Fucking Christ the @protocol is the most obtuse crock of shit I've ever looked at. It is complex solely for the sake of being complex and still suffers from *all* of the same problems as Mastodon.

Your server goes down? Sorry, all of your followers are lost. Account portability is no better than Mastodon. 'DIDs' serve literally no purpose. And none of the API code that Bluesky uses in their own app validates ANY of the crypto they're doing on the server. NONE OF IT.

Not only that, but instead of just... making a simple Rest API spec or something simple, they REINVENTED THE FUCKING WHEEL and made 'XRPC' and 'Lexicon', AKA a shittier, less flexible version of OpenAPI and JSON Schema (respectively) that works with absolutely NO existing tooling.

The actual protocol itself is poorly confused and incredibly awfully designed. Because of the useless bullshit crypto they're putting into it, it requires you to write a server that's strongly consistent with other servers. THAT IS EXTRAORDINARILY HARD TO DO!! And BLUESKY'S OWN SERVERS DON'T HANDLE THE EDGE CASES!!!

It uses pull-based federation instead of push-based like Mastodon. You have to write a separate 'indexer' that has your 'feed' on it. That requires a LOT more resources.

And because things must be strongly consistent, AND because any user can REWRITE THEIR OWN FUCKING HISTORY AT ANY TIME, you have to, as an indexer, account for lots of different edge cases where your recorded history diverges.

The protocol for federation is built to make federation as difficult and painful as possible. It is built so that Bluesky, the private company that makes the protocol, is the only 'indexer', the only one with a whole view of the network.

WHY DOES A FEDERATION PROTOCOL NEED USER AUTH API METHODS IN IT???? WHY DOES A FEDERATION PROTOCOL NEED A CONCEPT OF 'INVITE CODES'??????

Oh wait, BECAUSE IT ISN'T A FEDERATION PROTOCOL!!! It's literally JUST the API for Bluesky. That's it.

It's quite literally impossible to use this in more flexible environments. You just can't. You cannot build anything on this because it is so poorly designed and isn't generic enough.

And I went into this with an open mind. I was like "I'll just make a simple alternative to the BlueSky server in Elixir". But it CAN'T be a simple implementation like ActivityPub can be, because it is extraordinarily complex and requires you to make guarantees about your storage and how your application works.

It turns out using Git, which is almost always used with a centralized 'remote', to do federation, which needs to be weakly consistent, IS A BAD IDEA!!!!!

What this comes back to is... who cares about any of the crypto bullshit? Having a private key and signing everything with it proves nothing because that private key must have a reputation.

You can verify a domain on Mastodon. You can point a domain to a Mastodon server. You can do that with Pleroma. You can make your own alternative to Mastodon that works exactly like how Bluesky works with domains, but it would take a 4th of the time because ActivityPub is simple to implement!!!!

The ONE thing that this protocol brings to the table is the idea of strong consistency in federation. The only issue is, it makes that strong consistency so resource intensive and so hard to implement that it decreases community servers' ability and ease of federation!!!!

And also, NOBODY CARES ABOUT STRONG CONSISTENCY IN SOCIAL NETWORKS!!! Social networks are built on the idea that we all have a different view of things. We care about seeing stuff from our friends, not seeing EVERYTHING.

The 'account portability' piece is bullshit! The way 'account portability' works is by having two separate keys, one for signing and one as a 'recovery' key. You're supposed to be able to use the 'recovery' key to rewrite history if your account gets hacked or some shit.

WE HAVE THE ABILITY TO DO THAT AS SERVER ADMINS!!! MASTODON HAS THIS ALREADY!!

Additionally, if a Bluesky server goes down, their way of keeping access to your data is by STORING ALL OF IT ON YOUR DEVICE!!!!

Imagine if I had to store the 50k+ tweets I've made on Twitter on my device, and upload ALL of them to a new server whenever a community server went down. Imagine being a server admin having to deal with people uploading tons of JSON data and media a whole bunch at a time. And if you're implementing the protocol correctly, EACH JSON BLOB REQUIRES VERIFYING THE SIGNATURE!! So you'd have to do 50K SIGNATURE VERIFICATIONS! WHICH IS CPU INTENSIVE!!! AND SLOWS DOWN THE SERVER!!!

Additionally, the domain name is NOT your identifier. If you have a custom domain, that is NOT your identifier. Instead you have a 'DID:PLC', which is a kind of 'DID' (invented by, not a surprise, CRYPTO PEOPLE).

There is NOTHING FUNDAMENTALLY USEFUL ABOUT THIS IN FEDERATION. Because this DID is never made visible to a user, it is not human readable (it's a hash), and it doesn't do anything!!!

And if you're wondering why this senseless overcomplication wreaks of the same crypto overcomplication, it's because THE CEO IS A CRYPTO PERSON!!!!

The entire protocol is just layering on top of a lot of some useless, bullshit standards that the crypto community built.

@sam Am I understanding it right, then that they are building an individualist kind of portability as compared to Mastodon's more collectivist kind? They want to make each user a kind of sovereign citizen who owns their own profile, while Mastodon is predicated on you being part of something, a community on a server?

@Loukas No, your data is stored in a server that can be a community or an individual person. But that doesn't store your feeds, like Mastodon does. So like your feed on here exists on your server, and it's built by people sending messages to and from your server.

On Bluesky, there is a single, more 'global' feed called an indexer. That builds your feed.

@sam and the indexer is the thing that seems to be controlled by the original bluesky people and you couldn't work around?
@Loukas It is just extraordinarily complicated and not immediately obvious how to build one. ActivityPub allows you to build a 'feed' however you want in your app, but Bluesky requires a certain structure and way of pulling information in. The way you get all the posts is extraordinarily resource intensive and complicated to write correctly (because it needs to be consistent), which will make it so that there are few community-based alternatives.
@sam @Loukas it's a little more complicated than that-- your data doesn't live on "servers" bound to instance-like clusters of moderation policies and federation decisions, it lives on personal data stores (closer to the Solid model) which are commodity interoperable dumb lockers where bits go, but because they're self-verifying and signed, they can be consumed en-masse by multiple servers over time. your data never moved, access rights to that data just gets authZd and de-authZd
@sam @Loukas you're definitely 100% right though that the main beef AT people had with AP was the instance/server collective. these are not mutual aid anarchists, these are hyperindividualists. their vision of a server is more like an adtech aggregator or a search engine (which AP doesn't really have on a scale that would work for silicon valley, ever!), not a manageable cluster of like-minded individuals cooperating :D
@by_caballero @sam so BlueSky data is bitcoin and Mastodon data is fiat currency;)
@Loukas @sam well, more like BSky data is ready to be dumped into data lakes and sold in a decentralized way to next-generation adtech that operates only on permissionless, self-certifying data, and ActivityPub data is EU, GDPR-friendly, consumer-centric non-commercial data that makes life hard for data barons.
@by_caballero I can imagine, though, that BS creators sell it as your blockchained data in those central vaults being more 'hard' and 'owned' because it's not linked to any messy social relationships or groups, paralleling the classic libertarian argument against fiat currency ;)
@Loukas haha, there are pros and cons to every technical architecture and i'm the first to admit different philosophies of private property, actionable debt, and tort are baked into every data architecture. but it's quite complicated when you get into data management, particularly given that anything new is david and goliath is adtech. crypto-economics can be pretty ugly and libertarian but you also have to factor in the probability of it opening doors to alternatives and less-awful variants
@by_caballero absolutely, I'm just trying to understand based on clustering all I know about jack and the politics of people like him together with this technical description.
@Loukas well, i didn't even read your bio so apologies if i firehosed you with technical documentation. the short historico-political answer is that yes, crypto's main usecases include gambling, securities fraud, tax evasion, and money laundering, but a side-effect of crypto tooling being dumped on retail "users" (betatesters) is that now millions of non-programmers are finally using private keys instead of passwords and that opens up some interesting data-management architectures...
@by_caballero Huh, another point against Crypto Jack's new project, it seems.
@by_caballero @sam thank you, and how is this data legitimately accessed? What is required to have the key to these safe deposit boxes?
@Loukas @sam that's why each blog is signed, the signature would break if anyone futzed with it. if you're asking about authentication and authorization models, I couldn't tell you off the top of my head but I think as I understand it bsky is building on UCANs, which are like an ambitious OAuth alternative modeled more on object capabilities than ACLs exactly to enable this kind of permissionless layers and dumber lockers with smarter locks on them. https://ucan.xyz/
UCAN Distributed Auth

Auth tokens for a distributed, user-controlled world

@Loukas @sam The [BTC-friendly] fintech and neobank BLOCK, which has a great, well-funded open source department, is funding a pretty mature personal data store along very similar principles as well, if you're looking for docs and diagrams that make this sound less vapory.
https://developer.tbd.website/docs/web5/learn/decentralized-web-nodes/
Storage (DWNs) | TBD

3 minute read

@by_caballero I mean more in a political or legal way. Who decides who can access your data? Can you simply give or revoke access yourself, as a form of migrating providers? Do you apply to some decision-making body? I know none of this is happening yet, but what does AT so far imply?