Readit News logoReadit News
dark_mode commented on Pixnapping Attack   pixnapping.com/... · Posted by u/kevcampb
Thorrez · 4 months ago
>but I'm guessing if you install an app on a Windows Desktop computer it can do more chaos faster and more discreetly than pixnapping can on Android.

On desktop, apps aren't sandboxed. On mobile, they are. Breaking out of the sandbox is a security breach.

On desktop, people don't install an app for every fast food chain. On mobile, they do.

dark_mode · 4 months ago
inb4 "graphene solves this"

Deleted Comment

dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
fnwbr · 4 months ago
I think I understand the theory. But in fact it looks like tangled.sh is indeed using a "proprietary" Bluesky API rather than... e.g. calling `danabra.mov` right away to fetch his avatar: https://tangled.org/@tangled.org/core/blob/master/avatar/src...

... or am I misunderstanding?

dark_mode · 4 months ago
That does look weird to me. I would expect it to more generic because this would be miss data stored in PDS outside bluesky. At least according to my layman understanding.
dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
tomgag · 4 months ago
> I don't think the debate between them is super useful because their architectures are very different.

Sure, that's true, but I, personally, care mostly about one question: Who holds the keys to the kingdom? In this respect, I think the AT Protocol fails spectacularly, mainly due to the lack of a credible strategy to implement really self-custodian identities.

> You also mentioned an issue with the bluesky relay, but others already exist so it's not techincally tied to Bluesky. Heck, I think the fact multiple can exist at the same, while degrades the social aspect, still makes it decentralized.

Yes, but this is also true for Nostr, Diaspora, Mastodon, etc. The difference being, last time I checked (and of course things might have changed in the meantime) with AT Protocol it was only possible to self-host part of the infrastructure (and hosting the relay is insanely demanding).

> As for the identity management issue, they announced just last week that it's getting branched to an independent entity: https://docs.bsky.app/blog/plc-directory-org

This is another example of gaslighting from Bluesky that just makes me angry. How in the holiest of Hells does an "Identity directory controlled by a Swiss Association" make the whole thing better?

Sorry, not buying it. I don't have a horse in the race, but won't fall for the marketing.

dark_mode · 4 months ago
I agree with the sentiment and I wouldn't call Bluesky "open social"- I don't trust them either. But I still don't find these to be arguments to be against the protocol per se, which I find really interesting.

> Who holds the keys to the kingdom? In this respect, I think the AT Protocol fails spectacularly, mainly due to the lack of a credible strategy to implement really self-custodian identities

From what I've read, you can still own the entire stack from top to bottom, none of it is necessarily tied to bluesky. Even the identity managed being discussed only applies to bluesky, and whatever ecosystem subscribed to it; but in theory, you could create your own social platform with a new one (you'd obviously lose that ecosystem). But then again, this would also apply to Mastodon, since whoever owns the instance could always nuke it, and if you own your own instance, you need to build an network that trusts you. There's always an authority involved.

> The difference being, last time I checked (and of course things might have changed in the meantime) with AT Protocol it was only possible to self-host part of the infrastructure (and hosting the relay is insanely demanding).

Well it's definitely not the "50TB" you mentioned e.g here is someone running a relay on a $34/month vps and isn't going to accumulate more disk: https://whtwnd.com/bnewbold.net/3lo7a2a4qxg2l But it's importance is overblown anyway, it's just a json transmitter for signed data. I think the pds and identity managements are the better concern, and I hope there's a better way to decentralize those (if that makes sense).

EDIT: You're still correct that to fully spin up a new bluesky on your own you'd need an insane amount of storage for hosting all that data that's currently stored on bluesky (especially the did:plc and pds). All good arguments against the company, but that's only because people are choosing to store their pds repositories on bluesky. You could just as well point your repo to your own server and use a different social media. They could go under and someone else can create a new app view. I find that really cool; still leaves the identity issue open.

dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
tomgag · 4 months ago
Personal opinion: Bluesky is "fedi-washing". Better Mastodon or Nostr.

https://gagliardoni.net/#20250818_battle_of_socials

dark_mode · 4 months ago
I like the skepticism against Bluesky, and I agree that where VC money is involved things are mostly sketchy.

However, this post was about the at protocol, which seems like you just hand-waved in one sentence:

> The AT Protocol used by Bluesky has some interesting features, although to be honest I don't know how many of these are just impossible to achieve on ActivityPub or are just WIP lagging behind due to funding constraints.

I don't think the debate between them is super useful because their architectures are very different.

You also mentioned an issue with the bluesky relay, but others already exist so it's not techincally tied to Bluesky. Heck, I think the fact multiple can exist at the same, while degrades the social aspect, still makes it decentralized.

As for the identity management issue, they announced just last week that it's getting branched to an independent entity: https://docs.bsky.app/blog/plc-directory-org

dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
steveklabnik · 4 months ago
The “Bluesky API” is the appview, but the avatar is stored in your PDS. Even if you’re using a PDS hosted by Bluesky, it’s a different component that’s being asked to serve the avatar.
dark_mode · 4 months ago
Interesting. Ok just saw this https://github.com/bluesky-social/pds

> Self-hosting a Bluesky PDS means running your own Personal Data Server that is capable of federating with the wider ATProto network.

So pds (personal data server) is like the container where you chose to store the data and it follows a certain standard.

If the container is hosted is bluesky, i still consider it a "bluesky api" but I understand the nuance better now.

dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
Infernal · 4 months ago
If I understand correctly it doesn’t matter where the user’s profile is hosted, the point is the user has a store of data that can be accessed by multiple apps via the AT protocol, only naming convention separates one app’s data from another’s within a given user’s profile.
dark_mode · 4 months ago
Yeah I understood that part, was just confused by this particular sentence
dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
paool · 4 months ago
What is the incentive of someone to create an app and just pay for all the hosting involved?

Also, does everyone need to have their own domain name in order to have an identity cuz that seems like a non-starter.

dark_mode · 4 months ago
> What is the incentive of someone to create an app and just pay for all the hosting involved?

If you're creating a social app, website, or whatever, you still have to host all your users' data regardless. This is just about the protocol you use which enables universal compatibility, meaning users have the choice to store elsewhere.

> Also, does everyone need to have their own domain name in order to have an identity cuz that seems like a non-starter.

Not really. Bluesky is a good example; when you first sign up it does it for you under their own top domain by default iirc, but the great thing is you can actually use your own domain.

dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
dark_mode · 4 months ago
I wonder if there's a at protocol usecase for replacing something like Disqus in blogs, personal websites etc.
dark_mode commented on Open Social   overreacted.io/open-socia... · Posted by u/knowtheory
dark_mode · 4 months ago
Awesome read!

Question:

> What’s more interesting is that Tangled prefilled my avatar based on my Bluesky profile. It didn’t need to hit the Bluesky API to do that; it just read the Bluesky profile record in my repository.

I'm a bit confused by this. If a bluesky avatar contains an image, isn't that stored (at least by default) within bluesky? Meaning that Tangled will have to hit the Bluesky API?

Or maybe Dan is saying that his own repository is not hosted with Bluesky in which it would make sense, if wherever his repo is stored is getting hit to retrieve the image.

u/dark_mode

KarmaCake day91November 24, 2021View Original