todotask2Colibri – chat platform built on the AT Protocol for communities big and small
This looks neat, but should I be concerned about the permissions this is requesting for my account? Bluesky: Manage your profile, posts, likes and follows
Hi! We're doing that to allow you to update your profile from within the app. Not doing anything else besides that. If you have concerns, take a look at the source code:
https://github.com/colibri-social/colibri.social
https://github.com/colibri-social/colibri.social
Very interesting project.
From a product uptake perspective, I could suggest that since a user is still building trust when they begin use - to only require as few permissions as needed. I'd punt that profile update requirement out personally for another method later.
An example might be when a user has used your app for N sessions, or after N months.
They should prompt the user for permission when they use a feature that requires it, explain why, and allow them to cancel if desired. Have seen this pattern used many times elsewhere.
Good idea, will implement that! Maybe a button or something to refresh your permissions when/if you want to edit your profile via Colibri makes sense.
Please consider adding screenshots of the UI that provide an idea of what the experience will be like without having to log in using Bluesky or other credentials.
I assume it looks the same as literally every other chat app
Done! Thanks for the suggestion, that's a good idea.
Thanks for the quick fix :) Nice to see more Discord alternatives these days.
A few other landing page issues if you feel like addressing them:
- Attempting to navigate with the Tab key results in tab order following nav elements once, where focus indicators aren't visible, and then the same elements get iterated over again but this time focus indicators are visible.
- Tab order doesn't include screenshots and jumps to the FAQ
- Clicking a thumbnail shows the larger image but without any elements for closing the overlay
- Pressing Esc doesn't close the overlay
- No skip links on any of the pages
I don't know how I can keep forgetting about keyboard users. Thanks for bringing this to my attention, I'm working on it!
Users in a Discord server/local community on tools like Discord naturally expect that their actions within that community are private in so far as they trust everyone in the community (including the operator) to keep it so.
By using ATProto, Colibri fundamentally makes all of your communication within any community completely public to everyone on the internet.
That’s fine for something like Twitter, where the product sets the expectation of such a thing. You can imagine how big of an issue this is when you try to do it in a trusted community model. Add on that Discord is used by kids who likely don’t know this and you can see why this is dangerous.
I consider this not only just a liability but bordering negligence. It is fundamentally broken, at an architectural level
I agree that is borderline negligence, and by far the biggest issue with AT and Bsky. Here is what I believe to be the most recent discussion on that topic:
Fair point! A different user has already pointed out that this isn't disclosed enough on the landing page, and I'll be adding a section to clarify that, both on there and in the app itself.
I think one of the replies here already linked the current proposal for private data spaces, which I'm hoping will become implemented later this year. At that point, people will have the option of either having their community be 100% public, or confined to a more Discord-style data storage, where people can still join, but not everyone can "just read" the messages
Just want to chime in with, this does feel very slick, but this was the #1 question I had. I could not determine it from your site, and had to try it out to see.
One major criticism of things like Discord is that they're private, so I don't think that it's inherently disqualifying, some people might even prefer it for that reason. But it's very, very important that you're very clear about this, up front.
It's impossible to consider ATproto apps usable until the horrific oauth situation is fixed. It's still not possible to adjust oauth permissions to something restrictive dynamically so every app needs a new account which kind of defeats many of the interop promises, if apps even allow it (colibri requires invite code)