Nick Gerakines

We are thinking about going deep on #atproto on the @overcommitted.dev podcast. Who would you like to see interviewed? Which projects do you think deserve a shoutout? 👀

Really looking forward to a week from now. Between email, text messages, and phone calls, I'm inundated with political spam. Its non-stop. I'm so sick of it.

In Barcelona for #MozFest? Join our co-founder Tessa and an amazing lineup of AT Protocol builders tomorrow at 4:45pm for our panel “Shipping Self-Determination” @tessa.germnetwork.com @rude1.blacksky.team @kandake.africa @offline.arushibandi.com @anildash.com

Looking for an opportunity? Are you a staff SRE? bsky.social/about/join/s...

Election Season is here which brings up topics that have been settled and an increase in accounts trying to both sides/voice discriminatory opinions claiming we need to settle to win. The most critical thing we need to do now is to not engage with these individuals with no intention to be persuaded.

Speak up atproto peeps

Legend has it that there's going to be a robust tech-in-journalism track at Atmosphere 27. A community of hundreds of the most cutting-edge builders and thinkers on the internet will be there. You should probably apply to speak and share your work. Yes, you. atmosphereconf.org/speak

I did a golang STAR file implementation: 'tangled.org/bnewbold.net/cobalt/star' this is the new simple container format for atproto spaces: tangled.org/bnewbold.net/cobalt/star

I shared some details on off-the-clock.us, a members-only community container that I've been using to work through atproto spaces, communities, and feeds. More info and screenshots in discourse.

"This blog is about celebrating that friendship" with open source developers. That was our first post in Feb 2008. Today, all 1,557 posts (2008–2026) live in the Atmosphere as verified @standard.site records: https://opensource.googleblog.com/2008/02/welcome-to-google-open-source-blog.html

It's going to be a good day.

I think some of the best apps and tools out there are the ones you forget you have, until you do something that reminds you why you have them. #atproto #atdev #plc

Meanwhile, pro-democracy, pro-Europe protesters in Tbilisi, Georgia, are tonight nearing their 700th consecutive day of protest against the pro-Russian government. They haven't missed a single day in the last 23 months.

Who needs to do drugs to feel a rush when you can just mass rotate PDS operator keys?

We should be more ambitious with the software we build. danluu.com/ambitious/

who up late patching they vulnerabilities

We're shipping CoPE-B-S1, an open-weight decision model tuned for safety use cases. It's a significant step forward for our CoPE family of models in a few ways. A thread: blog.zentropi.ai/meet-cope-b-...

Soft launching this (still in TestFlight for a little bit) What it is: native Mac/ios/watch app that lets you run agents on your own machines It uses ACP to support a nice ui for any agent and @iroh.computer to connect your device straight to your machine.

🪐 spaces alpha release 🪐 folks, this is the big one! lots of updates across pretty core protocol mechanisms. hopefully the last/only of it's kind (tho we are planning another release next Thurs)

v43.0.0 shipped this morning. Changelog: minor stability improvements, the lower-back issue from v40 remains open, no breaking changes expected.

Midterm Election Jitters? No idea where to work out some of that anxiety? Come join us in making the news instead of being taken by it. Volunteer below to help make the Graze midterms feed the space you're looking for while doomscrolling on Nov 3:

If you run something in railway, now's a good time to work out your key rotation process. blog.railway.com/p/security-d...

Game developers fear that thieving AI vibecoders will make free game demos a thing of the past aftermath.site/steam-next-fes...

#HugOps to the Railway folks out there on hour ~6 of this outage.

This CA compromise is gonna be a goldmine for jailbreaking internet connected devices, thank you emudhra

This is an absolutely astounding press release from eMudhra. No apology, a suggestion that the researcher who found their private keys must have used AI, and an attempt to shift blame to auditors... wow. emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

I've been using Jetbrains mono for a while, but this looks really nice.

new reference PDS container has been published! if you do the classic self-hosting auto-update setup, you can force a faster refresh with: sudo pdsadmin update and while you are in there why not: sudo apt update sudo apt upgrade

Look at the time! The midterms are just 14 days away, and we have some *great* ways for you to get involved, and *make* the news instead of just consume it. First, sign up here to help moderate any of the 53 feeds we're providing to cover the election night:

Today is brought to you by ... the number 4.

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

just pushed a new release of 'goat' v0.2.7 this is mostly an upstream go security update (for CVE-2026-111943), but also includes a nice patch from @iame.li for working with binary XRPC API response bodies

Hey fellow atproto spaces devs, is it possible for an AppView serving XRPC endpoints to validate the membership of an identity within a space? cc/ @bnewbold.net @dholms.at @trezy.codes #atdev #atproto

This is a quietly metastasizing moral panic

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

I didn't know how much I needed this.

Continuing recent password reset and account recovery work, I've written and published a proposal for "seal" and "unseal" PLC operations that I want to discuss broadly, get feedback on, and proposal to the new plcred.org org. #atdev #atproto #plc

@essentialrandom.bsky.social published a survey of sidecar record patterns in AT Protocol, plus a proposed #4 for schema-defined extension fields in records. Check it out!

Your identity can move between apps. Your business should be able to, too. We’re building Atmosphere Money: social payments for the Atmosphere. Here’s the model, and what comes next:

Afternoon fix