Appreciated Daniel reaching out to the team about this! Hosting blobs is one of those things that will inevitably go through iterations as we understand the abuse vectors more and more, but for now it's really fun to see this kind of usage in action. The PDS is meant to be a database host in the same sense that a webserver is a website host.
Are you ever going to bring back Beaker Browser? Used to love playing around with that! Didn't realize you'd gone on to Bluesky, very neat.
Doesn't the potential for abuse reduce when content is linked through user's own domain rather than a particular appview like bsky? Bsky already supports a user's domain ALIASed to redirect.bsky.com: https://bsky.app/profile/jacob.gold/post/3kh6rnpdzmp2v
Congrats on finding a role at Bluesky. Beaker was such an amazing project to follow, that experience must be so useful.
ZOMG IT'S PAUL
There should really be a name for this phenomenon; put basically anything on the internet, and sooner or later people will try to host arbitrary files on it.
Johnson's Law: The more attention something receives, the bigger it's area of impact becomes.
There's already "parasitic computation" so we could probably go for "parasitic data storage"
I was curious as to the security context this runs in:
"access-control-allow-origin: *" is interesting - it means you can access content hosted in this way using fetch() from JavaScript on any web page on any other domain.
"content-security-policy: default-src 'none'; sandbox" is very restrictive (which is good) - content hosted here won't be able to load additional scripts or images, and the sandbox tag means it can't run JavaScript either: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe)
I didn't realize you could use CSP for preventing exhilaration now! How did they close the WebRTC loopholes?
Why would WebAssembly provide more protection against exfiltration than JavaScript in this case?
By default WebAssembly doesn't have access to the DOM or JavaScript globals. You have full control of how it can access these things.
is the default-src necessary if you're using sandbox or is it redundant?
`sandbox` doesn’t affect making requests via HTML (images, stylesheets, etc.).
[deleted]
I'm very hopeful for the possibility of using bluesky for blob data.
A friend and I had considered looking into storing DOOM WADs on bluesky so that "map packs" could be shared in the same way posts are. Follow an account, a list, or a starter pack, and you could theoretically modify GZDoom or some other client to know how to search and view any WADs posted by those accounts. Like how the Steam Workshop works, except it's via bluesky. :D
So, basically using Bluesky as an RSS feed for arbitrary data? Kind of?
One of the points that is made is that since the PDS that's being interacted with here is part of a 'Personal Data Server' rather than the Bluesky product, it ends up able to offer infinite free data storage.
This seems like one of the things that might be part of the references the bluesky team has made at time to introducing a subscription service - providing more space / bandwidth / higher quality video on your PDS seems like the type of hosting that could be offered at a premium tier.
“Hosting websites” has been possible on nostr for some time already with npub.pro …
Could some awesome person possibly summarise any limitations or use cases where this might not work well?
The example provided is quite basic static text, so I'm wondering if there's a reason for that?
The CSP headers didn't used to be there, which I used to pop an alert(), way back. (at the time there was also a MIME whitelist, but that whitelist included image/svg+xml, which allows script execution)
Anyone else feels like this will be abused for phishing and/or malware distribution?
It will be. We had the same issue with Matrix attachments.
It'll take about 5 mins for that to happen and then for *.bsky.network to start getting blocked by Google Safe Browsing, Palo Alto, Bluecoat etc.
is there any hosting site that isn't? feels like a computing law at this point; if you build a hosting site, someone will try to use it for malicious purposes.
Can’t you just make the hosting site features only be for real purposes?
Like a link shortener which only forwards to a domain that matches the subdomain? Or only for watching videos and collecting metrics etc.
As long as content is authored by the administrator of the server, I don't see where there is a security issue.
It's like if you point to your own Apache server in your own domain where you host a scam page and say there's a security issue with Apache because you could do that.
Or are you saying that you can make this person's server serve third-party content?
> Or are you saying that you can make this person's server serve third-party content?
Http: yes see OP
Email: not sure. Hopefully not. But spoofing happens.
Lack of moderation combined with an offical-sounding domain name.
This would have to get the user to follow a link or call a phone number or something though. These are plausible. It's too bad the content-security-policy can't prevent following links.
Bluesky seems to use a lot of totally different domain names for each part of their infrastructure, maybe for this reason. e.g. this one is bsky.network
While they're nowhere close on volume, they're certainly beating microsoft in terms of the rate they're adding similar looking official URLs.
[deleted]
I mean, the way AT Proto is designed, moderation primarily happens on the app layer, not the protocol layer. So on an app like Bluesky, you can have a lot of moderation. But the protocol itself allows hosting arbitrary content in a distributed/decentralized way.
[deleted]
hehehe. I pinned it to the top research ideas. I'll get back to you on this
Ah this is super cool! I’ve been thinking about doing this with my website, but was going to leverage the whtwind lexicon, since my site is mostly a blog. But for the front page, and anything else, I may have wanted something else.
This is more of an unstructured approach, which is cool because it needs less specialized tooling. It has the disadvantage of being… well, just a blob. No semantic information there.
I'm wondering whether a third-party PDS implementation should support other protocols as well. Would a combined git/PDS repo make any sense at all? (That is, it's a PDS, but it also implements enough of git to do read-only access via git commands.)
Based on https://bsky.social/about/support/tos#user-content , I would answer yes. While it's not expressly called out (permitted or forbidden), my reading of the above would indicate that it's not forbidden per se, and probably permitted ("Modify or otherwise utilize User Content in any media. This includes reproducing, preparing derivative works, distributing, performing, and displaying your User Content."). I believe training an LLM falls under "utilize" and "preparing derivative works".
That's about your user content, not others'.
I think the AT protocol is versatile in that users can acces each others data once authenticated without any centralized service (granted the aggregators and some other things may still be centralized).
So the recent push to artists to move there to protect their rights against AI training is not only false but a trap since anyone can point their cannons to train data on Bluesky.
Is there any auth necessary to pull data from a PDS? I know the main relay is a public firehouse so I would be surprised, but maybe the PDS can put relay servers on an allowlist?
As far as I can tell, all content on ATProto is fully public without auth
Does it federate or anything? Wonder what up to date summaries exist of it’s capabilities
If by federate you mean "is stored on content addressed, signed merkle trees that can be mirrored and served from more than one domain" then yes
I have a lot of hope for AT. I'm sure there's lots of smart people on HN that have done great things with the Fediverse, but this whole paradigm just seems more sustainable + realistic. Basically it gives us centralization by default, but with real decentralized support when you need it / for power users.
As far as sustainability goes I'm hoping for a better business model than "accept funds from Blockchain Capital" [0], some return on investment in mirroring the firehouse. I can muse, a Discord alternative where some users pay to host longer videos (current limit is 60sec [1]) or Patreon where a relay takes a cut in exchange for managing access/decryption keys, or Bandcamp or some other kind of social marketplace - as it is theres no reason I couldn't do this, it is an open platform after all.
Im hoping that most of the infra costs get amortized by people bringing on their PDS’s, while some of the core stuff (app layer, iOS app etc.) is maintained by a small team funded by donations/subscriptions.
Yeah I’m also worried about profitability, tho not particularly concerned about that particular investor, personally; all VCs are inherently amoral profit generators. They are a “benefit corporation” like anthropic, which gives them some leeway to deny shareholder requests in the name of public good. Which is nice!
In general I feel like social media is in the perfect spot for a huge shakeup as display ads breathe their last breath. Even if Google wins/draws out its Display Ads antitrust case and successfully implements some new interest-tagging system, I think anyone with a calculator and a newspaper subscription can read the leaves at this point; people are concerned about their data, and the money it generates is peanuts compared to more traditional advertising schemes. All of this is of course not even mentioning what I think intuitive algorithms will do (cynical or no, there’s lots of credentialed scientists saying that AGI (!!) is within reach in the coming decade, if not the coming few year).
All that to say: I feel like they can find a way to make it work. Revenue doesn’t need to be as high anyway if you a) don’t have 1000 devs optimizing Display Ad A/B tests all day, and b) have the support of the open source community.
If they can get ~100k subs to a $10/mo premium service similar to discord nitro, they are probably close to breaking even at the current scale and ops methodology. Which seems feasible.
Whenever I hear about Bluesky I think about Jack Dorsey quitting their board and asked people to stay on Twittet/X.
What I remember about that whole affair is that I'd really respected Jack for starting Bluesky, allowing it to be independent of Twitter (and Jay deserves a heaping of credit for pushing that!), and then losing that respect when he seemed to totally misunderstand what Bluesky had gone on to achieve.
Jack was pushing Nostr at the time which... seems ok if you're into that. But his arguments in his interview with Mike Solana really didn't make sense to me.
Bluesky’s attitude seems logical and their reasoning aligns with my thoughts exactly.
If techdirt’s article is to be believed, Dorsey’s departure has to do with going from an extreme to an extreme—from a traditional social monolith to a pure protocol—whereas Bluesky chose to pursue not only the protocol, but also “the app” as the face of that protocol for the ordinary user, and let’s face it: the ordinary user does not really care about protocols.
My speculation about him suggesting people “stay on Twitter” is that Nostr (which he apparently is invested in now) and Twitter are orthogonal, so there is no conflict there, but Bluesky competes with both.
Not a Bluesky user (the invite-only period has put me off for a while), but if they do not compromise on the protocol part (and there are no shenanigans unfolding, who knows, maybe Dorsey found something) their attitude seems to me to be the most reasonable for a mainstream social platform.
What's your issue with invite-only periods? Is there a better way to throttle signups while you scale a system early on?
[dead]
I mean, honestly, losing Dorsey was probably a big part of its success.
unrelated probably, but it made me realize how I don't really see Hugo/Jekyll type websites anymore.
How do you even know? Don't those both just generate static html?
Footer. also Jekyll/Hugo sites use generator so you can mostly find it in the meta generator tag.
Next.js sites are also a super easy find like this.
You can trivially remove it e.g. `disableHugoGeneratorInject = true` in `config.toml`.
It says "Powered by Hugo" at the bottom of the page.
Depending on the theme.
I build my own themes and don’t include that either
Same here
[deleted][deleted]
I build my own with Jinja2 templates my custom python script + mistune library to parse markdown to html, and a YAML file in similar format to Hugo (the previous generator i used to use)
I found building my own custom one with python3, much more freeing in all sorts of interesting ways, I also exposed the static site generator with a FastAPI based API to auto build my website from my notes, my cooking recipes, database records, financials, git commits, etc to build me a private protected website (via nginx auth) from anywhere, whether via sending a text message to my telegram bot, or running a Shortcuts command on my iPad, or just directly running a command from my terminal.
It took barely a day to setup, and allows me to run interesting custom extensions in all sorts of interesting ways, and builds me a personal website curated to my interest, where the primary viewer is supposed to be me. and it exposes a public barebones website with barely any content for everyone else.
One of these days I think i’ll expose more of it to the world.
I see plenty of blogs generated from Markdown with tools like that.
Has something overtaken Hugo and Jekyll in that space?
If you like JS/TS, then Astro.
I maintain a blog on Hugo but also host a couple of Astro ones. I think Hugo is great but to my eyes at least Astro has more active development behind it, and I also enjoy it more (probably because I know Typescript more than golang)
I just use mkdocs for everything.
Have you found a decent bare bones starter theme? I've been using MkDocs Material, and I find the theme too complicated (HTML etc) - hoping to find a super simple one that looks decent - plain - and is a good base for theming / styling. Thanks & take care.
Why was it decided not to build on any existing content-addressable networking system (IPFS or whatever)?
November 1, 2024 at 12:39 PM
Leo R. Comerford @leocomerford.bsky.social
·
23d
(Not implying that this was the wrong decision, it’s a genuine question.)
dan @danabra.mov
·
23d
actually not sure i can answer this well. paging @bnewbold.net or maybe @why.bsky.team (who worked on IPFS btw)
dan @danabra.mov
·
23d
my guess is that we’d want data hosting to be under direct control of the user (same as web hosting) rather than peer-to-peer, want instant deletion/edits at the source, need ability to move to a different host or take content down, need grouping into collections. not sure how much IPFS could adapt
dan @danabra.mov
·
23d
we do use some pieces from IPFS through (aside from the actual peer to peer mechanism)
bryan newbold @bnewbold.net
·
4mo
you can basically ignore it, we don't use "IPFS" proper anywhere.
there are strong social connections, and we borrow some tech components like CIDs (flexible hash/digest syntax) and DAG-CBOR (more-deterministic subset of CBOR, good for signing+hashing)
Bumblefudge @bumblefudge.com
·
1d
yeah this is all accurate. bluesky remixed a lot of IPFS components and patterns in interesting ways, but the monolithic global IPFS network (with chatty DHT distribution) wouldn't make sense here, BS made an infinitely more efficient/performant distribution of bytes tailored to its use case.
Bumblefudge @bumblefudge.com
·
1d
FWIW the IPFS foundation is working on making IPFS more modular and easily remixed for future BlueSkies, but it's a big task decomposing the monolith and reorienting the documentation and ergonomics...
[a second reply to the first skeet:]
Uai @why.bsky.team
·
23d
As far as im concerned (and i led ipfs development for a number of years) we are using ipfs, just a specific streamlined implementation of it.
All your repo data can be imported into an ipfs node and addressed via cid
Uai @why.bsky.team
·
23d
We dont use libp2p because for a consumer mobile app we didnt want to futz with nat traversal and connectivity and the like, but its definitely possible to build a p2p version of bluesky
"skeet" is such a terrible term for this. It's like mastodon "toot"s.
Using bodily functions as core infra terminology is off-putting and feels like a bit like a juvenile boy's club. I get that some people find it funny, but it alienates people. We should just call these "posts".
Eevn better: call them tweets. That's what they are.
Sure, whatever: I had certainly given it approximately no thought in this case, and my personal investment in 'sk**t' is zero. I'd edit my post but I seem to have hit the timeout. I will also say that I don't think this is the most interesting or on-topic thread to pull on from my comment.
Hard agree -- this one is especially bad because it's gendered. We'll see what happens, but I'd put my money on "post" winning out. There's some people on Bluesky who feel absurdly strong about this because of the history (the CEO asked them not to use it so they used it more often as a joke), but they're simply outnumbered already. Such is exponential growth...
[flagged]
In what sense?
[flagged]
What is there to respond to? "This thing may happen at some point in the future" isn't insight or commentary.
I can formulate a response, but it's already required more thought and effort than you seemed to have put into your comment. Engagement farming and bait isn't what HN is generally for.
[flagged]
I just cannot imagine being this upset about someone else doing something they enjoyed that hurt no one. This is pure gatekeeping at its finest.
It's a cool use of technology! Maybe this is Bobby's first API. Why the need to tell Bobby that you're too cool to appreciate it? As the opening of the OP points out, this has very little to do with ${new_propaganda_platform} as you so dismissively put it. They're self-hosting their site on a protocol not intended to exactly do that! That's cool even if you've been able to do that since whenever you discovered you could do that.
They don't seem to be doing any of the things you're throwing at them as negatives. They're not saying this is the future of the internet or something everyone should do or forcing all their friends onto it. It's just an interesting demonstration of the underlying tech of a protocol and what you can do with it.
If you seem to think people talking online about their joy about technology and the things they can do about it is "shit spewing" onto your beloved "WWW" then I'm not sure why you're here. You definitely don't seem like you actually read any part of the OP you're "shit spewing" all over.
[flagged]
This is a pretty pitiful comment. It fails (again) to actually make any salient points (what “propaganda platform” are you talking about? How did you reach that conclusion? Based on what?) and instead just does the “anti-interest negativity dance” that so many edgelords are into these days.
>Not sure why my parent comment was flagged. I guess when you can’t formulate a response, you flag and downvote? Is that the HN way?
It was a vague and negative one-liner, with no indication of what you were insinuating or why you think that way, from a brand new account.
If you spent 30 more seconds to expand on what history you were referring to and why you think history is repeating, it would not have been flagged.
Are you a mod/admin here?
No, just someone who spends too much time here and am familiar with the trends.
I’d have at least said something like “it reminds me of app.net, but with a lot more traction” or something to poke at a conversation.
Appreciated Daniel reaching out to the team about this! Hosting blobs is one of those things that will inevitably go through iterations as we understand the abuse vectors more and more, but for now it's really fun to see this kind of usage in action. The PDS is meant to be a database host in the same sense that a webserver is a website host.
Are you ever going to bring back Beaker Browser? Used to love playing around with that! Didn't realize you'd gone on to Bluesky, very neat.
Doesn't the potential for abuse reduce when content is linked through user's own domain rather than a particular appview like bsky? Bsky already supports a user's domain ALIASed to redirect.bsky.com: https://bsky.app/profile/jacob.gold/post/3kh6rnpdzmp2v
Congrats on finding a role at Bluesky. Beaker was such an amazing project to follow, that experience must be so useful.
ZOMG IT'S PAUL
There should really be a name for this phenomenon; put basically anything on the internet, and sooner or later people will try to host arbitrary files on it.
Johnson's Law: The more attention something receives, the bigger it's area of impact becomes.
There's already "parasitic computation" so we could probably go for "parasitic data storage"
I was curious as to the security context this runs in:
Here are the headers I got back: Presumably that ratelimit is against your IP?"access-control-allow-origin: *" is interesting - it means you can access content hosted in this way using fetch() from JavaScript on any web page on any other domain.
"content-security-policy: default-src 'none'; sandbox" is very restrictive (which is good) - content hosted here won't be able to load additional scripts or images, and the sandbox tag means it can't run JavaScript either: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe)
1: https://github.com/w3c/webappsec/issues/656#issuecomment-246...
2: https://www.w3.org/TR/CSP3/#exfiltration
I didn't realize you could use CSP for preventing exhilaration now! How did they close the WebRTC loopholes?
Why would WebAssembly provide more protection against exfiltration than JavaScript in this case?
By default WebAssembly doesn't have access to the DOM or JavaScript globals. You have full control of how it can access these things.
is the default-src necessary if you're using sandbox or is it redundant?
`sandbox` doesn’t affect making requests via HTML (images, stylesheets, etc.).
I'm very hopeful for the possibility of using bluesky for blob data.
A friend and I had considered looking into storing DOOM WADs on bluesky so that "map packs" could be shared in the same way posts are. Follow an account, a list, or a starter pack, and you could theoretically modify GZDoom or some other client to know how to search and view any WADs posted by those accounts. Like how the Steam Workshop works, except it's via bluesky. :D
So, basically using Bluesky as an RSS feed for arbitrary data? Kind of?
One of the points that is made is that since the PDS that's being interacted with here is part of a 'Personal Data Server' rather than the Bluesky product, it ends up able to offer infinite free data storage.
This seems like one of the things that might be part of the references the bluesky team has made at time to introducing a subscription service - providing more space / bandwidth / higher quality video on your PDS seems like the type of hosting that could be offered at a premium tier.
“Hosting websites” has been possible on nostr for some time already with npub.pro …
If this sort of thing interests you, check out atfile: https://github.com/electricduck/atfile
Could some awesome person possibly summarise any limitations or use cases where this might not work well?
The example provided is quite basic static text, so I'm wondering if there's a reason for that?
The CSP headers didn't used to be there, which I used to pop an alert(), way back. (at the time there was also a MIME whitelist, but that whitelist included image/svg+xml, which allows script execution)
Anyone else feels like this will be abused for phishing and/or malware distribution?
It will be. We had the same issue with Matrix attachments.
It'll take about 5 mins for that to happen and then for *.bsky.network to start getting blocked by Google Safe Browsing, Palo Alto, Bluecoat etc.
is there any hosting site that isn't? feels like a computing law at this point; if you build a hosting site, someone will try to use it for malicious purposes.
Can’t you just make the hosting site features only be for real purposes?
Like a link shortener which only forwards to a domain that matches the subdomain? Or only for watching videos and collecting metrics etc.
Any file upload can be used for unintended purposes, eg encoding files into static to upload to youtube and all other sorts of tomfoolery: https://github.com/boehs/awesome-cloud-storage-abuse
I don't see how. This is a direct link to the author's bluesky server (PDS) so of course it is controlled by them.
Phish could be this:
$inane_marketing_trope
...
Click here to Unsubscribe from Bluesky
https://porcini.us-east.host.bsky.network/xrpc/com.atproto.s...
...
Redirects to bad site.
As long as content is authored by the administrator of the server, I don't see where there is a security issue.
It's like if you point to your own Apache server in your own domain where you host a scam page and say there's a security issue with Apache because you could do that.
Or are you saying that you can make this person's server serve third-party content?
> Or are you saying that you can make this person's server serve third-party content?
Http: yes see OP
Email: not sure. Hopefully not. But spoofing happens.
Lack of moderation combined with an offical-sounding domain name.
This would have to get the user to follow a link or call a phone number or something though. These are plausible. It's too bad the content-security-policy can't prevent following links.
Bluesky seems to use a lot of totally different domain names for each part of their infrastructure, maybe for this reason. e.g. this one is bsky.network
While they're nowhere close on volume, they're certainly beating microsoft in terms of the rate they're adding similar looking official URLs.
I mean, the way AT Proto is designed, moderation primarily happens on the app layer, not the protocol layer. So on an app like Bluesky, you can have a lot of moderation. But the protocol itself allows hosting arbitrary content in a distributed/decentralized way.
hehehe. I pinned it to the top research ideas. I'll get back to you on this
Ah this is super cool! I’ve been thinking about doing this with my website, but was going to leverage the whtwind lexicon, since my site is mostly a blog. But for the front page, and anything else, I may have wanted something else.
This is more of an unstructured approach, which is cool because it needs less specialized tooling. It has the disadvantage of being… well, just a blob. No semantic information there.
I'm wondering whether a third-party PDS implementation should support other protocols as well. Would a combined git/PDS repo make any sense at all? (That is, it's a PDS, but it also implements enough of git to do read-only access via git commands.)
What other protocols would make sense?
https://github.com/anacrolix/btlink
I guess pkdns is a newer, actively maintained version of the same thing? https://github.com/pubky/pkdns
What's the license for the Bluesky data btw? Is it something free to mirror and train LLMs on?
So the ToS explicitly says Bluesky does NOT own your data.
However, data on AT Proto is fully public and it’d be trivial for someone to extract the data for AI to train.
For example, this app shows you entries hosted on the protocol: https://atproto-browser.vercel.app/at/nytimes.com
Based on https://bsky.social/about/support/tos#user-content , I would answer yes. While it's not expressly called out (permitted or forbidden), my reading of the above would indicate that it's not forbidden per se, and probably permitted ("Modify or otherwise utilize User Content in any media. This includes reproducing, preparing derivative works, distributing, performing, and displaying your User Content."). I believe training an LLM falls under "utilize" and "preparing derivative works".
That's about your user content, not others'.
I think the AT protocol is versatile in that users can acces each others data once authenticated without any centralized service (granted the aggregators and some other things may still be centralized).
So the recent push to artists to move there to protect their rights against AI training is not only false but a trap since anyone can point their cannons to train data on Bluesky.
Is there any auth necessary to pull data from a PDS? I know the main relay is a public firehouse so I would be surprised, but maybe the PDS can put relay servers on an allowlist?
As far as I can tell, all content on ATProto is fully public without auth
Does it federate or anything? Wonder what up to date summaries exist of it’s capabilities
If by federate you mean "is stored on content addressed, signed merkle trees that can be mirrored and served from more than one domain" then yes
Also it's uh, atproto.com
Pretty awesome! Convenience link to the fascinating github issue linked at the bottom, featuring Bluesky celebrity pfrazee: https://github.com/bluesky-social/atproto/issues/523
I have a lot of hope for AT. I'm sure there's lots of smart people on HN that have done great things with the Fediverse, but this whole paradigm just seems more sustainable + realistic. Basically it gives us centralization by default, but with real decentralized support when you need it / for power users.
As far as sustainability goes I'm hoping for a better business model than "accept funds from Blockchain Capital" [0], some return on investment in mirroring the firehouse. I can muse, a Discord alternative where some users pay to host longer videos (current limit is 60sec [1]) or Patreon where a relay takes a cut in exchange for managing access/decryption keys, or Bandcamp or some other kind of social marketplace - as it is theres no reason I couldn't do this, it is an open platform after all.
[0] https://www.blockchaincapital.com/blog/bluesky-13m-users-and...
[1] https://bsky.social/about/blog/09-11-2024-video
Im hoping that most of the infra costs get amortized by people bringing on their PDS’s, while some of the core stuff (app layer, iOS app etc.) is maintained by a small team funded by donations/subscriptions.
Yeah I’m also worried about profitability, tho not particularly concerned about that particular investor, personally; all VCs are inherently amoral profit generators. They are a “benefit corporation” like anthropic, which gives them some leeway to deny shareholder requests in the name of public good. Which is nice!
In general I feel like social media is in the perfect spot for a huge shakeup as display ads breathe their last breath. Even if Google wins/draws out its Display Ads antitrust case and successfully implements some new interest-tagging system, I think anyone with a calculator and a newspaper subscription can read the leaves at this point; people are concerned about their data, and the money it generates is peanuts compared to more traditional advertising schemes. All of this is of course not even mentioning what I think intuitive algorithms will do (cynical or no, there’s lots of credentialed scientists saying that AGI (!!) is within reach in the coming decade, if not the coming few year).
All that to say: I feel like they can find a way to make it work. Revenue doesn’t need to be as high anyway if you a) don’t have 1000 devs optimizing Display Ad A/B tests all day, and b) have the support of the open source community.
If they can get ~100k subs to a $10/mo premium service similar to discord nitro, they are probably close to breaking even at the current scale and ops methodology. Which seems feasible.
Whenever I hear about Bluesky I think about Jack Dorsey quitting their board and asked people to stay on Twittet/X.
https://amp.theguardian.com/technology/article/2024/may/07/j...
What do you think about it?
What I remember about that whole affair is that I'd really respected Jack for starting Bluesky, allowing it to be independent of Twitter (and Jay deserves a heaping of credit for pushing that!), and then losing that respect when he seemed to totally misunderstand what Bluesky had gone on to achieve.
https://www.techdirt.com/2024/05/13/bluesky-is-building-the-...
Jack was pushing Nostr at the time which... seems ok if you're into that. But his arguments in his interview with Mike Solana really didn't make sense to me.
Bluesky’s attitude seems logical and their reasoning aligns with my thoughts exactly.
If techdirt’s article is to be believed, Dorsey’s departure has to do with going from an extreme to an extreme—from a traditional social monolith to a pure protocol—whereas Bluesky chose to pursue not only the protocol, but also “the app” as the face of that protocol for the ordinary user, and let’s face it: the ordinary user does not really care about protocols.
My speculation about him suggesting people “stay on Twitter” is that Nostr (which he apparently is invested in now) and Twitter are orthogonal, so there is no conflict there, but Bluesky competes with both.
Not a Bluesky user (the invite-only period has put me off for a while), but if they do not compromise on the protocol part (and there are no shenanigans unfolding, who knows, maybe Dorsey found something) their attitude seems to me to be the most reasonable for a mainstream social platform.
What's your issue with invite-only periods? Is there a better way to throttle signups while you scale a system early on?
[dead]
I mean, honestly, losing Dorsey was probably a big part of its success.
unrelated probably, but it made me realize how I don't really see Hugo/Jekyll type websites anymore.
How do you even know? Don't those both just generate static html?
Footer. also Jekyll/Hugo sites use generator so you can mostly find it in the meta generator tag.
Next.js sites are also a super easy find like this.
You can trivially remove it e.g. `disableHugoGeneratorInject = true` in `config.toml`.
It says "Powered by Hugo" at the bottom of the page.
Depending on the theme.
I build my own themes and don’t include that either
Same here
I build my own with Jinja2 templates my custom python script + mistune library to parse markdown to html, and a YAML file in similar format to Hugo (the previous generator i used to use)
I found building my own custom one with python3, much more freeing in all sorts of interesting ways, I also exposed the static site generator with a FastAPI based API to auto build my website from my notes, my cooking recipes, database records, financials, git commits, etc to build me a private protected website (via nginx auth) from anywhere, whether via sending a text message to my telegram bot, or running a Shortcuts command on my iPad, or just directly running a command from my terminal.
It took barely a day to setup, and allows me to run interesting custom extensions in all sorts of interesting ways, and builds me a personal website curated to my interest, where the primary viewer is supposed to be me. and it exposes a public barebones website with barely any content for everyone else.
One of these days I think i’ll expose more of it to the world.
I see plenty of blogs generated from Markdown with tools like that.
Has something overtaken Hugo and Jekyll in that space?
If you like JS/TS, then Astro.
I maintain a blog on Hugo but also host a couple of Astro ones. I think Hugo is great but to my eyes at least Astro has more active development behind it, and I also enjoy it more (probably because I know Typescript more than golang)
I just use mkdocs for everything.
Have you found a decent bare bones starter theme? I've been using MkDocs Material, and I find the theme too complicated (HTML etc) - hoping to find a super simple one that looks decent - plain - and is a good base for theming / styling. Thanks & take care.
I use the readthedocs theme: https://www.mkdocs.org/user-guide/choosing-your-theme/#readt...
Not sure if that fits the bill for you, but I like it.
https://bsky.app/profile/leocomerford.bsky.social/post/3l7v6... To help the hard of clicking, this time I have pasted it all for you:
Leo R. Comerford @leocomerford.bsky.social
Why was it decided not to build on any existing content-addressable networking system (IPFS or whatever)?
November 1, 2024 at 12:39 PM
Leo R. Comerford @leocomerford.bsky.social · 23d
(Not implying that this was the wrong decision, it’s a genuine question.)
dan @danabra.mov · 23d
actually not sure i can answer this well. paging @bnewbold.net or maybe @why.bsky.team (who worked on IPFS btw)
dan @danabra.mov · 23d
my guess is that we’d want data hosting to be under direct control of the user (same as web hosting) rather than peer-to-peer, want instant deletion/edits at the source, need ability to move to a different host or take content down, need grouping into collections. not sure how much IPFS could adapt
dan @danabra.mov · 23d
we do use some pieces from IPFS through (aside from the actual peer to peer mechanism) bryan newbold @bnewbold.net · 4mo
you can basically ignore it, we don't use "IPFS" proper anywhere.
there are strong social connections, and we borrow some tech components like CIDs (flexible hash/digest syntax) and DAG-CBOR (more-deterministic subset of CBOR, good for signing+hashing)
Bumblefudge @bumblefudge.com · 1d
yeah this is all accurate. bluesky remixed a lot of IPFS components and patterns in interesting ways, but the monolithic global IPFS network (with chatty DHT distribution) wouldn't make sense here, BS made an infinitely more efficient/performant distribution of bytes tailored to its use case.
Bumblefudge @bumblefudge.com · 1d
FWIW the IPFS foundation is working on making IPFS more modular and easily remixed for future BlueSkies, but it's a big task decomposing the monolith and reorienting the documentation and ergonomics...
[a second reply to the first skeet:]
Uai @why.bsky.team · 23d
As far as im concerned (and i led ipfs development for a number of years) we are using ipfs, just a specific streamlined implementation of it. All your repo data can be imported into an ipfs node and addressed via cid
Uai @why.bsky.team · 23d
We dont use libp2p because for a consumer mobile app we didnt want to futz with nat traversal and connectivity and the like, but its definitely possible to build a p2p version of bluesky
"skeet" is such a terrible term for this. It's like mastodon "toot"s.
Using bodily functions as core infra terminology is off-putting and feels like a bit like a juvenile boy's club. I get that some people find it funny, but it alienates people. We should just call these "posts".
Same thing with names like CockroachDB and GIMP.
The official Bluesky FAQ says this:
>What is a post on Bluesky called?
>The official term is “post.”
https://bsky.social/about/blog/5-19-2023-user-faq
Eevn better: call them tweets. That's what they are.
Sure, whatever: I had certainly given it approximately no thought in this case, and my personal investment in 'sk**t' is zero. I'd edit my post but I seem to have hit the timeout. I will also say that I don't think this is the most interesting or on-topic thread to pull on from my comment.
Hard agree -- this one is especially bad because it's gendered. We'll see what happens, but I'd put my money on "post" winning out. There's some people on Bluesky who feel absurdly strong about this because of the history (the CEO asked them not to use it so they used it more often as a joke), but they're simply outnumbered already. Such is exponential growth...
[flagged]
In what sense?
[flagged]
What is there to respond to? "This thing may happen at some point in the future" isn't insight or commentary.
I can formulate a response, but it's already required more thought and effort than you seemed to have put into your comment. Engagement farming and bait isn't what HN is generally for.
[flagged]
I just cannot imagine being this upset about someone else doing something they enjoyed that hurt no one. This is pure gatekeeping at its finest.
It's a cool use of technology! Maybe this is Bobby's first API. Why the need to tell Bobby that you're too cool to appreciate it? As the opening of the OP points out, this has very little to do with ${new_propaganda_platform} as you so dismissively put it. They're self-hosting their site on a protocol not intended to exactly do that! That's cool even if you've been able to do that since whenever you discovered you could do that.
They don't seem to be doing any of the things you're throwing at them as negatives. They're not saying this is the future of the internet or something everyone should do or forcing all their friends onto it. It's just an interesting demonstration of the underlying tech of a protocol and what you can do with it.
If you seem to think people talking online about their joy about technology and the things they can do about it is "shit spewing" onto your beloved "WWW" then I'm not sure why you're here. You definitely don't seem like you actually read any part of the OP you're "shit spewing" all over.
[flagged]
This is a pretty pitiful comment. It fails (again) to actually make any salient points (what “propaganda platform” are you talking about? How did you reach that conclusion? Based on what?) and instead just does the “anti-interest negativity dance” that so many edgelords are into these days.
>Not sure why my parent comment was flagged. I guess when you can’t formulate a response, you flag and downvote? Is that the HN way?
It was a vague and negative one-liner, with no indication of what you were insinuating or why you think that way, from a brand new account.
If you spent 30 more seconds to expand on what history you were referring to and why you think history is repeating, it would not have been flagged.
Are you a mod/admin here?
No, just someone who spends too much time here and am familiar with the trends.
I’d have at least said something like “it reminds me of app.net, but with a lot more traction” or something to poke at a conversation.