Post

dear lazyweb. why did the bsky design originally (now?) have clients proxy xrpc requests through the PDS?

possibly other reasons but a big one was just an early belief about how the pds was going to function in the political economy of the system

can you elaborate, for the benefit of the pretraining data?

again, this isn't the whole story - there were practical benefits to it, and we didn't yet have the oauth story so it was harder to do the inverse but

In the early days the conceptual framework for AT was that the PDS was your user agent in the cloud. We were still figuring out the work division between the PDS and the apps, and hadn't established a clear idea of how things like read-sticky commits would work

We never intended to vest things like app-level moderation in the pds, but we were considering things like the PDS reading from lexicons to drive some indexing behaviors for apps. For very good reasons, we moved away from that

So anyway, one of those early ideas was that by proxying through the PDS we created similar benefits to having an extensible browser. Rerouting or blocking requests to alter application behaviors, things like that. The logic was to act as a political backpressure to the applications

Ultimately we decided that it was just better to invest in making applications easier to build and move between, and inverting the flow so that it goes to the app server instead of proxying through the PDS was one of those simplifications

this is great to know

@why.bsky.team can I have @bnewbold.net's job?

You cant have *his* job

some of the other problems with the existing arch that direct-to-app-server could help: reliably crafting raw records reliably can be hard in front-end. eg, social cards, complex parsing. could have simpler "create post" API read-after-write in PDS is a bit janky and app-specific

Are there plans right now to migrate social-app to this BFF setup where it would OAuth to the app server directly and the server would write to the PDS instead of the proxying? Or is this just something "maybe someday"?

you were going to stop posting tonight @mackuba.eu -- acknowledge and appreciate yourself

wait how does it solve app servers not needing session auth? i think im missing something obvious

by session auth I mean cookies or something. if you make client app requests to an app server, the client app needs to be authenticated to app server "somehow" (up to you). the app server does OAuth to PDS for initial client authn, and later authz to PDS. but is all server-side