favicon-512

Connected Places

Detail of the city of Gouda

Bluesky Report – #127

The impact of the Online Safety Act on Bluesky, E2EE messaging using your ATProto account, various news around PDSes, and more.

I also run a weekly newsletter, where you get all the articles I published this week directly in your inbox, as well as additional analysis. You can sign up right here, and get the next edition this Friday!

The News

The UK’s Online Safety Act is now in effect, and Bluesky has implemented their age verification system for UK users. This means that people with an UK IP address who have not verified their identity (via Epic’s Kids Web Services) will not be able to use DMs or view adult content on the official Bluesky apps. Other third-party clients for Bluesky have not implemented such as system yet to my knowledge, giving users in the UK a way to side-step these requirements. Independent ATProto developer @mary has created an extensive guide on all the ways that users can avoid the age verification system while still getting full access to the entire Bluesky network. The guide also explains how and why these workarounds are effective. The quick explanation is that the Bluesky client checks your IP address to see if you are located in the UK, and your PDS stores your verification status. Since both your PDS and the client can be ran outside of Bluesky’s control, and the AppView/API for Bluesky does not contain verification data, there are multiple avenues for workarounds.

The guide also notes: “It remains unclear whether UK regulators would consider Bluesky’s client-side implementation sufficient for OSA compliance. However, Bluesky Social PBC could reasonably argue the restrictions are effectively enforced for users on their PDS using unmodified clients, and that’s as far as they can guarantee in a decentralized network like Bluesky.” This seems correct to me, and how regulators will view Bluesky’s implementation (as well as fediverse implementations) is something I’m paying close attention to, and hope to get a bigger article out on soon.

Germ DM is a an encrypted messaging app for iOS that is now supporting ATProto in beta. Germ DM does not require a phone number to set up, instead users can create multiple ‘cards’, each with a separate identity and chats. Germ DM is already available for users to chat, by creating any identity card and chatting with other users on the network. The new ATProto integration that’s currently in beta allows users to create an identity that is linked to their ATProto account. This allows ATProto accounts to have end-to-end-encrypted messages with each other. Germ DM for ATProto is currently in beta. The app is available only on iOS, with other platforms coming later. A detailed blog by Germ Network explaining the technical aspects of their ATProto integration with MLS is available here.

ROOST, a non-profit organisation that’s building open source content moderation tools, has announced a new tool called Osprey. Osprey is “an open-source investigation and incident response tool that allows safety teams to understand what is happening on their platforms and take actions at scale.” Bluesky says that they will implement and use Osprey on the platform when it becomes available. The software is originally developed by Discord, and donated to ROOST for other platforms to use as well. Osprey is expected to become available in “the coming months”.

Spacedust is a new ATProto notifications firehose, which gives a constant output of notifications for all ATProto notifications for the entire network. Spacedust is part of the microcosm, a project to decentralise ATProto with self-hostable microservices that process the entire network but can still be run on consumer hardware. It is made by independent ATProto developer @phil, who also created a site which gives you browser notifications for your account on all platforms on the ATProto network.

Speaking of notifications, ShadowSky is a companion app to Bluesky, that gives more detailed information about notifications on Bluesky. It is designed to make sense of notifications when you get a lot of them, such as for popular accounts. It seems however to be quite taxing on Bluesky’s servers, which indicates the value of independent dedicated services like spacedust.

Bluesky will use internal repositories to work for their development work from now on. Part of using an open source code base is that all the current development work is visible for everyone, which ran into challenges with public communications and timing with partners on new features. Once a new feature is completed and released it will be added to the public code base and be open source. Previously, Bluesky experimented with adding [TOP SECRET] to their pull requests to prevent new features from leaking to the community, but found that solution to be slightly less optimal.

Europe Can Build Its Own Social Media, by Sebastian Vogelsang is an article about Eurosky in the Project Syndicate Magazine. Vogelsang is the developer of multiple popular apps for Bluesky, including Skeets and Flashes, and one of the people behind the Eurosky initiative. There is a clear demand in Europe for European social media infrastructure, both from users as well as from governments, and the big challenge is in how to actually make this happen. I’ll cover more on Eurosky and Free Our Feeds soon.

PDS Report (i guess?)

There’s been a surprising amount of news about ATProto’s Personal Data Servers (PDS) this week:

  • Adversarial ATProto PDS Migration, by independent security researcher David Buchanan. The promise of ATProto is to provide a ‘credible exit’, meaning you can always migrate your account to another service providers. So far, tools like goat and ATP Airport allow you to migrate your account to a different server in a context where the original host is cooperative. On ATProto it is also technically possibly to migrate your account to a different PDS server when the original host is uncooperative or offline. This requires technical skill and some preparation, making it not yet accessible to regular users. Buchanan’s writeup however shows that it is indeed possible to do so, and gives some further directions on how this process could be made more accessible.
  • Northsky has released their alpha version of a PDS Migration tool. It allows to migrate a PDS to another server, as well as creating backups of your repo and media, and set new personal rotation keys. Northsky is a cooperative to build safer social media spaces for the 2SLGBTQIA+ community on ATProto.
  • A script to keep a backup of your PDS repository on GitHub, using GitHub Actions. Having a backup of your PDS makes doing an account migration in an adversarial context significantly easier.
  • pdsfs is a new tool to mount your PDS as a FUSE filesystem. Wit pdsfs you can now access the PDS using standard file commands.
  • ATP Airport, a tool to migrate your PDS to a different server, had an issue this week where importing the wrong file could brink your account. The issue is now resolved, with an extensive writeup here as well. For people interested in the nitty-gritty of account migration on ATProto and PDSes there’s a some interesting info in how this all works in there.
  • A guide on how to Host a PDS via a Cloudflare Tunnel.
  • Streaming software Streamplace contains an ’embedded PDS’, and a blog post by the platform explains what that is and why they made that design choice.

Software updates

  • Flashes, a Bluesky app for photo sharing, beats Instagram in a race to first release an app for the iPad.
  • Flashes also shared a sneak peek at their development of an Android app.
  • Publishing and writing platform Leaflet.pub now supports blocks for code and math.
  • Surf, the multi-network app for the social web, is focused on creating and customising custom feeds. These feeds can be published to Bluesky for anyone else to use as well. Surf now has collaborated with the blueskydirectory.com site to make these custom feeds more easily discoverable.
  • Git collaboration platform Tangled latest update includes a timeline to see what other people are up to using Tangled.
  • Custom feed builder platform Graze has been giving out seed grants of $1k for the growth of the ATProto ecosystem. Their final two grants are for a tool for long-form writing, Weaver, that’s currently in development, and a project to physically print Bluesky posts with a thermal printer.
  • Grain is a photo sharing app on ATProto, that focuses on galleries and lives outside of the Bluesky Lexicon. They now have an iOS app in beta, with an Android app on the way as well.
  • Short-form video app Spark is opening up their waitlist.
  • Culture review app Popsky now has the ability to import book reviews from StoryGraph, and TV episodes and seasons can now be added and reviewed as well.

Event planner platform Smoke Signal and it’s developer Nick Gerakines have been busy recently as well:

  • Smoke Signal turned 1 year old recently, and creator Gerakines gave an ATProto Tech Talk on the platform and its technical implementation (VOD available).
  • You can now embed Smoke Signal events into a blog or website.
  • A proposal on how to transfer ownership of an ATProto record (such as the ownership of an event).
  • XRPC Webhooks, which allows a user to opt into sharing their email address with an event organiser when the RSVP to an event, without that data becoming publicly accessible.

The Links

QR code connected places for donations - general

Connected Places is a labor of love. Want to support the work I’m doing? You can click here to donate, or scan the QR code.

That’s all for this week, thanks for reading! If you want more analysis, you can subscribe to my newsletter. Every week you get an update with all this week’s articles, as well as extra analysis not published anywhere else. You can subscribe below! Follow on Bluesky: this blog:  @fediversereport.com and my personal account: @laurenshof.online.