Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Doomed from the start. It took me a while to figure this out, but ATProto is generally a bad idea; maybe even worse than Twitter.

Which is to say, it provides a more robust model for your (true) information and data to be exploited by others than even the Twitter model.

The Mastodon-slash-email model that relies on individual servers is better because decentralization is safer -- Those models bear more genuine "ability to delete" and more "plausible deniability."



The Mastodon model does not offer much ability to delete. Well-behaved servers will honor delete requests, but the protocol doesn't mandate it. Additionally, a user cannot generate delete requests if they get banned from their server or the server shuts down. Users and server admins can't control whether another server permits archiving of their content. Mastodon and other fediverse software allows following public posts by RSS, and RSS clients might keep them forever.

The only reasonable understanding is that these protocols are for for publishing to the public. It is not possible to reliably retract anything published to thousands of other peoples' computers. We used to try to teach people that the internet is forever, and that's even more true with federated protocols. That doesn't make them a bad idea.


> The Mastodon model does not offer much ability to delete.

The internet is forever, don't want it propagated? Don't post it.

> Well-behaved servers will honor delete requests, but the protocol doesn't mandate it.

Probably because they cannot truly guarantee or enforce it.


I think it's important to remember that decentralization is a barrier to having control over your data. If you're going to participate in these systems, you should treat everything you do as permanent, because by design you will not be in control of where that data is stored.


But at proto is equally open? You can also just save all of at proto.


You can save all of anything someone makes public with ATProto, ActivityPub, or RSS. You can do that with anything someone puts on a web page too, but those protocols simplify automation.

I understand why people want to be able to delete things from the internet, but it doesn't work that way. It has never worked that way. It can't work that way unless every computer is locked down to running remotely attested government-approved software, and that's obviously worse.


Once you hit publish, it's public and anyone and everyone can save a copy and distribute it. If you don't like that, don't hit publish.


ATProto won't be this way for much longer. Permissioned data is coming and will not be broadcast or accessible without grants. This will sit next to the public data, but separate.


So ATProto is about to die, in other words.

It was already wayyy too complex. And this? Yeah, they (you? sorry) really need to just give it up.


The vast majority of people don't want their activity broadcast out to the internet for anyone to grab.

Permissioned / private data is non negotiable for any social media tech trying to gain mass adoption.


I would say the opposite. If you don't want your activity public, don't put it on the Internet.


How do you think about Google Docs? I consider that "on the internet" since it is not on my computer. Same for private channels and threads in Discord.

Also, ATProto can be much more than social media tech, more like a plug-n-play distributed system

https://atproto.com/articles/atproto-for-distsys-engineers


Are you serious? Y'all are so confused about what this is.

The entire point of services like Bluesky and Twitter is broadcasting your activity out to the internet for anyone to see (which of, course, is technically little-or-no different from "grab")


ATProto is not Bluesky, the later is just one app on the former. There are many more apps like Tangled, git on ATProto, which need private repositories.

You seem rather confused. I do not work for Bluesky. I am an independent developer building completely separate applications on ATProto.


Fair, I'm aware and I am conflating what people do with Bluesky and what ATProto can do. I absolutely do see the value in ATProto doing things that aren't "social media"


I hope the bluesky team can as well, as we work towards permissioned data support.


Actually, yes, it does.

Or more precisely, it might. We now have a better idea of how people actually behave and it's not in accordance with "the internet is forever," and I have no interest in blaming them for 'human nature' in that way.

And it's all still dangerous. Again, I know the internet is forever, but someone else posting about ME might not.

This isn't an individual thing. It's "ecological."

And I have no interest in making Big Brother THAT MUCH EASIER to build.


This comment seems to be saying you don't want most people to do blog-like things. Most social media from Facebook to Youtube is blog-like if you squint.

It does seem like fewer people are posting personal content that way lately. Perhaps most people are better off sharing things one to one, or in small groups that are meant to stay private. That doesn't make it bad for the more public formats to exist; they're just not for everyone.


You can care a lot about plausible deniability and the ability to delete your own data, but it seems a bit weird to denounce a whole ecosystem as "generally a bad idea" on those grounds, when that is a deliberate anti-goal of the system design.

Don't use it if you don't like it. Some of us like the strong identity and content verification.


"Don't use it if you don't like it" is not a sufficient response here, because the gathering and verifying of personal data is NOT PURELY AN INDIVIDUAL PROBLEM. You might post about me. Etc.

Proverbial Big Brother ALSO likes "strong identity and content verification."


"People should not be allowed to post publicly on the internet" is definitely a hot take.


No clue what that refers to, it's not at all what I'm saying. What I'm saying is -- we can observe that "don't post what you don't want posted" is an insufficient response to our current internet in terms of safety and publicity.

I'm also putting forth the idea that the ATProto thing for social media makes us marginally less safe, due to its technical "centralization via confirmation" of the data it "broadcasts."


The community has voted for convenience over privacy, and twitter and bluesky have won over mastodon. You're right, but people don't actually care about privacy


Bluesky is very intentionally about public posting. It's a bit weird to say people "don't care about privacy" when speaking of a platform designed to amplify and distribute posts as widely and effectively as possible.


There is a lot of weirdness around Mastodon, particularly some people can’t seem to make up their minds if they want the stuff they post to be visible or not.


Exactly. And I'm willing to be that Bluesky folk might be somewhat similar because they haven't figured it out yet.

Except that the design of Bluesky severely increases the possibility of your data getting out of your control. And I can hear the immediate responses of "oh if you didn't want it public, don't post it," but as should be frightfully obvious -- not everyone thinks like that.


Mastodon doesn’t give you any real privacy. If I’m posting on something twitter like I want as much reach as possible. Sorry bud, we’re not actually all dumb naive people who haven’t seen the light.


Unfair characterization. You can make informed prediction about these 2nd order effects without thinking they are dumb. I don't think people who send nudes with Snapchat behaving as if they will be definitely deleted are dumb either because, you know, the heart wants what it wants.

That doesn't mean that there is no danger of people having "buyer's" regret later, or more importantly that there are issues beyond the individuals.


>You're right, but people don't actually care about privacy

The entire point of a platform like Twitter / Bluesky is reach, not privacy.

Posts and discussions there are meant to be public, and highly visible.

It's not that people don't care. It's that this is not what the platform is for.

What's important for a platform like that is not even anonymity, but functional pseudonymity.

And that thing is on its way to the effectively outlawed with the push for "age verification".

People do notice it and leave [1], but at some point, there might be no place to go to.

[1] https://www.reddit.com/r/privacy/comments/1rmlzhy/welp_goodb...


I 100% agree, I always thought that even Private Messages were a bad idea.

But no, we're way past "if you don't want it public don't post it." and then wiping our hands and being done. We need to think in a policy kind of way on this.

And again, things are already dangerous -- but ATProto makes them more dangerous. It's something like a chain-of-custody thing. I think the world is collectively safer where the gathering of data like this is less reliable and less verifiable.

ATProto's model makes the building of the proverbial evil Big Brother panopticon thing a LOT easier.


I'd rather say Twitter and Threads are the current winners if we're talking about userbase. Bluesky is basically in the same league with Mastodon while those two are so far above that you can't even see them without a telescope.


If a social network stays comparatively small but still active, I see that as a huge win. Half the people I follow are happily on Mastodon. I don't see that changing anytime soon.


I am on a bunch of socials but as time goes by I like my cohort on Mastodon better and better.


Many a Discord server would agree


As someone who was once an avid twitter user, my sense is that Mastodon--after a somewhat hopeful start just never gained the network momentum. Bluesky came closest to Twitter's old reach but is still something of a shadow of the old Twitter (as Twitter/X is these days as well).


Bluesky is not just a shadow, it's on a pretty steady decline. Their DAU numbers are dropping every month. Which probably tells you something about the unspoken reason for this change.



Yes they are? E.g., https://api.backlinko.com/app/uploads/2025/11/bluesky-websit...

This is also visible in your stats if you extend the time window. They had a peak in 2024 and are pretty much declining month to month ever since.


Are we seeing the same? All the stats are steadily going down https://i.imgur.com/QJakG56.png


I’d describe that last six months as ‘sideways’ —- what was that surge near the end of last year?


I believe that surge was Elon announcing AI image editing on X and a bunch of Japanese artists and their followers trying out Bluesky.


My understanding was the end of year time off / holidays, as compared to the dip around thanksgiving.


Jaz's stats are sus, use this instead: https://bskycharts.edavis.dev/edavis.dev/index.html


Ah, I didn't realize the link I shared was Jaz's (it was shared in another comment), but they look similarly sideways over the past 6 months, with a noticeable bump in Dec / Jan.


These specific stats are likely not as bad, I mainly take issue with the "user" count they promote.


Without researching actual numbers, it feels like that whole category of social media is pretty much uninteresting at this point. Not sure what really replaces it given that Facebook seems increasingly infested with AI slop and sponsored posts.


More IRL time with other people hopefully.


[dead]


We may have different interests and networks. Pretty much everyone I know has moved on. I don't even look at it any longer.


I mostly don't like this take because it presumes a precise definition of privacy that we all agree on. And it's not even remotely close to that, which is why I think the Bluesky model is perhaps insidious.


Good point. For sake of argument, how about this stratification of privacy levels:

twitter/x/bluesky - a big tech company owns your data

mastodon - a grassroots community organization owns your data

zulip - someone you've met personally owns the data

your blog - you own the data

(and yes these are a bit of a category error, but to achieve privacy maybe we should broaden the category and sacrifice reach)


Well, the problem is, now the word "owns" isn't really helpful either?

Because you have "possesses" (which can be anyone) vs. "controls?"

Twitter - single point of big company external control

Mastodon - One or multiple unverifiable fallible likely grassroots, points of external control

Bluesky - Once out, merely the illusion of control, because your data is out there, verifiable?.


deleting published stuff in any sort of decentralised network is always going to be limited at best

there is just no way to police what happens to data that is broadcast, which doesn't remove control away from the reader

it's annoying because in the abstract it's something everybody has the potential to need and need badly, but if you're afraid to put something out there to your name/pseudonym you really shouldn't


What? You don't even need to understand how Mastodon works in depth to realize that sending a post to 500 different servers owned by completely different people in completely different jurisdictions is going to make it harder to delete later.


Sure -- but it also makes it harder to verify. That's my issue with Bluesky, perhaps I'm thinking like a lawyer. ATProto's most touted feature is also its biggest danger. A post on 2 servers thats hashed/verified (and perhaps admissible in court) might be more dangerous than many more rando Mastodon servers.


Not being able to trust the integrity of the data on the Mastodon network to the point it's not admissible in court is not a good thing for Mastodon. If this is really true, I'd say it's a completely failure of the most fundamental concepts of information technology.


Seems like the solution is to either not incriminate yourself online or get plausible deniability with a pseudonym.


AGAIN, we are way past SIMPLE SOLUTIONS like this. We have enough data and information to be able to see the potential for harm that we can mitigate through smart policy without falling back on this simple argument.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: