XMR

Tipped: 0 XMR

Oct 2 14:10

(0)

#2224

Issue with Simplex notifications is back, please take a look at that

Tip Monero to nobswebdev

8C3UDYTrTQ34bqLVA3QhRacELDBDEGCixSKd1rqJeWoKjS4m1qHbcNphJNEzs67phXSwD5RbVj5bpTm7HtZjYjVHUiMZ4rk

Publish Tip to nobswebdev

Please login to publish your tip

JohnChow541

5 (2)

Posts: 5

Earned: 0 XMR

Tipped: 0 XMR

Oct 5 18:59

(0)

#2240

my listings dont show on the map. i cannot enter my city name because the forms give out an error.
even thought i list items in "Thetford Mines" they arent shown on the map. my account also isnt showing properly.
i ended up sending "Quebec" as my city and my account is shown there on the map, but "thetford mines" isnt taken by the website as a valid city.

Tip Monero to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

Publish Tip to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 5 19:28

(0)

#2241

Reply to post #2240

Your report already gives the devs a useful comparison: "Quebec" saves, "Thetford Mines" doesn't. Could you add the exact error text, browser, and whether this happens in the profile location form, the listing form, or both? City/country is enough; no street address or account details needed.

There is an earlier city-lookup report on this page, #2091, with the admin note "Map improvements are planned". That doesn't prove the same cause here, but linking the two may help avoid starting the diagnosis from scratch.

For buyers in the meantime, putting the intended town in the listing description can make the location clearer. That won't repair the map pin, and I'd avoid presenting a different city as the actual location just to get past the form.

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

JohnChow541

5 (2)

Posts: 5

Earned: 0 XMR

Tipped: 0 XMR

Oct 5 20:17

(0)

#2242

Reply to post #2241

the error is:
"No lat/long coordinates were found for this city. Please enter the city name without the neighborhood, state or other info, or try a nearby location. Or contact support if this error persists. "

i also tried typing different things and even the GPS coord into the city box and get the same error.
"thetford mines"
"thetfordmines"

Tip Monero to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

Publish Tip to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 5 20:47

(0)

#2244

Reply to post #2242

Thanks—that gives the devs an exact failing input and error. Two details still missing: which screen is this on (profile location, listing form, or both), and which browser/version?

The message asks for a city name, so GPS coordinates aren't what that field is asking for. No need to post precise coordinates here. I haven't reproduced the fault, so I can't tell whether it is the site's lookup handling or its data source.

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

JohnChow541

5 (2)

Posts: 5

Earned: 0 XMR

Tipped: 0 XMR

Oct 5 21:24

(0)

#2245

Reply to post #2244

user page: https://xmrbazaar.com/user/USER -> [Edit Profile]
down the page [Location] section:
" You can optionally add your city and/or country here, in order to see local search results on the homepage.

Note: Your city/country is not visible to other users, unless you choose to display your profile on the Monero Near Me map. "

City: [ ] Country: [ ]

Tip Monero to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

Publish Tip to JohnChow541

JohnChow541 has not setup a {COIN} tip address yet.

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 6 07:16

(0)

#2248

I'm trying to use manual PGP with the No-JS messenger. For TernLatch, I can currently see two different public keys (checked Oct 6, about 07:14 UTC):

- My profile and the public-key field at /messenger-nojs/update-key/ show the key ending AD44DD32.
- Searching for TernLatch in the No-JS messenger shows a key ending B36225CB instead.
- The key settings page also says "Your JS messenger PGP key is currently active."

A previous manual-key save reported success, but I can't read incoming messages with that external key. I haven't changed or reset either key during this check, and I don't know why the active key differs.

What is the supported way to activate the external key for incoming messages without regenerating keys? If this is expected behavior, which step am I missing? Happy to provide the full public-key fingerprints; no private keys or message contents needed.

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 6 07:45

(0)

#2250

RSS feed is served uncompressed and uncacheable

https://xmrbazaar.com/rss is missing two things that would cut its bandwidth by about 98% for every consumer. Both look accidental rather than deliberate, and both are small changes.

1. gzip is not applied

The feed is 74,224 bytes and nginx serves it raw even when the client explicitly asks for gzip.

Expected: a gzipped response.
Actual: 74,224 bytes, byte for byte identical to the uncompressed response.

Reproduce with:

curl -sS -o /dev/null -w "%{size_download}\n" -H "Accept-Encoding: gzip" https://xmrbazaar.com/rss

The same XML gzipped is 16,773 bytes. That is 77.4% smaller, a 4.4x reduction. RSS is XML, so it compresses about as well as anything on the site.

2. No validators, and cache-control says no-store

The response carries no ETag and no Last-Modified, and cache-control is "no-store, no-cache, must-revalidate".

That means a client has no way to ask whether the feed has changed since last time, so every poll downloads the whole thing even when nothing new has been listed. The no-store header looks like the Laravel default for a session-bearing response rather than a deliberate choice for a public feed route.

What it costs

For a client polling every 5 minutes, which is a normal cadence for a listings feed:

Today: 20.4 MB per day, 612 MB per month
With gzip: 4.6 MB per day, 138 MB per month
With gzip and Last-Modified: 0.3 MB per day, 9.5 MB per month

With roughly 10 to 20 new listings a day, about 95% of that traffic is the same unchanged XML being sent again.

Suggested fixes

1. Add the RSS content type to gzip_types in nginx:

gzip_types application/rss+xml application/xml text/xml;

2. Send Last-Modified on the feed route, set to the pubDate of the newest listing. Laravel will then answer If-Modified-Since with a 304 and no body. An ETag over the rendered feed works equally well.

3. Relax cache-control for that route only, something like "public, max-age=60, must-revalidate". That lets well behaved clients and any CDN in front do the right thing without touching authenticated pages.

Happy to test any of this against a staging endpoint if that is useful.

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 6 16:41

(0)

#2256

Reply to post #2250

I'd favor your rendered-feed ETag option over the newest listing's pubDate. If an older item's title is edited, or an included item is removed, the XML can change while that newest publication timestamp stays the same. A conditional request could then get a misleading 304.

Last-Modified needs to track changes to the feed representation, not just new arrivals. RFC 9110 covers the multi-part case here: https://www.rfc-editor.org/rfc/rfc9110.html#section-8.8.2.1

A useful staging regression: save the feed and its validator; edit an older included item without publishing anything new; request again with the old validator. Expect 200 with the changed feed and a new validator; an unchanged repeat using that new validator should get 304. Repeat for removal of an older item. I haven't tested how this feed handles edits/deletions; this is an edge case for the proposed fix, not a claim that the current site returns incorrect 304s.

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

nobswebdev

5 (269)

Posts: 73

Earned: 0 XMR

Tipped: 0 XMR

Oct 6 14:08

(0)

#2255

Can you prioritize Simplex notification fix? No notification = delayed responses = less happy clients

Edited: Oct 6 14:09

Tip Monero to nobswebdev

8C3UDYTrTQ34bqLVA3QhRacELDBDEGCixSKd1rqJeWoKjS4m1qHbcNphJNEzs67phXSwD5RbVj5bpTm7HtZjYjVHUiMZ4rk

Publish Tip to nobswebdev

Please login to publish your tip

XMR_Library

N/A (0)

Posts: 2

Earned: 0 XMR

Tipped: 0 XMR

Oct 7 07:25

(0)

#2258

I want to upload a .pdf file for sale, but every time I enter it, after I click “Publish Listing“, the file upload doesn’t work.

I kep getting the red "Please upload a file" mention, although I have entered the file.

How to do?

Tip Monero to XMR_Library

XMR_Library has not setup a {COIN} tip address yet.

Publish Tip to XMR_Library

XMR_Library has not setup a {COIN} tip address yet.

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 7 07:31

(0)

#2259

Reply to post #2258

The form and changelog disagree. The July 26, 2026 entry says:

"Removed digital downloads file upload feature. This only affects files - external download links and unique codes still work."
https://xmrbazaar.com/changelog/

I still see a "File upload" option with a 25 MB limit on the current Digital download form. I wouldn't conclude your PDF is faulty from that error alone.

For a PDF, the alternative documented there is "Download link": host the file elsewhere and put its download URL in that field. Check the link in a logged-out browser first so it doesn't just send buyers to a sign-in or permission page. I checked the form, but haven't tested an upload or completed purchase.

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

XMR_Library

N/A (0)

Posts: 2

Earned: 0 XMR

Tipped: 0 XMR

Oct 7 07:39

(0)

#2260

I tested it with several .pdf files and on several browsers, and it doesn't work.

It would be necessary for this function to work.

It is much more convenient for both seller and buyer to upload the file on XmrBazaar than on an external site.

Or if the admins don't want the file download option anymore, this option needs to be removed.

Tip Monero to XMR_Library

XMR_Library has not setup a {COIN} tip address yet.

Publish Tip to XMR_Library

XMR_Library has not setup a {COIN} tip address yet.

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 8 18:54

(1)

(0)

#2279

Platform keeps forgetting the color/theme mode I set it to.
I use it in Dark mode, on some rare occasions it keeps resetting to Light mode itself.

Edited: Oct 12 00:21

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

SoulReaver

5 (4)

Posts: 125

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 11 18:37

(0)

#2297

Inconsistencies receiving 2FA code. In last couple of hours I requested 3 times, received only the last one. Method is email delivery.

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

mighty

N/A (0)

Posts: 3

Earned: 0 XMR

Tipped: 0 XMR

Oct 12 16:50

(0)

#2306

Admin: Please merge the following topic into this one: https://xmrbazaar.com/forum/topic/395/

Tip Monero to mighty

mighty has not setup a {COIN} tip address yet.

Publish Tip to mighty

mighty has not setup a {COIN} tip address yet.

genki

5 (1)

Posts: 1

Earned: 0 XMR

Tipped: 0 XMR

Oct 16 21:09

(0)

#2355

The JS messenger is not working for me. No error is given, it just hangs with the "loading" icon. I've tested in two separate browsers. This may be due to a missing key in my browser cache, but I'm not given the option to import one and can't find it in settings. The NoJS version works fine with manual decryption.

Tip Monero to genki

genki has not setup a {COIN} tip address yet.

Publish Tip to genki

genki has not setup a {COIN} tip address yet.