3 ms·

Author here, happy to answer questions! Re: what is this even about, see my comment here: https://news.ycombinator.com/item?id=45469167 https://news.ycombinato

Author here, happy to answer questions! Re: what is this even about, see my comment here: https://news.ycombinator.com/item?id=45469167 https://news.ycombinator.com/item?id=45469167. Sorry I didn't write an elaborate intro to the article; I kind of meant it for a narrower audience of people looking for an answer to a technical question (how at:// resolves). I'll say this preemptively — actually resolving at:// URIs isn't something you'd do much as an app author because the usual model for apps is to listen to all data commits over the network via websocket (like https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1.us-east.bsky.network%2Fsubscribe https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1....), and to write to a local database whatever you're interested in. So you'd mostly use at:// URIs as unique global identifiers for pieces of data, but you probably won't actually resolve them since the data will be pushed to you. But it's nice that you can always fetch it on demand too. I focused on resolving in this article because I think "following along" the resolution procedure is a really good way to understand how handles, identity and hosting are tied up.

Vinnl 1y ago
I might be pre-empting some future articles of yours, and I'm happy to await either those, or me diving into ATProto deeper by myself some time in the future, but: can any app write any data to a PDS? And if so, the more interesting question: what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects?
- danabramov 1y ago
  Great questions! Yeah, this is something I want to write about it in the future. An app can write to PDS if the user grants it access via OAuth. Currently this access is very coarse (which is bad!) although backing up the entire repo is easy (which is good! but should be made more accessible to normies). There is an active workstream on OAuth Scopes (already partially deployed) which will let apps request more granular access (e.g. apps can write to "their own" collections but also ask to write e.g. Bluesky posts). In UI, this is done through sort of "bundles" of permissions. See https://github.com/bluesky-social/atproto/discussions/4118 https://github.com/bluesky-social/atproto/discussions/4118 for tracking issue. > what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects? Atproto data is governed by "lexicons" which are essentially type definitions used by app authors. E.g. `app.bsky.feed.post` type definition is maintained by the Bluesky team. There's a codegen that generates validation code from that definition. If validation doesn't pass, the Bluesky app server will just ignore that record. Records are generally treated by apps as untrusted input, similar to form submissions. They can be validated during ingestion or in the process of usage later.
yapfrog 1y ago
Not sure if you already replied to a similar question but regarding this quote > the actual server storing my data is currently https://morel.us-east.host.bsky.network https://morel.us-east.host.bsky.network. I’m happy to keep hosting it there but I’m thinking of moving it to a host I control in the future Is the process of moving hosts documented somewhere?
- mozzius 1y ago
  Yep, here: https://atproto.com/guides/account-migration https://atproto.com/guides/account-migration There’s also tools that can help automate this: https://pdsmoover.com/ https://pdsmoover.com/
psnehanshu 1y ago
Let's say I need to resolve @example.com and we use the HTTPS GET method. So we will query https:// example.com/.well-known/atproto-did Will it work if that link redirects to says https:// example.com/did.txt or even to a different host say https:// foo.bar/some/thing/did?
- danabramov 1y ago
  I don’t think it would follow redirects. See https://atproto.com/specs/handle#https-well-known-method https://atproto.com/specs/handle#https-well-known-method Edit: I'm wrong; see below
  - psnehanshu 1y ago
    It says "HTTP redirects (eg, 301, 302) are allowed, up to a reasonable number of redirect hops."
    - danabramov 1y ago
      Ah my bad, you're right! I glossed over that.

Vinnl 1y ago

I might be pre-empting some future articles of yours, and I'm happy to await either those, or me diving into ATProto deeper by myself some time in the future, but: can any app write any data to a PDS? And if so, the more interesting question: what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects?

danabramov 1y ago
Great questions! Yeah, this is something I want to write about it in the future. An app can write to PDS if the user grants it access via OAuth. Currently this access is very coarse (which is bad!) although backing up the entire repo is easy (which is good! but should be made more accessible to normies). There is an active workstream on OAuth Scopes (already partially deployed) which will let apps request more granular access (e.g. apps can write to "their own" collections but also ask to write e.g. Bluesky posts). In UI, this is done through sort of "bundles" of permissions. See https://github.com/bluesky-social/atproto/discussions/4118 https://github.com/bluesky-social/atproto/discussions/4118 for tracking issue. > what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects? Atproto data is governed by "lexicons" which are essentially type definitions used by app authors. E.g. `app.bsky.feed.post` type definition is maintained by the Bluesky team. There's a codegen that generates validation code from that definition. If validation doesn't pass, the Bluesky app server will just ignore that record. Records are generally treated by apps as untrusted input, similar to form submissions. They can be validated during ingestion or in the process of usage later.

yapfrog 1y ago

Not sure if you already replied to a similar question but regarding this quote > the actual server storing my data is currently https://morel.us-east.host.bsky.network https://morel.us-east.host.bsky.network. I’m happy to keep hosting it there but I’m thinking of moving it to a host I control in the future Is the process of moving hosts documented somewhere?

mozzius 1y ago
Yep, here: https://atproto.com/guides/account-migration https://atproto.com/guides/account-migration There’s also tools that can help automate this: https://pdsmoover.com/ https://pdsmoover.com/

psnehanshu 1y ago

Let's say I need to resolve @example.com and we use the HTTPS GET method. So we will query https:// example.com/.well-known/atproto-did Will it work if that link redirects to says https:// example.com/did.txt or even to a different host say https:// foo.bar/some/thing/did?

danabramov 1y ago
I don’t think it would follow redirects. See https://atproto.com/specs/handle#https-well-known-method https://atproto.com/specs/handle#https-well-known-method Edit: I'm wrong; see below
- psnehanshu 1y ago
  It says "HTTP redirects (eg, 301, 302) are allowed, up to a reasonable number of redirect hops."
  - danabramov 1y ago
    Ah my bad, you're right! I glossed over that.