Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was right about ATProto key management

notes.nora.codes

Post reply on HN
Print view View original

111–120 of 198 posts

Re: I was right about ATProto key management

#111

Post by fc417fc802 »

Meneth wrote: post #105
fc417fc802 wrote: post #104

Earlier quoted context omitted.

I agree that the ATProto situation described is ridiculous. However the situation with AP is not nearly as cheery as you describe. The protocol commits the exact same sin, essentially baking in the assumption that any given ICANN DNS entry will only ever be controlled by a single entity for all time. Real world implementations then associate keys with nodes using a TOFU scheme (which makes perfect sense) and if the d…

"the assumption that any given ICANN DNS entry will only ever be controlled by a single entity for all time." Email has that problem too, doesn't it?

Not really? Email is a dinosaur of a protocol that doesn't properly handle authentication to begin with.

Anyway other protocols or implementations making the same class of error doesn't change the fact that it's an error and that it causes real world problems for users such as described in the linked page.

Re: I was right about ATProto key management

#112

Post by tsimionescu »

anonymous908213 wrote: post #102
tsimionescu wrote: post #95

Earlier quoted context omitted.

Advertising is never going to inform you - it is by definition about persuasion, not information. An advertisement is always designed to try to convince you to buy a different product than you would rationally choose yourself. Even a seller in a physical market telling you their tomatoes are very sweet and juicy is simply trying to get you to buy: they have no idea, and don't care, if their tomatoes really are sweet…

> An advertisement is always designed to try to convince you to buy a different product than you would rationally choose yourself. Perhaps you could consider toning down the absolutism. This is true in many or most cases, but certainly not all cases. Let's take, for example, video games. I can afford to purchase any game that interests me, and do. However, I often go several months between new game purchases, because…

> An advertisement for a game does not need to convince me to purchase it over an alternative product, it simply needs to make me aware of its existence and broadly convey what the game is about so that I will know whether it matches my specific game interests closely enough to investigate further.

I agree that it does not need to do more than inform you - but that doesn't mean it won't do more. Please show me a single advertisement for a game that doesn't use bombastic language, show highly selective graphics, or appeal to a sense of nostalgia. I for one haven't seen one, even ones for the niche indie games I respect the most. Sure, not all commercials are equally deceitful, but they are all meant to be persuasive more than informative.

Re: I was right about ATProto key management

#113

Post by yoshuaw »

miki123211 wrote: post #99
jrm4 wrote: post #29

Earlier quoted context omitted.

So I agree with you that they should work like email -- but I've always said that Mastodon is better because it is like email; aka the power is in the nodes. What do you think is wrong about Mastodon? Genuinely curious because I also am super skeptical that ATProto brings anything that we really need.

The problem with centralized social media is that the admins have power over you. They can ban your account with no recourse, censor some of your posts (or some posts you want to read), or even post something from your own account that you don't approve of. Mastodon doesn't change this, it just changes who the admins are. It lets a person under the jurisdiction of admin A interact with a person under the jurisdiction…

A lot of us are our own instance admins, with our own accounts being the only accounts associated with our domains. I don't self-host though; I pay a dedicated hosting provider to handle this for me. This means I end up having a very similar relationship to my Mastodon provider as to my email- and cloud storage providers.

Re: I was right about ATProto key management

#114

Post by HumanOstrich »

Bluesky also randomly bans new accounts saying they violated the ToS. Like right after signup before you do anything. It says you'll receive an email with details (never happens) and offers a form to appeal. The form goes nowhere and you never hear anything again. This happened to me a couple months ago so it's probably still an issue. It seems more like sloppy, careless engineering than malice, however.

Re: I was right about ATProto key management

#115

Post by anonymous908213 »

tsimionescu wrote: post #112
anonymous908213 wrote: post #102

Earlier quoted context omitted.

> An advertisement is always designed to try to convince you to buy a different product than you would rationally choose yourself. Perhaps you could consider toning down the absolutism. This is true in many or most cases, but certainly not all cases. Let's take, for example, video games. I can afford to purchase any game that interests me, and do. However, I often go several months between new game purchases, because…

> An advertisement for a game does not need to convince me to purchase it over an alternative product, it simply needs to make me aware of its existence and broadly convey what the game is about so that I will know whether it matches my specific game interests closely enough to investigate further. I agree that it does not need to do more than inform you - but that doesn't mean it won't do more. Please show me a sing…

I don't exactly go around saving advertisements, but plainly informational ones do exist here and there. Off of memory, an example of an indie game trailer I think is well-made is that of Wargroove[1]. It's a simple and clear clip reel of gameplay showing off a variety of content and features, and if I recall correctly, advertisements for it were simply smaller slices of the trailer. I think there's nothing offensive about advertisements like this existing (although, that said, the number of times I wish to see such an advertisement is still exactly once).

[1] https://www.youtube.com/watch?v=62nqJxq3E-4

Re: I was right about ATProto key management

#116

Post by zeratax »

lmm wrote: post #96
pythonaut_16 wrote: post #86

Earlier quoted context omitted.

I don't understand how you can seriously pose Discord as an alternative in this conversation as it's entirely centralized and full of all sorts of toxic behavior and failure modes. Like at least suggest old school forums, IRC, or usenet.

Discord is technically centralised but in a way that mostly doesn't matter at the point of use, and its design avoids many of the failure modes of old school forums, IRC, or usenet where moderator cabals take control of any community and bully lowly users.

how does it avoid that? i have experienced just as many power tripping mods on discord as i have on irc. the only difference to me is that i have never seen an irc channel with over 20 million users

Re: I was right about ATProto key management

#117

Post by embedding-shape »

wmf wrote: post #36
nl wrote: post #23

> why is a centralized “burn” able to completely prevent me from interacting with people using Bluesky? Presumably to stop credential reuse attacks on Bluesky itself? Bluesky is one instance and they should enforce security on that instance. If you use a previously burnt ID, they have no way to tell it's you (indeed that's the whole point!) I've done some work in the DID space. Not really a fan, and the space is full…

It seems backwards to worry about attacks when basic functionality is undocumented/broken.

There are different types of attacks possible though, most broadly you can divide them into "design holes" and "implementation holes". This seems to be about preventing a design hole, and those you need to prevent with architecture/design, you can't just fix those once the implementation and documentation is done.

Re: I was right about ATProto key management

#118

Post by embedding-shape »

HumanOstrich wrote: post #114

Bluesky also randomly bans new accounts saying they violated the ToS. Like right after signup before you do anything. It says you'll receive an email with details (never happens) and offers a form to appeal. The form goes nowhere and you never hear anything again. This happened to me a couple months ago so it's probably still an issue. It seems more like sloppy, careless engineering than malice, however.

Happened to me a few weeks ago. I replied/filled out the form, and after a day it was unlocked. Seems to be very hit and miss, maybe depending on who is seeing your replies? Regardless, definitely a sucky issue...

Re: I was right about ATProto key management

#120

Post by account42 »

embedding-shape wrote: post #117
wmf wrote: post #36

Earlier quoted context omitted.

It seems backwards to worry about attacks when basic functionality is undocumented/broken.

There are different types of attacks possible though, most broadly you can divide them into "design holes" and "implementation holes". This seems to be about preventing a design hole, and those you need to prevent with architecture/design, you can't just fix those once the implementation and documentation is done.

But the design hole is treating (IMO unfortunately) transient identities (the web's domain name system) as something that should persistently identify something. Adding hacks like this doesn't fix the underlying mismatch but creates new issues as seen in the article.

Or to put it another way: Domain names changing hands is how the web works. If you design your system to support web identities in a way that domains can't change hands then you are not supporting web identities but rather something different.

Post reply on HN