diff --git a/www/common/common-messaging.js b/www/common/common-messaging.js
index 1e6e26ce3..4a3eb2a91 100644
--- a/www/common/common-messaging.js
+++ b/www/common/common-messaging.js
@@ -18,7 +18,7 @@ define([
             curvePublic: proxy.curvePublic,
             notifications: Util.find(proxy, ['mailboxes', 'notifications', 'channel']),
             avatar: proxy.profile && proxy.profile.avatar,
-            uid: proxy.uid, // XXX test without this and see if it breaks things
+            uid: proxy.uid,
         };
         if (hash === false) { delete data.channel; }
         return data;
diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js
index abf45b0bd..5bc8bf4f6 100644
--- a/www/common/common-ui-elements.js
+++ b/www/common/common-ui-elements.js
@@ -1991,7 +1991,7 @@ define([
 
         var $displayName = $userAdmin.find('.'+displayNameCls);
 
-        var $avatar = $userAdmin.find('> button .cp-dropdown-button-title'); // XXX alt="User menu"
+        var $avatar = $userAdmin.find('> button .cp-dropdown-button-title');
         var loadingAvatar;
         var to;
         var oldUrl = '';
diff --git a/www/common/inner/common-mediatag.js b/www/common/inner/common-mediatag.js
index 21cb25e82..33e5d74f7 100644
--- a/www/common/inner/common-mediatag.js
+++ b/www/common/inner/common-mediatag.js
@@ -90,17 +90,12 @@ define([
     // https://emojipedia.org/nature/
     var ANIMALS = AppConfig.emojiAvatars || [];
 
-    var getRandomAnimal = function () { // XXX should never actually happen?
-        if (!ANIMALS.length) { return ''; }
-        return ANIMALS[Math.floor(Math.random() * ANIMALS.length)];
-    };
-
     var getPseudorandomAnimal = MT.getPseudorandomAnimal = function (seed) {
         if (!ANIMALS.length) { return ''; }
-        if (typeof(seed) !== 'string') { return getRandomAnimal(); }
-        seed = seed.replace(/\D/g, '').slice(0, 10); // XXX possible optimization for on-wire uid
+        if (typeof(seed) !== 'string') { return; }
+        seed = seed.replace(/\D/g, '').slice(0, 10); // TODO possible optimization for on-wire uid
         seed = parseInt(seed);
-        if (!seed) { return getRandomAnimal(); }
+        if (!seed) { return; }
         return ANIMALS[seed % ANIMALS.length] || '';
     };
 
@@ -141,7 +136,7 @@ define([
 
             var $avatar = $('<span>', {
                 'class': 'cp-avatar-default' + (animal_avatar? ' animal': ''),
-                // XXX prevents screenreaders from trying to describe this
+                // this prevents screenreaders from trying to describe this
                 alt: '',
                 'aria-hidden': true,
             }).text(text);
@@ -196,7 +191,7 @@ define([
                 var $img = $(mt).appendTo($container);
                 MT.displayMediatagImage(common, $img, function (err, $image) {
                     if (err) { return void console.error(err); }
-                    centerImage($img, $image); // XXX add alt="" (unless the media-tag has an alt attr)
+                    centerImage($img, $image);
                 });
             });
         }
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index 3575c95b0..b7efd9f4f 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -235,9 +235,6 @@ define([
         };
     };
 
-    funcs.getAuthorId = function () { // XXX
-    };
-
     var authorUid = function(existing) {
         if (!Array.isArray(existing)) { existing = []; }
         var n;
@@ -263,7 +260,7 @@ define([
             });
             return uid || authorUid(existing);
         }
-        // XXX this should check for a matching curvePublic / uid if:
+        // TODO this should check for a matching curvePublic / uid if:
         // 1. you are logged in OR
         // 2. you have a token
         // so that users that register recognize comments from before
diff --git a/www/common/toolbar.js b/www/common/toolbar.js
index 5b359a323..5f1c2ece5 100644
--- a/www/common/toolbar.js
+++ b/www/common/toolbar.js
@@ -164,6 +164,7 @@ MessengerUI, Messages, Pages) {
         });
     };
     var showColors = false;
+    Messages.userlist_visitProfile = "Visit {0}'s profile"; // XXX "'s" is incorrect for names that end in "s" in English... don't care?
     var updateUserList = function (toolbar, config, forceOffline) {
         if (!config.displayed || config.displayed.indexOf('userlist') === -1) { return; }
         if (toolbar.isAlone) { return; }
@@ -249,6 +250,7 @@ MessengerUI, Messages, Pages) {
         var friendRequests = Common.getFriendRequests(); // Friend requests received
         editUsersNames.forEach(function (data) {
             var name = data.name || Messages.anonymous;
+            var safeName = Util.fixHTML(name);
             var $span = $('<span>', {'class': 'cp-avatar'});
             if (data.color && showColors) {
                 $span.css('border-color', data.color);
@@ -323,7 +325,7 @@ MessengerUI, Messages, Pages) {
                     $('<button>', {
                         'class': 'fa fa-bell cp-toolbar-userlist-button',
                         'data-cptippy-html': true,
-                        'title': Messages._getKey('friendRequest_received', [Util.fixHTML(name)]),
+                        'title': Messages._getKey('friendRequest_received', [safeName]),
                     }).appendTo($nameSpan).click(function (e) {
                         e.stopPropagation();
                         UIElements.displayFriendRequestModal(Common, friendRequests[data.curvePublic]);
@@ -334,7 +336,7 @@ MessengerUI, Messages, Pages) {
                         'class': 'fa fa-user-plus cp-toolbar-userlist-button',
                         'data-cptippy-html': true,
                         'title': Messages._getKey('userlist_addAsFriendTitle', [
-                            Util.fixHTML(name)
+                            safeName,
                         ])
                     }).appendTo($nameSpan).click(function (e) {
                         e.stopPropagation();
@@ -356,9 +358,9 @@ MessengerUI, Messages, Pages) {
                 });
             }
             if (data.profile) {
-                // XXX title to visit their profile "Visit {0}'s profile"
                 // Messages.contacts_info3 "Double-click their icon to view their profile",
                 $span.addClass('cp-userlist-clickable');
+                $span.attr('title', Messages._getKey('userlist_visitProfile', [name]));
                 $span.click(function () {
                     Common.openURL(origin+'/profile/#' + data.profile);
                 });
diff --git a/www/pad/cursor.js b/www/pad/cursor.js
index ae91c80f1..b0268336b 100644
--- a/www/pad/cursor.js
+++ b/www/pad/cursor.js
@@ -42,7 +42,7 @@ define([
 
         var cursors = {};
 
-    // XXX despite the name of this function this doesn't actually render as a tippy tooltip
+    // FIXME despite the name of this function this doesn't actually render as a tippy tooltip
     // that means that emojis will use the system font that shows up in native tooltips
     // so this might be of limited value/aesthetic appeal compared to other apps' cursors
         var makeTippy = function (cursor) {