Appreciated Daniel reaching out to the team about this! Hosting blobs is one of those things that will inevitably go through iterations as we understand the abuse vectors more and more, but for now it's really fun to see this kind of usage in action. The PDS is meant to be a database host in the same sense that a webserver is a website host.

I was curious as to the security context this runs in:

    curl -i 'https://porcini.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:j22nebhg6aek3kt2mex5ng7e&cid=bafkreic5fmelmhqoqxfjz2siw5ey43ixwlzg5gvv2pkkz7o25ikepv4zeq'

    x-powered-by: Express
    access-control-allow-origin: *
    cache-control: private
    vary: Authorization, Accept-Encoding
    ratelimit-limit: 3000
    ratelimit-remaining: 2998
    ratelimit-reset: 1732482126
    ratelimit-policy: 3000;w=300
    content-length: 268
    x-content-type-options: nosniff
    content-security-policy: default-src 'none'; sandbox
    content-type: text/html; charset=utf-8
    date: Sun, 24 Nov 2024 20:57:24 GMT
    strict-transport-security: max-age=63072000

"access-control-allow-origin: *" is interesting - it means you can access content hosted in this way using fetch() from JavaScript on any web page on any other domain.

"content-security-policy: default-src 'none'; sandbox" is very restrictive (which is good) - content hosted here won't be able to load additional scripts or images, and the sandbox tag means it can't run JavaScript either: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

There should really be a name for this phenomenon; put basically anything on the internet, and sooner or later people will try to host arbitrary files on it.

I'm very hopeful for the possibility of using bluesky for blob data.

A friend and I had considered looking into storing DOOM WADs on bluesky so that "map packs" could be shared in the same way posts are. Follow an account, a list, or a starter pack, and you could theoretically modify GZDoom or some other client to know how to search and view any WADs posted by those accounts. Like how the Steam Workshop works, except it's via bluesky. :D

One of the points that is made is that since the PDS that's being interacted with here is part of a 'Personal Data Server' rather than the Bluesky product, it ends up able to offer infinite free data storage.

This seems like one of the things that might be part of the references the bluesky team has made at time to introducing a subscription service - providing more space / bandwidth / higher quality video on your PDS seems like the type of hosting that could be offered at a premium tier.

“Hosting websites” has been possible on nostr for some time already with npub.pro …

If this sort of thing interests you, check out atfile: https://github.com/electricduck/atfile

Could some awesome person possibly summarise any limitations or use cases where this might not work well?

The example provided is quite basic static text, so I'm wondering if there's a reason for that?

The CSP headers didn't used to be there, which I used to pop an alert(), way back. (at the time there was also a MIME whitelist, but that whitelist included image/svg+xml, which allows script execution)

Anyone else feels like this will be abused for phishing and/or malware distribution?

Ah this is super cool! I’ve been thinking about doing this with my website, but was going to leverage the whtwind lexicon, since my site is mostly a blog. But for the front page, and anything else, I may have wanted something else.

This is more of an unstructured approach, which is cool because it needs less specialized tooling. It has the disadvantage of being… well, just a blob. No semantic information there.

I'm wondering whether a third-party PDS implementation should support other protocols as well. Would a combined git/PDS repo make any sense at all? (That is, it's a PDS, but it also implements enough of git to do read-only access via git commands.)

What other protocols would make sense?

https://github.com/anacrolix/btlink

What's the license for the Bluesky data btw? Is it something free to mirror and train LLMs on?

I think the AT protocol is versatile in that users can acces each others data once authenticated without any centralized service (granted the aggregators and some other things may still be centralized).

Pretty awesome! Convenience link to the fascinating github issue linked at the bottom, featuring Bluesky celebrity pfrazee: https://github.com/bluesky-social/atproto/issues/523

I have a lot of hope for AT. I'm sure there's lots of smart people on HN that have done great things with the Fediverse, but this whole paradigm just seems more sustainable + realistic. Basically it gives us centralization by default, but with real decentralized support when you need it / for power users.

Whenever I hear about Bluesky I think about Jack Dorsey quitting their board and asked people to stay on Twittet/X.

https://amp.theguardian.com/technology/article/2024/may/07/j...

unrelated probably, but it made me realize how I don't really see Hugo/Jekyll type websites anymore.

https://bsky.app/profile/leocomerford.bsky.social/post/3l7v6... To help the hard of clicking, this time I have pasted it all for you:

Leo R. Comerford ‪@leocomerford.bsky.social‬

Why was it decided not to build on any existing content-addressable networking system (IPFS or whatever)?

November 1, 2024 at 12:39 PM

‪Leo R. Comerford‬ ‪@leocomerford.bsky.social‬ · 23d

(Not implying that this was the wrong decision, it’s a genuine question.)

‪dan‬ ‪@danabra.mov‬ · 23d

actually not sure i can answer this well. paging @bnewbold.net or maybe @why.bsky.team (who worked on IPFS btw)

‪dan‬ ‪@danabra.mov‬ · 23d

my guess is that we’d want data hosting to be under direct control of the user (same as web hosting) rather than peer-to-peer, want instant deletion/edits at the source, need ability to move to a different host or take content down, need grouping into collections. not sure how much IPFS could adapt

‪dan‬ ‪@danabra.mov‬ · 23d

we do use some pieces from IPFS through (aside from the actual peer to peer mechanism) ‪bryan newbold‬ ‪@bnewbold.net‬ · 4mo

you can basically ignore it, we don't use "IPFS" proper anywhere.

there are strong social connections, and we borrow some tech components like CIDs (flexible hash/digest syntax) and DAG-CBOR (more-deterministic subset of CBOR, good for signing+hashing) ‪

Bumblefudge‬ ‪@bumblefudge.com‬ · 1d

yeah this is all accurate. bluesky remixed a lot of IPFS components and patterns in interesting ways, but the monolithic global IPFS network (with chatty DHT distribution) wouldn't make sense here, BS made an infinitely more efficient/performant distribution of bytes tailored to its use case. ‪

Bumblefudge‬ ‪@bumblefudge.com‬ · 1d

FWIW the IPFS foundation is working on making IPFS more modular and easily remixed for future BlueSkies, but it's a big task decomposing the monolith and reorienting the documentation and ergonomics...

[a second reply to the first skeet:]

‪Uai‬ ‪@why.bsky.team‬ · 23d

As far as im concerned (and i led ipfs development for a number of years) we are using ipfs, just a specific streamlined implementation of it. All your repo data can be imported into an ipfs node and addressed via cid ‪

Uai‬ ‪@why.bsky.team‬ · 23d

We dont use libp2p because for a consumer mobile app we didnt want to futz with nat traversal and connectivity and the like, but its definitely possible to build a p2p version of bluesky