Evelyn

Composable Trust, Part 1: Communities Without Credible Exit We guarantee that users aren’t subject to platforms. Yet communities are still subject to their stewards. Can we fix this?

Moderating @furryli.st always made me feel that something was missing from atproto. If we disappeared, so too would the community we built

This feeling’s finally crystallized into this proposal: Composable Trust

We created identities that survive platform failure. Lets do the same for communities!

greensky: what does permissioned data feel like?

happy friday folks! had to get this out, give it a go :)

So apparently not many people know this exists, I only had a chance to build an OAuth Client ID Metadata Document Service ~4 months ago, but I actually added the concept to the CIMD internet draft in the version published 10th January 2025.

This is how I imagine CIMDs working in development.

This sounds so old school 😂 I have a whole local setup that uses playwright to navigate the entire oauth flow for me but I have to use sslip or ngrok

Stop blowing my mind! I was using ngrok to get by

@spookalucca.tv is this the spot you were obsessing about

For those interested in paying for a platform that will actively protects its users, here's where you can pay us (Northsky)

Now up to 40ms latency compare to 10ms with cloudflare dns :/

Just last week I was in the queue for a club for over an hour and this guy just waltzes up to the bouncer, shows him his eurosky handle, and is let right in.

Here are some @eurosky.social testimonials from Germany:

"Since I joined Eurosky, I've been promoted, my wife and I sleep in the same bed again, and my children are talking to me again.“

I miss visiting my Eritrean family and just being able to pop in unannounced. Just once in my life I wanna live in a black neighborhood so every day can be like this.

"Final negotiations on Chat Control 2.0 just started between the European Commission, the European Parliament, and the Council of the EU.

What is good:

✅️ Encryption will not be broken

What is bad:

❌️ Commission & Council want #IDchecks"

It’s been 12 hours since @joshpetri.bsky.team announced his role and he still hasn’t explained his love for Alf.

Now I want to extend it to meet the vibe

A screenshot of the default page when you visit Stratos in a browser. Stratos is in a cool looking fancy ASCII art style reminiscent of crappy DOS role playing games from the 90s with fancy looking handwritten script. Below is the text: This is Stratos, a private permissioned data service for AT Protocol Most API routes are under /xrpc/ Code: https:// Protocol: https://atproto.com

I couldn't figure out how to make a cool logo so I went for 90s RPG

It's plural suggesting that they are now protectors of North and South America which nobody asked for

Americas

Welcome! To help us get to know you, can you tell us your favorite TV Show character and why it’s Alf?

The outage yesterday? Yeah was just two PDSs in one rack that had a hardware failure. Im a little upset we dont run PDSs on our own hardware but it is what it is.
The funny thing is that it was one of the older PDSs that included a lot of the early user accounts

Oauth is easy until you have to think about it 🥲
I may have rage skeeted about oauth oddities for a solid week recently

As we setup and refine our moderation processes we’re keeping on eye on what’s happening with bsky. Threatening a ban because a user blocks a _labeler_ of all things shouldn’t happen.
While we will use Bluesky moderation we will be reviewing actions against our users once we have the app+appview up

Nicks leaking my architecture plans again

Anyone asks we’re just signaling we’re human

atproto code touchers, pay attention tomorrow 🚨🚨🚨

For You, For Everyone - Graze Newsletter How Graze built a "composable personalization" engine for the open social web — and why it matters right now.

For You, For Everyone: we're thrilled to announce that our feed personalization engine is now live — and fully open source. Read our @leaflet.pub announcement below, or follow the 🧵:

XRPC requests between atproto servers are authenticated using JWTs. There are some inconsistencies in how OAuth permissions, PDS proxy headers, and JWTs all represent the "audience" of these tokens.

This proposal gives background and describes a rough solution.

Looking for rapid feedback!

There is no UI, integration for users is via a social app but I need to determine what a credible exit looks like. It’s going to mostly be documented for operators I supposed

Composable Trust, Part 2: Separating Trust from Governance ”Who belongs” and “What belonging means” are different questions. What happens if one steward stops answering both?

In Part 2:

To enable credible exit, ATproto deconstructed the “Platform” into independent layers with bounded authority.

Yet in online communities, a single steward necessarily becomes a single point of failure.

How can we deconstruct the *community* Atmospherically? What happens if we do?

Covering it would require adding a method for fetching boundaries during hydration but I don't see that scaling well. Since it's revocation it's not a major issue as it just means the user might see data for a teensy bit longer. However still make me a little nervous.

It’s mostly settled, the enrollment bits may shift as I nail down abuse/edge cases.