13 ms·
Can you use GDPR to circumvent BlueSky's adult content blocks?
- irusensei 1y agoBluesky doesn’t sound very decentralized to me.
- pjc50 1y agoIt isn't really, it's "Postel decentralization" (a lot of early internet services people might have assumed were distributed were in fact just a guy, John Postel). I don't think that matters in this context where the rules apply regardless of decentralization. However, I believe that you can in fact just use the protocol without any of the "age verification" nonsense the UK government has imposed on us.
- RobotToaster 1y agoIt isn't, it relies on a single BGS router server.
- dpatterbee 1y agoMy understanding is that Bluesky is a service built on top of a decentralized protocol, ATProto. This allows users to use alternative hosts for their data instead of the bluesky servers, but if you're using Bluesky then they still hold your data. I also think the private DMs might be hosted externally to ATProto because that is all meant to be public information or something. I would assume that the age verification is built at the app layer, so you could use an alternative app (I think they call them AppViews?) to get around the age verification thing. Don't know if alternatives really exist today though, there are probably some.
- Spivak 1y agoThere's a few, I really like PinkSky which makes BlueSky into Instagram instead of Twitter.
- extraduder_ire 1y agoAge verification is done in the client (app/website) the appview (CTO calls it an appserver now) is the backend that services api requests from the default, and most other, clients. DMs themselves are not stored in ATproto, and are kind of a hack. You can migrate your PDS (data server) away from bluesky's servers to another host, and as of a few days ago you can migrate back. (only if you initially signed up to bluesky, not if you started off self-hosting) The following gist is good to glean how the age-verification system works: https://gist.github.com/mary-ext/6e27b24a83838202908808ad528b3318 https://gist.github.com/mary-ext/6e27b24a83838202908808ad528...
- wkat4242 1y agoBlue sky isn't really decentralised. They keep way too much power to themselves. I don't use it for that reason. I do use nostr, Mastodon and Lemmy
- cykros 1y agoThat's what Jack Dorsey realized too, which is why he's a Nostr guy these days.
- throwaway290 1y agoNostr is just a protocol. on which you can just as easy build centralized platforms:)
- Spivak 1y agoIt seems like ATProto and Nostr have a similar architecture and similar centralization failure modes in the relay servers. The "you can run your own but in practice nobody does" problem.
- irusensei 1y agoAccording to https://nostr.watch https://nostr.watch there is a considerable number of operational relays. From what I understand from BlueSky is that personal PDS can host accounts and content but the network depends on big hubs like the main bluesky instance. It almost feels more like a convenient cost cutting strategy from the company behind BlueSky than actual decentralization. Correct me if I'm wrong. This sounds worse than Mastodon. As for Nostr is more of a one to many system where a user would sign a message and post it to a bunch of relays where it can be fetched all while said message itself contains hints where to find it.
- throwaway290 1y ago> According to https://nostr.watch https://nostr.watch there is a considerable number of operational relays. But on Nostr you can build a social app that uses only your relays and your relays can reject anything from everyone else
- konart 1y agoATProto is a protocol too. No need to use bluesky itself.
- nemo44x 1y ago[flagged]
- Geezus_42 1y agoBecause Twitter people aren't super sensitive... :D
- ronbenton 1y agoBut isn’t this just referring to the app view? And there can be (and are) many independent implementations of the app view?
- biggestfan 1y agoThe age verification is client side and can easily be bypassed with a third party client or even with a userscript https://gist.github.com/mary-ext/6e27b24a83838202908808ad528b3318 https://gist.github.com/mary-ext/6e27b24a83838202908808ad528... Bluesky's apps have the verification, but everything else using the protocol can just not implement it.
- numpad0 1y agoyup, completely centralized. The decentralization angle pretty died on spot after anime artists migrating from Twitter was about to hit a critical mass and someone forced them so-called moderation to fix that.
- jrm4 1y agoIt sounds like a dumb kind of centralization; yes, you can download all your old stuff, in the hopes that someone else will host it for you eventually. The smarter thing is the thing we already have with email (and that Mastodon can do) -- you have to place trust somewhere, so do it with whatever decentralized server you choose. I get that it's not robust -- or more specifically you DO have to trust whoever's running the server -- but that's better that the now obvious goofy centralization that Bluesky is now subject to.
- immibis 1y agoBluesky is centralised. Using technology that could also hypothetically support a decentralised platform does not make the centralised platform decentralised. https://arewedecentralizedyet.online/ https://arewedecentralizedyet.online/
- latexr 1y ago> Frankly, it is baffling that such a well-funded company takes this long to answer a simple request. What is frankly baffling is that after the past two decades someone would still believe more money equals better customer service, or that VC-funded companies care even the smallest bit about you.
- grues-dinner 1y agoGood human customer service may be a turn off for VCs hoping for a unicorn. It doesn't scale infinitely, so if you need customer service to make your thing go - and presumably you do otherwise you wouldn't have a rep for good service, you'd have no service and no one would notice - your product probably isn't going to go stratospheric.
- jeroenhd 1y agoCustomer service is one thing, but GDPR data requests are a matter of legal compliance. From their privacy policy page: Data Protection Officer: Bluesky has appointed a Data Protection Officer (DPO). You may contact our DPO at Ametros Group Ltd, Lakeside Offices, Thorn Business Park, Rotherwas Industrial Estate, Hereford, Herefordshire, HR2 6JT, dpo@ametrosgroup.com. Data Protection Representative: Bluesky has appointed a Data Protection Representative (DPR) for both the UK and EU. You may contact Bluesky's EU Representative at Ametros Ltd, Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, Ireland, gdpr@ametrosgroup.com. You may contact Bluesky's UK Representative at Ametros Group Ltd, Lakeside Offices, Thorn Business Park, Rotherwas Industrial Estate, Hereford, Herefordshire, England, HR2 6JT, gdpr@ametrosgroup.com. This shows that the author should file a complaint with the Irish DPA (assuming they're an EU national) or the UK's DPA if they're from there. Bluesky repeatedly exceeded the applicable legal deadlines. They seem to have outsourced their compliance to https://ametrosgroup.com/ https://ametrosgroup.com/ which would probably explain why it takes forever to get them to comply; the people dealing with the legal paperwork don't have access to the API to run a data export because they're a completely different company.
- latexr 1y agoI understand that. Over the years I’ve sent several GDPR requests for my data and its deletion, and I always remind the service in the very first message that the law requires a response within thirty days. But I also know that a failure to comply is very hard to fight. These companies avoid the law for as long as they can. > the author should file a complaint with the Irish DPA Good luck with that. If you follow the work done by noyb, what you quickly learn is the Irish DPA loves US companies and giving them a pass. They actively defend them. The new Irish DPC commissioner is a former Meta lobbyist. https://noyb.eu/en/former-meta-lobbyist-named-dpc-commissioner-meta-now-officially-regulates-itself https://noyb.eu/en/former-meta-lobbyist-named-dpc-commission...
- swiftcoder 1y agoKudos on going through the whole public-facing process. It may be a bit pointless, but it is a good way to unearth process gaps
- jay_kyburz 1y ago> "Asked to provide my country of residence and to prove my account ownership by send an email from the address associated with my BSky account." Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. Is the email "From" field safe to trust? Can it be spoofed? Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services?
- shakna 1y agoIt's usually only reasonable to ask for a government ID, where you have already verified that in the past. Asking for it is discouraged - as that's you now handling sensitive information you should not store. You can only use what you know of the client, to verify their request. Proof of control of the only identity you have, tends to be "fair and reasonable".
- mschuster91 1y ago> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. By the time someone has access to an email account, they could just reset the password and access the data anyway, no loss of trust. > Is the email "From" field safe to trust? Can it be spoofed? If it matches the account email address, send the response to that email. A simple spoof will only lead to the user getting a "your gdpr export is ready" but the attacker can't get to the data.
- torben-friis 1y ago>Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? Isn’t that the general practice? Maybe with extra steps, but most services allow the “I just forgot my password -> I get a recovery email” flow, which trusts that the email from which the account was created is proof of identity. Then you get access to everything else with the password.
- 1y ago
- petercooper 1y agoI have the same issue. DMs coming in, but no way to see them. I'm not bothered by it and would rather it just be disabled, but they could make them read-only (or even just show the author) while disabling replies (which should still adhere to the OSA).
- tonyhart7 1y agoI thought bluesky is decentralized tweet so we don't have to deal with verification like this?????
- evbogue 1y agoThe signed databases can be decentralized, but the index is mostly controlled by Bluesky and most of the 3rd party apps depend on Bluesky API calls. These API calls are not currently applying these tougher filters that the Bluesky social-app applies to the feeds.
- driverdan 1y ago> If you don't want to verify your age, you can still use its services - but it won't serve you porn or let people send you non-public messages. > I think that's pretty reasonable. You lost me right there. Blocking DMs because of draconian age verification is not reasonable. There's nothing inherently problematic about DMs. Someone can be a creep in public just as easily as in DMs.
- billy99k 1y agoand just why is age verification 'draconian'?
- cess11 1y agoBecause it axes a liberty humans have enjoyed since we started talking to each other.
- tempfile 1y agoYour reply has been generated! In order to receive your reply, please complete a routine Age Verification check. To verify, simply post a copy of your government-issued ID into the comment box. FAQs: Q: Why should I give some stranger on the internet a copy of my government ID? A:
- maybewhenthesun 1y agobecause there is no way to verify someone's age without removing their privacy protections. No matter what politicians seem to believe it's just not possible. I've always taught my children never to use their real names online. Precisely to avoid creeps. Mandatory age verification means mandatory identification.
- edent 1y agoI don't think that's quite accurate. Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to the third-party. They relay to the site "this user is / isn't over 18". They don't send the DoB, address, photo etc. So the online service only receives a binary yes/no and nothing else. I don't lose any privacy there. The third-party knows that you wanted to be verified on service xyz, but not what you do there. Depending on the service I'm using, I may or may not care that they know. Handing over a passport / licence to get into a bar leaks more information than that.
- bArray 1y ago> Your Direct Messages. We store and process your direct messages in order to enable you to communicate directly and privately with other users on the Bluesky App. These are unencrypted and can be accessed for Trust and Safety purposes. Your private DMs being unencrypted means that they are semi-private DMs. E2E should be enforced everywhere.
- OkayPhysicist 1y agoDifferent contexts have different threat models. If my goal is to have a secure, private conversation with someone, I'll use Signal. If my goal is to communicate some less-than-sensitive information with someone, but the content isn't relevant to anybody else, then an unencrypted DM is fine. In the context of public-broadcast social media, the service's ability to moderate abusive uses of a DM system is probably more important to me than the ability to have absolute control over who reads my messages.
- extraduder_ire 1y agoThey are working on private repo data, Direct Messages were a hack job added in a hurry. It was one of the things people would hound the developers about any time they posted about anything. Also, "private DMs" would more accurately be called PMs.
- jayd16 1y ago> If services don't want to provide moderation then they shouldn't let their younger users be exposed to harm. Isn't that moderation?
- Rover222 1y ago"We store and process your direct messages in order to enable you to communicate directly and privately with other users on the Bluesky App. These are unencrypted and can be accessed for Trust and Safety purpose" Sounds about right for a platform created specifically because another platform stopped censoring things.
- edent 1y agoYou do know that Twitter's DMs were also unencrypted, right?
- Rover222 1y agoYes, my point is that the Bluesky Trust and Safety committee would probably ban someone for saying trans women aren't women (or whatever opinion is not allowed). Just like old twitter. Undeniably a low-effort and unhelpful comment on my part.
- greatgib 1y agoThis proves that bluesky sucks at least as much as Twitter as it is still a walled garden...
- pfraze 1y agoWe might suck as much as Twitter but not because we’re a walled garden. These rules are applied in our apps, not on other at:// apps, which can decide for themselves what to do about these laws.