5 ms·
Bluesky Exploits
- riffic 3y agojust throwing out there that ActivityPub has been given Recommendation status at the W3C (what is a recommendation? https://www.w3.org/standards/ https://www.w3.org/standards/) ATProto is a NIH reinvention of the wheel by a "public benefit LLC" of unclear ownership* that has demonstrated time and again its unwillingness to take a seat at the table within a group like the W3C or the IETF in protocol development. What is ActivityPub, you may ask? https://en.wikipedia.org/wiki/ActivityPub https://en.wikipedia.org/wiki/ActivityPub * EDIT: I completely missed there was Bluesky $8M seed round in July, lol. It's now a public benefit C Corp whatever that means. https://techcrunch.com/2023/07/05/bluesky-announces-its-8m-seed-round-first-paid-service-custom-domains/ https://techcrunch.com/2023/07/05/bluesky-announces-its-8m-s...
- paxys 3y ago"Public benefit" is simply a marketing term when applied to a private for-profit corporation. It operates like any other company, with an extra line in its mission statement that it will operate for the public good. What does that mean? Nothing. Who enforces it? No one.
- pfraze 3y ago[flagged]
- riffic 3y agoa belated congrats on the fundraising round.
- mplewis 3y agoIs this really the best way for you to represent your company?
- verdverm 3y agoI think it's going to be the people leading the next social media company that will make it succeed. From what I've seen on HN & Twitter from the Bluesky team, it does not inspire any confidence that they would be any better than what we have today. maybe @dang should get some YC funding to start something inspired by HN...?
- KnightHawk3 3y agonot really how i would post on articles about my work
- edoceo 3y agoBruv. Snark is not cool here and you're in the big-chair. Get good.
- its-summertime 3y agoJeremie and Bryan, at least, have interacted (and at least Jeremie has drafted multiple RFCs) with the IETF. Current mailing list items specific to bluesky https://mailarchive.ietf.org/arch/search/?q=bluesky&qdr=y https://mailarchive.ietf.org/arch/search/?q=bluesky&qdr=y
- riffic 3y agoI am not on a first name basis with the people involved. If they're already involved in IETF processes I am sure they're familiar with the Independent Submission process for the RFC Editor (RFC 4846) https://www.rfc-editor.org/about/independent/ https://www.rfc-editor.org/about/independent/
- deleted 3y ago[deleted]
- olah_1 3y agoActivityPub is fine as long as you're okay with a specific server owning your account and all your data. Many people just want that not to be the case.
- deleted 3y ago[deleted]
- 4lex_8 3y agoI can’t be the only one who finds a lot of these new federated social networks to be a bit fishy… the whole idea is really great but bluesky & now metas “threads” are really only pseudo-federated. They both claim the future option to choose your instance but by default you start out on their centralized instance. This feels like a predatory tactic to be able to control the average user who doesn’t care about the value of decentralized networks.
- evbogue 3y ago[flagged]
- orliesaurus 3y agoI have a bluesky account but I am not active..yet - are a lot of people active? I need some people from HN to follow...anyone?
- deleted 3y ago[deleted]
- romesc 3y agoIf you send me an invite, I pinky promise I will post something interesting and we can have a HN clique of at least 2. =D Email: {HNusername}@live.com
- defatigable 3y agoNot OP, but I have an extra - I emailed it to you.
- romesc 3y agoThank you kind soul! Unfortunately, I found out that mailbox is full. Thanks microsoft... If you happen to see this, please check my profile for a working email!
- defatigable 3y agoOf course, I messaged you at your profile email address.
- djbusby 3y agoI'm not there I'd take an invite
- defatigable 3y agoI've got a few extra, happy to send you one. What's the easiest way?
- TheAceOfHearts 3y agoThere doesn't seem to be any response to this from the Blue Sky team so far. I can't help but think that Jack doesn't believe in Blue Sky that much. From what I can find, he doesn't seem to participate or even have an account. Meanwhile, at least Elon and Mark both post regularly on their social media sites.
- wmf 3y agoJack moved on to Nostr.
- Uehreka 3y agoWhile I’m guessing this is a joke, it would also be the most Jack thing ever if true.
- wmf 3y agoIt's not a joke.
- soap- 3y agoHe deleted his bluesky account sometime today
- gigglesupstairs 3y agoWhat’s the reason though, any idea?
- soap- 3y agoHe's been very vocal about disliking the average bluesky user. IIRC he's said they aren't accepting enough, there's more details somewehere on his nostr account.
- davidgerard 3y agoThis is because he talked about his admiration for RFK Jr. and got pushback.
- ruined 3y agothese are pretty boring. we've been playing with them for months now. there was no response because people have beat the hell out of this particular horse already if you consider it an exploit you should probably consider, say, github issues markdown to be exploitable the tl;dr is the server shouldn't trust the client and the client shouldn't trust the server to supply accurate link cards or link metadata. right now it's not a huge deal because there's only one instance and it is invite-only. consider it demo grade software.
- pfraze 3y ago> all media uploads live forever and are publicly retrievable even if you mark the associated post for deletion I have no idea what this is referring to
- ruined 3y agohmmm, maybe i misunderstood. edited out
- pfraze 3y agoWe used to retain post history, but that’s been removed with repo v3. We prioritized taking media down ages ago. If anything like that is still happening, it’d be CDN cache and I’d have to pester the backend team to make sure it’s being cleared in delete reliably
- matsemann 3y agoIs video happening soon? As someone mostly going viral 8n twitter with videoes, it's the one thing missing from completing my move. Still use bsky a lot to discuss, but to share my videoes embedded in Twitter gives much more traction than a YT link on bsky.
- pfraze 3y agoWe know about these. We have mitigations planned. We don’t think they’re cause for huge alarm. Bluesky posts have a rich text system, which means links in posts are similar to anchor tags. It’s not a markup; it’s a way to annotate slices of a string with facets such as links or bold or etc. This means you can linkify any text, thus the first concern raised. We intend to create an interstitial warning if the linkified text doesn’t show the domain clearly. The posts also have an embed system for images, links, and other posts. We currently naively accept the link cards as published, and we need to stop doing that and fetch the link cards on read instead.
- deleted 3y ago[deleted]
- Retr0id 3y agoAs someone who's been following development and the situation in general, I just thought I'd pop in to say "I second this" - which normally wouldn't be a very useful reply, but I think people are (rightfully) skeptical of first-party claims when it comes to the significance of security issues.
- evbogue 3y agoPaul, take a break and let your superiors answer for their design decisions.
- Retr0id 3y agoafaik, Paul designed the rich text system.
- evbogue 3y agoAnd he works for people who run a centralized social network who pushed it into production.
- wpietri 3y agoAnd if they drop by, they could also address the poor handling of security reports as described in the fine article. Because if the only way to get a reply about security issues is to get it to the front page of HN, that's a sign to me that the security team, if there is one, is deeply underwater.
- soap- 3y agoThese aren't really "exploits" in the traditional sense, it's just misrepresenting a link card.
- aidenn0 3y agoWhat is Bluesky? https://bsky.app/ https://bsky.app/ shows nothing but a sign-in page and wikipedia doesn't seem list it either.
- sundaeofshock 3y agoReally? https://en.m.wikipedia.org/wiki/Bluesky_Social https://en.m.wikipedia.org/wiki/Bluesky_Social
- aidenn0 3y agoAh, the "Social" was the part I was missing. Just searching for "Bluesky" takes you to https://en.wikipedia.org/wiki/Blue_Sky https://en.wikipedia.org/wiki/Blue_Sky
- deleted 3y ago[deleted]
- housemusicfan 3y agoIf an exploit is used in a forest, and no one's around to hear it....
- askiiart 3y agoAuthor's Mastodon post: https://fosstodon.org/@north/111057335768073441 https://fosstodon.org/@north/111057335768073441
- evbogue 3y agoThe biggest Bluesky exploit is not mentioned in the article, which is they hold your private keys.
- evbogue 3y agoRegarding the downvote. Am I wrong?
- wmf 3y agoYou've made your point; you don't need to keep posting the same thing. If the whole point of Bluesky is to be decentralized, should they have first released a centralized beta version? IMO no, but they had reasons that make sense. It looks like they are still planning to decentralize in good faith.
- evbogue 3y agoI understand what you're saying here.
- dustedcodes 3y ago[dead]
- ctas 3y agoPlease take into account that Bluesky is still young and run by a small team which is moving fast. Ignoring a few reports that they consider non-critical is not a strong negative signal, especially not during a time of rapid growth and while they're in beta and invite-only. They just cracked the million users and are probably navigating through a lot of chaos on a daily basis. Those of us who've been in similar situations know that this is normal.