This "social coding" thing Tangled has going on is cool but I don't want it. I hear they're figuring out private repos but for me, I don't want the same account I use for social for my code.

I'm probably in the minority though.

This cheap criticism of the headline doesn’t actually apply to the problems brought up in the article:

> Your PDS operator can post as you, like things as you, follow people as you, and it would be cryptographically indistinguishable from your real activity. The signatures are valid.

Your domain name owner or DNS provider cannot redirect your domain name to a different server and cryptographically impersonate you.

Can you move a DNS record AND make it look like I signed off on it?

The author's concern seems to be more focused on impersonation

Yes you do own your domain, as much as you can own your house. Your hosting provider can only take down your hosting, not your domain. Seizing domain names isn't very common. And by the way, with Web3 domains, you have full ownership via your own private key, with no need to pay rent. Is it possible to lose your house that you own? Yes. It's far more rare to lose a domain you own, by it being seized.

DNSSec is used to prevent unauthorized stealing of domains. Furthermore, if someone does steal one domain you own, they don't steal all your accounts across all domains. If they take over your hosting, that's a fixable problem -- you just repoint the domain.

Now, having said that, I designed the Safebox exactly to prevent these scenarios from happening, and create an actually solid foundation for decentralized social networking, AI workloads, etc. If anyone is interested, probably the best link to begin reading about it is: https://safebots.ai/about (If you do, I'd love to hear your thoughts)

But without private keys they can't pretend to be the same you. There is a very big difference here.

that is why you have did:plc in ATProto but that doesn't resolve the concerns raised in this article.

> Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre,

Keeping a private keep on the client to sign your activity is a fundamental cryptography practice.

If you use a private key to sign your emails or git commits, it’s not security theater.

If you were to have to upload your private key to GitHub or your email provider, that would be severity theater.

> Is author new at the whole web thing?

Unnecessarily mean comment.

> This is just how the web works, and there is no easy around it without losing features people care about [...]

Well, apart from using a separate email address for every single "provider"?

(Spoiler: there's no way I'm going to sign into your service with a shared email ... you get <youservice>@<me>.com)

You have the ability to move, as long as Bluesky Social PBC allows it.

They hold the keys for your DID. If they don't allow you to move to another PDS, you can't move. The original theory was that you'd hold the private keys, but that's something that would hugely limit adoption so they decided to hold the keys themselves.

In terms of moving your backlog of posts to a new server, part of the issue is liability (not merely legal liability, but reputational as well). When you have a user on your platform and they're posting stuff, you're moderating them in real time. If they turn out to be a horrible troll, you've get the reports. Let's say a horrible troll has been on EvilServer and EvilServer has been ignoring the reports against them. They now want to move to your GoodServer and bring all their post history with them. As an admin of GoodServer, you can't see that everyone has been reporting this troll for years. They're now moving over lots of horrible, inflammatory, potentially illegal posts to your server.

Except it isn't as straightforward as most people would think. The last time I checked this, I think there were some issues with Bluesky app view and it didn't show accounts from a self hosted PDS

So annoying to read. Meanwhile, the key information ("backup key with higher priority") is mentioned in a sentence without any kind of elaboration or link to some follow-up/how-to.

and what makes you say that?

Because there is no single "default instance that is always a good choice and wouldn't go down randomly because of lack of funding". That's both a strong and a weak side of fedi

Higher friction and fragmentation are Fediverse features (not bugs) that give it a different grain. ATProto has different tradeoffs that lead to a different form of social media. I'm glad both exist, and bridging efforts are worth paying attention to for anyone frustrated with the distinctions.

How is the fediverse different. Can't the owner of an instance post as you? Can they read all your data stored on their instance and pass it to anyone they want to?

Based on all the traffic and development activity I'm not sure on what basis one would say "failed"

Bluesky / AT is the most successful open social network in history and the only one to become culturally significant. It has been adopted by presidents, celebrities, journalists, and mainstream users.

Bluesky has sustained 1M+ daily active users and 3M+ monthly active users for roughly two years, and there is no obvious reason to believe it will fall substantially below that number.

It is also in the process of adding (decentralized) subcommunities, which I expect to have a huge growth impact.

> smart contract-based process for recovering ids if keys get lost or hacked

How would that even work?

What is the incentive for an individual to participate in a non-financial blockchain?

Bitcoin-style blockchains “work” because everyone gets the possibility of a little reward for all the hassle and non-negligible CPU time of being a node.