Luke's feedback on the permissioned data proposal is pretty interesting. The current proposal has a kind of locational element to permissions, where a record's URI reflects the access control, and I can understand why that would be jarring. I'm talking with the team about whether we think that's something that could change, and what a change like that would cost. We're still in the collecting feedback phase so it's good to hear how it hits people.
Regarding his other concern, I would've loved to make atproto a localfirst protocol -- that's the field the atproto team came from -- but we had to pick & choose where to spend our complexity budget. I wouldn't say it's a nonstarter for the ecosystem; you can use something like iroh in conjuction with atproto to share identities -- dial people at their dids or domain names -- and then commit state to the atproto repo once it's ready to leave your local sync mesh. Maybe that sort of thing makes its way into future versions of the protocol. But, engineering often involves trades, and for the v1 that was one of the trades we had to make.
I've been building a board game community on ATProto. The idea revolves in trying to build the feeling of local clubs but online, instead of "PLAY NOW" being on the landing page (although you can play now if you want) it's organized around clubs. I also wanted to move away from one game oriented community. I play Go and Chess and I would love clubs to be for mixed games. You can create leagues, or tournaments, etc.
As an extension of that I've been building a small language to build games (with a nice time traveling debugger and automatic replays) inspired by Elm. Go and Chess are both built on top of this and you could fork them and modify the rules. Want to code a new Chess variant? Go ahead! Want to code a whole new game you want to try? Go ahead!
What I'm very excited with ATProto is that because all games are broadcast on it and each shares a core system of turn-based replays (and review system with branching) software can be built on top to do AI analysis, or a replay view. The idea that my application can be extended without me adding an API is very exciting and very much in the direction I want to take the system (community is the core tenet).
Reading articles like this one, I do think people are trying to put a square peg (their applications) through a round hole (ATProto). The ATProto was designed around all data being public. You write public data to a user's PDS and then any application can read that public data and do something with it. If all data was private (encrypted?) by default then that would defeat half of all of ATProto's goals.
Imagine someone starts startup A on-top of the ATProto. They raise some money, get some users, some people love it, but ultimately they die. If the data was private to that service, that data dies with the startup. But if the data is all public future startup B can read that old data and do something with it. As a user that's brings me a ton of utility and comfort trying out new services.
If you're trying to built a local-first, mostly private service I just don't think the ATProto is the right tool for the job.
> If you're trying to built a local-first, mostly private service I just don't think the ATProto is the right tool for the job.
I agree! I think the "permissioned data" working group is aiming to solve the middle ground – where you want to broadcast something "publicly" but to a specific audience instead of the whole world (e.g. invite-only event, membership club). It's "private" in the sense it's not open to all but not in the sense that only you can see the data.
Nick Gerakines has been sharing some good examples of what you could build using permissioned data:
atproto permissioned data [1] will solve the dilemma you're describing. Ultimately all the data is in the same place (your PDS) and you can always read and write any data there. If startup A goes away, startup B can read that old data and do something useful with it.
> If all data was private (encrypted?) by default then that would defeat half of all of ATProto's goals.
Yeah, this is the reason why I don't understand why they succumbed to the idea ATProto must handle private and has started on work trying to figure it out (https://atproto.wiki/en/working-groups/private-data). Instead, focus on just really great public data archiving and displaying, at scale.
> I don't understand why they succumbed to the idea ATProto must handle private
The answer is very simple, the people demand it.
Technically, or if you squint the right way, it is a new protocol (atp://) that shares some parts with the public side. Notably the relay is out (for now?) and the data lives in a different sqlite table (iirc/aiui).
If the primary user concern is "all data is public", then the utility of ATProto is extremely narrow and will likely lose to something with a different philosophy.
The main need is strong authentication, certainly for enabling P2P microblogging type apps.
The privacy stuff is covered by Signal etc. anyway, and you could layer that on top if you wanted to, but in a P2P setup privacy is always going to be a bit disappointing as so much metadata is inevitably exposed unless you do crazy stuff like flood fill the network with every message without regard to routing.
The definition of privacy is a spectrum, with what you describe at the most information secops end. Most people are not so worried about metadata leakage (they don't even know what it is, similar to atproto for most bluesky users).
What most want is to not be reposted and ratio'd by terminally online people like Blue MAGA did on Bluesky. They also just want to post to their followers or friends, not the world.
So in your concept if you are A and have two folowers B and C that don't know each other but both comment on your post what should happen? Should you see both but they not see each other?
This is the tip of the iceberg of boring questions that fall out, all of which have annoying user experience implications which are intimately tied to the underlying infrastructure and cryptosystems, effectively setting them in stone. There are reasons these systems fall into the camps of either federated with strong ID or really very centralized.
A core principle of ATProto is that the cost of switching is low, thereby facilitating real competition on social media. So the answer is two parts
1. App views decide permission parameters for their modality and frame the user experience
2. Users use these permission parameters to dial in their personal experience
I believe there is more middle ground than you leave space for. See systems like ReBAC/Zanzibar, Anonymous Credentials, and UCANN. Google Workspace is a good model that many many people understand and are happy with (IAM wise).
With a design like this, you can build an enforceable world-read, mutual-following-write version of Bluesky, something users ask for every time Bluesky announces any new feature.
ATProto and its advocates increasingly sound like all the crypto-based decentralized platforms that failed. The difference is that crypto people actually had reasons to run nodes, they got paid to, while ATProto expects enthusiasts to do so for the love of the game or act like bluesky and have 99% of the "decentralized" platform on a centralized node.
It never catches on with application developers because it requires you to already worship the protocol and build around it.
> the resulting design looks very hard to build on
> Private and public data are basically identical. ... The permission is world-read
Way back before Bluesky decided on their own what permissioned data would look like, when the Atmosphere Private Data WG still thought they had a say in the design, I gave a talk on a ReBAC/Zanzibar style system that aligns with what I think the author is looking for.
I suppose we could still build on and run a fork like mine if enough people wanted a more robust IAM system. There are some fundamental issues that I am not sure are resolvable without building them into the protocol core from the start. I have personally given up because of the leadership and am waiting/pondering the next protocol. Another design constraint I'd like to see is incentivizing apps to be federated and installable at the PDS as well as incentivizing small social over public square modalities.
My statement is not super constructive, but yes, I also really liked this article. Local-first, privacy, even the example of managing personal restaurant reviews.
I don't have enough meaningful thoughts here to contribute, but you & OP: I hope we can build a federated protocol for sharing stuff again.
btw, for historical context, the reason it is called "permissioned" instead of "private" is because there were sufficient people in the atmo that were very opinionated the E2EE is the only true private. It became an exercise in bikeshedding every time "private data" came up.
What's even the point of publishing anything online any more if you don't hope to become an influencer? The nature of the game has changed, and now does everything possible to discourage it.
Luke's feedback on the permissioned data proposal is pretty interesting. The current proposal has a kind of locational element to permissions, where a record's URI reflects the access control, and I can understand why that would be jarring. I'm talking with the team about whether we think that's something that could change, and what a change like that would cost. We're still in the collecting feedback phase so it's good to hear how it hits people.
Regarding his other concern, I would've loved to make atproto a localfirst protocol -- that's the field the atproto team came from -- but we had to pick & choose where to spend our complexity budget. I wouldn't say it's a nonstarter for the ecosystem; you can use something like iroh in conjuction with atproto to share identities -- dial people at their dids or domain names -- and then commit state to the atproto repo once it's ready to leave your local sync mesh. Maybe that sort of thing makes its way into future versions of the protocol. But, engineering often involves trades, and for the v1 that was one of the trades we had to make.
I've been building a board game community on ATProto. The idea revolves in trying to build the feeling of local clubs but online, instead of "PLAY NOW" being on the landing page (although you can play now if you want) it's organized around clubs. I also wanted to move away from one game oriented community. I play Go and Chess and I would love clubs to be for mixed games. You can create leagues, or tournaments, etc.
As an extension of that I've been building a small language to build games (with a nice time traveling debugger and automatic replays) inspired by Elm. Go and Chess are both built on top of this and you could fork them and modify the rules. Want to code a new Chess variant? Go ahead! Want to code a whole new game you want to try? Go ahead!
What I'm very excited with ATProto is that because all games are broadcast on it and each shares a core system of turn-based replays (and review system with branching) software can be built on top to do AI analysis, or a replay view. The idea that my application can be extended without me adding an API is very exciting and very much in the direction I want to take the system (community is the core tenet).
How do you prevent a player from manipulating game state outside of the app view?
There is a subgroup in the Atmo working on games, have you found them yet?
Reading articles like this one, I do think people are trying to put a square peg (their applications) through a round hole (ATProto). The ATProto was designed around all data being public. You write public data to a user's PDS and then any application can read that public data and do something with it. If all data was private (encrypted?) by default then that would defeat half of all of ATProto's goals.
Imagine someone starts startup A on-top of the ATProto. They raise some money, get some users, some people love it, but ultimately they die. If the data was private to that service, that data dies with the startup. But if the data is all public future startup B can read that old data and do something with it. As a user that's brings me a ton of utility and comfort trying out new services.
If you're trying to built a local-first, mostly private service I just don't think the ATProto is the right tool for the job.
> If you're trying to built a local-first, mostly private service I just don't think the ATProto is the right tool for the job.
I agree! I think the "permissioned data" working group is aiming to solve the middle ground – where you want to broadcast something "publicly" but to a specific audience instead of the whole world (e.g. invite-only event, membership club). It's "private" in the sense it's not open to all but not in the sense that only you can see the data.
Nick Gerakines has been sharing some good examples of what you could build using permissioned data:
- Private Events: https://ngerakines.leaflet.pub/3mqxalpvn4k2e
- Bookmarks: https://ngerakines.leaflet.pub/3mqu653us3k2p
- Community content: https://ngerakines.leaflet.pub/3mqzsstcsok25
- Forums: https://ngerakines.leaflet.pub/3mr3uqjjaxs2d
- Polls: https://ngerakines.leaflet.pub/3mr3waxevjc24
atproto permissioned data [1] will solve the dilemma you're describing. Ultimately all the data is in the same place (your PDS) and you can always read and write any data there. If startup A goes away, startup B can read that old data and do something useful with it.
[1] https://github.com/bluesky-social/proposals/blob/main/0016-p...
> If all data was private (encrypted?) by default then that would defeat half of all of ATProto's goals.
Yeah, this is the reason why I don't understand why they succumbed to the idea ATProto must handle private and has started on work trying to figure it out (https://atproto.wiki/en/working-groups/private-data). Instead, focus on just really great public data archiving and displaying, at scale.
> I don't understand why they succumbed to the idea ATProto must handle private
The answer is very simple, the people demand it.
Technically, or if you squint the right way, it is a new protocol (atp://) that shares some parts with the public side. Notably the relay is out (for now?) and the data lives in a different sqlite table (iirc/aiui).
Yeah, running a social website where you can't write anything in private to just your friends is not very based.
If the primary user concern is "all data is public", then the utility of ATProto is extremely narrow and will likely lose to something with a different philosophy.
That is about to change very, very soon though: https://dholms.leaflet.pub
> The ATProto was designed around all data being public.
I might turn this around to say that ATProto was the square peg trying to fit into the round hole (the vast majority of people want privacy)
The main need is strong authentication, certainly for enabling P2P microblogging type apps.
The privacy stuff is covered by Signal etc. anyway, and you could layer that on top if you wanted to, but in a P2P setup privacy is always going to be a bit disappointing as so much metadata is inevitably exposed unless you do crazy stuff like flood fill the network with every message without regard to routing.
The definition of privacy is a spectrum, with what you describe at the most information secops end. Most people are not so worried about metadata leakage (they don't even know what it is, similar to atproto for most bluesky users).
What most want is to not be reposted and ratio'd by terminally online people like Blue MAGA did on Bluesky. They also just want to post to their followers or friends, not the world.
So in your concept if you are A and have two folowers B and C that don't know each other but both comment on your post what should happen? Should you see both but they not see each other?
This is the tip of the iceberg of boring questions that fall out, all of which have annoying user experience implications which are intimately tied to the underlying infrastructure and cryptosystems, effectively setting them in stone. There are reasons these systems fall into the camps of either federated with strong ID or really very centralized.
> what should happen?
A core principle of ATProto is that the cost of switching is low, thereby facilitating real competition on social media. So the answer is two parts
1. App views decide permission parameters for their modality and frame the user experience
2. Users use these permission parameters to dial in their personal experience
I believe there is more middle ground than you leave space for. See systems like ReBAC/Zanzibar, Anonymous Credentials, and UCANN. Google Workspace is a good model that many many people understand and are happy with (IAM wise).
With a design like this, you can build an enforceable world-read, mutual-following-write version of Bluesky, something users ask for every time Bluesky announces any new feature.
ATProto and its advocates increasingly sound like all the crypto-based decentralized platforms that failed. The difference is that crypto people actually had reasons to run nodes, they got paid to, while ATProto expects enthusiasts to do so for the love of the game or act like bluesky and have 99% of the "decentralized" platform on a centralized node.
It never catches on with application developers because it requires you to already worship the protocol and build around it.
I don't think anyone ever got paid to "run nodes".
I think what they're talking about is like how bitcoin miners get paid in bitcoin for mining
We don't even get paid to be in this cult, that's how organic it is
The intention is good. I like the reviews idea. Since the author has hit the limitations of ATProto, could ActivityPub be an answer?
I switched from codeberg to tangled, and the transition couldn't have been smoother. Being on the ATmosphere really helps with peace of mind.
This author speaks to me!
> it should just be called “private data”
> the resulting design looks very hard to build on
> Private and public data are basically identical. ... The permission is world-read
Way back before Bluesky decided on their own what permissioned data would look like, when the Atmosphere Private Data WG still thought they had a say in the design, I gave a talk on a ReBAC/Zanzibar style system that aligns with what I think the author is looking for.
https://www.youtube.com/watch?v=oYKA85oZc8U&t=3730s
I suppose we could still build on and run a fork like mine if enough people wanted a more robust IAM system. There are some fundamental issues that I am not sure are resolvable without building them into the protocol core from the start. I have personally given up because of the leadership and am waiting/pondering the next protocol. Another design constraint I'd like to see is incentivizing apps to be federated and installable at the PDS as well as incentivizing small social over public square modalities.
https://github.com/verdverm/atproto
My statement is not super constructive, but yes, I also really liked this article. Local-first, privacy, even the example of managing personal restaurant reviews.
I don't have enough meaningful thoughts here to contribute, but you & OP: I hope we can build a federated protocol for sharing stuff again.
btw, for historical context, the reason it is called "permissioned" instead of "private" is because there were sufficient people in the atmo that were very opinionated the E2EE is the only true private. It became an exercise in bikeshedding every time "private data" came up.
You can find the discussions here: https://discourse.atmosphere.community/tag/private-data/2
What's even the point of publishing anything online any more if you don't hope to become an influencer? The nature of the game has changed, and now does everything possible to discourage it.