Top
Best
New

Posted by kevinak 6 hours ago

Who owns your ATProto identity?(kevinak.se)
120 points | 110 commentspage 2
skywalqer 4 hours ago|
Why aren't the keys stored encrypted?
jimmydoe 5 hours ago||
It seems most ppl who dislike X has already settled, a small amount moved to DeSo like atp or ap, most just stayed or went offline. Unless China GFW magically collapsed, there seems no reason ATProto user base will continue to grow. So, when will the monetization/enshitification phase begin?

I'm asking this not bc I like enshitification, but the app view design seems such a perfect fit for user data mining/targeting, that it's hard to believe it was not part of design consideration in day one.

kevinak 42 seconds ago|
Atproto is not decentralised, it’s faux decentralised. You can technically be sovereign, but incentives and the way things have been done results in massive centralisation - 99.9% of users are on a Bluesky PDS and have not registered a higher priority rotation key. And they won’t, ever, because that’s how humans work.

The day Bluesky decides to enshittify there’s a very real possibility that they might also just stop allowing people to extract their keys and splinter off the network. The enshitification begins when VCs turn upp the heat it they start getting low on cash.

Noaidi 5 hours ago||
Centralization is always a trap.

No idea why people have such a hard time joining and supporting the Fediverse.

sheo 5 hours ago||
Because there is no single "default instance that is always a good choice and wouldn't go down randomly because of lack of funding". That's both a strong and a weak side of fedi
ftfish 3 hours ago||
mastodon.social has been around for a decade now, seems stable enough.
iand 4 hours ago|||
How is the fediverse different. Can't the owner of an instance post as you? Can they read all your data stored on their instance and pass it to anyone they want to?
webdevladder 5 hours ago|||
Higher friction and fragmentation are Fediverse features (not bugs) that give it a different grain. ATProto has different tradeoffs that lead to a different form of social media. I'm glad both exist, and bridging efforts are worth paying attention to for anyone frustrated with the distinctions.
triyambakam 5 hours ago||
What's the evidence for this? I'd be very keen to understand. This looks Claude written which is fine but adds an extra layer of skepticism for me.
kevinak 42 minutes ago|
You can just read the documentation: https://atproto.com/guides/overview#account-portability

“The signing key is entrusted to the PDS so that it can manage the user's data, but rotation keys can be controlled by the user, e.g. as a paper key. This makes it possible for the user to update their account to a new PDS without the original host's help.”

verdverm 5 hours ago||
Probably doesn't matter for the "40M+ users", most of them have churned at this point and growth is negative. This is good critique for the next iteration of open social protocols, but fundamentally atproto did not fail because of technical reasons. The next iteration should make privacy the default and core to protocol, and be very mindful of how the leadership / social dynamics played out.
singpolyma3 5 hours ago||
Based on all the traffic and development activity I'm not sure on what basis one would say "failed"
ftfish 5 hours ago|||
Source?

What I see here doesn't look good.

https://bluefacts.app/bluesky-user-growth

Never mind the pivot to reddit.

https://www.cnbc.com/2026/06/04/bluesky-twitter-rival-reddit...

adithyassekhar 5 hours ago||
What’s the definition of success here? Instagram like user counts?
bikelang 4 hours ago|||
Arguing that success is purely about the ultra high numbers seems to miss the forest for the trees. Is HN a failure because it did not reach the level of DAU as Reddit? The quality of discussion and community here is certainly substantially higher. I feel the same about Mastodon and Bsky vs Twitter. I’ll take community I actually want to engage with over sheer numbers any day.
ftfish 3 hours ago||
Bluesky has about 2-3 year runway, so, we'll see.

Source: Bluesky COO https://conference.publicspaces.net/en/session/growth-and-su... (somewhere towards the end in the Q&A section).

tptacek 4 hours ago||||
I think critics would settle for commercial viability, given the funding structure.
verdverm 2 hours ago||||
They had a vision and goal to change social media, to get people away from Big Social. They haven't failed in the technical sense of closing, there are less than 1.5M daily (the stats trackers are starting to shut down), but they will also never fulfill on the promises. In the startup world, this is called a zombie company.

One way they failed hard is that they talked about how they were against the investors and VC incentives, then they took $100M from Bain Capital (PE) just after peak user count, but didn't tell us for almost a year. They could have put up a simple $5/month to support the cause, but they took investor money instead. This is why I left.

pessimizer 5 hours ago|||
https://bsky.jazco.dev/stats
jacobgold 5 hours ago||
Bluesky / AT is the most successful open social network in history and the only one to become culturally significant. It has been adopted by presidents, celebrities, journalists, and mainstream users.

Bluesky has ~50M registered users and has sustained ~5M monthly active users for long while. There's no reason to believe it will fall substantially below this level.

It is also in the process of adding (decentralized) subcommunities, which I expect to be really cool and have a large impact on growth.

tptacek 4 hours ago||
"Registered users" is a meaningless statistic. Daily active users has consistently declined.
jacobgold 3 hours ago||
I'd be the last person to downplay the fact that the Bluesky app has a serious retention problem. But it has "broken through" in an incredible way and DAUs/MAUs are quite stable.

Registered users is not at all meaningless. Bluesky has those user's email addresses, the mobile app is still installed on many of their devices, they have accounts, and they can potentially be reactivated.

For example, if Bluesky announced a feature exciting enough, like subcommunities, it could email those 50M users and possibly bootstrap a serious open network competitor to Reddit.

ftfish 3 hours ago|||
A chunk of these registered users are apparently "ghost accounts" hosted on a PDS on a trump.com subdomain.

https://bsky.app/profile/tyggero.cz/post/3moskpisnuc2t

Source: https://sifa.id/stats

Statement from Bluesky: https://bsky.app/profile/pfrazee.com/post/3mmp27wwnic2j

jacobgold 3 hours ago||
Based on your comments, it seems like you're trying to spread FUD?

The stats page you linked to explains exactly what's going on. These spam PLC identities have nothing to do with with the tens of millions of real Bluesky registered users.

Either you misunderstood or you're being intentionally dishonest.

ftfish 3 hours ago||
Never said that, though, plus provided sources. Just adding context for what the total number of users means.
jacobgold 3 hours ago||
You still seem to be implying the number of real registered users on Bluesky isn't ~50M, which it is. The PLC identity spam you referenced is not being counted in this number.
ftfish 3 hours ago|||
If that's the case, then I stand corrected, but a source for that claim would be helpful.
jacobgold 2 hours ago||
I was rounding up, the actual number is ~45 million: https://bsky.jazco.dev/stats (these stats are based on real activity, not PLC identities)

At current rate it will 50M in 6 months.

verdverm 2 hours ago|||
It is confusing to say "users" when it is actually "accounts", humans tend to associate "user" with another human, where as "account" can cover people and bots (many on atproto)

eg. I personally had more than a dozen accounts

jacobgold 2 hours ago||
That's a fair distinction to make but my (educated) guess is that something like 95% of users have a single account on Bluesky.

Most users signed up by downloading the app or visiting the web site and created a single account.

As a point of reference, the official Google Play store independently verifies that the Bluesky app has had 10M+ installs.

https://play.google.com/store/apps/details?id=xyz.blueskyweb...

There are no official stats on the iOS app or web but those are both likely similar or larger sources of users.

verdverm 2 hours ago||
I would counterpoint that a non-insignificant number of the accounts are spam/bots. Jaz's stats overestimate because it does not remove certain accounts which have been takedown/deleted, let alone those that remain. I have shared analysis of this on HN, Bluesky, and Discord to avoid making educated guesses.

The reality is that a significant chunk (>50%) was Blue MAGA, or turned off by them, and I see little prospect that they will reactivate. Outside of the Bluesky echo chamber, there is a deep brand association with Bluesky being primarily political refugees. They see Bluesky as the left-wing Truth Social. I've asked hundreds of people IRL if they have heard of Bluesky, they are far more likely to have this brand association than to have heard of "atproto" (more than half vs 1-2% / can count on one hand).

jacobgold 1 hour ago||
Sure, it may overestimate the exact count, but that doesn't change the fact that tens of millions of real people have downloaded Bluesky and signed up.

Right now, Bluesky has one large community, which is already great for some people but not most people. Once Bluesky adds Communities, new communities can form, making it interesting to the other 90% of people who were excited initially and then turned off by it being "one note".

verdverm 1 hour ago||
I think your association with Blueksy is painting a rosier picture for yourself than reality portends. Do you know how many of those accounts never added a profile picture or even liked a single post? Do you think people are likely to reactivate to something they checked out once and has only shrunk since? Can ActivityPub/Mastodon add some new feature that will reactivate all the people who tried that out and moved on?

If you'd like to crawl the network to get real data, I built this a while ago https://github.com/verdverm/atmunge (it will take a few days to get sufficient data to do analysis, due to rate-limits)

Certainly Bluesky has stats about mobile app installs / usage. If they were good, they would be sharing that instead of the /users/accounts/ number that feels good but hides the reality. The first step (imo) would be to stop trying to deny reality and start asking why it is the reality. Only then can corrections be made. I don't think the core issues are technical, a missing feature, or a social media modality that was supposed to be built in the atmosphere. (other than my strongly held opinion that public-by-default was the wrong choice and bolting on permissioned spaces now is not a right answer)

tptacek 3 hours ago|||
I don't believe the firm behind Bluesky can go to an investor and say "look at all these email addresses we have" and raise on that.
jacobgold 3 hours ago||
Of course investors care about registered users, for the same reason I explained. But yeah, they do care a lot more about retention and growth rate for good reason. Bluesky Social, PBC has raised $120M+ dollars from investors.
scyclow 5 hours ago|
This is where non-financial use of blockchain could really shine, IMO. Self-sovereign identity management with a smart contract-based process for recovering ids if keys get lost or hacked. Blockchains are pretty out of favor these days, but I really don't see a better solution for decentralized identity management.
SkiFire13 5 hours ago||
> smart contract-based process for recovering ids if keys get lost or hacked

How would that even work?

TheDong 4 hours ago|||
If someone's account gets lost or hacked, the person with the most incentive to own that account is usually the original owner, so just give it to whoever is willing to pay the most, problem solved. We can call it "proof of stake", where you always stake a certain amount to keep owning your account, and when contested, whoever stakes the most gets it.

Poor people don't deserve rights on the blockchain anyway, it's not like they can afford the transaction fees, if they didn't want their account stolen they should have tried being rich, or buying into nearer the top of the pyramid.

Don't worry about people who pass away or lose internet for an extended period, we'll deal with that in v2, when we get "proof of death" and "proof of internet disconnectivity" on the blockchain somehow.

/s if it's necessary

tarpitt 3 hours ago||
I think you're right that transaction fees are a key problem. It's ultimately a bandwidth problem. You're bidding for the limited vbytes, and the bidding price only increases with traffic, kicking poor users out.

I think the key thing to recognise with petname systems is that there doesn't need to be this sort of "top-level consensus" as opposed to ecash systems.

You can have two instances of namecoin, say Namecoin1 or Namecoin2. You can just have different domains like alice.nmc1 and bob.nmc2 and have them interoperate properly. You can just keep forking blockchain-based petname systems to overcome the bandwidth/fee problem.

What this means is that Namecoin1 full nodes don't need to synchronize all the domain names on Namecoin2 and vice-versa. Similar to TLDs on DNS. We can imagine that there might be different petname TLDs for different global regions, and they might be merge-mined.

This isn't true for money applications like bitcoin or eth, because by forking BTC or ETH or something, you are creating new coins.

tarpitt 3 hours ago|||
Perhaps some sort of namecoin or ENS-like petname system with multisig or some type of scripting that enables different recovery methods.

For example, you could set your petname up so it can be controlled by a single keypair, which can be overridden after a certain time by a ring signature based on keypairs held by friends, family, peers, and trusted computing devices you leave in a safe deposit box.

Or maybe you could trust your identity with some centralized entity, but only as part of a 2-of-3 multisig with yourself and another trusted entity.

Basicially namecoin with bitcoin-like scripting controls.

AndrewStephens 5 hours ago||
What is the incentive for an individual to participate in a non-financial blockchain?

Bitcoin-style blockchains “work” because everyone gets the possibility of a little reward for all the hassle and non-negligible CPU time of being a node.

tarpitt 3 hours ago|||
Good question, this made me think.

You get a reward for being a mining node, not just any node. Even then, do miners have much incentive to share blocks, other than the ones they mine?

I think the incentive is mutual for most nodes (aside from the mining aspect). People will set up a node to accept transactions in an automated manner, or to have higher confidence in the state of their accounts.

It's like being on the floor of the stock market. People participating want to be where all the information is (for their own benefit), and there is incentive to bring others in and share information (because it increases the amount of information you have).

I suppose you could be a "selfish" node. The bitcoin-equivalent of someone who leeches and never seeds. But the advantage is low relative to the amount of money moving around. Most people don't care about the bandwidth of running a bitcoin node, they care about latency. Unlike bittorrent, there isn't a de-facto finished version of the file being synced: it's a constantly-updating list that everyone wants to have the latest version of. I can't find the words, but this seems to be the fundamental difference.

vid 5 hours ago||||
What's the incentive for people to participate in file sharing networks? To some degree it's access to a world of free media (same as access to a world of decentralized identities), but to a large degree it's an interesting hobby/excuse to be interested in tech. Some people have racks of hard drives dedicated to hobbies like this, just because it's interesting and is worthy.
majorchord 3 hours ago|||
For me the incentive is being able to own an identity that nobody can take away from me. And the assumption is that services will support this type of identity, so I don't have to make accounts on other systems that people can take away and now I've lost all access to any data I had.
AndrewStephens 3 hours ago||
I think what you are looking for is something like Mastodon or related activity-pub service. You can run your own instance and nobody can take that away from you. No need to drag a blockchain into it - just host whatever services you need.
tarpitt 3 hours ago||
except for your domain registrar and your PKI certificate authority