XMPP was what i’d call a fairly advanced and technical protocol and it still powered some of the most user friendly chat apps (for example Tlen in poland) it’s not about the protocol itself, it’s about how it’s presented to the user

Some universal truths about chat protocols: 1. you do not need federation, IRC figured it out already, it’s called connecting to a bunch of servers, what you need is persistent identity 2. E2EE makes no sense the bigger the group gets 3. one instance should be able to fit more than one community

Customer: "Hey, we found a bug in your stuff. Here's a .pcap which triggers it. Can you fix it?" Us: "Sure, we fixed it, and we added your .pap as a test case!" <repeat several times> <years elapse> Me: "This .pcap looks like a capture from a live network. Are we sure we're don't have […]

I finally gave in to temptation, and changed my handle and avatar to match my Fediverse, Discord etc identities. Anyone who might have recognised the old avatar will just have to guess who I am ;)

Cool, I'm now an Invited Expert with the W3C FedID Working Group, which allows me to better advocate the for needs of decentralized social web when it comes to FedCM and related technologies Looking forward to working with the other working group members on these topics! www.w3.org/groups/wg/fe...

I think this is the right call. What intrigues me is the notion of broadcast outside of the relays. When shared private data is written is that pushed to authenticated app views or do we have fetch only? If we have push is it via websockets? that could lead to a huge number of open socket right?

And I made a joke post about "vibe surgery" just the other day... www.reuters.com/investigatio...

Sure, they should be accounted for, but they don’t really change the fact that luddism is not fairly portrayed as an anti-technology boogeyman. Invoking the Luddites without contextualizing their motivations and tactics in the labor movement is intellectually negligent.

The root of all evil in technology is hype-oriented development. Under sell and over deliver.

if you're interested in #atproto getting a better sign-in flow in browsers, please give this a thumbs up. #FedCM also if u know more about how this would benefit you, leave a comment following their template! github.com/web-platform...

vibecoded web apps have such boring security bugs. "the whole database was wide open". oh. ok. at least have some class and write some sql-injectable php. maybe a little stack buffer overflow as a treat.

This helps illustrate that “private data on Bluesky” is several needs in a trenchcoat, which is generally bad for cryptography design. Do you want data intended for specific recipients? Do you want data for just the user? How private should the data be? Can metadata or existence be public?

End-to-end encryption means whatever you're sending is not readable BETWEEN the ends. If you own an endpoint, you can read it. That is how the FBI has historically gotten data from Signal chats. There's no magic. You just go where the plaintext is. Please stop believing vague scares about this.

Is there a reason why atproto development discussions are not public? (Talking about the private data plans.) Have I missed it? I'd love to contribute lessons from @peergos.org

Good piece. I think the "global view" emphasis is paramount to grokking the AP-versus-ATP tradeoffs-- for global-view use-cases, ATP makes a lot more sense, and separates concerns sensibly. For a cozy/local-only view or for some private-shared-data/off-protocol use-cases, ATP might be more work!

Honestly loving the sound of this. > as a transitional approach, didplcbft can act as more of a mirror of an authoritative PLC implementation, namely, plc-directory wdyt @warpfork.bsky.social @bumblefudge.com @mythik.co.uk @bnewbold.net @retr0.id 👀

Global townsquares considered harmful at this stage of humanity's development.

Here a demonstration how an ATProto login could look like with FedCM support, left /accounts of the PDS, middle the ATProto Oauth demo client (go) and right pdsls showing the result. The PDS FedCM /assertion endpoint creates a short lived idToken which is used in the flow as an id_token_hint

i don't know what the EU's anti-coercion instrument is. i understand it's probably a complex parliamentary mechanism to trigger a series of nonbinding regulations. but i choose to see it as a continent-sized cartoon snub nose revolver held in an enormous mechanical hand rising out of southern france

Important updates for people passively keeping up with the AP side of the protocol governance topic. the WG is technically a maintenance only WG (no new features) but there are administrative ways things like an OAuth profile or LOLA could eventually get normative status if the WG works on them.

it's a joy to write about well-designed systems

ActivityPub is getting its first formal update path since 2018. I wrote about why this matters, how this leads to some strange and funny power dynamics, and about who actually participate connectedplaces.online/reports/fedi...

Good to see a little flurry of people saying "actually X is rubbish, let's all join Bluesky instead"! And a warm welcome to @fierydw4rf.bsky.social and @meliannight.bsky.social :)

New feature request: AlphaTags! Any word which starts with a letter of the alphabet automatically turns into a link to every other post which uses that word.

Get in nerds, we’re putting atproto in the browser.

Agreed, and FedCM could be prototyped on any custom PDS that’s running out there now. Community can move faster on this than bsky-corp. Sending out the @-signal to @futur.blue @mary.my.id @mk.gg @lewis.moe 🪿 Participation thread: github.com/bluesky-soci...

> Open Source was never the commercial product. It's the conduit to something else. Yeah, a conduit to the feudal cloud hegemony 🤷‍♂️ Personally I don’t wanna run a capital-intensive hosting company. Call me a naive dreamer, but I just wanna make great software and sell it for a modest profit. Kay?

Heads up to anyone using @roomy.space! We just moved the current version of Roomy and all of it's data to old.roomy.space in case you login and wonder where all your stuff went.

My first week for work for #2026 draws to a close ... and most of the discussion with my boss has been on the topic of "what do we do about this bloody #idiot #slopmonger we've ended up with on the team"? I hope the year takes a turn for the better, ideally very soon. #aislop #aicoding #notoai […]

The Ely Christmas Star 2025, a video of how it went. www.youtube.com/watch?v=JQ4D... This is an an annual effort between the end of Second Sunday and Boxing Day. #Ingress

Happy New Year, Bluesky (and beyond)!

Nerds behold, the very first Leaf stream DID: did:plc:tqd32oyrvfdkzh62zmk3tftv Soon every space in @roomy.space shall have it's own Leaf stream with it's own DID.

Seeing everyone here talk about auth & internet handles is refreshing, largely because this sort of conversation generally wouldn't happen on the Fediverse. That and trying to convince people that "mo, standardisation and discoverability are actually good things" is hard.

my take on login ux is that there should be a button that says "log in" and you click it and you get logged in

My thoughts on "Sign in with your internet handle" as a call-to-action for authentication, and my guidance and best practices for handling authentication inputs. #ATProtocol #Authentcation ngerakines.leaflet.pub/3ma7hed2kdk2x

Announcing Key Transparency for the Fediverse soatok.blog/2025/12/15/a... #fediverse #e2ee #keytrans #keytransparency #key-transparency #crypto #cryptography #privacy #opensource

I just finished a new blog post that talks about how @roomy.space's new server is going to work. I explain where the data is stored, how we do authorization, how we preserve data ownership without the PDS, and more. It's a big one!

Wrote my first leaflet! This is about the threat-model of PLC & the current work we're doing to address that including making the directory more auditable

Really well written and description of the problem that @roomy.space is working on: how to leverage decentralized identity that doesn’t follow the PDS-origin path. Exposes a lot of edges in the atmosphere that need polish. Really love auth separated from PDS here.

Something I've been meaning to write for a while, about a few places where I wish that Bluesky/ATProto had gone just a bit further. www.mythik.co.uk/social/so-ne...

Ooooh! ID-JAG or OAuth Identity Assertion JWT Authorization Grants looks interesting: https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-01.html #oauth

Apropos of nothing, a moderation list bsky.app/profile/over...

The Mercator projection if it weren’t cropped (click to view full size)

I may have just broken the minds of ActivityPub developers at #fediforum, but the question I posed was "what happens if we do this differently? What other ways of building the Fediverse are there? Why are we building monolithic applications?" The first half of the session was very much so an […]

Personal data storage is an idea whose time has come: Data Ownership as a conversation changes when data resides primarily with people-governed institutions rather than corporations. blog.muni.town/personal-dat...

A glimpse into the Bridgy Fed monitoring dashboards. Pretty conventional mix of infra, OS, and app level metrics. Note the delay numbers. When you do something in one network, how quickly do we bridge it across? We pay a lot of attention to that, we try hard to keep it as fast as possible!

I have created a bot that will give you an absurd compliment if you mention the username @absurdcompliments.bsky.social

Making the internet better doesn't start by saying "let's not change what they did at the toxic place" Yeah it's risky and it could totally flop, but no chance I want to go down with we tried nothing and we're out of ideas

We've been hard at work for the last month on a new @roomy.chat architecture that we hope will get us into production: A Brief History of Roomy's Architectures blog.muni.town/brief-histor... I'm very excited about the new design and the performance that we're showing on our initial tests!