12 ms·

Where it's at://

416 points by steveklabnik 1y ago

Kye 1y ago
Finally, some love for for did:web.
- rmccue 1y ago
  webvh seems to be getting some love as well recently, which addresses at least one of the downsides of it. It’s kind of annoying that a huge number of DID methods are specific to cryptocurrencies and are practically abandoned.
indigodaddy 1y ago
This is some newfangled shit to be sure. I guess it’s time for some old dogs to learn some new tricks of this new web..
- quotemstr 1y ago
  I fail to see what problem this thing solves.
  - robmccoll 1y ago
    Data sovereignty and distributed identity. It's trying to avoid a centralized authority on where data is stored or how to resolve and trust an identity other than DNS and using signatures to validate data that you didn't get directly from the author.
  - danabramov 1y ago
    Here's a TLDR on the problem it solves: https://overreacted.io/open-social/#the-big-picture https://overreacted.io/open-social/#the-big-picture. I've linked to this article in the intro. In short, it's a different model where apps participate host user data on the web under user's control. This enables some interesting use cases, like all apps can deeply interoperate by default. It's hard to explain this concisely, the article I linked to is my best attempt.
    - quotemstr 1y ago
      I understand, appreciate, and share the desire for a decentralized and censorship-resistant social graph. I'm just not sure what problem the new URL scheme solves. Is DNS not already decentralized? It's not that I don't see the value in what you're trying to do --- it's that don't understand what problem you're solving that we can't solve with hypertext, RSS, and data attributes. > The advantage of storing structured app-specific entities, such as posts and likes, instead of HTML documents is obvious. Agreed. > This allows you to create many projections of the same data—a profile page, a list of posts, an individual post with comments. WE HAD THIS! In some sense, we still do. XSLT exists. The dream was always that XML documents linked together with defined schemas would be the source of truth for an information web and we'd style them dynamically to provide for different UIs. I mean, look. Maybe the XML-centric semantic web was just an idea before its time. Maybe at:// will succeed where it didn't due to timing, real-world social context, or just the force of will of its proponents. But from a technical POV, I'm just not seeing why I'd want to use this instead of reviving those older but proven technologies.
      - danabramov 1y ago
        This is building on top of DNS. At the center of at:// is a question of identity. For identity, you want some kind of a global login, or a "handle", that you can remember. at:// uses domains for that (e.g. my "handle" is danabra.mov). That is literally DNS. However, you also want somebody to hold your data. Most people don't want to host their own data. (I don't.) So that's where the notion of hosting comes into play. My current host, as explained in the article, is https://morel.us-east.host.bsky.network https://morel.us-east.host.bsky.network. (That's also resolved through DNS.) Finally, the important bit is that I (as an identity) should be able to change both my handle (i.e. how people refer to me) and my hosting (i.e. where my data is stored) without breaking any links to my data from other data ("links between JSON" is how we represent "reply to a post", "like to a reply", "follow of a person", etc). This is why links are tied to an identity rather than to hosting or to handle. The identity document also contains my public key which is important to allow trustless caching and retransmission of the data. That's about it. >But from a technical POV, I'm just not seeing why I'd want to use this instead of reviving those older but proven technologies. I think everything being signed is a big one. There is no need to trust anyone retransmitting the data because it's transferring signed commits. But yes, this is essentially a fusion of something like Git with something like RSS, but for JSON and on top of DNS, HTTPS, CBOR, and WebSocket. Compared to RSS, the novel parts is that you don't need to trust the retransmitters, that it's pushed via WebSockets, that it scales to real-time communication for millions of users (in production today), and that it's application-agnostic but the data formats are application-controlled. E.g. we have different apps like Tangled.org (GitHub on atproto), Leaflet.pub (Medium on atproto), etc, all able to "see" each other's data and interop.
  - doytch 1y ago
    Listen I'm not a crazy huge fan of a lot of new tech, but this is pretty transformational. When reading the first article [1] I was struck by the fact that it granted so much new freedom to your "social identity" on the internet. The comparison to hosting providers was incredible, because imagine you building a website and posting your thoughts there or starting a business there...and then immediately being shut down and all your data lost because of some arbitrary change of policy at your "host". Everyone always talks about how your Google account being tied to logins is scary because you can get arbitrarily locked out. This protocol makes something like functionally impossible since /you/ control your data. [1] https://overreacted.io/open-social/ https://overreacted.io/open-social/
    - card_zero 1y ago
      > Bob, however, isn’t technical. He doesn’t even know that there is a “repository” with his “data”. He got a repository behind the scenes when he signed up for his first open social app. > Bob uses a free hosting service that came by default with his first open social app. > If she owns alice.com, she can point at://alice.com at any server. But does Bob own bob.com? That sounds beyond Bob's abilities and interest level. So Bob is stuck on one platform, in practice, and it's full other Bobs who are also stuck. The "free hosting service" (why is it free?) is now the gatekeeper. It may let him switch platforms.
      - beeflet 1y ago
        Even if bob "owned" bob.com, that amounts to a row in some centralized database somewhere.
        card_zero 1y ago
        It seems to mean that Bob's free hosting service has to be a relatively benign and permanent institution like ICANN, and not some ropey old operation like Photobucket. Others on this thread are talking about Decentralized IDs, https://en.wikipedia.org/wiki/Decentralized_identifier https://en.wikipedia.org/wiki/Decentralized_identifier . Looks like those are stored in several competing systems. There's a blockchain one, a Chinese one that wants to know your real name, and a Microsoft one that wants to store your photo. This all has, uh, implications, which sound much less liberating than this at:// protocol does at first.
  - tolerance 1y ago
    It’s Web3 reanimated.
    - danabramov 1y ago
      I like to think of it as Web3, the good parts.
  - skybrian 1y ago
    You could do it with top-level domain names alone, but that would require users to buy domain names and retain control over them forever. It means you have to trust your domain registrar and pay them fees. This is too big a burden for new Bluesky users. You could do it more cheaply with subdomains, but then you have to trust the owner of the parent domain. So instead, they created a new registry and a way for users to cryptographically sign their registry documents. Since this is all done behind the scenes, most users are still fully trusting the central Bluesky infrastructure. But in theory, they could migrate off of it.
ape4 1y ago
So the atmosphere is in the cloud
sigfubar 1y ago
[flagged]
- danabramov 1y ago
  Here's another article answering this question: https://overreacted.io/open-social/ https://overreacted.io/open-social/. The one you're commenting on links to it in the first paragraph with "if not, read this!" for that exact reason--I can't explain the motivation and technical details in the same post, or to repeat the same explanation from post to post. Here's a tldr if you don't want to read the entire thing: https://overreacted.io/open-social/#the-big-picture https://overreacted.io/open-social/#the-big-picture
  - beeflet 1y ago
    I read this article the other day and I am not sure what the breakthrough is with AT/bsky. It seems like the functionality "This blurs the boundaries between apps. Every open social app can use, remix, link to, and riff on data from every other open social app." is already provided on the web through hyperlinks. There is seemingly nothing in the AT protocol that prevents sites from defederating and enabling vendor lock-in, just like how every other social media site has switched to requiring you to log in to see links. There is seemingly nothing usefully decentralized about it. There is some sort of psuedo-distribution where you can host on your own domain. But like email, I imagine these types of users will be effectively blocked due to spam filtering. It's like P2P if it was invented by people who know nothing about P2P, but just want to create a version of twitter that is immune to the company being bought out by someone they don't like and instituting a different censorship regime.
    - icy 1y ago
      > already provided on the web through hyperlinks. Yeah except there’s no guarantee of structured data there! With AT, each record is specified using a corresponding lexicon—making for much more straightforward interop. > There is seemingly nothing in the AT protocol that prevents sites from defederating and enabling vendor lock-in, just like how every other social media site has switched to requiring you to log in to see links. And that’s fine! Any site can choose to do whatever they please—but the underlying AT records always remain accessible to other consumers (apps, users, …). > I imagine these types of users will be effectively blocked due to spam filtering. Blocked by whom? If the relay (which pulls records from your PDS) “blocks” your PDS, you can simply switch to one that doesn’t. The beauty of AT infra is every piece of it can be run separately. That’s “meaningful” decentralization.
danabramov 1y ago
Author here, happy to answer questions! Re: what is this even about, see my comment here: https://news.ycombinator.com/item?id=45469167 https://news.ycombinator.com/item?id=45469167. Sorry I didn't write an elaborate intro to the article; I kind of meant it for a narrower audience of people looking for an answer to a technical question (how at:// resolves). I'll say this preemptively — actually resolving at:// URIs isn't something you'd do much as an app author because the usual model for apps is to listen to all data commits over the network via websocket (like https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1.us-east.bsky.network%2Fsubscribe https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1....), and to write to a local database whatever you're interested in. So you'd mostly use at:// URIs as unique global identifiers for pieces of data, but you probably won't actually resolve them since the data will be pushed to you. But it's nice that you can always fetch it on demand too. I focused on resolving in this article because I think "following along" the resolution procedure is a really good way to understand how handles, identity and hosting are tied up.
- Vinnl 1y ago
  I might be pre-empting some future articles of yours, and I'm happy to await either those, or me diving into ATProto deeper by myself some time in the future, but: can any app write any data to a PDS? And if so, the more interesting question: what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects?
  - danabramov 1y ago
    Great questions! Yeah, this is something I want to write about it in the future. An app can write to PDS if the user grants it access via OAuth. Currently this access is very coarse (which is bad!) although backing up the entire repo is easy (which is good! but should be made more accessible to normies). There is an active workstream on OAuth Scopes (already partially deployed) which will let apps request more granular access (e.g. apps can write to "their own" collections but also ask to write e.g. Bluesky posts). In UI, this is done through sort of "bundles" of permissions. See https://github.com/bluesky-social/atproto/discussions/4118 https://github.com/bluesky-social/atproto/discussions/4118 for tracking issue. > what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects? Atproto data is governed by "lexicons" which are essentially type definitions used by app authors. E.g. `app.bsky.feed.post` type definition is maintained by the Bluesky team. There's a codegen that generates validation code from that definition. If validation doesn't pass, the Bluesky app server will just ignore that record. Records are generally treated by apps as untrusted input, similar to form submissions. They can be validated during ingestion or in the process of usage later.
gerdesj 1y ago
"Given an at:// URI, how do you locate the corresponding JSON?" This is chicken and egg stuff. I don't get it and I've picked on the intro of the explainer. Why would I want "the JSON"? Yes, I did skim the "read this" link. It's not for me.
- danabramov 1y ago
  Yeah, sorry for abrupt intro. In short, at:// protocol lets you build apps that can deeply interop and query/embed each other's information, allow the user to have a shared user identity between apps, and allow the user to self-host their content (or move their hosting) without impacting the apps. It does this by giving bits of JSON permanent URIs that aren't tied to a specific user handle or hosting server, but instead are rooted in identity. The article describes how that works (and what an "identity" is) in technical detail. Here's a concrete example: a blogging app (https://leaflet.pub https://leaflet.pub) automatically "sees" mentions of a Leaflet post on a different microblogging app (https://bsky.app https://bsky.app) and can display them: https://bsky.app/profile/o.simardcasanova.net/post/3luujudlr5c2j https://bsky.app/profile/o.simardcasanova.net/post/3luujudlr.... This is not done by hitting an API; it's just that both apps aggregate the same information from the open network into their respective databases.
  - baliex 1y ago
    I'm pretty new to the at:// protocol, and I like what I'm reading, thanks for the write-up. To your "This is not done by hitting an API" point; if I understand correctly, I'd argue that the _endpoints_ that you detail in your post _are_ the API. The whole point is that there's no single _central_ API, but each server that wants to be part of the network participates by hosting an API that meets the standard outlined in the protocol. In a way it's semantics, but I'd be interested in yours thoughts on that. To either correct or confirm my understanding.
    - danabramov 1y ago
      No, that’s really not the case. The Leaflet app “knows” about Bluesky posts by reading Leaflet's own database on the Leaflet servers. It doesn’t need Bluesky’s cooperation to use “Bluesky’s” public data. It doesn’t need to hit Bluesky’s API for that. And if Bluesky shut down its API completely, it would still work. This is because a stream of all public data from all apps is being subscribed to by all apps. Whatever you care about, you save into your app’s database. Each app’s database serves as an app-specific index of the data on the network. If you want to query Bluesky posts later, you just save them as they stream in. So every app can piggyback on data created by other apps. And anyone can run a "retransmitter" (aka a relay) like this. It's an application-agnostic aggregator over websockets. The one operated by Bluesky-the-company is most popular one, but https://atproto.africa/ https://atproto.africa/ is another one, and you can get one running yourself for about $30/mo; the implementations are open source.) I explain this in more detail in https://overreacted.io/open-social/ https://overreacted.io/open-social/, Ctrl+F to "to a stream that retransmits events from all known repositories on the network".
thecommakozzi 1y ago
[dead]
mmbizzle 1y ago
What about when Bluesky goes out of business and plc.directory is shut down? This all seems unnecessarily fragile.
- mempko 1y ago
  This is no different then how the web works. So not a great argument against this protocol.
  - beeflet 1y ago
    How does it improve over the existing system, other than slapping the word "decentralized" on?
- Vinnl 1y ago
  To strongman the article, I imagine that's the reason behind: > Bluesky is currently moving PLC to an independent legal entity in Switzerland to address some of these concerns. The AT community is also thinking and experimenting. (The article has links there.)
  - danabramov 1y ago
    I've also linked to https://updates.microcosm.blue/3lz7nwvh4zc2u https://updates.microcosm.blue/3lz7nwvh4zc2u and https://plc.wtf/ https://plc.wtf/ which are relevant. These are good questions to ask!
  - xmprt 1y ago
    What happens when the independent legal entity stops getting funding and has to shut down?
    - edoceo 1y ago
      Need a PLC+DHT thing maybe? Or maybe someone will try to blockchain?
      - 1y ago
hyperhello 1y ago
"They’ll figure out the physical server where its JSON is currently hosted, and show that JSON for you" So, DNS?
- danabramov 1y ago
  A combination of DNS and HTTPS (as described further in the post).
globalnode 1y ago
how can it be hacked? can i impersonate someone else? whats to stop me from making posts with someone elses handle. how secure is the data? or does it just ride over tls and use that for protection.
- danabramov 1y ago
  Every commit in your repo is signed with your private key which stays on your hosting. (You also can get another special key for your identity that would let you force-change hosting if your hosting gets adversarial.) Changes from your hosted repository get transmitted as signed commits (kind of like Git) so they can be verified by those receiving the retransmission against your public key.
  - deleted 1y ago
    [deleted]
Oper_52 1y ago
ATProto is even more overhyped than Rust. I'll stick to Twitter and Usenet, thanks.
rmccue 1y ago
Excellent explanation as always from Dan, and timely with the latest news from Bluesky on moving the PLC management. We picked the same DID systems for https://fair.pm/ https://fair.pm/ to decentralise WordPress plugin distribution (and general management for user-facing packages; think App Store rather than Cargo). The Bluesky folks (especially Bryan) were super helpful in helping us out - even shipping Ed25519 key support so we could use libsodium. (We’re designing our protocol on top of DIDs and using Bluesky’s stackable moderation, but chose not to use atproto directly - but the great thing is that DIDs are a W3C standard, and PLC isn’t tied to atproto.)
- password4321 1y ago
  Not gonna lie I can't resist asking for more info on who is "we" (and a link with more about the "what"), it sounds like a technical solution is coming down the pipe vs. all the WordPress drama.
  - deleted 1y ago
    [deleted]
  - rmccue 1y ago
    “we” = group of long term contributors and core committers, including myself (I wrote the WP REST API), hosted by the Linux Foundation. (More info on the linked site; I don’t want to hijack the thread too much.)
- supermatt 1y ago
  > PLC isn’t tied to atproto Isn’t PLC (a did method created by bluesky) tied to bluesky (or some other central authority)? Why do they call it a did when it’s centralised? As did:plc isnt portable, why didn’t they just use did:web, and decorate the identity docs with PLC-like behaviour? Why isn’t the method-specific-id part of the did something deterministic/portable, like a hash of a public key that can at least permit some revolver-driven portability? Why didn’t they use some mechanism for decentralisation, like a DHT (e.g. did:pkarr)? It seems to me that PLC is thinly veiled attempt for another master to exert control.
magicalhippo 1y ago
So any server storing such at:// links will need to do some DNS/HTTPS dance to get the canonical representation, or permalink as the author calls it. Doesn't that make it quite fragile without functioning DNSSEC? Haven't really thought it through but my immediate reaction is DNS poisoning seems like it could do some damage here, allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or?
- danabramov 1y ago
  This is a bit beyond my understanding (I'll ping someone who may be able to answer), but https://atproto.com/specs/handle#dns-txt-method https://atproto.com/specs/handle#dns-txt-method mentions "DNSSEC is not required" (though I'm also not sure that's what you're asking). >allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or? DNS only resolves the Handle->DID, but you still need to verify DID->Handle mapping by getting the DID Document. It's bidirectional.
  - deleted 1y ago
    [deleted]
  - magicalhippo 1y ago
    > "DNSSEC is not required" I guess I need to study that in more detail, as I don't immediately see how it's preventing DNS attacks. > DNS only resolves the Handle->DID, but you still need to verify DID->Handle mapping by getting the DID Document. It's bidirectional. Yes but if I've already hijacked the DNS to point to my own DID, what's stopping me from saying I go by your handle? Sure older posts wouldn't verify, but a new post would be signed by the keypair I've put in the DID I hijacked, no? Or is that some other key in the DID? New to AT so perhaps this is a non-issue. Main concern of mine is that DNSSEC seems to not have a very bright future, so not something new stuff should rely on IMHO.
    - danabramov 1y ago
      >Yes but if I've already hijacked the DNS to point to my own DID, what's stopping me from saying I go by your handle? The process of establishing "this handle points to this DID" consists of: 1. Resolving handle -> DID via HTTPS/DNS (part you're concerned about) 2. Downloading the DID Document from its host 3. Verifying that the DID Document contains the same handle Hijacking the DNS does not help you with (2) and (3). The handle isn't considered associated with the DID until (2) and (3) are done.
stebalien 1y ago
The recommendation to resolve from handles to DIDs for "permalinks" is concerning to me: - My handle is something _I_ control. I can make it point at a different PDS at any time. - My DID is something my PDS controls. I could solve this by indirecting through a web DID under my control, but there's no recommendation anywhere in Bluesky's documentation. Is that something everyone needs to do to ensure real identity portability? edit: I'm not sure this CAN be solved without running a PDS given that I can't use my own keys. What am I missing here?
- danabramov 1y ago
  This doesn't look right to me. What you control is your identity (i.e. DID Document). As long as you control your identity, you can change either your handle or your hosting aka PDS. Your hosting/PDS does not control your DID.
  - rmccue 1y ago
    What stebalien might be referring to is that your DID document for PLC specifically is controlled by anyone with the rotation key. In the Bluesky implementation, this is Bluesky for convenience’s sake, to make it possible for users to easily sign up. (I’m not sure internally if it’s part of the PDS or held separately.) PLC has a mechanism allowing “higher” keys to override “lower” ones within a certain time window, so being able to add your own rotation key that “outranks” Bluesky’s would solve this issue. Alternatively, use web DIDs and then it’s fully self-managed just as DNS would be.
    - stebalien 1y ago
      Is there any documentation on how to do this without running a custom appserver and/or PDS? Can I create my own DID and delegate to another DID?
      - rmccue 1y ago
        This is mostly separate to the PDS - Bluesky is more like the client here (albeit, they also currently run the PLC service). It’s part of your DID document which they manage for you mostly, but there’s ways to take ownership of your PLC DID - see Dan’s links for that. For our non-atproto uses of the PLC directory, we have similar needs, and we’ll likely let users provide their own public key before we create their document to help solve this. We have a technical audience though, so that solution may not make sense for Bluesky - but there’s a lot of people thinking about how to improve this in the atmosphere.
drnick1 1y ago
This is verbose and unclear. An article like this should always start by explaining what problem it tries to solve before going into technical details.
- danabramov 1y ago
  This is a technical explanation for an audience already interested in the topic. The motivation ("explaining the problem") is described in the article linked in the very first sentence. Here's a tldr: https://news.ycombinator.com/item?id=45469167 https://news.ycombinator.com/item?id=45469167
  - drnick1 1y ago
    Thanks. It's quite shocking however that GPT did a better job at explaining this to me than the original article.
    - danabramov 1y ago
      Which article are you talking about? I think https://overreacted.io/open-social/ https://overreacted.io/open-social/ (which is what I linked to) gives a pretty detailed explanation if that's what you wanted. As for the article in today's submission, I meant it for the audience that's already interested in the topic, and did not pad it out with a motivational section. I'm glad GPT was useful to you.
- auggierose 1y ago
  What you might see as verbose, I think is exceptionally clear. Also, the article comes with an entire other article explaining the problem, so not sure what you are on. If you cannot even click on a link, maybe you shouldn't complain about verbosity in the first place.
drsanta 1y ago
The at protocol seems a little Nebraskan Church Excel doc complex: https://xkcd.com/1667/ https://xkcd.com/1667/
- verdverm 1y ago
  this may help see it as an "anyone can participate at any point" event stream hence why it is called the "activity transfer protocol" https://atproto.com/articles/atproto-for-distsys-engineers https://atproto.com/articles/atproto-for-distsys-engineers
drnick1 1y ago
I still don't understand how this project meaningfully addresses the problem of identity and data ownership. When it come to identities, either you have your own domain, or you use someone else's domain (say, Bluesky). Most people don't have domains, and so their identity will be owned by a third party. You also have the same problem when it comes to the data itself. The moment Bluesky or some other server bans you, your repo is shut down and you lose the ability to move the data somewhere else. In short, this is exactly like email. Unless you have your own domain and server you don't control anything.
- password4321 1y ago
  At least with email you can own a PGP/SMIME key and take it elsewhere, right? Isn't this something similar with ATproto?
  - danabramov 1y ago
    Yes, see here: https://news.ycombinator.com/item?id=45471337 https://news.ycombinator.com/item?id=45471337. You can change your domain with no cooperation from whoever owns your current domain. And you can change your host, provided you have a backup of your data. (If the old hosting doesn't cooperate, you'd also need a rotational key.)
- athrowaway3z 1y ago
  I'm not a user, but I do think there is a need for these type of schemes. Approximately 0% of email users could change email host, and prove their identity between the old messages and the new messages. The value is it caps bluesky's "window of abuse". Platforms like Facebook or Twitter have dialed up the enshitification far beyond what I find acceptable, but many people are still on there. A competitor to bluesky can decide how to approach it. Like staying (partially) compatible, and decide to compete on UI, repo storage, or user admin.
- solatic 1y ago
  > Most people don't have domains, and so their identity will be owned by a third party. Indeed, and as a result, such users will always be vulnerable to specific risks like sudden bans, i.e. when the hosting service becomes adversarial. The only full protection is to own your own domain off a neutral TLD, with protocols that use DNS to describe how traffic should be routed. But, because most users don't have domains (as you pointed out), the state-of-the-art can still be improved upon with partial flexibility and protections, when the hosting service is cooperative. This project allows people to keep their Bluesky handle (because they don't own a domain) while (hypothetically) moving their data hosting to a different provider, unlike current Big Social where your data is stuck on Facebook/X/Instagram/TikTok/YouTube forever. Bluesky has an interest in this because it also allows people to set up their own handle and move their hosting to Bluesky. Sometimes we improve upon the existing state of the art not by delivering perfect solutions, but by delivering improvements upon limitations that we accept as a given (like the fact that most users will not set up their own domains).
teddyh 1y ago
This seems to fill the same function as DNS, but adds a layer of abstraction on top of it, while also adding a dependency on a service provided by Bluesky. I fail to see how this improves things on the whole.
- danabramov 1y ago
  It builds on top of DNS (in at least in two places) so it’s not equivalent — and it fills a different function to it. See https://news.ycombinator.com/item?id=45469296 https://news.ycombinator.com/item?id=45469296 for a breakdown. PLC is being spun out into an independent entity, the longer term goal is for it to operate somewhat similar to ICANN. Its code is easy to run so something else could conceivably replace it. It’s also possible for AT to allow other `did` methods in the future as long as they’re persistent and can be performantly resolved.
AtlasBarfed 1y ago
So what you need is a sort of document or object-level DNS? Sure would be tough, because it makes name distinction a lot harder, and it's going to be a lot more granular?
angerson 1y ago
This is a nice write-up. I recently added post-to-bluesky support to my ongoing social-media-scheduler project [1], thinking it would be the simplest of the services to work on, but I ended up getting really confused instead. DID and handle resolution was the easiest part of ATProto---as the author says, a library can do the job easily. For Ruby it's DIDKit [2]. Where ATProto really threw me was the seeming non-ownership of record types. Bluesky uses "app.bsky.feed.post" for its records, as seen in the article; there seem to be a lot of these record types, but there doesn't seem to be a central index of these like there are for DIDs, or a standard way of documenting them... and as far as I've been able to find, there's no standard method of turning an at:// URI into an http:// URL. When my app makes a post on behalf of a user, Bluesky only sends an at:// URI back, which I have to convert myself into an http:// URL to Bluesky. I can only do that with string manipulation, and only because I know, externally, what format the URL should be in. There's no canonical resolution. [1]: https://toucanpost.com https://toucanpost.com [2]: https://github.com/mackuba/didkit https://github.com/mackuba/didkit
- Tomuus 1y ago
  Record types are now "on protocol", you resolve them via a similar mechanism as in the article. https://atproto.com/specs/lexicon#lexicon-publication-and-resolution https://atproto.com/specs/lexicon#lexicon-publication-and-re...
  - danabramov 1y ago
    As an example of that, if you open any `app.bsky.feed.post` in pdsls, the "Info" tab[1] links has a link to the "Lexicon document" for it: [1]: https://pdsls.dev/at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/app.bsky.feed.post/3m2e3z65ark2n#info https://pdsls.dev/at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/app.... [2]: https://pdsls.dev/at://did:plc:4v4y5r3lwsbtmsxhile2ljac/com.atproto.lexicon.schema/app.bsky.feed.post https://pdsls.dev/at://did:plc:4v4y5r3lwsbtmsxhile2ljac/com....
- verdverm 1y ago
  > I have to convert myself into an http:// URL to Bluesky at:// URIs and specific lexicon are not limited to a single app. The NSID (app.bsky.feed.post) has authority based on domain, but Bluesky cannot prevent anyone from reading / writing records of that type. There are alternative apps that read the same at:// but put them under a different https://... tl;dr, there is not a 1-1 mapping between at:// and https://, it's 1-N
thrown-0825-1 1y ago
Reminds me of the various crypto protocols talking about theoretical decentralization while entirely bound to 1 platform with no other useful apps in sight.
- stevage 1y ago
  Much like Git and GitHub (at least for many years, it's improved a little bit now).
  - porridgeraisin 1y ago
    I don't see how. Many large projects have been running with git patches over emails for decades.
    - jonhohle 1y ago
      Yeah, that’s a really odd take. Git is completely usable apart from GitHub and I would wager that the majority of Git usage happens without GitHub. I personally have far more personal repos hosted on a NAS than anything in GitHub, and while I did work for one company that used GitHub professionally, I can’t imagine it’s anywhere near ubiquitous. Prior to that I worked at a company with 10s of thousands of internal git repos and before their migration to git used a git front end for perforce. Prior to that (and prior to GitHub), I used a git front end for subversion. I see GitHub as the successor to SourceForge, not a requirement for using git.
      - stevage 1y ago
        I guess we are just in very different professional circles. I've worked with dozens of teams over the last 10 years or so, and I've never come across anyone that self-hosts a repository. The vast majority use Github, and there's been a couple of Bitbuckets, and a couple of GitLabs. That's it. Prior to that there were a few Subversions, a Perforce, MS's thing (TFS?).
        1y ago
rmoriz 1y ago
After 3 years on Mastodon and some lurking on bsky, I believe the main issue is not technical but getting and keeping interesting content on a platform. This is a social issue as bubbles ruin everything over time. OTOH using algorithms to mix some „foreign“ content into the feeds causes outrages. Sure we can all go web3 and self-hosted but nobody will read. Mastodon is the posterchild of a failed experiment. I‘m interested in the creative, productive, inspiring long-tail content on all platforms instead of migrating the peer group over to a new platform every couple of years. I know them already, I have better ways to communicate with my direct peers and the rest is like having 500 contacts on LinkedIn: A social illusion. I appreciate and respect the technical efforts behind atproto, but yet I can‘t see that it solves the problem described above.
- zoul 1y ago
  In what way is Mastodon a failed experiment? Low number of active users or something else?
  - rmoriz 1y ago
    Mastodon never had a good amount of orginal content to explore, only very few creators produced and shared. Topics I followed were mainly infosec, programming, biking but content and interaction faded dramatically over the last 6 months. You won’t get anything back, no reach, no constructive feedback, no real life contacts. Twitter was a place to get inspired and learn new things, find OC memes, code snippets, niche insight, etc. Mastodon lately just went full anticapitalist, anti-tech, anti AI. Nothing insightful. Irrationality. Depression. Reddit is still a better place to discover and discuss things, if you find active subs covering a topic.
- numpad0 1y ago
  Yeah it's solving a wrong problem. What's needed is means to get enough bandwidth of data, not giving yet another blog site you can post to. The kind of content that wins the Internet is never the kind that'll be "popular", despite all objective data, so whoever to run the platform has to "algorithm" the system to prefer "popular" contents which destroys the community as well as greater society in matters of decades. We just needed an RSS with a local algorithm.
deleted 1y ago
[deleted]
jiehong 1y ago
Performance worries me when reading that. Even with having a cache as explained.
- danabramov 1y ago
  As stated near the end of the article, this isn’t something you’d do much as an app developer. The article describes how to pull but the predominant model for building apps is to have the data pushed to you. So in practice you’d use at:// URIs as unique identifiers for the data you’re receiving and indexing on your backend, not something you actually need to resolve. You wouldn't need to resolve them because you'd be receiving the JSON itself via the websocket.
  - verdverm 1y ago
    To add, it's largely required for an app to listen to the event stream because a user may write a record you care about directly (not through your app), and you likely want to know about that as "real-time" as possible. Crawling will never get you close to that
1718627440 1y ago
Why do they use forward names for the username, but backward names for the server? That's inconsistent.
- danabramov 1y ago
  Backward names are not used for the "server". (I presume that by "server" you mean hosting, which is determined by the `serviceEndpoint` in the DID document rather than by something in the AT URI, as the article explains.) If you're asking about “app.bsky.” in the AT URI, it doesn’t indicate a server you’re going to connect to. As stated in the post, it indicates a data format. Think of it as a file extension which describes who governs the schema of that JSON. Formats (called "lexicons" in AT) use a reverse-namespace scheme so that formats governed by the same app appears next to each other alphabetically. That might remind you of Java.
1718627440 1y ago
I don't see why you need another URI scheme at all. Most protocols already support usernames: user@domain. All you need to do is make the part after @ optional like it is for email.
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- danabramov 1y ago
  Can you clarify what the proposed change is? I don't quite follow. For example, what does `at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/sh.tangled.feed.star/3m23ddgjpgn22` become ?
  - 1718627440 1y ago
    https://did:plc:fpruhuo22xkm5o7ttr2ktxdo@/sh.tangled.feed.star/3m23ddgjpgn22 which then resolves to: https://did:plc:fpruhuo22xkm5o7ttr2ktxdo@morel.us-east.host.bsky.network/sh.tangled.feed.star/3m23ddgjpgn22 There might be conflicts there with a specification of passwords, so you need to use another separator than :.
    - danabramov 1y ago
      That's not a valid HTTPs URL though, is it? Since there's no specific location to hit. Maybe I'm missing something.
      - 1718627440 1y ago
        Then i did not understand the article, I thought morel.us-east.host.bsky.network was the specific location after resolving the DID.
        1y ago
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
akk0 1y ago
Inspired by another recent post on ATProto I signed up for bsky, but all I see is endless American politics. I relentlessly click "less like this" but it doesn't seem to budge. Is this just what the platform is like? Being constantly barraged by the same predictable takes on today's bizarre overseas controversy is not very conducive to mental peace...
- rcxdude 1y ago
  It does thankfully have a functioning non-algorithmic feed that only shows who you've followed, which I feel is the only way to maintain sanity on any of these platforms.
  - akk0 1y ago
    I imagine myself switching over to that pretty quickly if I do stick with the platform (I also use YouTube that way) but that doesn't address the discovery problem. It's just really sad that you give people a platform to say whatever they want to the world and most people seem to have little to say beyond "here's what made me unhappy today"...
    - downsplat 1y ago
      > that doesn't address the discovery problem. The real problem is the expectation of immediate discovery. People have gotten used to "give me something new now", and the algorithm complies but then quality is low. Slow, organic discovery is where it's at. Seed your feed by following people you already know, then slowly add other people you come across. If your feed is half empty for weeks, that's a feature, not a bug.
      - deleted 1y ago
        [deleted]
      - spartanatreyu 1y ago
        This is exactly why mastodon is so useful. It doesn't have an algorithm, it only shows you who you follow in chronological order. It's not for profit, so it isn't trying to drive engagement. Chasing engagement just leads to feeds full of spam, clickbait and ragebait.
ulrischa 1y ago
To make bluesky really lift of and become widely accepted for decentral social media there should be a simple solution to self host your postings. E.g. something you can easily host on a webhosting with php or so. The docker container provided is great but one step to high for broad usage.
- danabramov 1y ago
  Yeah, it needs to be easier to do. It's already getting more accessible with tools like https://pdsmoover.com/ https://pdsmoover.com/ and communities like Blacksky offering hosting. Ideally there would be many such providers.
brap 1y ago
>Essentially, you need to hit the https://plc.directory https://plc.directory service with a GET To me this is where the entire model breaks down and becomes 100% centralized. At the very least, I would expect that there would be a configurable list of such trusted directories, entirely decoupled from the protocol itself, similarly to DNS roots or CAs.
- redleader55 1y ago
  But you can use did:web:fqdn if you want; it's explained in the article.
  - account42 1y ago
    And few enough people will do that so Bluesky can just kill off support for it when the service becomes popular and they move to the extraction phase without much opposition. Remember all the chat services that supported XMPP before they killed that? Same level of guarantee here. If most users are expected to choose the centralized option it might as well be the only one.
tempodox 1y ago
> Whoever’s hosting the data could change over time… But the fundamental fact remains that when you host your data on someone else’s system (without a binding agreement), it can vanish or become inaccessible at any time for any reason. And you won’t have any control over who can access it or why.
- danabramov 1y ago
  Yes, which is already the case with every app you use. But like I explain in the second half of https://news.ycombinator.com/item?id=45471337 https://news.ycombinator.com/item?id=45471337, you’d still be able to restore your account from a backup to a different host without losing reach or breaking any links. See also https://blog.muni.town/atproto-isnt-what-you-think/ https://blog.muni.town/atproto-isnt-what-you-think/ which goes into more detail on the consequences of this approach.
deleted 1y ago
[deleted]
andandandand11 1y ago
[flagged]
James_K 1y ago
I've never really gotten AT protocol. It just seems like reïnventing the web. I guess it's a little more secure than the normal web because there's no JS, and you can make it seem more integrated because users won't have custom styles, but neither of these are particularly appealing to me. HTML + RSS does basically the same job, and then link aggregator sites like news.ycombinator.com recommend content much better than the algorithms you get in social media. I guess the big advantage is reposts and comments, but practically you could achieve these in the regular web through indexing with backlinks. The conceptual service Bluesky is providing is essentially just a web-index of items published using the AT protocol.
- danabramov 1y ago
  I tried to make a pretty extensive case for it at https://overreacted.io/open-social/#open-social https://overreacted.io/open-social/#open-social, I'd suggest reading it with an open mind to form an opinion. I think there's quite a few interesting aspects there, like apps being able to "piggyback on" data from other apps. I wouldn't call AT a "reinvention" of the web, personally I see it as a minor bump that codifies some conventions that let apps interoperate while keeping the source of user data outside those apps. New products can be started from data of other (even defunct) products and remix it. That's pretty powerful.
  - James_K 1y ago
    I'm still not really convinced. Look at it from my perspective: I have my website, BSky isn't compatible with the web, therefore I would have to provide two different versions of all content I publish to satisfy someone else's protocol. It's very annoying. It would be simpler and more effective if it was built on existing web technologies. The only actually new things AT and BSky provide is a signature scheme for content, and the ability to store replies, follows, and likes. You manage most of that in as a few HTML meta tags à la OpenGraph. The other parts of it already exist, those being a web-page designer and an indexer.
losvedir 1y ago
So is the protocol sort of like a big public kafka topic? If you want to create a new web app, say, you don't actually store the data yourself. You basically set up a listener to "the big topic in the sky" and ask your users to save all their data in their own respective places, which the protocol will propagate out into the world such that your app's listener will hear about and cache it. Do I have that right? It's a very interesting concept for how to build a web app while the users still own their data. I don't have a great understanding of the process, though. Are their "offsets" or something to make sure you don't miss updates? Partitions for scalability? Maybe I'm pattern matching too hard to Kafka here.
- verdverm 1y ago
  > So is the protocol sort of like a big public kafka topic? yes, at least the firehose is that, and anyone can subscribe or run their own https://atproto.com/articles/atproto-for-distsys-engineers https://atproto.com/articles/atproto-for-distsys-engineers > to make sure you don't miss updates Yes, the firehose and jetstreams have a cursor, though with limited time window depending on the instance. (1-3h -> 72h) If you want the entire history you do what's called a backfill
  - maelito 1y ago
    Hi, thanks for these info. I have a web app that produces atproto records, app.cartes.comment. My server listens to Jetstream and builds its DB based on this. But what about if my server goes down for say 4 days ? How can I rebuild my DB to catch up those days ? It looks like Jetstream cannot work for this. My need is simple : give me all the records of the collection on the whole atmosphere. How to do this ?
crazygringo 1y ago
I'm fascinated by the idea of at://. But besides even whether it would ever make business sense, I worry about basic things like: - If you own your data, can't you change it at any time? I can make perfectly reasonable posts that lots of people agree with, then change it to vile stuff. Even if existing sites at the time store hashes and prevent updates, a new site loading the post will never know it was once different. - How are things like upvotes tracked? If every upvote is an object stored by the person upvoting, how do you even find the people upvoting? And doesn't it become trivial to create tons of fake profiles upvoting everything you do? - And how is moderation/spam even handled? Now if sites are supposed to be showing replies to posts made from everyone across any platform, not just their own, how is moderation handled when you don't know anything about these accounts making replies? I just don't understand how all of the necessary work around transparency, accountability, moderation, and spam can be done in a world where users store their own data, and therefore can fake their own data.
- reactordev 1y ago
  Why not publish the changes too? The data of the resulting json can include whatever you wish. That data is your data. So if an app developer wants to include the history of changes, that would be the place to do it. Or link to previous at:// addresses for it. Walk it back like a linked list. As for the identity moderation part, if you read up about DID, it tells you how to know who they are and you can block them or do whatever you need to do. The point isn’t that this is some blockchain, it’s just a federated method to share data when you own the data. Poison well attacks aside. In the end, it’s a way to say this person, generated this data, at this location, in case you’re interested. If you care about the things you mentioned, you might not be interested at all.
  - crazygringo 1y ago
    > Why not publish the changes too? Because you are being adversarial and trying to trick people. > if you read up about DID, it tells you how to know who they are But it doesn't tell you're they're not a spammer. I don't see anything about reputation. > in case you’re interested But that's the point. You're interested in legitimate upvotes to try to find useful content. You're not interested in spam upvotes. In a decentralized world, how does anyone tell the difference?
onetom 1y ago
I wonder, how rigidly has the JSON format been baked into the protocol. It feels like a shortsighted choice, just because it's prevalent in recent decades. It took years to implement performant parsers for it and it has a lot of quirks, missing features and the tons of double quotes and mandatory commas significantly harm its human readability... Not sure what would I recommend instead, but personally I would prefer using EDN instead, as a Clojure programmer https://github.com/edn-format/edn https://github.com/edn-format/edn
- verdverm 1y ago
  You can write lexicon (the schema) in whatever language you want and then transform them to JSON for sharing. The record format should be something widely used and implemented for sending over the wire. There are lots of languages and ecosystems participating.
  - rixed 1y ago
    > The record format should be something widely used and implemented for sending over the wire. That's just one of the parameters. It should also be something efficient if it's going to be sent over the wire at scale.
    - verdverm 1y ago
      We're all sending JSON around all the time, it's not really that big a performance hit, especially in context of the formats transiting networks today (it's the same, lots and lots of JSON)
      - danabramov 1y ago
        Note that it's CBOR being sent over WebSockets (afaik).
        verdverm 1y ago
        The firehose is CBOR, jetstream is JSON (which more people use) I was mainly speaking more generally than atproto. Most APIs talk JSON these days
rixed 1y ago
The article is very light on details about the key used to sign changes of the DID (when the article says "all changes to their data" I guess it refers to the DID?) But suppose I'm user foobar.bsky.social (appologies to the actual foobar). I've created this identity on bluesky, I do not remember having uploaded a key, or being ofered to download one. Where is that key exactly? Who owns it? And how/when is it used? Also, if the did is hosted on plc.directory, what mechanism prevent whoever controls that website to overwrite my did and impersonate me?
bohlen11 1y ago
[dead]
enbugger 1y ago
Do I understand it correctly that nothing stops so called feed builders just stop showing post of particular profile at day X? Yes, it will noticed but that would not matter much as it can be already too late. Or if to be more general, can AtProto stop intel services to erase/pessimize particular post/profile from the network?
deleted 1y ago
[deleted]

Where it's at://

416 points by steveklabnik 1y ago

Kye 1y ago

Finally, some love for for did:web.

rmccue 1y ago
webvh seems to be getting some love as well recently, which addresses at least one of the downsides of it. It’s kind of annoying that a huge number of DID methods are specific to cryptocurrencies and are practically abandoned.

indigodaddy 1y ago

This is some newfangled shit to be sure. I guess it’s time for some old dogs to learn some new tricks of this new web..

quotemstr 1y ago
I fail to see what problem this thing solves.
- robmccoll 1y ago
  Data sovereignty and distributed identity. It's trying to avoid a centralized authority on where data is stored or how to resolve and trust an identity other than DNS and using signatures to validate data that you didn't get directly from the author.
- danabramov 1y ago
  Here's a TLDR on the problem it solves: https://overreacted.io/open-social/#the-big-picture https://overreacted.io/open-social/#the-big-picture. I've linked to this article in the intro. In short, it's a different model where apps participate host user data on the web under user's control. This enables some interesting use cases, like all apps can deeply interoperate by default. It's hard to explain this concisely, the article I linked to is my best attempt.
  - quotemstr 1y ago
    I understand, appreciate, and share the desire for a decentralized and censorship-resistant social graph. I'm just not sure what problem the new URL scheme solves. Is DNS not already decentralized? It's not that I don't see the value in what you're trying to do --- it's that don't understand what problem you're solving that we can't solve with hypertext, RSS, and data attributes. > The advantage of storing structured app-specific entities, such as posts and likes, instead of HTML documents is obvious. Agreed. > This allows you to create many projections of the same data—a profile page, a list of posts, an individual post with comments. WE HAD THIS! In some sense, we still do. XSLT exists. The dream was always that XML documents linked together with defined schemas would be the source of truth for an information web and we'd style them dynamically to provide for different UIs. I mean, look. Maybe the XML-centric semantic web was just an idea before its time. Maybe at:// will succeed where it didn't due to timing, real-world social context, or just the force of will of its proponents. But from a technical POV, I'm just not seeing why I'd want to use this instead of reviving those older but proven technologies.
    - danabramov 1y ago
      This is building on top of DNS. At the center of at:// is a question of identity. For identity, you want some kind of a global login, or a "handle", that you can remember. at:// uses domains for that (e.g. my "handle" is danabra.mov). That is literally DNS. However, you also want somebody to hold your data. Most people don't want to host their own data. (I don't.) So that's where the notion of hosting comes into play. My current host, as explained in the article, is https://morel.us-east.host.bsky.network https://morel.us-east.host.bsky.network. (That's also resolved through DNS.) Finally, the important bit is that I (as an identity) should be able to change both my handle (i.e. how people refer to me) and my hosting (i.e. where my data is stored) without breaking any links to my data from other data ("links between JSON" is how we represent "reply to a post", "like to a reply", "follow of a person", etc). This is why links are tied to an identity rather than to hosting or to handle. The identity document also contains my public key which is important to allow trustless caching and retransmission of the data. That's about it. >But from a technical POV, I'm just not seeing why I'd want to use this instead of reviving those older but proven technologies. I think everything being signed is a big one. There is no need to trust anyone retransmitting the data because it's transferring signed commits. But yes, this is essentially a fusion of something like Git with something like RSS, but for JSON and on top of DNS, HTTPS, CBOR, and WebSocket. Compared to RSS, the novel parts is that you don't need to trust the retransmitters, that it's pushed via WebSockets, that it scales to real-time communication for millions of users (in production today), and that it's application-agnostic but the data formats are application-controlled. E.g. we have different apps like Tangled.org (GitHub on atproto), Leaflet.pub (Medium on atproto), etc, all able to "see" each other's data and interop.
- doytch 1y ago
  Listen I'm not a crazy huge fan of a lot of new tech, but this is pretty transformational. When reading the first article [1] I was struck by the fact that it granted so much new freedom to your "social identity" on the internet. The comparison to hosting providers was incredible, because imagine you building a website and posting your thoughts there or starting a business there...and then immediately being shut down and all your data lost because of some arbitrary change of policy at your "host". Everyone always talks about how your Google account being tied to logins is scary because you can get arbitrarily locked out. This protocol makes something like functionally impossible since /you/ control your data. [1] https://overreacted.io/open-social/ https://overreacted.io/open-social/
  - card_zero 1y ago
    > Bob, however, isn’t technical. He doesn’t even know that there is a “repository” with his “data”. He got a repository behind the scenes when he signed up for his first open social app. > Bob uses a free hosting service that came by default with his first open social app. > If she owns alice.com, she can point at://alice.com at any server. But does Bob own bob.com? That sounds beyond Bob's abilities and interest level. So Bob is stuck on one platform, in practice, and it's full other Bobs who are also stuck. The "free hosting service" (why is it free?) is now the gatekeeper. It may let him switch platforms.
    - beeflet 1y ago
      Even if bob "owned" bob.com, that amounts to a row in some centralized database somewhere.
      - card_zero 1y ago
        It seems to mean that Bob's free hosting service has to be a relatively benign and permanent institution like ICANN, and not some ropey old operation like Photobucket. Others on this thread are talking about Decentralized IDs, https://en.wikipedia.org/wiki/Decentralized_identifier https://en.wikipedia.org/wiki/Decentralized_identifier . Looks like those are stored in several competing systems. There's a blockchain one, a Chinese one that wants to know your real name, and a Microsoft one that wants to store your photo. This all has, uh, implications, which sound much less liberating than this at:// protocol does at first.
- tolerance 1y ago
  It’s Web3 reanimated.
  - danabramov 1y ago
    I like to think of it as Web3, the good parts.
- skybrian 1y ago
  You could do it with top-level domain names alone, but that would require users to buy domain names and retain control over them forever. It means you have to trust your domain registrar and pay them fees. This is too big a burden for new Bluesky users. You could do it more cheaply with subdomains, but then you have to trust the owner of the parent domain. So instead, they created a new registry and a way for users to cryptographically sign their registry documents. Since this is all done behind the scenes, most users are still fully trusting the central Bluesky infrastructure. But in theory, they could migrate off of it.

ape4 1y ago

So the atmosphere is in the cloud

sigfubar 1y ago

[flagged]

danabramov 1y ago
Here's another article answering this question: https://overreacted.io/open-social/ https://overreacted.io/open-social/. The one you're commenting on links to it in the first paragraph with "if not, read this!" for that exact reason--I can't explain the motivation and technical details in the same post, or to repeat the same explanation from post to post. Here's a tldr if you don't want to read the entire thing: https://overreacted.io/open-social/#the-big-picture https://overreacted.io/open-social/#the-big-picture
- beeflet 1y ago
  I read this article the other day and I am not sure what the breakthrough is with AT/bsky. It seems like the functionality "This blurs the boundaries between apps. Every open social app can use, remix, link to, and riff on data from every other open social app." is already provided on the web through hyperlinks. There is seemingly nothing in the AT protocol that prevents sites from defederating and enabling vendor lock-in, just like how every other social media site has switched to requiring you to log in to see links. There is seemingly nothing usefully decentralized about it. There is some sort of psuedo-distribution where you can host on your own domain. But like email, I imagine these types of users will be effectively blocked due to spam filtering. It's like P2P if it was invented by people who know nothing about P2P, but just want to create a version of twitter that is immune to the company being bought out by someone they don't like and instituting a different censorship regime.
  - icy 1y ago
    > already provided on the web through hyperlinks. Yeah except there’s no guarantee of structured data there! With AT, each record is specified using a corresponding lexicon—making for much more straightforward interop. > There is seemingly nothing in the AT protocol that prevents sites from defederating and enabling vendor lock-in, just like how every other social media site has switched to requiring you to log in to see links. And that’s fine! Any site can choose to do whatever they please—but the underlying AT records always remain accessible to other consumers (apps, users, …). > I imagine these types of users will be effectively blocked due to spam filtering. Blocked by whom? If the relay (which pulls records from your PDS) “blocks” your PDS, you can simply switch to one that doesn’t. The beauty of AT infra is every piece of it can be run separately. That’s “meaningful” decentralization.

danabramov 1y ago

Author here, happy to answer questions! Re: what is this even about, see my comment here: https://news.ycombinator.com/item?id=45469167 https://news.ycombinator.com/item?id=45469167. Sorry I didn't write an elaborate intro to the article; I kind of meant it for a narrower audience of people looking for an answer to a technical question (how at:// resolves). I'll say this preemptively — actually resolving at:// URIs isn't something you'd do much as an app author because the usual model for apps is to listen to all data commits over the network via websocket (like https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1.us-east.bsky.network%2Fsubscribe https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1....), and to write to a local database whatever you're interested in. So you'd mostly use at:// URIs as unique global identifiers for pieces of data, but you probably won't actually resolve them since the data will be pushed to you. But it's nice that you can always fetch it on demand too. I focused on resolving in this article because I think "following along" the resolution procedure is a really good way to understand how handles, identity and hosting are tied up.

Vinnl 1y ago
I might be pre-empting some future articles of yours, and I'm happy to await either those, or me diving into ATProto deeper by myself some time in the future, but: can any app write any data to a PDS? And if so, the more interesting question: what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects?
- danabramov 1y ago
  Great questions! Yeah, this is something I want to write about it in the future. An app can write to PDS if the user grants it access via OAuth. Currently this access is very coarse (which is bad!) although backing up the entire repo is easy (which is good! but should be made more accessible to normies). There is an active workstream on OAuth Scopes (already partially deployed) which will let apps request more granular access (e.g. apps can write to "their own" collections but also ask to write e.g. Bluesky posts). In UI, this is done through sort of "bundles" of permissions. See https://github.com/bluesky-social/atproto/discussions/4118 https://github.com/bluesky-social/atproto/discussions/4118 for tracking issue. > what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects? Atproto data is governed by "lexicons" which are essentially type definitions used by app authors. E.g. `app.bsky.feed.post` type definition is maintained by the Bluesky team. There's a codegen that generates validation code from that definition. If validation doesn't pass, the Bluesky app server will just ignore that record. Records are generally treated by apps as untrusted input, similar to form submissions. They can be validated during ingestion or in the process of usage later.

gerdesj 1y ago

"Given an at:// URI, how do you locate the corresponding JSON?" This is chicken and egg stuff. I don't get it and I've picked on the intro of the explainer. Why would I want "the JSON"? Yes, I did skim the "read this" link. It's not for me.

danabramov 1y ago
Yeah, sorry for abrupt intro. In short, at:// protocol lets you build apps that can deeply interop and query/embed each other's information, allow the user to have a shared user identity between apps, and allow the user to self-host their content (or move their hosting) without impacting the apps. It does this by giving bits of JSON permanent URIs that aren't tied to a specific user handle or hosting server, but instead are rooted in identity. The article describes how that works (and what an "identity" is) in technical detail. Here's a concrete example: a blogging app (https://leaflet.pub https://leaflet.pub) automatically "sees" mentions of a Leaflet post on a different microblogging app (https://bsky.app https://bsky.app) and can display them: https://bsky.app/profile/o.simardcasanova.net/post/3luujudlr5c2j https://bsky.app/profile/o.simardcasanova.net/post/3luujudlr.... This is not done by hitting an API; it's just that both apps aggregate the same information from the open network into their respective databases.
- baliex 1y ago
  I'm pretty new to the at:// protocol, and I like what I'm reading, thanks for the write-up. To your "This is not done by hitting an API" point; if I understand correctly, I'd argue that the _endpoints_ that you detail in your post _are_ the API. The whole point is that there's no single _central_ API, but each server that wants to be part of the network participates by hosting an API that meets the standard outlined in the protocol. In a way it's semantics, but I'd be interested in yours thoughts on that. To either correct or confirm my understanding.
  - danabramov 1y ago
    No, that’s really not the case. The Leaflet app “knows” about Bluesky posts by reading Leaflet's own database on the Leaflet servers. It doesn’t need Bluesky’s cooperation to use “Bluesky’s” public data. It doesn’t need to hit Bluesky’s API for that. And if Bluesky shut down its API completely, it would still work. This is because a stream of all public data from all apps is being subscribed to by all apps. Whatever you care about, you save into your app’s database. Each app’s database serves as an app-specific index of the data on the network. If you want to query Bluesky posts later, you just save them as they stream in. So every app can piggyback on data created by other apps. And anyone can run a "retransmitter" (aka a relay) like this. It's an application-agnostic aggregator over websockets. The one operated by Bluesky-the-company is most popular one, but https://atproto.africa/ https://atproto.africa/ is another one, and you can get one running yourself for about $30/mo; the implementations are open source.) I explain this in more detail in https://overreacted.io/open-social/ https://overreacted.io/open-social/, Ctrl+F to "to a stream that retransmits events from all known repositories on the network".

thecommakozzi 1y ago

[dead]

mmbizzle 1y ago

What about when Bluesky goes out of business and plc.directory is shut down? This all seems unnecessarily fragile.

mempko 1y ago
This is no different then how the web works. So not a great argument against this protocol.
- beeflet 1y ago
  How does it improve over the existing system, other than slapping the word "decentralized" on?
Vinnl 1y ago
To strongman the article, I imagine that's the reason behind: > Bluesky is currently moving PLC to an independent legal entity in Switzerland to address some of these concerns. The AT community is also thinking and experimenting. (The article has links there.)
- danabramov 1y ago
  I've also linked to https://updates.microcosm.blue/3lz7nwvh4zc2u https://updates.microcosm.blue/3lz7nwvh4zc2u and https://plc.wtf/ https://plc.wtf/ which are relevant. These are good questions to ask!
- xmprt 1y ago
  What happens when the independent legal entity stops getting funding and has to shut down?
  - edoceo 1y ago
    Need a PLC+DHT thing maybe? Or maybe someone will try to blockchain?
    - 1y ago

hyperhello 1y ago

"They’ll figure out the physical server where its JSON is currently hosted, and show that JSON for you" So, DNS?

danabramov 1y ago
A combination of DNS and HTTPS (as described further in the post).

globalnode 1y ago

how can it be hacked? can i impersonate someone else? whats to stop me from making posts with someone elses handle. how secure is the data? or does it just ride over tls and use that for protection.

danabramov 1y ago
Every commit in your repo is signed with your private key which stays on your hosting. (You also can get another special key for your identity that would let you force-change hosting if your hosting gets adversarial.) Changes from your hosted repository get transmitted as signed commits (kind of like Git) so they can be verified by those receiving the retransmission against your public key.
- deleted 1y ago
  [deleted]

Oper_52 1y ago

ATProto is even more overhyped than Rust. I'll stick to Twitter and Usenet, thanks.

rmccue 1y ago

Excellent explanation as always from Dan, and timely with the latest news from Bluesky on moving the PLC management. We picked the same DID systems for https://fair.pm/ https://fair.pm/ to decentralise WordPress plugin distribution (and general management for user-facing packages; think App Store rather than Cargo). The Bluesky folks (especially Bryan) were super helpful in helping us out - even shipping Ed25519 key support so we could use libsodium. (We’re designing our protocol on top of DIDs and using Bluesky’s stackable moderation, but chose not to use atproto directly - but the great thing is that DIDs are a W3C standard, and PLC isn’t tied to atproto.)

password4321 1y ago
Not gonna lie I can't resist asking for more info on who is "we" (and a link with more about the "what"), it sounds like a technical solution is coming down the pipe vs. all the WordPress drama.
- deleted 1y ago
  [deleted]
- rmccue 1y ago
  “we” = group of long term contributors and core committers, including myself (I wrote the WP REST API), hosted by the Linux Foundation. (More info on the linked site; I don’t want to hijack the thread too much.)
supermatt 1y ago
> PLC isn’t tied to atproto Isn’t PLC (a did method created by bluesky) tied to bluesky (or some other central authority)? Why do they call it a did when it’s centralised? As did:plc isnt portable, why didn’t they just use did:web, and decorate the identity docs with PLC-like behaviour? Why isn’t the method-specific-id part of the did something deterministic/portable, like a hash of a public key that can at least permit some revolver-driven portability? Why didn’t they use some mechanism for decentralisation, like a DHT (e.g. did:pkarr)? It seems to me that PLC is thinly veiled attempt for another master to exert control.

magicalhippo 1y ago

So any server storing such at:// links will need to do some DNS/HTTPS dance to get the canonical representation, or permalink as the author calls it. Doesn't that make it quite fragile without functioning DNSSEC? Haven't really thought it through but my immediate reaction is DNS poisoning seems like it could do some damage here, allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or?

danabramov 1y ago
This is a bit beyond my understanding (I'll ping someone who may be able to answer), but https://atproto.com/specs/handle#dns-txt-method https://atproto.com/specs/handle#dns-txt-method mentions "DNSSEC is not required" (though I'm also not sure that's what you're asking). >allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or? DNS only resolves the Handle->DID, but you still need to verify DID->Handle mapping by getting the DID Document. It's bidirectional.
- deleted 1y ago
  [deleted]
- magicalhippo 1y ago
  > "DNSSEC is not required" I guess I need to study that in more detail, as I don't immediately see how it's preventing DNS attacks. > DNS only resolves the Handle->DID, but you still need to verify DID->Handle mapping by getting the DID Document. It's bidirectional. Yes but if I've already hijacked the DNS to point to my own DID, what's stopping me from saying I go by your handle? Sure older posts wouldn't verify, but a new post would be signed by the keypair I've put in the DID I hijacked, no? Or is that some other key in the DID? New to AT so perhaps this is a non-issue. Main concern of mine is that DNSSEC seems to not have a very bright future, so not something new stuff should rely on IMHO.
  - danabramov 1y ago
    >Yes but if I've already hijacked the DNS to point to my own DID, what's stopping me from saying I go by your handle? The process of establishing "this handle points to this DID" consists of: 1. Resolving handle -> DID via HTTPS/DNS (part you're concerned about) 2. Downloading the DID Document from its host 3. Verifying that the DID Document contains the same handle Hijacking the DNS does not help you with (2) and (3). The handle isn't considered associated with the DID until (2) and (3) are done.

stebalien 1y ago

The recommendation to resolve from handles to DIDs for "permalinks" is concerning to me: - My handle is something _I_ control. I can make it point at a different PDS at any time. - My DID is something my PDS controls. I could solve this by indirecting through a web DID under my control, but there's no recommendation anywhere in Bluesky's documentation. Is that something everyone needs to do to ensure real identity portability? edit: I'm not sure this CAN be solved without running a PDS given that I can't use my own keys. What am I missing here?

danabramov 1y ago
This doesn't look right to me. What you control is your identity (i.e. DID Document). As long as you control your identity, you can change either your handle or your hosting aka PDS. Your hosting/PDS does not control your DID.
- rmccue 1y ago
  What stebalien might be referring to is that your DID document for PLC specifically is controlled by anyone with the rotation key. In the Bluesky implementation, this is Bluesky for convenience’s sake, to make it possible for users to easily sign up. (I’m not sure internally if it’s part of the PDS or held separately.) PLC has a mechanism allowing “higher” keys to override “lower” ones within a certain time window, so being able to add your own rotation key that “outranks” Bluesky’s would solve this issue. Alternatively, use web DIDs and then it’s fully self-managed just as DNS would be.
  - stebalien 1y ago
    Is there any documentation on how to do this without running a custom appserver and/or PDS? Can I create my own DID and delegate to another DID?
    - rmccue 1y ago
      This is mostly separate to the PDS - Bluesky is more like the client here (albeit, they also currently run the PLC service). It’s part of your DID document which they manage for you mostly, but there’s ways to take ownership of your PLC DID - see Dan’s links for that. For our non-atproto uses of the PLC directory, we have similar needs, and we’ll likely let users provide their own public key before we create their document to help solve this. We have a technical audience though, so that solution may not make sense for Bluesky - but there’s a lot of people thinking about how to improve this in the atmosphere.

drnick1 1y ago

This is verbose and unclear. An article like this should always start by explaining what problem it tries to solve before going into technical details.

danabramov 1y ago
This is a technical explanation for an audience already interested in the topic. The motivation ("explaining the problem") is described in the article linked in the very first sentence. Here's a tldr: https://news.ycombinator.com/item?id=45469167 https://news.ycombinator.com/item?id=45469167
- drnick1 1y ago
  Thanks. It's quite shocking however that GPT did a better job at explaining this to me than the original article.
  - danabramov 1y ago
    Which article are you talking about? I think https://overreacted.io/open-social/ https://overreacted.io/open-social/ (which is what I linked to) gives a pretty detailed explanation if that's what you wanted. As for the article in today's submission, I meant it for the audience that's already interested in the topic, and did not pad it out with a motivational section. I'm glad GPT was useful to you.
auggierose 1y ago
What you might see as verbose, I think is exceptionally clear. Also, the article comes with an entire other article explaining the problem, so not sure what you are on. If you cannot even click on a link, maybe you shouldn't complain about verbosity in the first place.

drsanta 1y ago

The at protocol seems a little Nebraskan Church Excel doc complex: https://xkcd.com/1667/ https://xkcd.com/1667/

verdverm 1y ago
this may help see it as an "anyone can participate at any point" event stream hence why it is called the "activity transfer protocol" https://atproto.com/articles/atproto-for-distsys-engineers https://atproto.com/articles/atproto-for-distsys-engineers

drnick1 1y ago

I still don't understand how this project meaningfully addresses the problem of identity and data ownership. When it come to identities, either you have your own domain, or you use someone else's domain (say, Bluesky). Most people don't have domains, and so their identity will be owned by a third party. You also have the same problem when it comes to the data itself. The moment Bluesky or some other server bans you, your repo is shut down and you lose the ability to move the data somewhere else. In short, this is exactly like email. Unless you have your own domain and server you don't control anything.

password4321 1y ago
At least with email you can own a PGP/SMIME key and take it elsewhere, right? Isn't this something similar with ATproto?
- danabramov 1y ago
  Yes, see here: https://news.ycombinator.com/item?id=45471337 https://news.ycombinator.com/item?id=45471337. You can change your domain with no cooperation from whoever owns your current domain. And you can change your host, provided you have a backup of your data. (If the old hosting doesn't cooperate, you'd also need a rotational key.)
athrowaway3z 1y ago
I'm not a user, but I do think there is a need for these type of schemes. Approximately 0% of email users could change email host, and prove their identity between the old messages and the new messages. The value is it caps bluesky's "window of abuse". Platforms like Facebook or Twitter have dialed up the enshitification far beyond what I find acceptable, but many people are still on there. A competitor to bluesky can decide how to approach it. Like staying (partially) compatible, and decide to compete on UI, repo storage, or user admin.
solatic 1y ago
> Most people don't have domains, and so their identity will be owned by a third party. Indeed, and as a result, such users will always be vulnerable to specific risks like sudden bans, i.e. when the hosting service becomes adversarial. The only full protection is to own your own domain off a neutral TLD, with protocols that use DNS to describe how traffic should be routed. But, because most users don't have domains (as you pointed out), the state-of-the-art can still be improved upon with partial flexibility and protections, when the hosting service is cooperative. This project allows people to keep their Bluesky handle (because they don't own a domain) while (hypothetically) moving their data hosting to a different provider, unlike current Big Social where your data is stuck on Facebook/X/Instagram/TikTok/YouTube forever. Bluesky has an interest in this because it also allows people to set up their own handle and move their hosting to Bluesky. Sometimes we improve upon the existing state of the art not by delivering perfect solutions, but by delivering improvements upon limitations that we accept as a given (like the fact that most users will not set up their own domains).

teddyh 1y ago

This seems to fill the same function as DNS, but adds a layer of abstraction on top of it, while also adding a dependency on a service provided by Bluesky. I fail to see how this improves things on the whole.

danabramov 1y ago
It builds on top of DNS (in at least in two places) so it’s not equivalent — and it fills a different function to it. See https://news.ycombinator.com/item?id=45469296 https://news.ycombinator.com/item?id=45469296 for a breakdown. PLC is being spun out into an independent entity, the longer term goal is for it to operate somewhat similar to ICANN. Its code is easy to run so something else could conceivably replace it. It’s also possible for AT to allow other `did` methods in the future as long as they’re persistent and can be performantly resolved.

AtlasBarfed 1y ago

So what you need is a sort of document or object-level DNS? Sure would be tough, because it makes name distinction a lot harder, and it's going to be a lot more granular?

angerson 1y ago

This is a nice write-up. I recently added post-to-bluesky support to my ongoing social-media-scheduler project [1], thinking it would be the simplest of the services to work on, but I ended up getting really confused instead. DID and handle resolution was the easiest part of ATProto---as the author says, a library can do the job easily. For Ruby it's DIDKit [2]. Where ATProto really threw me was the seeming non-ownership of record types. Bluesky uses "app.bsky.feed.post" for its records, as seen in the article; there seem to be a lot of these record types, but there doesn't seem to be a central index of these like there are for DIDs, or a standard way of documenting them... and as far as I've been able to find, there's no standard method of turning an at:// URI into an http:// URL. When my app makes a post on behalf of a user, Bluesky only sends an at:// URI back, which I have to convert myself into an http:// URL to Bluesky. I can only do that with string manipulation, and only because I know, externally, what format the URL should be in. There's no canonical resolution. [1]: https://toucanpost.com https://toucanpost.com [2]: https://github.com/mackuba/didkit https://github.com/mackuba/didkit

Tomuus 1y ago
Record types are now "on protocol", you resolve them via a similar mechanism as in the article. https://atproto.com/specs/lexicon#lexicon-publication-and-resolution https://atproto.com/specs/lexicon#lexicon-publication-and-re...
- danabramov 1y ago
  As an example of that, if you open any `app.bsky.feed.post` in pdsls, the "Info" tab[1] links has a link to the "Lexicon document" for it: [1]: https://pdsls.dev/at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/app.bsky.feed.post/3m2e3z65ark2n#info https://pdsls.dev/at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/app.... [2]: https://pdsls.dev/at://did:plc:4v4y5r3lwsbtmsxhile2ljac/com.atproto.lexicon.schema/app.bsky.feed.post https://pdsls.dev/at://did:plc:4v4y5r3lwsbtmsxhile2ljac/com....
verdverm 1y ago
> I have to convert myself into an http:// URL to Bluesky at:// URIs and specific lexicon are not limited to a single app. The NSID (app.bsky.feed.post) has authority based on domain, but Bluesky cannot prevent anyone from reading / writing records of that type. There are alternative apps that read the same at:// but put them under a different https://... tl;dr, there is not a 1-1 mapping between at:// and https://, it's 1-N

thrown-0825-1 1y ago

Reminds me of the various crypto protocols talking about theoretical decentralization while entirely bound to 1 platform with no other useful apps in sight.

stevage 1y ago
Much like Git and GitHub (at least for many years, it's improved a little bit now).
- porridgeraisin 1y ago
  I don't see how. Many large projects have been running with git patches over emails for decades.
  - jonhohle 1y ago
    Yeah, that’s a really odd take. Git is completely usable apart from GitHub and I would wager that the majority of Git usage happens without GitHub. I personally have far more personal repos hosted on a NAS than anything in GitHub, and while I did work for one company that used GitHub professionally, I can’t imagine it’s anywhere near ubiquitous. Prior to that I worked at a company with 10s of thousands of internal git repos and before their migration to git used a git front end for perforce. Prior to that (and prior to GitHub), I used a git front end for subversion. I see GitHub as the successor to SourceForge, not a requirement for using git.
    - stevage 1y ago
      I guess we are just in very different professional circles. I've worked with dozens of teams over the last 10 years or so, and I've never come across anyone that self-hosts a repository. The vast majority use Github, and there's been a couple of Bitbuckets, and a couple of GitLabs. That's it. Prior to that there were a few Subversions, a Perforce, MS's thing (TFS?).
      - 1y ago

rmoriz 1y ago

After 3 years on Mastodon and some lurking on bsky, I believe the main issue is not technical but getting and keeping interesting content on a platform. This is a social issue as bubbles ruin everything over time. OTOH using algorithms to mix some „foreign“ content into the feeds causes outrages. Sure we can all go web3 and self-hosted but nobody will read. Mastodon is the posterchild of a failed experiment. I‘m interested in the creative, productive, inspiring long-tail content on all platforms instead of migrating the peer group over to a new platform every couple of years. I know them already, I have better ways to communicate with my direct peers and the rest is like having 500 contacts on LinkedIn: A social illusion. I appreciate and respect the technical efforts behind atproto, but yet I can‘t see that it solves the problem described above.

zoul 1y ago
In what way is Mastodon a failed experiment? Low number of active users or something else?
- rmoriz 1y ago
  Mastodon never had a good amount of orginal content to explore, only very few creators produced and shared. Topics I followed were mainly infosec, programming, biking but content and interaction faded dramatically over the last 6 months. You won’t get anything back, no reach, no constructive feedback, no real life contacts. Twitter was a place to get inspired and learn new things, find OC memes, code snippets, niche insight, etc. Mastodon lately just went full anticapitalist, anti-tech, anti AI. Nothing insightful. Irrationality. Depression. Reddit is still a better place to discover and discuss things, if you find active subs covering a topic.
numpad0 1y ago
Yeah it's solving a wrong problem. What's needed is means to get enough bandwidth of data, not giving yet another blog site you can post to. The kind of content that wins the Internet is never the kind that'll be "popular", despite all objective data, so whoever to run the platform has to "algorithm" the system to prefer "popular" contents which destroys the community as well as greater society in matters of decades. We just needed an RSS with a local algorithm.

deleted 1y ago

[deleted]

jiehong 1y ago

Performance worries me when reading that. Even with having a cache as explained.

danabramov 1y ago
As stated near the end of the article, this isn’t something you’d do much as an app developer. The article describes how to pull but the predominant model for building apps is to have the data pushed to you. So in practice you’d use at:// URIs as unique identifiers for the data you’re receiving and indexing on your backend, not something you actually need to resolve. You wouldn't need to resolve them because you'd be receiving the JSON itself via the websocket.
- verdverm 1y ago
  To add, it's largely required for an app to listen to the event stream because a user may write a record you care about directly (not through your app), and you likely want to know about that as "real-time" as possible. Crawling will never get you close to that

1718627440 1y ago

Why do they use forward names for the username, but backward names for the server? That's inconsistent.

danabramov 1y ago
Backward names are not used for the "server". (I presume that by "server" you mean hosting, which is determined by the `serviceEndpoint` in the DID document rather than by something in the AT URI, as the article explains.) If you're asking about “app.bsky.” in the AT URI, it doesn’t indicate a server you’re going to connect to. As stated in the post, it indicates a data format. Think of it as a file extension which describes who governs the schema of that JSON. Formats (called "lexicons" in AT) use a reverse-namespace scheme so that formats governed by the same app appears next to each other alphabetically. That might remind you of Java.

1718627440 1y ago

I don't see why you need another URI scheme at all. Most protocols already support usernames: user@domain. All you need to do is make the part after @ optional like it is for email.

deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
danabramov 1y ago
Can you clarify what the proposed change is? I don't quite follow. For example, what does `at://did:plc:fpruhuo22xkm5o7ttr2ktxdo/sh.tangled.feed.star/3m23ddgjpgn22` become ?
- 1718627440 1y ago
  https://did:plc:fpruhuo22xkm5o7ttr2ktxdo@/sh.tangled.feed.star/3m23ddgjpgn22 which then resolves to: https://did:plc:fpruhuo22xkm5o7ttr2ktxdo@morel.us-east.host.bsky.network/sh.tangled.feed.star/3m23ddgjpgn22 There might be conflicts there with a specification of passwords, so you need to use another separator than :.
  - danabramov 1y ago
    That's not a valid HTTPs URL though, is it? Since there's no specific location to hit. Maybe I'm missing something.
    - 1718627440 1y ago
      Then i did not understand the article, I thought morel.us-east.host.bsky.network was the specific location after resolving the DID.
      - 1y ago

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

akk0 1y ago

Inspired by another recent post on ATProto I signed up for bsky, but all I see is endless American politics. I relentlessly click "less like this" but it doesn't seem to budge. Is this just what the platform is like? Being constantly barraged by the same predictable takes on today's bizarre overseas controversy is not very conducive to mental peace...

rcxdude 1y ago
It does thankfully have a functioning non-algorithmic feed that only shows who you've followed, which I feel is the only way to maintain sanity on any of these platforms.
- akk0 1y ago
  I imagine myself switching over to that pretty quickly if I do stick with the platform (I also use YouTube that way) but that doesn't address the discovery problem. It's just really sad that you give people a platform to say whatever they want to the world and most people seem to have little to say beyond "here's what made me unhappy today"...
  - downsplat 1y ago
    > that doesn't address the discovery problem. The real problem is the expectation of immediate discovery. People have gotten used to "give me something new now", and the algorithm complies but then quality is low. Slow, organic discovery is where it's at. Seed your feed by following people you already know, then slowly add other people you come across. If your feed is half empty for weeks, that's a feature, not a bug.
    - deleted 1y ago
      [deleted]
    - spartanatreyu 1y ago
      This is exactly why mastodon is so useful. It doesn't have an algorithm, it only shows you who you follow in chronological order. It's not for profit, so it isn't trying to drive engagement. Chasing engagement just leads to feeds full of spam, clickbait and ragebait.

ulrischa 1y ago

To make bluesky really lift of and become widely accepted for decentral social media there should be a simple solution to self host your postings. E.g. something you can easily host on a webhosting with php or so. The docker container provided is great but one step to high for broad usage.

danabramov 1y ago
Yeah, it needs to be easier to do. It's already getting more accessible with tools like https://pdsmoover.com/ https://pdsmoover.com/ and communities like Blacksky offering hosting. Ideally there would be many such providers.

brap 1y ago

>Essentially, you need to hit the https://plc.directory https://plc.directory service with a GET To me this is where the entire model breaks down and becomes 100% centralized. At the very least, I would expect that there would be a configurable list of such trusted directories, entirely decoupled from the protocol itself, similarly to DNS roots or CAs.

redleader55 1y ago
But you can use did:web:fqdn if you want; it's explained in the article.
- account42 1y ago
  And few enough people will do that so Bluesky can just kill off support for it when the service becomes popular and they move to the extraction phase without much opposition. Remember all the chat services that supported XMPP before they killed that? Same level of guarantee here. If most users are expected to choose the centralized option it might as well be the only one.

tempodox 1y ago

> Whoever’s hosting the data could change over time… But the fundamental fact remains that when you host your data on someone else’s system (without a binding agreement), it can vanish or become inaccessible at any time for any reason. And you won’t have any control over who can access it or why.

danabramov 1y ago
Yes, which is already the case with every app you use. But like I explain in the second half of https://news.ycombinator.com/item?id=45471337 https://news.ycombinator.com/item?id=45471337, you’d still be able to restore your account from a backup to a different host without losing reach or breaking any links. See also https://blog.muni.town/atproto-isnt-what-you-think/ https://blog.muni.town/atproto-isnt-what-you-think/ which goes into more detail on the consequences of this approach.

deleted 1y ago

[deleted]

andandandand11 1y ago

[flagged]

James_K 1y ago

I've never really gotten AT protocol. It just seems like reïnventing the web. I guess it's a little more secure than the normal web because there's no JS, and you can make it seem more integrated because users won't have custom styles, but neither of these are particularly appealing to me. HTML + RSS does basically the same job, and then link aggregator sites like news.ycombinator.com recommend content much better than the algorithms you get in social media. I guess the big advantage is reposts and comments, but practically you could achieve these in the regular web through indexing with backlinks. The conceptual service Bluesky is providing is essentially just a web-index of items published using the AT protocol.

danabramov 1y ago
I tried to make a pretty extensive case for it at https://overreacted.io/open-social/#open-social https://overreacted.io/open-social/#open-social, I'd suggest reading it with an open mind to form an opinion. I think there's quite a few interesting aspects there, like apps being able to "piggyback on" data from other apps. I wouldn't call AT a "reinvention" of the web, personally I see it as a minor bump that codifies some conventions that let apps interoperate while keeping the source of user data outside those apps. New products can be started from data of other (even defunct) products and remix it. That's pretty powerful.
- James_K 1y ago
  I'm still not really convinced. Look at it from my perspective: I have my website, BSky isn't compatible with the web, therefore I would have to provide two different versions of all content I publish to satisfy someone else's protocol. It's very annoying. It would be simpler and more effective if it was built on existing web technologies. The only actually new things AT and BSky provide is a signature scheme for content, and the ability to store replies, follows, and likes. You manage most of that in as a few HTML meta tags à la OpenGraph. The other parts of it already exist, those being a web-page designer and an indexer.

losvedir 1y ago

So is the protocol sort of like a big public kafka topic? If you want to create a new web app, say, you don't actually store the data yourself. You basically set up a listener to "the big topic in the sky" and ask your users to save all their data in their own respective places, which the protocol will propagate out into the world such that your app's listener will hear about and cache it. Do I have that right? It's a very interesting concept for how to build a web app while the users still own their data. I don't have a great understanding of the process, though. Are their "offsets" or something to make sure you don't miss updates? Partitions for scalability? Maybe I'm pattern matching too hard to Kafka here.

verdverm 1y ago
> So is the protocol sort of like a big public kafka topic? yes, at least the firehose is that, and anyone can subscribe or run their own https://atproto.com/articles/atproto-for-distsys-engineers https://atproto.com/articles/atproto-for-distsys-engineers > to make sure you don't miss updates Yes, the firehose and jetstreams have a cursor, though with limited time window depending on the instance. (1-3h -> 72h) If you want the entire history you do what's called a backfill
- maelito 1y ago
  Hi, thanks for these info. I have a web app that produces atproto records, app.cartes.comment. My server listens to Jetstream and builds its DB based on this. But what about if my server goes down for say 4 days ? How can I rebuild my DB to catch up those days ? It looks like Jetstream cannot work for this. My need is simple : give me all the records of the collection on the whole atmosphere. How to do this ?

crazygringo 1y ago

I'm fascinated by the idea of at://. But besides even whether it would ever make business sense, I worry about basic things like: - If you own your data, can't you change it at any time? I can make perfectly reasonable posts that lots of people agree with, then change it to vile stuff. Even if existing sites at the time store hashes and prevent updates, a new site loading the post will never know it was once different. - How are things like upvotes tracked? If every upvote is an object stored by the person upvoting, how do you even find the people upvoting? And doesn't it become trivial to create tons of fake profiles upvoting everything you do? - And how is moderation/spam even handled? Now if sites are supposed to be showing replies to posts made from everyone across any platform, not just their own, how is moderation handled when you don't know anything about these accounts making replies? I just don't understand how all of the necessary work around transparency, accountability, moderation, and spam can be done in a world where users store their own data, and therefore can fake their own data.

reactordev 1y ago
Why not publish the changes too? The data of the resulting json can include whatever you wish. That data is your data. So if an app developer wants to include the history of changes, that would be the place to do it. Or link to previous at:// addresses for it. Walk it back like a linked list. As for the identity moderation part, if you read up about DID, it tells you how to know who they are and you can block them or do whatever you need to do. The point isn’t that this is some blockchain, it’s just a federated method to share data when you own the data. Poison well attacks aside. In the end, it’s a way to say this person, generated this data, at this location, in case you’re interested. If you care about the things you mentioned, you might not be interested at all.
- crazygringo 1y ago
  > Why not publish the changes too? Because you are being adversarial and trying to trick people. > if you read up about DID, it tells you how to know who they are But it doesn't tell you're they're not a spammer. I don't see anything about reputation. > in case you’re interested But that's the point. You're interested in legitimate upvotes to try to find useful content. You're not interested in spam upvotes. In a decentralized world, how does anyone tell the difference?

onetom 1y ago

I wonder, how rigidly has the JSON format been baked into the protocol. It feels like a shortsighted choice, just because it's prevalent in recent decades. It took years to implement performant parsers for it and it has a lot of quirks, missing features and the tons of double quotes and mandatory commas significantly harm its human readability... Not sure what would I recommend instead, but personally I would prefer using EDN instead, as a Clojure programmer https://github.com/edn-format/edn https://github.com/edn-format/edn

verdverm 1y ago
You can write lexicon (the schema) in whatever language you want and then transform them to JSON for sharing. The record format should be something widely used and implemented for sending over the wire. There are lots of languages and ecosystems participating.
- rixed 1y ago
  > The record format should be something widely used and implemented for sending over the wire. That's just one of the parameters. It should also be something efficient if it's going to be sent over the wire at scale.
  - verdverm 1y ago
    We're all sending JSON around all the time, it's not really that big a performance hit, especially in context of the formats transiting networks today (it's the same, lots and lots of JSON)
    - danabramov 1y ago
      Note that it's CBOR being sent over WebSockets (afaik).
      - verdverm 1y ago
        The firehose is CBOR, jetstream is JSON (which more people use) I was mainly speaking more generally than atproto. Most APIs talk JSON these days

rixed 1y ago

The article is very light on details about the key used to sign changes of the DID (when the article says "all changes to their data" I guess it refers to the DID?) But suppose I'm user foobar.bsky.social (appologies to the actual foobar). I've created this identity on bluesky, I do not remember having uploaded a key, or being ofered to download one. Where is that key exactly? Who owns it? And how/when is it used? Also, if the did is hosted on plc.directory, what mechanism prevent whoever controls that website to overwrite my did and impersonate me?

bohlen11 1y ago

[dead]

enbugger 1y ago

Do I understand it correctly that nothing stops so called feed builders just stop showing post of particular profile at day X? Yes, it will noticed but that would not matter much as it can be already too late. Or if to be more general, can AtProto stop intel services to erase/pessimize particular post/profile from the network?

deleted 1y ago

[deleted]