Post

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

bryan newbold

@bnewbold.net

eg, everything that does handle resolution, or OAuth client flows, or fetches identity info or data w/o validation, or service proxying, will need some form of operational update or mitigation.

20/10/26, 8:37 pm1 repost38 likes

bryan newbold

@bnewbold.net

I'm sort of wishing more of the atproto identity code I have written was doing real PLC validation, instead of just fetching the DID doc...

Eli Mallon

@iame.li

i thought about that too but that requires pulling all N DID docs that have ever existed for that user, yeah?

Evelyn

@kandake.africa

I'm tinkering with the idea of introducing did:webvh but it's not in the spec for anything so I ended up with this middle ground of tracking keys in Stratos. I'm going to see what shape I end up with and maybe introduce a similar mechanism in other services to monitor service auth keys

stratos.zoneService signing key history | StratosPrivate permissioned data layer for ATprotocol

Nick Gerakines

@ngerakines.me

I supported it in atproto-crates for a hot minute, and removed it recently for the current release candidate. I think it is a sound and reasonable DID method. that we should be more widely supporting and using.

bryan newbold

@bnewbold.net

pulling the full PLC audit log. which usually isn't that big, and probably compresses well, but yeah there are tail cases. replicas help with load on the directory. a lot of services (clients) don't do many resolutions. ones that do will probably have good caching, maybe local validating replica

fig (aka:[phil])

@bad-example.com

reference read-replica validating ops is the very best thing about it imo. only helps here if you access it not-over-public-tls but that's very possible if you self-host it. (but also, read-replica perf when fetching full identity audit logs is also very good)