71–80 of 184 posts
Earlier quoted context omitted.
[flagged]
What is there to respond to? "This thing may happen at some point in the future" isn't insight or commentary. I can formulate a response, but it's already required more thought and effort than you seemed to have put into your comment. Engagement farming and bait isn't what HN is generally for.
Pretty awesome! Convenience link to the fascinating github issue linked at the bottom, featuring Bluesky celebrity pfrazee: https://github.com/bluesky-social/atproto/issues/523 I have a lot of hope for AT. I'm sure there's lots of smart people on HN that have done great things with the Fediverse, but this whole paradigm just seems more sustainable + realistic. Basically it gives us centralization by default, but with…
As far as sustainability goes I'm hoping for a better business model than "accept funds from Blockchain Capital" [0], some return on investment in mirroring the firehouse. I can muse, a Discord alternative where some users pay to host longer videos (current limit is 60sec [1]) or Patreon where a relay takes a cut in exchange for managing access/decryption keys, or Bandcamp or some other kind of social marketplace - a…
Earlier quoted context omitted.
Is there any auth necessary to pull data from a PDS? I know the main relay is a public firehouse so I would be surprised, but maybe the PDS can put relay servers on an allowlist?
As far as I can tell, all content on ATProto is fully public without auth
Earlier quoted context omitted.
What is there to respond to? "This thing may happen at some point in the future" isn't insight or commentary. I can formulate a response, but it's already required more thought and effort than you seemed to have put into your comment. Engagement farming and bait isn't what HN is generally for.
[flagged]
It's a cool use of technology! Maybe this is Bobby's first API. Why the need to tell Bobby that you're too cool to appreciate it? As the opening of the OP points out, this has very little to do with ${new_propaganda_platform} as you so dismissively put it. They're self-hosting their site on a protocol not intended to exactly do that! That's cool even if you've been able to do that since whenever you discovered you could do that.
They don't seem to be doing any of the things you're throwing at them as negatives. They're not saying this is the future of the internet or something everyone should do or forcing all their friends onto it. It's just an interesting demonstration of the underlying tech of a protocol and what you can do with it.
If you seem to think people talking online about their joy about technology and the things they can do about it is "shit spewing" onto your beloved "WWW" then I'm not sure why you're here. You definitely don't seem like you actually read any part of the OP you're "shit spewing" all over.
Earlier quoted context omitted.
As far as I can tell, all content on ATProto is fully public without auth
Does it federate or anything? Wonder what up to date summaries exist of it’s capabilities
Also it's uh, atproto.com
I was curious as to the security context this runs in: curl -i 'https://porcini.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:j22nebhg6aek3kt2mex5ng7e&cid=bafkreic5fmelmhqoqxfjz2siw5ey43ixwlzg5gvv2pkkz7o25ikepv4zeq' Here are the headers I got back: x-powered-by: Express access-control-allow-origin: * cache-control: private vary: Authorization, Accept-Encoding ratelimit-limit: 3000 ratelimit-rema…
Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe) 1:…
Earlier quoted context omitted.
I don't see how. This is a direct link to the author's bluesky server (PDS) so of course it is controlled by them.
Phish could be this: $inane_marketing_trope ... Click here to Unsubscribe from Bluesky https://porcini.us-east.host.bsky.network/xrpc/com.atproto.s... ... Redirects to bad site.
It's like if you point to your own Apache server in your own domain where you host a scam page and say there's a security issue with Apache because you could do that.
Or are you saying that you can make this person's server serve third-party content?
Earlier quoted context omitted.
[flagged]
I just cannot imagine being this upset about someone else doing something they enjoyed that hurt no one. This is pure gatekeeping at its finest. It's a cool use of technology! Maybe this is Bobby's first API. Why the need to tell Bobby that you're too cool to appreciate it? As the opening of the OP points out, this has very little to do with ${new_propaganda_platform} as you so dismissively put it. They're self-hosti…
Earlier quoted context omitted.
Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe) 1:…
Why would WebAssembly provide more protection against exfiltration than JavaScript in this case?