6 ms·

I don't see how it's incompatible. The problem with Twitter (before the whole blue check system was gutted into meaninglessness) was that not enough verificati

I don't see how it's incompatible. The problem with Twitter (before the whole blue check system was gutted into meaninglessness) was that not enough verification badges were handed out. It's not exactly a dangerous situation. Bluesky's idea of verified orgs granting verification badges to its own org members would be an example of a much more robust and hands off system than what Twitter had. The dangerous scenario is what happened to Twitter after the Elon takeover: verification becomes meaningless overnight while users still give the same gravity to verification badges which causes a huge impersonation problem. But that possibility is not a reason to have zero verification.

righthand 2y ago
What’s stopping me from making an org that hands out verifications to anyone?
- d4mi3n 2y ago
  Presumably a contractual agreement with BlueSky. Trust needs to stem from somewhere, so you’re either looking at a web-of-trust model where somebody (BlueSky or BlueSky clients) makes decisions on what sign-offs to trust, or you trust BlueSky to perform due diligence on partner orgs that provide this service and to hold them accountable when that trust is breached. The WoT model works but as GPG has shown it requires your end users (people? BlueSky client developers?) to manage who they trust as an authority on anything.
  - godelski 2y ago
    Your profile says you're a security engineer, so I'm hoping you can help me understand. What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still. And why not move into a system like multiparty keys? Keys assigned by domain holder, need to be signed, and verified accounts must login with a private key that validates. That way you don't just get that the account is validated but the post is too. Yeah, this would require more technical expertise to do but the organizations we're usually most concerned about would have no problem with that. Besides, tooling gets easier when there's meaningful pushes to make it available to general audiences
    - verdverm 2y ago
      There was once Handshake, but they failed mainly because they didn't want to work along side the current system, they wanted to replace it completely with a blockchain. It's actually one of the good use case IMHO, but their leadership didn't want to play nice with what we already have so transition could happen smoothly
    - d4mi3n 2y ago
      What is appropriate here really depends on what properties BlueSky wants to assert about it's ecosystem. > What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still. As commenters earlier in this thread have noted, one property BlueSky claims it wants to develop/maintain is resistance against BlueSky itself becoming an adversarial party--say in the event it is bought out by an eccentric multi-billionaire who may take steps to discredit certain parties or reduce their reach or reputation. I don't think the current DNS verification methodology helps or hurts in a BlueSky is hostile scenario. I think the only issues with the current DNS username verification system as I understand it are the same issues with any DNS based verification system in that vanilla DNS was not a protocol designed to be resistant to adversarial use and as a result there are many ways for people to tamper with DNS records, DNS queries, and confuse systems that incorrectly trust DNS records to be trustworthy or well-formed. DNS cache poisoning is a thing. Domain takeovers have and will continue to happen. Now, if we're talking about what technologies are suitable for username verification in a word where BlueSky is adversarial, we have a very different conversation. I think the scope of such a scenario extends a lot further than usernames. If your primary interface into the AT Protocol feed is the BlueSky website or the official BlueSky application, you are trusting BlueSky to validate usernames. An adversarial BlueSky could easily decide if your interface marks someone as trusted or untrusted without your knowledge. The only way I could think to avoid this would be to use a different interface to the global feed, but then you run into new problems that are more difficult to avoid: the fact that most BlueSky users don't host their own data (though this is doable with https://atproto.com/guides/self-hosting https://atproto.com/guides/self-hosting). BlueSky also manages the global feed, so barring a competitive global index, you'll still be consuming a feed curated by BlueSky's AT Protocol services and implementation. I'd close this by saying I am _not_ an expert in the AT Protocol, BlueSky's systems, or this space in general. This is a very fast and loose risk assessment I made after reviewing the AT Protocol and a bit of research on how BlueSky says it provides it's services. My current assessment is that if the community wants to be robust against BlueSky becoming adversarial, there needs to be a lot more support for self-hosting of PSPs and similar data stores, alternative global indexes, and likely also independent governance of the AT Protocol itself.
- derefr 2y ago
  Bluesky's moderators, apparently. > For example, the New York Times can now issue blue checks to its journalists directly in the app. Bluesky’s moderation team reviews each verification to ensure authenticity.
  - dymk 2y ago
    That sounds in conflict with “The company is a future adversary”
    - steveklabnik 2y ago
      It's no more than any client only showing the information it wants to; anyone can verify anyone else, without permission from the company. Any client can surface this information in any way they'd like, without permission from the company.
      - krainboltgreene 2y ago
        Regardless of the intent or future this is an incredibly neat rhetorical trick that Bluesky's designers have pulled. Any semi-motivated contrarian can make the required arguments for either concern. It even happens to be true! Meanwhile every mastodon discussion required (requires?) someone who deeply understands the system to spend "10 comments deep" energy just to arrive at a much less amenable position. Signed, a person who was that someone.
- verdverm 2y ago
  Nothing, however AppViews like Bluesky decide which verifiers they trust. An AppView could also allow for user choice, like how algos and moderation work.
  - steveklabnik 2y ago
    deer.social already allows users to set a preference to turn off all verification badges, for example. EDIT: so does bksy.app, actually.
    - verdverm 2y ago
      There are also labelers emerging to hide, mute, or block verified accounts... for those who are really zealous against the concept
- steveklabnik 2y ago
  Nothing: anyone can hand out verifications to anyone they'd like. Now, how those are displayed is up to the display software. BlueSky themselves get to decide who gets a blue check based on verification records, but if you wrote your own software, you could do whatever you'd like. There's a bsky fork that already has an account option to let you hide blue checks in your own view.
  - FlyingSnake 2y ago
    If anyone can hand out verifications to anyone they like then we’re back to square one. Why do we need these “Blue Checks”? It feels like BlueSky is trying to reclaim the lost clout for some of their influential users.
    - steveklabnik 2y ago
      It's in line with the protocol design. If only BlueSky themselves could verify, that'd be too centralized. Mind you, just because anyone can create a verification record doesn't mean that the default client shows them. > Why do we need these “Blue Checks”? Normie users care about this sort of feature.
      - FlyingSnake 2y ago
        > Normie users care about this sort of feature. That’s a really weak argument because normie users want TikTokified social media with a clout based caste system. I thought BlueSky had a different goal in mind.
        steveklabnik 2y ago
        Bluesky cares about both audiences.
        anon7000 2y ago
        BlueSky wants to make a social media platform that normies want to use. The whole idea is to design a protocol that can achieve huge scale and behave a lot like existing social media apps (which people "like") while still being open and flexible.
- waterTanuki 2y ago
  The fact they have to be reviewed by bsky before verification? It's in the article if you actually read it.
TiredOfLife 2y ago
The problem with Twitter (before the whole blue check system was gutted into meaninglessness) was that verification badges were merit and nepotism and not identity based
- mattl 2y ago
  That’s not true though. They were for journalists and public figures.
  - comeonbro 2y ago
    Here is probably the most well-known instance of Pre-Musk Twitter removing blue checks from the accounts of public figures for reasons other than the account not being who it claims to be: https://techcrunch.com/2017/11/15/twitter-removes-verified-checkmarks-from-several-white-supremacists-profiles/ https://techcrunch.com/2017/11/15/twitter-removes-verified-c... Not pictured: innumerable other accounts which were never granted a blue check in the first place, despite being the easily verifiable real accounts of journalists and public figures. It was de facto a caste system of political favor and connections.
    - deleted 2y ago
      [deleted]
  - dijit 2y ago
    Nearly everyone I interacted with on Twitter (pre-Musk) got their verification badge by essentially being in the San Francisco tech community. No matter how prominent someone might be on this side of the Atlantic, it never mattered, meanwhile mid-managers and coders at no-name startups had blue checks because, I mean, they knew someone at Twitter- and who else is verifying people? I don’t really fault them for verifying people they personally knew. But it meant that you had a situation where (and no offence meant to them) “nobodies” (as in, non-promenant figures) were “in the club” with heads of state, companies and heads of industry. So there was a definite whiff of nepotism, because it was a de-facto status symbol.
fortran77 2y ago
The problem I had with twitter was the check was supposed to mean one thing and one thing only: that the person was who he or she claimed to be. What twitter starting doing was removing blue checks from people who were causing problems for the platform (but not behaving bad enough to kick off). This made no sense because people still needed to know if a person was who he claimed to be (e.g., Milo Yiannopoulos) even if the person was controversial or problematic or just plain nasty. Blue Checks weren't "gutted". Now they just mean something else -- you're a premium subscriber.
- wyclif 2y ago
  This is absolutely correct—I remember quite clearly how it all went down. When Twitter first rolled out verification, it was supposed to ensure that the person you were following or interacting with was the person they claimed to be.
  - burningChrome 2y ago
    This was also because there were so many people setting up fake accounts using real celebs. The most famous of which was probably the Dave Chapelle, Kat Williams story that Chapelle tells where a fake Chapelle account was feuding with a fake Kat Williams account. https://www.youtube.com/watch?v=7_Egh9mW5y4 https://www.youtube.com/watch?v=7_Egh9mW5y4
- NelsonMinar 2y ago
  The problem is that X (formerly Twitter) is still calling blue checks "verified". Even though nothing about the account is verified. It's deliberately misleading.
- hombre_fatal 2y ago
  I use the word "gutted" to refer to the level of trust in the old system that was abandoned in the identical-looking new system. The correct way to have rolled that out would have been a brand new icon, but they wanted to cash in on the reputation of the old system. "Now you can pay for this once-coveted badge!"
ein0p 2y ago
Why is it "meaningless overnight" on Twitter? Twitter knows who you are if you're paying them montly. Ergo, you are "verified".
- lexandstuff 2y ago
  Because the original point of it was to distinguish journalists and public figures, so you could tell imposters apart from real people. Now its purpose is to show who has a premium subscription. Totally different feature using the same name.
  - ein0p 2y ago
    But not all "journalists and public figures" received the checkmark. It was entirely up to the ultra-woke Twitter management who gets a checkmark and who doesn't. I frankly don't see why the current, deterministic setup is better than the former non-deterministic one.
    - darthrupert 2y ago
      Ultra-woke Twitter? What the hell are you blathering about?
      - ein0p 2y ago
        This, specifically: https://www.esquire.com/style/news/a45458/jack-dorsey-stay-woke-shirt/ https://www.esquire.com/style/news/a45458/jack-dorsey-stay-w...
        DonHopkins 2y ago
        Now it's ultra-racist ultra-fascist Twitter management. Do you actually think that's better? Why are you whining about "woke" people who have long since been fired, but embracing the racists and fascists who are now running and being platformed and amplified on Twitter? Yes, "Twitter". If Elon Musk can publicly abuse, humiliate, lie about, deadname, and misgender his own daughter to his millions of followers, than I can deadname Twitter.

righthand 2y ago

What’s stopping me from making an org that hands out verifications to anyone?

d4mi3n 2y ago
Presumably a contractual agreement with BlueSky. Trust needs to stem from somewhere, so you’re either looking at a web-of-trust model where somebody (BlueSky or BlueSky clients) makes decisions on what sign-offs to trust, or you trust BlueSky to perform due diligence on partner orgs that provide this service and to hold them accountable when that trust is breached. The WoT model works but as GPG has shown it requires your end users (people? BlueSky client developers?) to manage who they trust as an authority on anything.
- godelski 2y ago
  Your profile says you're a security engineer, so I'm hoping you can help me understand. What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still. And why not move into a system like multiparty keys? Keys assigned by domain holder, need to be signed, and verified accounts must login with a private key that validates. That way you don't just get that the account is validated but the post is too. Yeah, this would require more technical expertise to do but the organizations we're usually most concerned about would have no problem with that. Besides, tooling gets easier when there's meaningful pushes to make it available to general audiences
  - verdverm 2y ago
    There was once Handshake, but they failed mainly because they didn't want to work along side the current system, they wanted to replace it completely with a blockchain. It's actually one of the good use case IMHO, but their leadership didn't want to play nice with what we already have so transition could happen smoothly
  - d4mi3n 2y ago
    What is appropriate here really depends on what properties BlueSky wants to assert about it's ecosystem. > What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still. As commenters earlier in this thread have noted, one property BlueSky claims it wants to develop/maintain is resistance against BlueSky itself becoming an adversarial party--say in the event it is bought out by an eccentric multi-billionaire who may take steps to discredit certain parties or reduce their reach or reputation. I don't think the current DNS verification methodology helps or hurts in a BlueSky is hostile scenario. I think the only issues with the current DNS username verification system as I understand it are the same issues with any DNS based verification system in that vanilla DNS was not a protocol designed to be resistant to adversarial use and as a result there are many ways for people to tamper with DNS records, DNS queries, and confuse systems that incorrectly trust DNS records to be trustworthy or well-formed. DNS cache poisoning is a thing. Domain takeovers have and will continue to happen. Now, if we're talking about what technologies are suitable for username verification in a word where BlueSky is adversarial, we have a very different conversation. I think the scope of such a scenario extends a lot further than usernames. If your primary interface into the AT Protocol feed is the BlueSky website or the official BlueSky application, you are trusting BlueSky to validate usernames. An adversarial BlueSky could easily decide if your interface marks someone as trusted or untrusted without your knowledge. The only way I could think to avoid this would be to use a different interface to the global feed, but then you run into new problems that are more difficult to avoid: the fact that most BlueSky users don't host their own data (though this is doable with https://atproto.com/guides/self-hosting https://atproto.com/guides/self-hosting). BlueSky also manages the global feed, so barring a competitive global index, you'll still be consuming a feed curated by BlueSky's AT Protocol services and implementation. I'd close this by saying I am _not_ an expert in the AT Protocol, BlueSky's systems, or this space in general. This is a very fast and loose risk assessment I made after reviewing the AT Protocol and a bit of research on how BlueSky says it provides it's services. My current assessment is that if the community wants to be robust against BlueSky becoming adversarial, there needs to be a lot more support for self-hosting of PSPs and similar data stores, alternative global indexes, and likely also independent governance of the AT Protocol itself.
derefr 2y ago
Bluesky's moderators, apparently. > For example, the New York Times can now issue blue checks to its journalists directly in the app. Bluesky’s moderation team reviews each verification to ensure authenticity.
- dymk 2y ago
  That sounds in conflict with “The company is a future adversary”
  - steveklabnik 2y ago
    It's no more than any client only showing the information it wants to; anyone can verify anyone else, without permission from the company. Any client can surface this information in any way they'd like, without permission from the company.
    - krainboltgreene 2y ago
      Regardless of the intent or future this is an incredibly neat rhetorical trick that Bluesky's designers have pulled. Any semi-motivated contrarian can make the required arguments for either concern. It even happens to be true! Meanwhile every mastodon discussion required (requires?) someone who deeply understands the system to spend "10 comments deep" energy just to arrive at a much less amenable position. Signed, a person who was that someone.
verdverm 2y ago
Nothing, however AppViews like Bluesky decide which verifiers they trust. An AppView could also allow for user choice, like how algos and moderation work.
- steveklabnik 2y ago
  deer.social already allows users to set a preference to turn off all verification badges, for example. EDIT: so does bksy.app, actually.
  - verdverm 2y ago
    There are also labelers emerging to hide, mute, or block verified accounts... for those who are really zealous against the concept
steveklabnik 2y ago
Nothing: anyone can hand out verifications to anyone they'd like. Now, how those are displayed is up to the display software. BlueSky themselves get to decide who gets a blue check based on verification records, but if you wrote your own software, you could do whatever you'd like. There's a bsky fork that already has an account option to let you hide blue checks in your own view.
- FlyingSnake 2y ago
  If anyone can hand out verifications to anyone they like then we’re back to square one. Why do we need these “Blue Checks”? It feels like BlueSky is trying to reclaim the lost clout for some of their influential users.
  - steveklabnik 2y ago
    It's in line with the protocol design. If only BlueSky themselves could verify, that'd be too centralized. Mind you, just because anyone can create a verification record doesn't mean that the default client shows them. > Why do we need these “Blue Checks”? Normie users care about this sort of feature.
    - FlyingSnake 2y ago
      > Normie users care about this sort of feature. That’s a really weak argument because normie users want TikTokified social media with a clout based caste system. I thought BlueSky had a different goal in mind.
      - steveklabnik 2y ago
        Bluesky cares about both audiences.
      - anon7000 2y ago
        BlueSky wants to make a social media platform that normies want to use. The whole idea is to design a protocol that can achieve huge scale and behave a lot like existing social media apps (which people "like") while still being open and flexible.
waterTanuki 2y ago
The fact they have to be reviewed by bsky before verification? It's in the article if you actually read it.

TiredOfLife 2y ago

The problem with Twitter (before the whole blue check system was gutted into meaninglessness) was that verification badges were merit and nepotism and not identity based

mattl 2y ago
That’s not true though. They were for journalists and public figures.
- comeonbro 2y ago
  Here is probably the most well-known instance of Pre-Musk Twitter removing blue checks from the accounts of public figures for reasons other than the account not being who it claims to be: https://techcrunch.com/2017/11/15/twitter-removes-verified-checkmarks-from-several-white-supremacists-profiles/ https://techcrunch.com/2017/11/15/twitter-removes-verified-c... Not pictured: innumerable other accounts which were never granted a blue check in the first place, despite being the easily verifiable real accounts of journalists and public figures. It was de facto a caste system of political favor and connections.
  - deleted 2y ago
    [deleted]
- dijit 2y ago
  Nearly everyone I interacted with on Twitter (pre-Musk) got their verification badge by essentially being in the San Francisco tech community. No matter how prominent someone might be on this side of the Atlantic, it never mattered, meanwhile mid-managers and coders at no-name startups had blue checks because, I mean, they knew someone at Twitter- and who else is verifying people? I don’t really fault them for verifying people they personally knew. But it meant that you had a situation where (and no offence meant to them) “nobodies” (as in, non-promenant figures) were “in the club” with heads of state, companies and heads of industry. So there was a definite whiff of nepotism, because it was a de-facto status symbol.

fortran77 2y ago

The problem I had with twitter was the check was supposed to mean one thing and one thing only: that the person was who he or she claimed to be. What twitter starting doing was removing blue checks from people who were causing problems for the platform (but not behaving bad enough to kick off). This made no sense because people still needed to know if a person was who he claimed to be (e.g., Milo Yiannopoulos) even if the person was controversial or problematic or just plain nasty. Blue Checks weren't "gutted". Now they just mean something else -- you're a premium subscriber.

wyclif 2y ago
This is absolutely correct—I remember quite clearly how it all went down. When Twitter first rolled out verification, it was supposed to ensure that the person you were following or interacting with was the person they claimed to be.
- burningChrome 2y ago
  This was also because there were so many people setting up fake accounts using real celebs. The most famous of which was probably the Dave Chapelle, Kat Williams story that Chapelle tells where a fake Chapelle account was feuding with a fake Kat Williams account. https://www.youtube.com/watch?v=7_Egh9mW5y4 https://www.youtube.com/watch?v=7_Egh9mW5y4
NelsonMinar 2y ago
The problem is that X (formerly Twitter) is still calling blue checks "verified". Even though nothing about the account is verified. It's deliberately misleading.
hombre_fatal 2y ago
I use the word "gutted" to refer to the level of trust in the old system that was abandoned in the identical-looking new system. The correct way to have rolled that out would have been a brand new icon, but they wanted to cash in on the reputation of the old system. "Now you can pay for this once-coveted badge!"

ein0p 2y ago

Why is it "meaningless overnight" on Twitter? Twitter knows who you are if you're paying them montly. Ergo, you are "verified".

lexandstuff 2y ago
Because the original point of it was to distinguish journalists and public figures, so you could tell imposters apart from real people. Now its purpose is to show who has a premium subscription. Totally different feature using the same name.
- ein0p 2y ago
  But not all "journalists and public figures" received the checkmark. It was entirely up to the ultra-woke Twitter management who gets a checkmark and who doesn't. I frankly don't see why the current, deterministic setup is better than the former non-deterministic one.
  - darthrupert 2y ago
    Ultra-woke Twitter? What the hell are you blathering about?
    - ein0p 2y ago
      This, specifically: https://www.esquire.com/style/news/a45458/jack-dorsey-stay-woke-shirt/ https://www.esquire.com/style/news/a45458/jack-dorsey-stay-w...
      - DonHopkins 2y ago
        Now it's ultra-racist ultra-fascist Twitter management. Do you actually think that's better? Why are you whining about "woke" people who have long since been fired, but embracing the racists and fascists who are now running and being platformed and amplified on Twitter? Yes, "Twitter". If Elon Musk can publicly abuse, humiliate, lie about, deadname, and misgender his own daughter to his millions of followers, than I can deadname Twitter.