maybe an opportunity to unlock a broadly interoperable login/identity flow is what is needed to make AP C2S happen after all this time.

Show Post

One questions i have been pondering on is "should an activitypub user be able to login to an atproto app?" and vice versa? What would that mean? What would the cross product of AP, AT, indie auth, LWS be? Many atproto apps allow you to login with email (bluesky most notably), what does that mean?

Show Post

So the thing that’s kinda boggling me about 4 is, uh, so we’re only now realizing that sometimes we have to support *revoking* certificates?

Show Post

i dont think that would mitigate everything and patching would still be high priority for this one. but , like, wouldn't that be nice. if the app itself or some file its devs can publish alongside the binaries told your reverse proxy it could do those and in which routes it needed exceptions for

Show Post

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

Show Post