diff --git a/customize.dist/pages.js b/customize.dist/pages.js
index e34ea2c8d..0a6165ec1 100644
--- a/customize.dist/pages.js
+++ b/customize.dist/pages.js
@@ -85,7 +85,7 @@ define([
     Pages.docsLink = footLink('https://docs.cryptpad.fr', 'docs_link');
 
     Pages.infopageFooter = function () {
-        var terms = footLink('/terms.html', 'footer_tos'); // XXX
+        var terms = footLink('/terms.html', 'footer_tos'); // FIXME this should be configurable like the other legal pages
         var legalFooter;
 
         // only display the legal part of the footer if it has content
diff --git a/lib/commands/metadata.js b/lib/commands/metadata.js
index 2fdb41c8a..9b6a23e02 100644
--- a/lib/commands/metadata.js
+++ b/lib/commands/metadata.js
@@ -14,14 +14,13 @@ Data.getMetadataRaw = function (Env, channel /* channelName */, _cb) {
 
     // return synthetic metadata for admin broadcast channels as a safety net
     // in case anybody manages to write metadata
-    /*
-    if (channel.length === HK.ADMIN_CHANNEL_LENGTH) { // XXX
+    if (channel.length === HK.ADMIN_CHANNEL_LENGTH) {
         return void cb(void 0, {
             channel: channel,
             creation: +new Date(),
             owners: Env.admins,
         });
-    } */
+    }
 
     var cached = Env.metadata_cache[channel];
     if (HK.isMetadataMessage(cached)) {
@@ -152,7 +151,7 @@ Data.setMetadata = function (Env, safeKey, data, cb, Server) {
                 const metadata_cache = Env.metadata_cache;
 
                 // update the cached metadata
-                metadata_cache[channel] = metadata; // XXX guard against malicious takeover of the broadcast channel
+                metadata_cache[channel] = metadata;
 
                 // it's easy to check if the channel is restricted
                 const isRestricted = metadata.restricted;
diff --git a/lib/decrees.js b/lib/decrees.js
index 4eb1dff85..fca8fb331 100644
--- a/lib/decrees.js
+++ b/lib/decrees.js
@@ -139,6 +139,8 @@ var args_isMaintenance = function (args) {
         (args[0] === "" || (isNumber(args[0].end) && isNumber(args[0].start)));
 };
 
+// we anticipate that we'll add language-specific surveys in the future
+// whenever that happens we can relax validation a bit to support more formats
 var makeBroadcastSetter = function (attr, validation) {
     return function (Env, args) {
         if ((validation && !validation(args)) && !args_isString(args)) {
@@ -156,7 +158,7 @@ var makeBroadcastSetter = function (attr, validation) {
 commands.SET_LAST_BROADCAST_HASH = makeBroadcastSetter('lastBroadcastHash');
 
 // CryptPad_AsyncStore.rpc.send('ADMIN', [ 'ADMIN_DECREE', ['SET_SURVEY_URL', [url]]], console.log)
-commands.SET_SURVEY_URL = makeBroadcastSetter('surveyURL'); // XXX anticipate language-specific surveys
+commands.SET_SURVEY_URL = makeBroadcastSetter('surveyURL');
 
 // CryptPad_AsyncStore.rpc.send('ADMIN', [ 'ADMIN_DECREE', ['SET_MAINTENANCE', [{start: +Date, end: +Date}]]], console.log)
 // CryptPad_AsyncStore.rpc.send('ADMIN', [ 'ADMIN_DECREE', ['SET_MAINTENANCE', [""]]], console.log)
diff --git a/www/admin/inner.js b/www/admin/inner.js
index 1b6d27865..33691892b 100644
--- a/www/admin/inner.js
+++ b/www/admin/inner.js
@@ -1203,7 +1203,7 @@ define([
                 }
                 if (error) {
                     console.error('One of the selected languages has no data');
-                    return false; // XXX better error handling?
+                    return false;
                 }
                 return {
                     defaultLanguage: defaultLanguage,
@@ -1213,7 +1213,7 @@ define([
 
             var send = function (data) {
                 $button.prop('disabled', 'disabled');
-                data.time = +new Date(); // XXX not used anymore?
+                //data.time = +new Date(); // FIXME not used anymore?
                 common.mailbox.sendTo('BROADCAST_CUSTOM', data, {}, function (err) {
                     if (err) {
                         $button.prop('disabled', '');
@@ -1233,7 +1233,7 @@ define([
                 send(data);
             });
 
-            UI.confirmButton(removeButton, { // XXX table jank
+            UI.confirmButton(removeButton, {
                 classes: 'btn-danger',
             }, function () {
                 if (!activeUid) { return; }
diff --git a/www/common/common-interface.js b/www/common/common-interface.js
index a1663ce63..9711de3fa 100644
--- a/www/common/common-interface.js
+++ b/www/common/common-interface.js
@@ -739,6 +739,7 @@ define([
             }
         });
     };
+    // TODO: make it such that the confirmButton's width does not change
     UI.confirmButton = function (originalBtn, config, _cb) {
         config = config || {};
         var cb = Util.mkAsync(_cb);