Post

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

eg, everything that does handle resolution, or OAuth client flows, or fetches identity info or data w/o validation, or service proxying, will need some form of operational update or mitigation.

I'm sort of wishing more of the atproto identity code I have written was doing real PLC validation, instead of just fetching the DID doc...

i thought about that too but that requires pulling all N DID docs that have ever existed for that user, yeah?

pulling the full PLC audit log. which usually isn't that big, and probably compresses well, but yeah there are tail cases. replicas help with load on the directory. a lot of services (clients) don't do many resolutions. ones that do will probably have good caching, maybe local validating replica