Post

SwiftOnSecurity

@swiftonsecurity.com

Post deletes being complete happening soon! Thanks @jay.bsky.team! NOTE regardless of network, scraping happens and can't really be stopped. For years a bot reposted my every tweet. Please be careful. BlueSky is a playground - not a different universe - even if we rejoice in momentary reprieve.

Jay 🦋@jay.bsky.team

yep, we probably need a new user FAQ. But on this issue, the PRs to hard delete blobs and accounts are landing soon, and rebasing to hard delete posts is following. https://github.com/bluesky-social/atproto/pull/963

github.comDelete blobs app migration by dholms · Pull Request #963 · bluesky-social/atprotoBuilding off of #959 Deleting all currently dereferenced blobs Test & code for this do not need to be merged in, just ran

yes, people should treat data here like it’s the public web. we had a long discussion today about whether/how to discourage scraping/archiving — @pfrazee.com?

yeah I'm gonna go Big Technical on this one

4/5/23, 3:00 am30 reposts207 likes

every user in atproto has a signed data repository, which is quite similar to a git repository. changes get written in commits and each repository maintains a history (commit log) we do that because the network is largely pull-based, and maintaining the history makes catchup sync efficient

designing the data repository is a bit of an art, because it's a merkle tree and you're balancing the size of proofs for a given record or subset of the data against the flexibility of the data it contains. @dholms.xyz is your guy on how all that works

as it turned out, the way image blobs get stored in the repository make it easy to just drop them and leave dangling references. that's why we're able to ship that quickly records, however, are harder to expunge without losing the ability to verify the proofs

Prose and Khans

@temujin9.t9productions.com

What if you pushed all deleteable record data into a secondary space like you use for image blobs, and kept only relatively harmless metadata in the immutable record portion?

@klbr.bsky.social

if you had an archived copy of the skeet, isn't it true that you can verify it's authentic even if the original skeet was deleted? because the proof is still there?

daniel tells me it might be possible to change the data structure so that it's possible, but he had that kind of quiver in his voice when he said it that tells me I shouldnt expect it any time soon that means if we want to expunge the actual records, we have to do a "rebase"

stuff like this is why I really enjoy the concept behind objecthash, as it allows you to redact parts of your data without affecting the integrity of your graphs. it does open a bunch of other attack vectors but opens up some nice possibilities.

@hdevalence.bsky.social

i believe you but i don’t understand what about the way you’re doing deletions makes it hard to verify proofs. when we do deletions in our merkle tree we just remove the k/v pair and recompute all of the hashes of parent nodes like any other write

@kevinmarks.com

Does this mean that post editing with an edit history visible (like Mastodon) would be relatively straightforward to add, unlike deletion? So we could get quick typo-fixing edits without compromising the underlying design?

it would but we're waiting on some additional pointers so that fetching historical revisions can be efficient enough there are also a lot of UX challenges to step through

What was the most challenge part in finding the balance between proofs and subset?

you're trying to create a tree with the perfect amount of depth & breadth. too wide and you need a ton of sibling hashes to compute the thread. too deep and the recursing chain gets long

Jef Kazimer 😶‍🌫️ 🆔

Is it ever envisioned that users will control those signing keys? I assume today during signnin with passwords we have an association to a centrally stored signing key used under the covers since we don't have the key ourselves. But is that the longterm vision?

up until august that was the design, but it introduced a ton of complexity. we decided instead to use recovery keys that can override the signing keys for rehoming your repository. you *do* control the recovery key and that way you're protected but not signing every op

Jef Kazimer 😶‍🌫️ 🆔

I know the team is working on critical features but security really is foundational for.people to feel secure to adopt and build upon. The more popular a site will become the worthy of attacking and account take over will happen. It will be harder to change mindset to be more secure by default

Jef Kazimer 😶‍🌫️ 🆔

I do see the challenges with user held signing keys for portability and recovery at scale. Today's use of simple passwords is temporary? Are you looking at stronger auth methods before the userbase scales up? Tommorow is world password day & it would be great to use modern methods like passkey

@handle.invalid

pull-based — if that’s the case, how does dialing into com.atproto.sync.subscribeRepos work? is it just constantly pulling every x milliseconds from all possible repos or something else i am not understanding

that's a @dholms.xyz question

@mattwallaert.com

I read this thread for fun, @pfrazee.com…for fun!

you madman

Sage Deviant 🏳️‍⚧️

@trans.bsky.social

Commenting so I remember to come back and read this later

@rbergin.bsky.social

And now you have a nickname. Let’s go Big Technical! Can also work shorter. Let’s go BT! Or even Biggie Tech! Wait - can you rap?