Sam Goto

Sam Goto

@sgo.to

Make the web go brrr

636 followers653 following940 posts

Sam Goto
@sgo.to

I'm proud about this move! Good stuff @opensource.google !!

Google Open Source@opensource.google

"This blog is about celebrating that friendship" with open source developers. That was our first post in Feb 2008. Today, all 1,557 posts (2008–2026) live in the Atmosphere as verified @standard.site records: https://opensource.googleblog.com/2008/02/welcome-to-google-open-source-blog.html

opensource.googleblog.comWelcome to the Google Open Source BlogPosted by Chris DiBona, Open Source Team Three years and some 320 posts ago, we launched the code.google.com blog with a post detailing (with too m...
Sam Goto
@sgo.to

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity! www.w3.org/events/meeti... I'd love to see you all represented there, remotely or in person!

w3.org26 October 2026 | Open-World FedCM for Decentralized Social Networks | CalendarThe World Wide Web Consortium (W3C) is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards.
Sam Goto@sgo.to

@thisismissem.social @divy.zone and I recently went through an exploration of how the browser can help you login to websites with atproto accounts. We recently presented to the FedID CG and here is a sneak peek in case you couldn't join! This is early but we'd love your input before we go too far!

Sam Goto
@sgo.to

One questions i have been pondering on is "should an activitypub user be able to login to an atproto app?" and vice versa? What would that mean? What would the cross product of AP, AT, indie auth, LWS be? Many atproto apps allow you to login with email (bluesky most notably), what does that mean?

Sam Goto
@sgo.to

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity! www.w3.org/events/meeti... I'd love to see you all represented there, remotely or in person!

w3.org26 October 2026 | Open-World FedCM for Decentralized Social Networks | CalendarThe World Wide Web Consortium (W3C) is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards.
Sam Goto@sgo.to

@thisismissem.social @divy.zone and I recently went through an exploration of how the browser can help you login to websites with atproto accounts. We recently presented to the FedID CG and here is a sneak peek in case you couldn't join! This is early but we'd love your input before we go too far!

View full thread
Sam Goto
@sgo.to

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity! www.w3.org/events/meeti... I'd love to see you all represented there, remotely or in person!

w3.org26 October 2026 | Open-World FedCM for Decentralized Social Networks | CalendarThe World Wide Web Consortium (W3C) is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards.
Sam Goto@sgo.to

@thisismissem.social @divy.zone and I recently went through an exploration of how the browser can help you login to websites with atproto accounts. We recently presented to the FedID CG and here is a sneak peek in case you couldn't join! This is early but we'd love your input before we go too far!

Sam Goto reposted

hailey
@hailey.at

me knowing i’m not responsible for any php application right now

Sam Goto reposted

Filippo Valsorda
@filippo.abyssdomain.expert

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise
Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise
Sam Goto
@sgo.to

Add first class support for short videos and compete with tiktok/instagram, rather than twitter.

Jake Gold@jacob.gold

The Bluesky Retention Problem was identified with certainty in late 2023. In 2024, the Discover algo was supposed to be the solution. In 2025, the Discover v2 algo is supposed to be the solution. I genuinely hope that it is! But I'm incredibly skeptical, and for the same reasons I was in 2024.

Sam Goto
@sgo.to

My PDS recently broke because bsky.app added a x-atproto-session-id CORS header :) That's probably my fault, but Claude was pretty good at spotting that! It also found a security vulnerability :) The joys of running your own PDS! Honestly, a lot less trouble than I was expecting :)

Sam Goto
@sgo.to

Pretty small price to pay so far, for the peace of mind of owning my own PDS :)

Sam Goto
@sgo.to

The natural selection forces in my household are: - if you go in the dishwasher and break I won't buy you again - if you go in the washer and dryer and you wrinkle or shrink you also won't live long enough to reproduce This is the way.

Sam Goto
@sgo.to

My first job ever was an internship on orkut.com. Then, my first job at Google 20 years ago was to rejoin that team. I just added my name to support what Orkut is creating. It made me think of you. orkut.com Sign the petition and lets affect change! Slow down and fix things!

Sam Goto
@sgo.to

Actually, correction, I realize that my first internship ever was a summer before at a gaming company developing a chess and othello engine for them :)

Sam Goto
@sgo.to

My first job ever was an internship on orkut.com. Then, my first job at Google 20 years ago was to rejoin that team. I just added my name to support what Orkut is creating. It made me think of you. orkut.com Sign the petition and lets affect change! Slow down and fix things!

Sam Goto
@sgo.to

The fourth picture here from left to right is me (and my then girlfriend, who turned into my wife and mother of my kids -- higher resolution photo to the side) on the orkut.com home page!

Sam Goto
@sgo.to

Anyone following me from the atproto/activitypub community going to TPAC? Im interested in organizing/meeting like minded people and ways that browsers can help these communities and in case you are too id love to connect! I'll be at IETF in SF after TPAC too, so also another opportunity to meet!

Sam Goto
@sgo.to

The "no steps back" is, in my opinion, what sets atproto apart from everything that came before it. I use it too for much of my work in browsers too, under a different name: user behavior / developer backwards compatibility. It comes at a massive cost, but I think is a powerful guiding principle.

Sam Goto
@sgo.to

Yesterday I was at work explaining atproto to a coworker and at the end of it I asked them to open bluesky to give it a try and they said "oh, this looks like a twitter clone". And I said "exactly my point". Bluesky is backwards compatible from a user comprehension perspective: no new information.

Sam Goto
@sgo.to

But under the hood of "no steps back", a massive one is being taken forward.

Sam Goto
@sgo.to

Pondering about terrytao.wordpress.com/2026/09/24/w... and the need for humans to "understand" ... ... In computer vision and translation, "understanding" symbolically came at such a huge cost ... feels like we gave up "understanding" for "utility".

terrytao.wordpress.comWe’re gonna need a lot more mathematicians[This is a guest post by Amit Sahai. This blog post was initially written in a different file format and converted using AI. — T.] When I was an undergraduate student, I remember talking with…
Sam Goto
@sgo.to

I wonder if AI makes the cost of writing software 0 if that will lead to more native applications (vs web apps) or fewer. On one hand, if you make native apps as cheap to develop as web apps they might grow, but on the other hand, users might need more and more the web's security model. Any bets?

Sam Goto
@sgo.to

Wow, no way! I just installed the @atpassport.net Firefox extension and managed to log into a website using FedCM in Firefox using my own PDS. This is insane, I had no idea this was possible at all, and gives a whole opportunity for us to implement FedCM in Firefox (and maybe even Safari?).

Sam Goto
@sgo.to

I'm getting a "your account is too new" (has to be at least 7 days old) to create a group chat ... probably because my PDS is hand-written and i messing things up ... Any chance someone at bluesky can figure out why that's happening?

Sam Goto
@sgo.to

(bored, testing posting to bluesky, will try to pick a fight) Browser bookmarks: no idea why they still exist. Who manually curates bookmarks since search engines were introduced? Change my mind.

Sam Goto reposted

André Bandarra
@bandarra.me

Microsoft Edge's #WebMCP implementation is ready for testing, and the team has new demos! Can't get enough pizza related WebMCP demos! 🍕🍕🍕

Patrick Brosset@patrickbrosset.com

📢 Lot's of updates in our new Edge for devs issue: OpaqueRange, referenceTarget, window-drag, <install>, WebMCP, and more!

blogs.windows.comNew in Edge for developers – Create better components and make your site agent-readyWelcome back to New in Edge for developers, our recurring roundup of recent web platform updates in Microsoft Edge. In this edition, we'll look more closely at some of the newest additions to Microso...
Sam Goto
@sgo.to

This is insane great! One of my teammates moved recently to Igalia and is able to continue doing what he passionate about doing What a wonderful story!

Igalia@igalia.com

Today Igalia turns 25. Ten engineers started it in A Coruña in 2001 with no investors and no managers. There are now close to 200 of us, and everything we build still goes upstream. igalia.com/2026/09/21/T...

Sam Goto
@sgo.to

Early on in my career I read Drive and the premise that motivation comes from three things: autonomy, mastery and purpose. It never occurred to me that coding assistants may be removing the mastery aspect of the job and in doing so making it less appealing. medium.com/@maxwbuckley...

Sam Goto
@sgo.to

I can tell that lately I haven't been vibe coding as much as I was 2-3 months ago. I don't know why.

Sam Goto
@sgo.to

I spend an insane amount of time on chess.com can't wait to see this succeed!!

Thorne 🌸 - Play Cozysters! 🎢@ens0.me

Consider this still a beta. It definitely won't mess up your PDS (it only requests access over Atcade records), but it honestly could use more QA. But you can challenge anyone to a game with just their Bluesky handle! atcade.com

atcade.comatcadeChess, checkers, four in a row, backgammon and mancala with anyone on Bluesky. Sign in with your account and challenge a handle.