5 ms·

> Ownership of identity This isn't currently a reality with ATProto, though they're making important progress over the status quo. Your identity in atproto is

> Ownership of identity This isn't currently a reality with ATProto, though they're making important progress over the status quo. Your identity in atproto is your DID. Your domain (if you use one) is just a handle. Currently all DID resolution goes through https://plc.directory https://plc.directory, which is completely controlled by Bluesky. Their plan is to eventually have this run more like the DNS by something like a nonprofit, but AFAIK that process hasn't started. The question is if Bluesky turned completely evil today, what recourse would users and app developers have? All the other apps could form a coop for a new DID directory and switch their users over. That might work, but I would like to see something like this in place running alongside Bluesky's directory since the logistics of running such a thing are not obvious. Also, it's not entirely clear to me that running an alternative pseudo-DNS is really better than just using DNS like the fediverse does. One really nice thing about it is that DIDs are opaque values, so squatting should essentially go away. And there's not really any good reason for DIDs to expire like domains do. This is nice for account recovert, since in the worst case if you couldn't prove your identity to the DID registrar your account would just go stale, rather than potentially being taken over by a bad actor[0]. [0]: https://news.ycombinator.com/item?id=42699099 https://news.ycombinator.com/item?id=42699099

Retr0id 2y ago
> Currently all DID resolution goes through https://plc.directory https://plc.directory almost all. You can use did:web if you want to be more independent (but since 99.99% of people don't it's almost completely irrelevant in the big picture). > The question is if Bluesky turned completely evil today, what recourse would users and app developers have? With sufficient developer consensus, we could all agree to switch to "plc2.directory". It'd be a shitshow, but hopefully not completely fatal. > One really nice thing about it is that DIDs are opaque values, so squatting should essentially go away Zooko's triangle strikes again! https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle (often expressed as a problem, but in this context it's mostly an advantage)
- xeonmc 2y ago
  do you know how did:web works? Documentation only describes that .well-known/atproto-did should be the DID value, but no instruction at all on where the DID document should be.
  - evbogue 2y ago
    you put an identifier on a dns txt record and then Bluesky's directory checks to make sure the identifier is there. I'm not sure there is documentation on how to do this yourself though, if that was what you are asking.
    - xeonmc 2y ago
      no, that's just the identifier, I'm talking about the json document itself.
      - evbogue 2y ago
        Oh! I misunderstood the question. Navigating to my profile here: https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 I clicked a link and my DID document is stored here: https://plc.directory/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://plc.directory/did:plc:i3gjwozl32eq3j3ejyw44hh4 Not sure how you'd store it in other places, though that'd be pretty decentralized if you could.
        deleted 2y ago
        [deleted]
        deleted 2y ago
        [deleted]
  - Retr0id 2y ago
    It's documented here: https://w3c-ccg.github.io/did-method-web/ https://w3c-ccg.github.io/did-method-web/ For example, here's `did:web:retr0.id` : https://retr0.id/.well-known/did.json https://retr0.id/.well-known/did.json (.well-known/atproto-did is for handle resolution, not did:web)
evbogue 2y ago
Exactly. The DIDs are held by Bluesky's directory, and they point to your latest signing key, which is also most often held by Bluesky. DID:Web is a one-time authentication process where Bluesky's directory checks to see if you have a DNS txt record and from then on you are known by your domain name and no longer have access to the bsky.app subdomain name that you initially start with. You can't see most of this information in the Bluesky app, so I find it helpful to use this other program to look up my information: https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 For those of you who have time to listen to an hour podcast, pfrazee explains in depth how the Bluesky DID system works here: https://www.softwaresessions.com/episodes/atproto/ https://www.softwaresessions.com/episodes/atproto/
bloopernova 2y ago
Cool, it's like a bit of KeyBase lives on. (Note, I'm not saying PLC derives directly from KeyBase! Just that the concept lives on!) I really liked the idea of KeyBase. I found the idea of a cross-platform cross-system identity elegant.
- jazzyjackson 2y ago
  Worked really nicely for backing up private git repos to multiple devices, they might have found a good market in shared file systems where every artifact is signed by the author, making file provenance possible. I consider the zoom acquisition one of the greater tragedies in software history.

Retr0id 2y ago

> Currently all DID resolution goes through https://plc.directory https://plc.directory almost all. You can use did:web if you want to be more independent (but since 99.99% of people don't it's almost completely irrelevant in the big picture). > The question is if Bluesky turned completely evil today, what recourse would users and app developers have? With sufficient developer consensus, we could all agree to switch to "plc2.directory". It'd be a shitshow, but hopefully not completely fatal. > One really nice thing about it is that DIDs are opaque values, so squatting should essentially go away Zooko's triangle strikes again! https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle (often expressed as a problem, but in this context it's mostly an advantage)

xeonmc 2y ago
do you know how did:web works? Documentation only describes that .well-known/atproto-did should be the DID value, but no instruction at all on where the DID document should be.
- evbogue 2y ago
  you put an identifier on a dns txt record and then Bluesky's directory checks to make sure the identifier is there. I'm not sure there is documentation on how to do this yourself though, if that was what you are asking.
  - xeonmc 2y ago
    no, that's just the identifier, I'm talking about the json document itself.
    - evbogue 2y ago
      Oh! I misunderstood the question. Navigating to my profile here: https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 I clicked a link and my DID document is stored here: https://plc.directory/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://plc.directory/did:plc:i3gjwozl32eq3j3ejyw44hh4 Not sure how you'd store it in other places, though that'd be pretty decentralized if you could.
      - deleted 2y ago
        [deleted]
      - deleted 2y ago
        [deleted]
- Retr0id 2y ago
  It's documented here: https://w3c-ccg.github.io/did-method-web/ https://w3c-ccg.github.io/did-method-web/ For example, here's `did:web:retr0.id` : https://retr0.id/.well-known/did.json https://retr0.id/.well-known/did.json (.well-known/atproto-did is for handle resolution, not did:web)

evbogue 2y ago

Exactly. The DIDs are held by Bluesky's directory, and they point to your latest signing key, which is also most often held by Bluesky. DID:Web is a one-time authentication process where Bluesky's directory checks to see if you have a DNS txt record and from then on you are known by your domain name and no longer have access to the bsky.app subdomain name that you initially start with. You can't see most of this information in the Bluesky app, so I find it helpful to use this other program to look up my information: https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 https://pdsls.dev/at/did:plc:i3gjwozl32eq3j3ejyw44hh4 For those of you who have time to listen to an hour podcast, pfrazee explains in depth how the Bluesky DID system works here: https://www.softwaresessions.com/episodes/atproto/ https://www.softwaresessions.com/episodes/atproto/

bloopernova 2y ago

Cool, it's like a bit of KeyBase lives on. (Note, I'm not saying PLC derives directly from KeyBase! Just that the concept lives on!) I really liked the idea of KeyBase. I found the idea of a cross-platform cross-system identity elegant.

jazzyjackson 2y ago
Worked really nicely for backing up private git repos to multiple devices, they might have found a good market in shared file systems where every artifact is signed by the author, making file provenance possible. I consider the zoom acquisition one of the greater tragedies in software history.