Bluesky and AT protocol

north,
@north@fosstodon.org avatar

Fuck it. #YOLO

#Bluesky continues to be entirely non-responsive to the numerous security vulnerabilities I've reported to them, so I spent the evening writing up a nice README and a framework with exploit modules, and just made it all public.

Have fun.

https://github.com/qwell/bsky-exploits

#infosec #security

Edent,
@Edent@mastodon.social avatar

@north Ha! I reported the exact same thing to Twitter 4 years ago.
https://shkspr.mobi/blog/2019/03/scammers-abusing-twitter-cards-via-redirects/
Wankers.

north,
@north@fosstodon.org avatar

Paul Frazee, a developer at Bluesky, has publicly responded to somebody about this issue (...they still have not contacted me, however).

I could not disagree more, but there you have it.

chargrille,
@chargrille@progressives.social avatar

If Jack Dorsey & Elon Musk (who are friends) just wanted to run a MAGA site full of fascists, they could have just bought Parler & saved themselves approx 43.999 billion dollars.

What they wanted was to cripple the sad remnants of investigative journalism, and the political left, which successfully used Twitter for political organizing, activism & messaging throughout the Trump regime.

Why would anyone who cares about either of these things go to Jack's project.

chargrille,
@chargrille@progressives.social avatar

Amid rumors he'd been forced out as Twitter CEO (for the 2nd time), Dorsey reached out to Musk & together they planned his takeover, which Dorsey backed to the tune of $1 billion in shares.

He is one of the biggest owners of Twitter.

They're collaborators, not competitors.

https://progressives.social/@chargrille/110649546742614799

chargrille,
@chargrille@progressives.social avatar

A Jack Dorsey owned protocol or platform will never, ever be a safe space for Democratic or progressive organizing, or even a safe gathering space for any marginalized community (which includes women).

It's actually a big deal to throw away this moment - an opening of possibility to meaningfully disrupt the cycle of Enshittification & to build a vastly more democratic social media space.

tchambers, (edited )

New research from my team on the :

This is our 3rd quarterly update on which platforms are growing, new entries such as , Notes, & all public data on Meta's
Includes latest on the ,
New polling, new posting data & more.

Welcome any notes or feedback & boosts!

Get it here: https://is.gd/5PJQH7

cc: @spreadmastodon @fediversereport @fediversenews

tchambers,

Also a big call out to data. The entire Fediverse section of this report would not have been possible without that resource.

cc: @dansup

amart,
@amart@hachyderm.io avatar

@oxpal @tchambers I recommend following @donmelton - he’s like a human algorithm here boosting a wide variety of voices, viewpoints, topics, and ideas. Definitely center-left but with reasonable practicality which for me works out just great. I’ve found loads of new and interesting folks to follow from his boosts.

Honestly I think Don is an algorithm vs a person since he rarely posts himself and always favorites any posts I make that tag him. 👍👍

siin,
@siin@pagan.plus avatar

I've been on BlueSky for 10 minutes and... (An Essay)

I get it now. I used to be like "Why can't people just stop using Twitter/Instagram/WhateverTheFuck? If they need social media, why can't they just use Mastodon? Why doesn't Pixelfed get more users? It's literally the same UI".

But I get it. I've been on BlueSky for what? 10 minutes? And I can feel my brain chemistry changing. Mastodon is a coffee shop. It doles out caffeine. You still get the little dopamine hit when you get notifications, you get that kind of substitute for human interaction that feels nice. But Twitter and BlueSky and Instagram and these apps from companies with access to inordinate amounts of data to build algorithms designed by psychologists to literally be As Addicting as Possible? These apps are dealing meth. But they've pressed it like ecstasy and made it cute. They've made it socially acceptable. But let me tell you something.

Ever since I logged onto BlueSky, I've been thinking about it. I don't think about Mastodon all day. "Oh my god what should I post next? What will get me followers? Would this be funny? Is this on brand?" I don't think about it. I come here because I have interactions with people without the pretext that they're engaging with me to get engagement in return. Because sometimes in my life I feel isolated and because this substitute for human interaction feels nice.

I thought I'd get BlueSky (despite their horrifying privacy policy - more on that later) because there are some Things Going On that make me need to get a little more serious about making money. But fuck, if this is the only way? I'm taking a vow of poverty, or getting a day job.

Because then there's their privacy policy. Access to websites you visit before and after, identifying information about your device, purchases you make, and it goes on. But even that level of invasive access should give us pause, right? I have a lot of things set up on my computer that mitigate some of that access, but then let's think about how we give the app access to our photos and videos (all of them, not just what we post in the moment), our device's camera and microphone (not just while we're using it) and so on. And then think about how our society grooms us to believe (and maybe in some circumstances this belief is true) that we need these sites for access, for engagement, to make money.

The price of not working in a warehouse is every piece of information we can reasonably gather about you to use and sell however we please, for whatever purpose, indefinitely, and it never expires and we don't pay you for it.

This is exploitation and my ancestry makes me pause, horrified, at what this information will eventually come back and do to us when inevitably the wrong person/group gets ahold of it. And that's pretending like we even know who has our data and what they're doing with it, right? Because we don't know. We really don't. Call me paranoid, say that I shouldn't worry if I have nothing to hide, give me all of the excuses you've been programmed to give about why we should not worry about a surveillance state that we pay for. Then come online and rant about how dangerous governments are and fail to see the irony in it all.

And I'm a hypocrite. I bought in, too. For personal gain. After criticizing others for years for doing the same thing. It's true. But the interesting side effect is that I've gained so much insight into why we're so addicted to sensationalism, why we're so addicted to these sites, why we're so unwell in general. The kinds of things my feed is inundated with, especially since I haven't curated it yet and it's showing me what it wants to? My god. We cannot have a healthy society when this is what we're consuming all day every day. There is no way to be a healthy person, I believe, when consuming this all day every day.

So anyways. As always, perhaps a bit sanctimonious. But I'm a little dumbfounded at the experience of all of this after years off of corporate social.

eloquence,
@eloquence@social.coop avatar

@siin

Thanks for reporting back. I've not posted on yet, but even just looking at the feeds I get that same sinking feeling: here's a platform that, just like the ones that came before it, wants to kick emotional feedback loops into overdrive.

At its best, that's "only" addictive. At its worst, it accelerates and amplifies the worst human behaviors.

UlrikeHahn,
@UlrikeHahn@fediscience.org avatar

@siin @Ruth_Mottram I read this in disbelief, so checked, and there it is:

“Automatic Collection of Personal Information. …..We may also automatically collect information regarding your use of our Services, such as pages that you visit before, during and after using our Services, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services.”

https://blueskyweb.xyz/support/privacy-policy

Haste,
@Haste@mastodon.social avatar

The community is on strike, in protest of “free speech” moderation policies and refusal to prevent or remove .

The inciting incident this time: users signing up with the n-word in their usernames. Using the word “cracker”, however, was a bannable offense.

Bluesky has not responded for over 36 hours as of writing. Devs are blocking protestors. Timelines are filled with variations of:

“No more normal posting until my Black friends and family are safe.”

Haste,
@Haste@mastodon.social avatar

It is beautiful to watch folks organize spontaneously around this. There are some really novel techniques being used that I have not seen before.

Shitposters and sex workers blurring their posts and withholding lewds, if only there was a safe platform to post them. Quote chains of people asking the devs to block them too in solidarity. Users building custom, public mute lists to block out fascists and protect marginalized communities.

The devs are liking nazi callout posts & posting on Twitter

Haste,
@Haste@mastodon.social avatar

But I would also like to take a second, before you enjoy too much schadenfreude, to point out that by and large PoC communities also are not safe on Mastodon.

A huge amount of the feedback being levied on Bluesky’s lasseiz faire moderation policies also apply to us here.

I have very little faith Bluesky will improve, but we still could.

cmdr_nova,
@cmdr_nova@mkultra.monster avatar

devs trying to convince people who thought picking a server on mastodon was too hard, to use regex

cmdr_nova,
@cmdr_nova@mkultra.monster avatar

@tom "we've laid the groundwork, now you can develop the rest of the app"

lanodan,
@lanodan@queer.hacktivis.me avatar

@cmdr_nova When the heck would one need a regex to "build their own feed"?
(And I use regexes quite often, because Unix)

Richard_Littler,
@Richard_Littler@mastodon.social avatar

Jack Dorsey is furious that has attracted "very very common" people. He also doesn't like the idea of moderation tools facilitating the banning of racists.

All these tech billionaires are like a version of the movie Big, in which a pre-adolescent boy wakes up in the body of an aging Howard Hughes. Or Colonel Kurtz. Or a sardine.

anathema_device,
@anathema_device@bne.social avatar
binaryphile,
@binaryphile@fosstodon.org avatar
KatM,
@KatM@mastodon.social avatar

Are there incentives to convert Mastodonians over to ? I feel like I walked onto a used car lot this morning. Please stop evangelizing another Jack Dorsey product. We know where to find it. If you love it, good for you. And hey, we’ll see you on your return trip when he sells it to one of his billionaire libertarian friends!

soc,
@soc@chaos.social avatar

@KatM Some people apparently cannot function without a billionaire lording over them. 🤷

womble,

@soc @KatM feudalism is a hell of a drug.

chargrille,
@chargrille@progressives.social avatar

You should stay away from , not actively help Jack Dorsey make his next billion & build his power as an owner of another social media empire.

Dorsey helped fund Musk's takeover to the tune of $1 billion, making him one of Musk's top backers (after Qatar).

He owns part of Twitter.

He & Musk planned Musk's takeover at Twitter. They are collaborators, not competitors.

https://progressives.social/@chargrille/110286207887749108

>Edit to add Dave Troy's piece https://davetroy.medium.com/no-elon-and-jack-are-not-competitors-theyre-collaborating-3e88cde5267d

chargrille,
@chargrille@progressives.social avatar

@ricardoharvin @davetroy

The other thing I've been trying to focus attention on, is that Jack's "solution" to abusers in social media - "algorithmic choice" - is intentionally anti-social & inherently biased towards increasing hate speech &stochastic terrorism.

Mastodon's model "shifts moderation to the source, rather than the destination" creating accountability. See https://escapingtech.com/tech/opinions/i-was-wrong-about-mastodon-moderation.html

And the reason Jack re-wrote an analog for ActivityPub protocol was so he could capture the audience.

The ability for users to choose if they wish to be collateral damage is what makes Mastodon work. If an instance is de-federated due to extremism, the users can pressure their moderators to act in order to gain re-federation. Otherwise, they must make the decision if to go down with the ship or simply move. This creates a healthy self-regulating ecosystem where once an instance starts to get de-federated, reasonable users will move their accounts, leaving behind unreasonable ones, which further justifies de-federation, and will lead to more and more instances choosing to de-federate the offending one. Since instance owners are either running their instance for community purposes, or for profit via donations, user loss is very harmful. As such, there is an economy of accountability which shifts moderation to the source, rather than the destination. It's in an instance owner’s best interest to maintain the friendliest possible community, as this is what attracts new users and keeps exiting ones. With instance moderators held accountable for their own instances, this significantly reduces the moderation burden on other instances. It also creates a double-moderation system, where if some badness does slip past the source instance’s moderators, moderators on the recipient instances can pick up the slack.

CarlG314,

@chargrille "Insanity is doing the same thing over and over and expecting different results." -Albert Einstein.

How can anyone fed up with join without stopping to ask how submitting to the control of one deranged oligarch over another is an improvement.

ploum,
@ploum@mamot.fr avatar

"I’m not on Mastodon because there’s nobody there, there’s not enough users to make it succeed, my whole community is on Twitter and don’t want to migrate and… hey… I now have a account! Please follow me on Bluesky, it’s very cool, it belongs to a billionaire but is decentralised. Or at least, the billionaire promises us it will be, which is cool."

– Basically every silicon valley pundit

Alex,
@Alex@vran.as avatar

@ploum What's funny is that Jack Dorsey, the billionaire who everyone thinks owns Bluesky, is just on the board of directors, doesn't have an account, and is actively endorsing a Web3 competitor to Bluesky. Bluesky is just a shady for-profit Mastodon wannabe that will never amount to anything in the federated social media space. Now we watch as their own users get angry that federation is coming, even though that was the promise from the beginning.

dawngreeter,
@dawngreeter@dice.camp avatar

@ploum Mastodon's big problem is that there is no corporation with an eccentric CEO who would give themselves the title of Mastodon Mammoth or something, talk to the press how their stock will go up due to a dream they had yesterday, hype up investors and show up in tech biz news feeds.

I mean, for me, that's a feature. But capitalist machinery does not know what to do with things that aren't for sale. Let us recall that PC gaming got revived almost entirely due to Steam.

MikeRiverso,

Bluesky’s having a bit of a moderation crisis, which got me thinking about the ways in which the major Twitter clones approach moderation:

has libertarian “free speech at all costs” moderation.
has puritan neoliberal top-down moderation.
has Nazis-to-the-front anti-moderation.
has a server covenant and vote-with-your-feet, accountable community moderation.

The first three are run by tech-bro billionaires. The latter is not. And it shows.

MikeRiverso,

The moderation approach here is quite anarchist, really.

And it’s amazing how quickly Twitter became Gab.

mrcompletely,
@mrcompletely@heads.social avatar

@MikeRiverso "if only someone could have seen this mod problem coming - hold on [taps earpiece] - well folks I'm being informed that in fact many, many people predicted this. Maybe we should start listening to them? No? We won't be doing that? Ok, well, back to you, Dave"

rolle, (edited )
@rolle@mementomori.social avatar

For all the people who say ”I had to select a server, it was so complicated to sign up to Mastodon. On Bluesky it was easy” - how are these two different logic-wise? I mean what the hell?

stux,
@stux@mstdn.social avatar

@rolle apparently Bsky posts are always visible via API endpoints no matter the "privacy settings" on the accounts

And thats by design

henrik,
@henrik@eliitin-some.fi avatar

@rolle maybe the pretty graphics are too sophisticated to comprehend? 😅

noondlyt,

And there it is, monetization before decentralization.

They're selling domains. I knew it.

3:59 . a Post Bluesky @bsky.app • 1h We raised an $8M seed round led by Neo, with participation from other seasoned allies who want to help us realize our vision of an open commons for public conversation. With this funding, we can expand our team, manage increasing ops & infra costs, and grow the AT Protocol ecosystem & Bluesky app.
Bluesky @bsky.app • 1h We're excited to share our first paid service! We're partnering with Namecheap to provide easy custom domain management. With this, you can easily set a custom domain as your Bluesky handle and much more. Simply navigate to account.bsky.app to get started. ® Domains & Support @aliceshay @aliceshay social $11.98 @aliceshay.com $14.58 @aliceshay.net $16.98 PASt STO @aliceshay.cloud $9.98 Renews at 526 98/vr Purchase and Manage Domains Directly Through Bluesky https://blueskyweb.xyz/blog/7-05-2. We're excited to announce a new feature that allows users to seamles...

tariq,
@tariq@absolutelyhar.am avatar

@noondlyt I mean I think this mostly makes sense. You can have a domain as your username and you can use either an existing domain or get a new one (I have my domain as my username for example). I don’t think that this is necessarily antithetical to decentralization.

noondlyt,

@tariq It's not but it demonstrates that they are concerned first with making money and second or third with a decentralized platform. This is not what Jack talked about a year ago. Decentralization is not the priority.

mastodonmigration, (edited )
@mastodonmigration@mastodon.online avatar

No, you can't license my cat picture to Elon, Jack and Mark.

When you post on , or you agree to grant them a very broad perpetual license to the content, including the right to sublicense. On Mastodon, most instances do not take a license. Any bridge that takes content from Mastodon and, without permission, puts that content on one of these platforms is violating that user's to the content. You can not content which you do not own.

mastodonmigration,
@mastodonmigration@mastodon.online avatar

@mjr Appreciate your clarification. Thank you. Generally was referring to owning the content outright or a license that includes the right to sub-license.

Interesting to note that these corporate social media sites generally include the right to sub-license in their terms of service, so these bridge builders are not only planning on giving away a license to the content they do not own (or have a right to sub-license), but they are granting a right to sub-license this content. It's not OK.

mastodonmigration,
@mastodonmigration@mastodon.online avatar

@benmounseywood Yes, been trying to explain this this to the people furiously working on @activitypubblueskybridge , but seems they just shrug and go back to their "won't this be cool" engineering discussions.

Just because you can drive a truck through the storefront and invite everyone to take anything they want, does not make it legal to do so.

panos,
@panos@catodon.social avatar

OK this will probably be an unpopular opinion, but regarding the and whether it's ok to be opt-out... For me the discussion doesn't make much sense because this is how fedi works. When you enable federation, your posts are federated to any activitypub-supporting server, unless you opt-out by fediblocking. Do you approve all of these servers? Do you agree with their ToS? Have you read the ToS of all of them, or know where they belong to? No. I know this might make you insecure about your data, but it's better to be honest than create a false impression of control, which then feels attacked when Threads or Bluesky appear. I understand that somebody may not want their content appearing in Zuckerberg's or Dorsey's platform. But they could already be running an AP server that's federated to your server, and you will never know. This is what we signed up for, adopting an open protocol and using software that federates with everyone as the default. And tbh I like it this way - an opt-in federation would be a disaster for smaller servers, it would practically be impossible to federate. By using an AP-enabled server, I'm telling everyone that it's ok to interact with my content - unless I actively block them. It doesn't include an agreement for how or from whom this content will be used. The fact that both servers run AP-compatible software is only a technicality. So if Bluesky implemented AP support it would suddenly be ok that interacting with their users would be opt-out, like with every AP server?

Don't get me wrong, I understand that everyone wants to be in control of their social circle, and I support you if you want to block Threads or Bluesky bridges. But I don't really see how it's unethical to have a bridge that is opt-out, just like any other AP-server. Our only "agreement" is using an open protocol, not any common ToS. ActivityPub is not ethically superior by definition, anyone can adopt it, and we have the right to block them, and this is all by design, it's not a different corner of the internet, everyone in the internet can use the protocol and see/display your public content. The drama every time some server does basically what we allowed them to do and we don't like it, is getting really old quickly. It doesn't "protect" fedi, it only makes it hostile and boring. If you're concerned about who sees your content, please run a followers-only account and control your followers. Running a public account in an openly federated platform and then getting angry when you don't agree with every single server you're federating with is a recipe to make sure you'll be angry for years to come.

tbroyer,
@tbroyer@piaille.fr avatar

@panos @hsivonen This is not much different from free/libre open source software in a sense: you may not like that some people use the software you create, but if it's FLOSS then that's what you signed for, and adding terms to the license to prevent such use would make it no longer FLOSS.

That's how GAB can use Mastodon, 4chan can be built with PHP and YUI, etc. whether you like them or not.

FinchHaven,
@FinchHaven@sfba.social avatar

@feld

"The admin of any large fedi instance has the same power"

The admin of any large fedi instance didn't write an app specifically to do this

Big difference

This is a one-off

  • All
  • Subscribed
  • Moderated
  • Favorites
  • bluesky
  • GTA5RPClips
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • tacticalgear
  • cubers
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • osvaldo12
  • ngwrru68w68
  • kavyap
  • InstantRegret
  • JUstTest
  • everett
  • Durango
  • cisconetworking
  • khanakhh
  • ethstaker
  • tester
  • anitta
  • Leos
  • normalnudes
  • modclub
  • megavids
  • provamag3
  • lostlight
  • All magazines