A new form of verification on Bluesky
bsky.social
bsky.social
On a technical level, this sort of works like a Root CA: anyone can verify anyone by publishing a `app.bsky.graph.verification` record to their PDS. Bluesky then chooses to turn those from trusted accounts into the blue check, similar to browsers bundling root CAs into the browser.
* https://pdsls.dev/at://did:plc:z72i7hdynmk6r22z27h6tvur/app.... <- bluesky verifying me. it's coming from at://bsky.app, and therefore, blue check
* https://pdsls.dev/at://did:plc:3danwc67lo7obz2fmdg6jxcr/app.... <- me verifiying people I know. it's coming from at://steveklabnik.com, and therefore, no blue check.
I am not 100% sure how I feel about this feature overall, but it is something that a lot of users are clamoring for, and I'm glad it's at least "on-protcol" instead of tacked on the side somehow. We'll see how it goes.
Verification should always have been "This is who they say they are", not an endorsement.
The "algorithm" boosting tweets from verified accounts also showed it was an endorsement rather than verification.
When people lost verification for being distasteful, it reinforced the blue checkmark as being an endorsement.
The takeover sold-out the "value" build up from blue checkmarks by just straight up selling them. It explicitly made the platform "Pay for reach".
Why? Accounts can be sold/hacked, and there is a lot of that on social media. A verified account may even be a higher value target for some of the reasons you're bringing up, like algorithm boosts, verifications being considered an endorsement. In either case, unverification not only makes sense, but should be expected.
I'm talking about people, who are still verifiably the same people, becoming unverified.
Yes, where accounts have changed hands, or changed identity, they should be unverified.
That's actually one of the cases where twitter did not un-verify. Accounts "earned" the blue-check then changed identity to something else, appearing "verified" as that new identity.
Such things could be ripe for abuse. Although to be fair a social media platform might be able to push some of the blame onto the corporate registries.
Even trademarks only cover a company's particular domain. See the long history of Apple Corps vs Apple Computers
https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer
In my view this is how verification ought to work:
- A user writes a bio / about field
- A trust provider verifies that bio is factual
- Any change to that bio will cause their bio to become unverified until it can be re-verified. ( The bio change can be held back until verification can complete. )
- An appeals process exists
How "trust providers" are established without leading to excess centralisation is a difficult problem. This is especially true given that like moderation, it's an expensive thing to do.
There is the possibility of trust-chains such as the way Lobsters works, but there's a exposed to the masses I suspect that people just mass-verify everything without any checking.
In reality you'd be left with one or two central pillars that people trust, and everything else which people don't.
There's also the danger that too much verification leaves new users in the cold. If 90% of genuine users are "verified", then a brand new user doesn't have much chance of making it through filters to become known enough to hope for verification, and will find themselves ignored and effectively locked out. ( This is already the case for some platforms where you're effectively required to give your phone number else end up in the "probably a bot" pile and de-facto shadow-banned. )
In short: originally the purpose was nothing more "this account belongs to the person they claim to be and we've directly verified this with them". Unfortunately, people habitually misinterpreted the checkmark as not just being verification but also a tacit endorsement of the account by Twitter the company. Which isn't great when you get a high profile controversial event and it's lead organizer has a verified Twitter account.
After that, they appended an "in good standing" qualifier, and it quickly devolved into a "you know a person who knows a person who knows a person" situation since they also announced a public pause of the program. (Notably, the ID check, while it existed, was pretty much abandoned. Twitter at some point began demanding ID scans to report things to their support, but that obviously never actually translated to a blue check.)
Musk's version of it is hilariously simplistic, but also robs it of any and all value: just pay money for it and you'll get it. It works in the sense that it confirms the poster has a bank account (although this probably doesn't confirm much in and of itself), but any and all value of said verification is minimal because any old hack/scammer can do that.
Verification is a difficult system to get right and people have all sorts of pre-baked in ideas on how it should work versus how it actually works and the use of a checkmark played a part into how Twitters version was perceived over the years. (As well as Twitters own unreliability in being consistent about what it means.)
[0]: https://blog.giovanh.com/blog/2022/11/01/the-failure-of-acco...
Oh you could also pay Twitter employees $20K under the table to be verified too.
Before that it was: "Someone will give you the checkmark if they like what you say enough and/or if you are deemed 'popular enough' according to an obscure committee; likely a combination of both. But there is a certain threshold above which it does not matter what you way, and you will always be verified". You could loose your checkmark on the whim of some dude who got his latte order wrong in the morning. No one was ever given the rulebook. In fact there was no rulebook. Checkmark just meant "I went to a bar with a Twitter employee and we agreed on a lot of things".
The same thing will happen to Bluesky. The system is akin to how CA and SSL does work with a critical difference. To get an SSL certificate, there is a clear step-by-step guide on how to get it. And after it has been granted it isn't revoked regardless of wether DigiCert agrees with the content of your website.
except then he was also randomly giving out checkmarks to people who didn't want them and specifically told him to remove them
If I want to hear what a journalist has to say, I would go to their official website like NYT or Tagesspeigel and read it there. Should we be interested in what Kim Sang yun or Sebastian Mustermann has said few minutes ago?
The problem of spam and impersonation goes way beyond Blue Checks.
You are borderline arguing that information is bad (because that's all a verification is).
Your words not mine.
I questioned why sites like X or BlueSky or Reddit can be sole in charge of who is "verified" and Real™. We can listen to what the Journalists, UN officials etc have to say on their own media websites, right?
Too much news is bad for us anyway [1]
Are they the sole arbitrator if they simply use a DNS record?
That's the same tech used to verify their official website.
I hear you. I haven't investigated every account that got the badge, but it feels to me like they picked people who are both technical and engaged with the protocol, so not entirely arbitrary. That naturally will have some correlation with "I know someone at bsky". I know I've seen accounts that I think are cooler than I am who didn't get verified yet! I'm sure they'll be expanding soon, which will dilute this sort of association.
The concept of verification and Bluesky's original mission of decentralization are two very at-odds concepts, and I think they've bridged that pretty well and left a lot of options for themselves to expand it in the future. I'm just worried about the very visible parallels to the Twitter ecosystem emerging.
My opinions on this will change if I join the verified elite, in case any bsky employees are in the thread.
Not necessarily. Consider the PGP Web-of-Trust model. Centralization of trust is choice, nothing inherent in verification as such.
Hilariously, it's kind of less centralized than I expected: there's no "Bluesky is the web of the root of trust" here, only "Bluesky chooses which records convert to UI" which leaves the whole system open for others.
It would be better to lean into BlueSky's feature set than to mimic Twitter.
The blue check on your account doesn't tell me what about the account has been verified. It probably means you're the Steve Klabnik that shows up a bunch of places in a web search, but that would mean much less if someone else also had that name and a web presence.
Your verified domain name tells me much more, but I recognize that's not the right verification approach for everyone. What I think would be more meaningful is labels like "@rust-lang.org says @steveklabnik.com is a Rust core developer" or perhaps a label with some metadata given special treatment in the UI showing mutual affiliation, e.g. "@rust-lang.org and @steveklabnik.com say they're affiliated with each other".
Edit - a further refinement: instead of verificatiions, allow accounts to feature labels placed on them by others for special treatment in the UI.
It’s true that it’s not generally exposed yet. We’ll see if they do. I think that would be neat but I also am unsure if that’s what non-power users truly want.
You don't trust the NYT to verify its own reporters?
Also, why do you say that in any circumstance? Who do you trust?
What happens when those individuals stop being NYT reporters? Does @nytimes.com leave them verified? Or does that account yank the verification? And who's to say @nytimes.com is only verifying NYT reporters?
> Also, why do you say that in any circumstance? Who do you trust?
People I've met in person, for one. Bluesky has an opportunity to make the old-school web-of-trust idea mainstream, with UI around "Is this someone you've met face-to-face?" and then extending that with multiple levels of checkmarks based on how many degrees of separation exist between a given user's verified personhood and your own.
Organizations actually accountable to the general public, for another. Not some corporation, even if it's a publicly-traded one like the NYT. This is the exact sort of thing that government agencies could be implementing independently as a service to their residents (like I mentioned elsewhere). Or private-sector non-profits; Associated Press would be much more trustworthy than the NYT by that virtue alone, and yet @apnews.com ain't even verified at all, let alone given the magic "trusted verifier" powers. Why?
Barring that, I trust nobody. A blue checkmark doesn't convince me someone's "real". It just convinces me someone got a blue checkmark. I'd rather see that checkmark actually mean something that I can independently verify. Keybase had the right idea there, with the ability to add proofs to your various online accounts to assert "yes, these belong to the same person"; that would be something worthy of some checkmarks. I'd be thrilled to see little icons for "yes, there's a bidirectional connection between @foo.bsky.social and github.com/foo / reddit.com/u/foo / news.ycombinator.com/user?id=foo / etc.".
I’m on Bsky as well but haven’t seen any such updates.
I think this makes sense, because 1. most people want this sort of feature for news and 2. the kinds of people they verified technically are likely to play around with it and see how sound it is, which is who I'd want to be kicking the tires.
I'm not sure when they'll verify more people, but this is only the beginning, for sure.
How is this compatible with Bluesky's internal cultural vision of "The company is a future adversary"[1][2][3]? With Twitter, we've seen what happens with the bluecheck feature when there's a corporate power struggle.
[1]: https://news.ycombinator.com/item?id=35012757 [2]: https://bsky.app/profile/pfrazee.com/post/3jypidwokmu2m [3]: https://www.newyorker.com/magazine/2025/04/14/blueskys-quest...
The problem with Twitter (before the whole blue check system was gutted into meaninglessness) was that not enough verification badges were handed out. It's not exactly a dangerous situation.
Bluesky's idea of verified orgs granting verification badges to its own org members would be an example of a much more robust and hands off system than what Twitter had.
The dangerous scenario is what happened to Twitter after the Elon takeover: verification becomes meaningless overnight while users still give the same gravity to verification badges which causes a huge impersonation problem. But that possibility is not a reason to have zero verification.
What twitter starting doing was removing blue checks from people who were causing problems for the platform (but not behaving bad enough to kick off). This made no sense because people still needed to know if a person was who he claimed to be (e.g., Milo Yiannopoulos) even if the person was controversial or problematic or just plain nasty.
Blue Checks weren't "gutted". Now they just mean something else -- you're a premium subscriber.
The correct way to have rolled that out would have been a brand new icon, but they wanted to cash in on the reputation of the old system. "Now you can pay for this once-coveted badge!"
Now, how those are displayed is up to the display software. BlueSky themselves get to decide who gets a blue check based on verification records, but if you wrote your own software, you could do whatever you'd like. There's a bsky fork that already has an account option to let you hide blue checks in your own view.
Mind you, just because anyone can create a verification record doesn't mean that the default client shows them.
> Why do we need these “Blue Checks”?
Normie users care about this sort of feature.
That’s a really weak argument because normie users want TikTokified social media with a clout based caste system. I thought BlueSky had a different goal in mind.
They don't, but the original Twitter Bluecheck elites who ran to Bluesky really do
Any client can do whatever they want with the information, that's right.
> or even use a public list of such revocations.
Revocation is deletion, so it's hard to enumerate revocations.
In decentralized design it is not. A server can continue to list verified accounts, a 3rd party revocation list may mention some of them, a client will show only accounts not in the list as verified.
The WoT model works but as GPG has shown it requires your end users (people? BlueSky client developers?) to manage who they trust as an authority on anything.
What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still.
And why not move into a system like multiparty keys? Keys assigned by domain holder, need to be signed, and verified accounts must login with a private key that validates. That way you don't just get that the account is validated but the post is too. Yeah, this would require more technical expertise to do but the organizations we're usually most concerned about would have no problem with that. Besides, tooling gets easier when there's meaningful pushes to make it available to general audiences
> What was the problem with the current DNS system? I definitely think there could be improvements like displaying domain instead of TLD but still.
As commenters earlier in this thread have noted, one property BlueSky claims it wants to develop/maintain is resistance against BlueSky itself becoming an adversarial party--say in the event it is bought out by an eccentric multi-billionaire who may take steps to discredit certain parties or reduce their reach or reputation.
I don't think the current DNS verification methodology helps or hurts in a BlueSky is hostile scenario. I think the only issues with the current DNS username verification system as I understand it are the same issues with any DNS based verification system in that vanilla DNS was not a protocol designed to be resistant to adversarial use and as a result there are many ways for people to tamper with DNS records, DNS queries, and confuse systems that incorrectly trust DNS records to be trustworthy or well-formed. DNS cache poisoning is a thing. Domain takeovers have and will continue to happen.
Now, if we're talking about what technologies are suitable for username verification in a word where BlueSky is adversarial, we have a very different conversation. I think the scope of such a scenario extends a lot further than usernames. If your primary interface into the AT Protocol feed is the BlueSky website or the official BlueSky application, you are trusting BlueSky to validate usernames. An adversarial BlueSky could easily decide if your interface marks someone as trusted or untrusted without your knowledge.
The only way I could think to avoid this would be to use a different interface to the global feed, but then you run into new problems that are more difficult to avoid: the fact that most BlueSky users don't host their own data (though this is doable with https://atproto.com/guides/self-hosting). BlueSky also manages the global feed, so barring a competitive global index, you'll still be consuming a feed curated by BlueSky's AT Protocol services and implementation.
I'd close this by saying I am _not_ an expert in the AT Protocol, BlueSky's systems, or this space in general. This is a very fast and loose risk assessment I made after reviewing the AT Protocol and a bit of research on how BlueSky says it provides it's services. My current assessment is that if the community wants to be robust against BlueSky becoming adversarial, there needs to be a lot more support for self-hosting of PSPs and similar data stores, alternative global indexes, and likely also independent governance of the AT Protocol itself.
Were you given the ability to make a trustless or more decentralized system is there some route you would pursue? Maybe ignoring the AT protocol so I (and others?) can get a better sense of how such systems might be employed to ensure that an arbitrary organization can build defenses against themselves becoming adversaries (seems like a fairly useful mindset in general).
> For example, the New York Times can now issue blue checks to its journalists directly in the app. Bluesky’s moderation team reviews each verification to ensure authenticity.
Meanwhile every mastodon discussion required (requires?) someone who deeply understands the system to spend "10 comments deep" energy just to arrive at a much less amenable position.
Signed, a person who was that someone.
EDIT: so does bksy.app, actually.
https://techcrunch.com/2017/11/15/twitter-removes-verified-c...
Not pictured: innumerable other accounts which were never granted a blue check in the first place, despite being the easily verifiable real accounts of journalists and public figures.
It was de facto a caste system of political favor and connections.
No matter how prominent someone might be on this side of the Atlantic, it never mattered, meanwhile mid-managers and coders at no-name startups had blue checks because, I mean, they knew someone at Twitter- and who else is verifying people? I don’t really fault them for verifying people they personally knew.
But it meant that you had a situation where (and no offence meant to them) “nobodies” (as in, non-promenant figures) were “in the club” with heads of state, companies and heads of industry.
So there was a definite whiff of nepotism, because it was a de-facto status symbol.
When GP says "that’s not true though" I can't even tell which part he is talking about. This is fairly recent and well-documented stuff.
Unless you mean deterministically ultra-fascist.
If Bluesky becomes evil, you just configure your AppView not to trust their verifications.
Of course, that's the problem: right now we mostly have one AppView (bsky.app), which is the current SPOF in the mitigation plan against the "Bsky becomes the baddies" scenario.
We need a way to reflect that human "social trust" is born distributed, and centralising trust subverts it. But here, while they introduce third party verifiers, rather than individuals deciding which verifiers to trust, bsky is going to bless some. So this is just centralised trust with delegation.
With that in mind, it seems like bluesky is trying to thread the needle on providing tools for the community to do their own verification (via the protocol) while also making their own client "notable user" friendly (via blessed verifications that show blue checks).
I also don't see why it wouldn't be possible for someone to build a labeler that shows verifications from non-bluesky blessed sources. Then community members could subscribe to that labeler to get non-blessed verifications that they choose to show. It wouldn't show up as a blue check but it would still show up on the user's profile in bluesky.
It would look something like this existing "verification" labeler that doesn't use the underlying verification feature on the protocol but instead has to maintain the data in a 3rd party store: https://imgur.com/a/tXR4FUu
Additionally, third-party clients like Pinksky or Skylight could choose to show blue checks or whatever UI for any verifiers they choose. All the data is on the protocol now, so the 3rd party clients wouldn't need to do the verification themselves.
An automated version of this system might say "we verify anybody who at least N people within 3-4 steps of your followers graph are also following."
In a big city, you go to the store that's labeled "Butcher" and figure that, because the building is quite permanent and there's a lot of butchery stuff in there and it seems clean and there are people going in and out, then it's probably a fine butcher shop. No real "social" trust involved.
An automated version of this is probably domain checking, follower count, checking that N other 'verified' accounts follow it, some basic "is this a known malicious actor" checks, waiting until the account has some age, etc. Still kind of distributed, but not really relying on your own social trust metrics.
What's fun is that Bluesky allows you to implement both of those mechanisms yourself.
And what ever happened to Keybase? That seemed like a good solution. Verify by public private key? It really seems like that could be extended. I mean we have things like attribute keys and signing keys. It seems like a solvable solution but just the platforms need to create a means for the private bodies to integrate their keys.
Hell, I wish we'd have verification keys for cops and gov employees. So me a badge? No, show me a badge with a key I can scan and verify your identity. It's much harder to forge a badge with a valid key than it is to forge a badge that just looks good enough
Part of the problem here is consistent identity over time. People do not like changing their handles unless they want to. I'm steveklabnik.com now, but if I started working at the NYT, and had to switch to steveklabnik.nyt.com, old links break to my posts, etc. And what happens if I want to be verified by more than one org at a time? Domains (at present) can't do that.
> old links break to my posts
> People do not like changing their handles unless they want to
> what happens if I want to be verified by more than one org at a time?
Second off, I agree that this is a desirable thing to have. It is why I was suggesting something similar to keybase (keyoxide?) or attribute keys. It definitely seems like Bluesky is intending to do something similar to the attribute keys but there's some details lacking and seems like an existing verified user needs to vet an entity prior to their ability to distribute keys. I'd also be quite happy if there was a publicly visible ledger so one could see former verifications (it's all visible via the firehose anyways, right?).
[0] And there's the classic problem on typing "@" and then the person's name and not actually finding them because the search system is fucked up and is looking for the address handle. I've seen this on both sites, more frequently twitter, and even when typing the address handle directly. Apparently this is a harder problem than I'd have thought (particularly replying to someone in the thread...)
I went to one of my posts and clicked "copy link to post." that gives me an URL like this:
https://bsky.app/profile/steveklabnik.com/post/3lndppxy7xc2a
If I change my account to `steveklabniklol.com`, then this URL wouldn't work, as that url turns into
https://bsky.app/profile/steveklabniklol.com/post/3lndppxy7x...
See here for more: https://github.com/bluesky-social/social-app/issues/1221
> People are paying attention to the Display Handle and not the address one
I agree, and that's why people don't like changing it.
> it doesn't seem like Bluesky's implementation will do this
It does.
> I went to one of my posts
But regardless of what could be done, I'm just talking about what is the case right now. Which is that they break.
I think that doing this raises a lot of product questions, so I'm not shocked they haven't done it. But I'd like it if they would.
I do agree that multiple domain-based identities would be a nice feature though.
They got acquired by Zoom and promptly put Keybase into maintenance mode.
DNS for your average user is too complicated. Also what should the domain name be for a journalist at the NYT? What if they leave the NYT?
> DNS for your average user is too complicated.
In fact, I don't think I want most users verified. It then creates a reverse incentive where anonymous accounts are distrusted by default and too much trust is given to verification. An important part of a system with free speech and not governable (the point of distributed) is to be able to freely speak. Sometimes that means hiding your identity. Especially for those in countries or societies with particularly authoritarian rule. The best way to keep people quiet is to make them afraid of their neighbor.
> what should the domain name be for a journalist at the NYT?
> What if they leave the NYT?
Everyone has the bsky.social handle, so you revert. I'd even be happy if optional profiles could show former affiliations. But it doesn't seem like a big problem. I mean NYT shouldn't be verifying a journalist if that journalist is no longer at NYT. Their new employer should.
Keybase got acquired back in 2020 and it's popularity -- at least among cypherpunks, seems to have dropped off.
feels like identity + trust systems keep coming back around but never quite stick. maybe too hard to balance usability, decentralization, and adoption all at once.
There are some good ideas there (and Bluekey uses DIDs: https://atproto.com/specs/did)
Could use follows, retweets, etc instead of page links
The approach they've taken ("trusted verifiers") is an approach aligned with their values, as it is an extension of the labelling concept that is already well established in the ecosystem. As an idealist, it is a shame that they gave up, I think they could have had an impact on shifting how non-technical people view domain names and understand digital identity... but as a pragmatist, this is the right choice. Bluesky has to pick their battles, and this isn't a hill to die on.
[1] https://handles.net [2] https://news.ycombinator.com/item?id=42749786
That just leaves me wondering why they bothered with a new separate system instead of just using the existing label system. A "verified by bsky.social" or "verified by nyt.com" or whatever label would do the job perfectly well, no?
> they can apply on a per-post granularity as well as a per-account granularity
I might want my verification to apply on a per-post granularity. For example: if I'm speaking on behalf of my employer, then my post should reflect that, whereas my usual shitposting and pet projects probably should not reflect that. Currently the only solution there is to have entirely separate accounts (which might not be unreasonable even with post-level verification, but still).
I'm also left wondering about the temporal aspects of verification. My employer might verify me as one of their employees now, but not necessarily a year from now. Per-post verification would reflect that I was authorized to speak on my employer's behalf at the time I made posts to that effect, without retroactively implying that for posts I made before I worked for that employer, and without that verification needing revoked for those posts after I stop working for that employer.
This is all admittedly a long ways off from what Bluesky probably intends with its new verification feature, but I guess what I'm getting at is that if labels can already do per-account and per-post granularity then having a second kind of label that's only per-account and doesn't offer anything that normal labels can't already do doesn't seem all that valuable.
> you can lose your blue check if you change your handle or display name, but labels stay the same no matter what.
That seems reasonable (but IMO questionably necessary) for handle changes, but rather unreasonable for display name changes.
Sure, what I'm trying to describe is the various differences so we can speculate why they may have made the decisions that they did. "more flexibility is always better" is a valid choice, but it may not be theirs.
> That seems reasonable (but IMO questionably necessary) for handle changes, but rather unreasonable for display name changes.
I call this the "jaboukie problem," and it's effectively necessary for this kind of feature. Jaboukie Young-White is a comedian who, every time Twitter verified him, would change his account to impersonate another, and then make an inflammatory post "as them." The blue check lent legitimacy to this. It was hilarious, don't get me wrong, but it does undermine trust in the feature.
First of all, verification is about identity, not about on whose behalf you're speaking. These concepts are linked, ie if NYT verifies your identity, that might look like an endorsement. I feel like using verification to communicate information about endorsement is not a good idea. On social media, its significantly more important that if you say you're John Doe, that's who you are than it is for users to know if some org endorses your opinions. The extra effort/risk/friction to also communicate endorsements is not in balance with the extra value.
Besides this, its probably a good idea to keep your shitposting and spokespersoning to separate account
There's no UI to do it. It's not currently intended to be a generalized feature, but because the protocol is, it's forwards compatible with eventually doing that if they decide to.
I'm assuming the New York Times ain't hand-inserting records into their account's PDS, which means they probably have some kind of UI already in place. I also wouldn't be surprised if people already built their own third-party applications to this effect (sounds like deer.social already allows users to specify their own verifiers, and I'd be entirely unsurprised if they extend that to allowing users to verify each other directly, too - if they haven't already done so). Still, that hardly sounds less difficult than the current labeler situation.
They didn't really give up, though - the domain verification still stands and is just as powerful as ever.
All I’m saying is that if weak moderation has had a positive effect somewhere, it’s worth showcasing that. Otherwise the evidence is decisively in favor of strong moderation.
In terms of how to keep the moderation team from deteriorating, other platforms could learn a thing or two from HN: put someone competent in charge of the team, and give them lots of incentives to do well.
Well, the “wrong” politics are.
Don’t mistake banned for politics with getting downvoted because your arguments don’t hold up.
Because those conversations do end up happening elsewhere, this site is famous for leaving readers with a strongly false impression of what viewpoints are actually popular among whatever you would want to call this Silicon Valley hacker / VC scene space.
The highly insidious thing about censorship is not only you don't know what you're not seeing but you don't know you're not seeing it -- you don't know what's missing.
All research shows the opposite in fact. Adding friction to something causes a chilling effect in nearly any and all examples we have ever paid attention to. When you remove easy access to guns, people kill themselves less despite there being other easy ways to do so. When reddit banned a bunch of toxic communities, the entire site had less toxicity, even on subreddits that were unrelated to the toxic communities
Friction works. It works insanely effectively too.
Something like
bluesky user X is equivalent(has control)
to domain A(domain verification)
to youtube account B (youtube verification)
to mastodon account C (mastodon verification)
to D@nytimes.com (email verification)
The problem is that some domains would have no problem standing up this sort of verification. The Times only benefits from verifying it's employees. However I can see fellow social media sites balking as this equivalency weakens their walls that keep people in.
As someone who believes in equal access and privilege, this is just horrible. "Trusted Verifiers" - how does the bsky team decide which orgs can be trusted? One could argue that this is worse than Twitter. And of course, the echo chamber is going to get worse.
read again, slowly perhaps about first layer of verification.
Trusted flaggers literally need to publish transparency records and are approved by orgs in EU countries under elected governments.
If you say that is all bullshit and EU is a North Korea and North Korea is a shining example of democracy then you should probably remove your dig at DPRK's self naming;) Because your own comment measures non-democratic countries by the standard of democratic countries. if you want to be wrong be consistent at least
>EU is a North Korea and North Korea is a shining example of democracy
I've never said that.
You alluded to EU DSA being like non-democratic countries with "democratic republic" in their name. Yes I exaggerated your point.
there’s nothing surprising about this
Censorship is a negative frame when it also provides healthy platform moderation and safety.
I think even the default subs on Reddit are far less progressive than BlueSky.
It’s also interesting that your view of progressive might be different than mine. In this current age, I guess even advocates for DEI are considered too “progressive”. Which (in my opinion) relates more to a shift of right to far right, which shifts the balance, and people mistake it for what are really just centric viewpoints being “leftist”.
To me, BlueSky is the best current alternative to what Twitter originally was.
[1] https://www.npr.org/2024/10/22/nx-s1-5156184/elon-musk-trump... [2] https://www.nbcnews.com/tech/social-media/elon-musk-turned-x...
Do we have any surveys on this?
It seems to me that BlueSky is trying to rewind the clock and be the pre-Elon Twitter. They had a decent chance to become what Signal is to messaging, but looks like they are trying to be just another Social Media company.
We’re truly in the post-social media age.
https://www.turkishminute.com/2025/04/17/bluesky-restrict-ac...
They landed on country-specific moderation, which is all publicly accessible and documented, allowing countries to label specific posts/contents and have them hidden in the country. Again, this is only on the Bluesky client; other clients can ignore the 'hide' label if they choose.
This is an article that details it pretty well and links to a few tools that allow you to view everything hidden by any country moderation team: https://fediversereport.com/bluesky-censorship-and-country-b...
And then "soft forks" like https://deer.social/
Why would there be no 2FA options, like when using https://element.io for a homeserver?
They've recently added OAuth, but since it's pretty new, a lot of older projects haven't moved over yet.
2FA exists but only for emails right now, more to come. https://github.com/bluesky-social/social-app/issues/1071
Am I anti moderation? No, not really. But the attitude blue sky users have towards it feels very much like wanting to be validated for not liking twitter('s users) rather than a forum for adults who enjoy seeing content from people wildly unlike themselves, which is what drew me to twitter 15 years ago.
You won’t find real discussion on Twitter. It’s an attention market, and thus discussions are not incentivised at all. I found way more interesting “unlike me” thoughts in real life than on any social media in the past 7 years (and before that I was just lucky for a few years). It’s not that they don’t exist at all, but the cost of finding these is magnitudes higher nowadays on the internet than off from that. Also, who wants discussions left most of social media years ago. Most of the smarter people whom I followed left every platform as their usage became more costly. Not just Twitter.
You could say this about any forum on the internet, including this one. But the diversity of thought and interest here is quite small in comparison to twitter just by sheer numbers and the necessity of this forum circling the shared interest of VC culture.
Hey, I understand why people left twitter. I just don't see how bluesky improves on the actual culture of the site—the best posters never transitioned.
As it is also the personal mouthpiece (and semen receptacle) for the richest and most deoxygenated freak ever created by our species it represents an existential threat to the continuation of a livable planet.
So yeah I guess Bluesky users do have some "attitude" towards Twitter. It's a natural consequence of distancing yourself from abomination.
Is that a reference to something? Haven't heard that phrase before.
They've spent the past 4-8 years platforming writers to say absolute horseshit about trans people and equivocate between Biden having like 6 leftover classified documents in his house vs Trumps bathroom of for sale state secrets.
And the traditional media also seems to have a symbiotic relationship with Trump, whose chaos drives news ratings.
Put another way, a Bluesky post saying "BREAKING: Trump dies from natural causes" from an employed NYT journo carries a different salience than the same post from a random Bluesky user.
Or… you know… win a Pulitzer.
I think it's pretty hilarious that the Times, of all people, count as 'trusted'. It makes me automatically distrust BlueSky verification, which doesn't sound like the intention.
In practical terms, no, they are status markers.
Why? Who do you trust?
With that said, the Times is one of the better media orgs. But IMO they should very much not be trusted blindly.
My media diet is a blend of various sources: The Atlantic, The Economist, The Free Press, Reason, Semaphore, Politico, New Statesman, and Axios. Even the Drudge Report sometimes.
I wish I had more right-leaning sources to follow, but I often find their content inflammatory and rage-bait-ey (before anyone complains that liberal media does this too, yes, I agree. HuffPo and similar are cancer.)
> I wish I had more right-leaning sources to follow, but I often find their content inflammatory and rage-bait-ey
Agreed. I recommend David French, the NYT columnist; easily the best I've read.
News organizations have in recent years started selling so-called "contributor" positions. Anyone with enough money can be a journalist and influence public opinion. And NYT and similar outlets are not trustworthy sources either way, they sneak edit articles when they get caught spreading misinformation but regularly don't disclose what was actually changed. Basically rewriting their reporting as the narrative changes.
On a technical level, any account can "verify" any other account.
On a practical level, blue checks are shown only if that verification comes from someone BlueSky trusts. Right now, that's bsky.app and nytimes.com.
The only difference is that Bluesky won't show a blue check for just any verification, only ones from accounts they trust. That's a social relationship, not a technical one, and so I'm sure if the NYT decided to go rogue, Bluesky would have them not be an input into the blue check any more.
Which ones? I've heard of that with lower credibility organizations (Forbes, I think), but nothing like the NYT.
> they sneak edit articles when they get caught spreading misinformation but regularly don't disclose what was actually changed.
I think they correct things. I'm not sure they have ever been in the habit if notifying people of every correction, though it would be interestesting to have an edit history with diffs.
They describe it as a "blue check" when in fact it is a white check on a blue circular background.
Just nit-picking I guess but sometimes I read a passage that describes something and I conjure an image in my mind of what I would see should I open my eyes with it all laid out in front of me. This does not fit the image that is described in the post and makes we want to question the author's observational skills.
Trend.
I mean, what even are network effects!?
The web really was better with more pseudonyms. I don't care if you are you, I can read your text, judge it on it's merits (according to my yardstick) and I basically don't care if you or other people consume information that is true or false.
Am I missing something?
The ability to put fake blue checks on your website isn't the point.
Bluesky (and the web at large) is slowly becoming filled with spam and AI-generated content. Even if you're OK with more spam (not sure why you would be but you do you), why would you be OK with more content generated by non-humans (the vast majority of which attempts to pass as human)? This just makes it harder to find needles of authentic human content in a haystack of slop.
Various levels of verification make it easier to distinguish what's real from not real, for whatever definition of "real" you prefer. Without any such verification, the web just becomes a bigger wasteland.
Exactly! ;) Bullshit is still bullshit, whether it's under a real name or a pseudonym. Additionally, blue checks don't stop "real/verified" people from copy/pasting AI-generated content.
That's my point. ;)
Internet was intended to be anonymous.
It doesn't mean "this person is trustworthy" it means "this person is who they claim to be". But people desperately want it to be the former, or some sort of club.
But these are completely orthogonal concepts that demand different solutions.
Bluesky should do better here though, their definition of "verified" is buried in the blog post as "authentic and notable". This is okay I guess, sort of matches old Twitter. But a bit wishy-washy.
One idea could be to link verification badges to Wikipedia (or Wikidata) entities so you understand who is confirming what about the account. "This Mark Cuban Bluesky account is the same as the Mark Cuban in this Wikipedia article" and let the Wikipedia editors fight over noteworthiness etc.
If it's only for notable people, then it is a sort of club.
Maybe people trying to protect their "brand"? Is there really that much demand for branded content?
I’m a proponent of verification only for “important people”. Yes, the definition of important is funny, and people may feel slighted by it: but I’ve yet to find a system that helps me identify high quality sources so immediately on a social media platform.
The trouble with what platforms like Twitter did was by trying to stick to some definition of important, they took what should be a mundane "yep, this is the person it looks like" icon and made it into a status symbol that everyone wanted. Twitter had a hard time defining the boundaries: Shouldn't they verify their most influential users even if they're not real world celebrities or public figures? What happens if someone who is verified says something that they don't like? How do you prevent corruption when you give other organizations special privileges for verification?
For Twitter and Instagram verification, people were bribing employees and getting verification just because they joined an organization (like an eSports team or a news organization.) This was not a good status quo.
Bluesky is probably headed towards the same problem if they try to be the bearer of who's important. Obviously, you can't verify any Joe Schmoe, but honestly you can just set a reasonable threshold based on their status in the platform for as to whether or not they should be eligible to get verification. When you do stuff like say "You should be able to be verified because you work for NYT", that's just weird. Being a journalist doesn't magically make you important, or mean that your posts will be worthy of greater consideration, yet that's what you're setting people up for when you make verification into a big ordeal like this, and it's the reason why Twitter would unverify people for e.g. having an opinion too far outside the Overton window. And using in-platform metrics to determine eligibility seems reasonable anyways... If you have like 10 followers, your verification status is utterly meaningless anyways.
I think if they want to solve the problem for journalists they should've verified the organizations and then made this separate from verifying individuals. Then accounts under that domain could just have some sort of special badge. This especially makes sense because otherwise you could literally just have your personal account become verified by having a couple month stint at the NYT or something, which is non-sensical.
Bewildering to me that seemingly any move in the right direction for social media is criticized with even more venom. How exhausting it must be to be stuck in such a frame of mind.
Showing users that these ideas work is a win, it doesn't matter what Bluesky does in the future.
If I am verified by 2 parties each of whom is verified by 10 parties each of whom is verified by 1 party then my verification score would be 20 (= 2 x 10 x 1).
Then people could trust me beinhg me 20 x more than somebody who is only verified by one party who is only verified by one party who is not verified by anybody?
Not sure how big of a priority this is for the team that runs it, but I would probably use it 20x more if it was ran competently.
It's politics I can't avoid there, not pornography.
Granted, I'm probably part of the problem, since I do post (and repost) some political stuff every once in awhile, but still.
And even that is not a guarantee as it needs to be validated by the bluesky team, for which it helps, in their own words – to have connections with them.
Otherwise I could buy dozens of domains and spin up bots to churn out AI slop as "validated" accounts. I could buy linustorvalds.com for 25k and impersonate him.
It's still a two-tier system for clout-chasers. If you're cool enough, you get a "Officially Cool™" badge from the bsky team. If you're not, hope that a 3rd party provider decides to give you one. Or you're a second-grade netizen.
A high score usually indicates a trusted account. Check it out here: https://bluefacts.app/top
Trust is always going to be a game of cat and mouse, and this seems like just another move.
Is this not still a top-down system, just with one level of indirection?
Something not-top-down might look more like the web-of-trust model.
https://news.ycombinator.com/item?id=40298552#40298804
Delegation similar to bluesky's "NYT org issues certs to journalist" is also possible and done in a far more versatile manner.
If you have a domain and want the ability to issue certs to others, email me...this will just be for experimenting of course :)
Fine with this albeit very 'manual'...but not clear if any other choice. I do really like the domain username scheme and if anything this news just draws more attention to that because there's sooo many organizations/news outlets etc not taking advantage.
If these orgs don't have IT departments, then, well, pay me $20 and I'll do it for you.
Can a country I don't like verify it's president that I don't like neither?
Prime minister? Members of the Senate? All citizens? Their own bot farm?
haha
Before Twitter did any sort of verification it was not difficult to determine whether an account claiming to be someone was actually that person for anyone who was actually interested.
I suspect a lot of people have this delusional fantasy where “verification” is going to shape political discourse in their favor.
It was if you were a regular, non-technical user or not terminally on Twitter.
Can't be that hard to have this
After all, we already have an established and highly-monitored set of sibling "trust roots" — we call them Certificate Authorities.
And we already have an identity-validation system coupled onto X.509 FQDN-as-CN (i.e. TLS) certificates — certificate validation levels.
BlueSky could just:
1. require a domain username for verification;
2. require that the domain presents an Organization Validated (OV) cert for verification as a "public individual" (i.e. the kind with a "personal brand" — which usually implies "worth registering as an LLC");
3. require that the domain presents an Extended Validation (EV) cert for verification as a corporation.
...and the whole problem of identity validation becomes outsourced, and federated, and decentralized. (Federated because multiple sibling CAs; decentralized because every computer administrator gets to decide for themselves which CAs their machine should trust.)
---
A rebuttal might be that "EV certs can't be used for this, because EV certs are too expensive, take too long to get, and don't integrate well with automatic per-subdomain DV cert issuance via ACME."
But (IMHO) that's not a problem to be worked around; that's a problem to be fixed. Why leave a broken generalized web-of-trust infrastructure sitting there unused?
If an online casino can KYC/AML you in two minutes with a passport scan and a 3D camera photo, it shouldn't be impossible to do for OV+EV validation what we did for DV validation with ACME. (Ideally in such a way that you can do the interactive process once, receiving not a cert, but some kind of collateral; and then, later on, any ACME server should accept that collateral during an interactive domain ownership probe, to upgrade the DV cert it's issuing you into an OV/EV cert.)
---
The other neat thing about this approach is that, in a "fat" native BlueSky app (i.e. not just an Electron wrapper), the app wouldn't have to trust the BlueSky service to say who's verified. The app could TLS-validate each domain username itself, to compute the appropriate badge for that user — just as a web browser does when you visit a website. And it would presumably use your machine's OS TLS CA store for that validation, just as (some) browsers do.
2. I've been programming and hosting websites for a decade+ and I would have no idea where to start with any of the things that you propose they "just" require.
3. The OV requirement seems kind of hokey. There's no such thing as "worth registering as an LLC" — anything can be an LLC. You could have an LLC that just holds your dog's assets and call it Internal Revenue Service (LLC), assuming someone else hasn't already grabbed that name in your state, and that would be completely valid.
All of this would make it way too difficult to navigate verification for normal people, and I'm not convinced it would do anything to stop determinated bad actors.
That's because OV/EV certification are (currently) viewed/remembered mostly as "a bunch of bullshit that nobody sees the point in", and/or "a money-making scheme designed to allow big companies to throw money at the problem of looking 'more secure' than small companies, by showing up with a prettier lock icon/address bar state in web browsers" — ignoring the fundamental value provided by the design of the system, due to the pragmatics and politics of existing and previous (mostly previous) implementations of the design.
A site presenting an EV cert used to look like e.g. this in Firefox: https://upload.wikimedia.org/wikipedia/commons/6/63/Firefox_...
And this in IE/Edge: https://www.thesslstore.com/blog/wp-content/uploads/2010/06/...
Once browsers stopped visually differentiating sites signed by OV/EV certificates from sites signed by DV certificates with the big "green for go" coloration, corporations no longer had any motivation to get EV certificates, so everybody forgot they existed. This happened a decade+ ago.
(And then, in 2019, the last vestige of this distinction was removed, when EV certs stopped making browsers show the identified company name beside the lock icon: https://www.leaderssl.com/news/492-google-and-mozilla-will-s...).
Because of this, nobody today is really familiar with EV certs. But that doesn't mean they're hard or arcane; they're just obscure. And the process for getting one is clunky — but it used to be that the process for getting regular (DV) certs was clunky, too. The EV cert process just hasn't been updated with the times to match the ease of getting a DV cert, because nobody has cared to do so, because there's no demand.
But neither of those things mean that EV certs aren't fundamentally a good way to secure identity in a web of trust. Every code signing certificate is an EV cert, for example. And all cross-signed CA certs are EV certs. EV certs are still there, quietly underpinning much of X.509's security model, in TLS and elsewhere.
And as such, it's silly to recreate the EV validation ecosystem, but worse, for something (identity verification on BlueSky) that is pretty much exactly "the green address bar" use-case all over again — when we could instead just revive the dormant infrastructure that powered things the last time we cared about federated identity verification, and polish it up a bit for use in 2025.
> All of this would make it way too difficult to navigate verification for normal people
If they wanted, BlueSky could match what they're doing today by 1. setting up their own X.509 CA, and then 2. delegating the constrained ability to issue OV+EV certs to users from this CA, to named entities (like the NYT, as mentioned in the announcement.) Then you wouldn't have to do anything; everything could be handled on their end, with a BlueSky-CA-issued OV or EV cert just magically appearing bound to your BlueSky account.
(And they could — but wouldn't have to — get this CA into default trust stores of client devices. The BlueSky webapp backend would have the BlueSky CA explicitly in its trust store; as would any first-party native fat clients. Any third-party native fat clients would need to add the CA cert into the app and configure their HTTP client to use it. X.509 is not one global system; every X.509 root-of-trust creates its own tree-of-trust, which is only a web-of-trust insofar as multiple roots-of-trust can [but don't have to] cross-sign things.)
The point here is just that with X.509, big entities who BlueSky is unwilling to delegate identity-verification authority to, or who don't trust BlueSky — or, as BlueSky themselves say, the existing userbase at the point where BlueSky itself becomes adversarial to them — can step outside of this de-facto centralized trust model, by instead getting an different X.509 CA of choice to issue EV certs for any entities they want identity-verified; and then uploading (or in the case of a native app, installing) these certs to bind them to their BlueSky accounts.
In a bigcorp MDM domain, your EV cert allowing you to speak as @bigcorp_pr or whatever, would just get MDM-installed onto your device and you'd never even think about it. You'd just know that you actually can't log into that BlueSky account on any non-company device, despite knowing the password to the account, because no other device has the cert installed.
> and I'm not convinced it would do anything to stop determinated bad actors.
It does as much and as little as what BlueSky's announced approach — have human moderators check identity verifications using their common sense — does.
That's all EV validation is, in the end: collecting a bunch of information and then having a human look at it and say "yeah, this is really who should be getting certified to say they own this domain" or "no, this seems to be some kind of domain hijacking attempt." (Or even "this domain seems created to typosquat a popular brand, so I'm not granting the cert, even if the person really does own the domain." Denying typosquatters EV certificates is/was an explicit feature of most CAs' EV processes — although the term "typosquatting" hadn't been coined yet, so it was referred to as "trademark protection" or somesuch.)
The only difference, in leaning on X.509 infrastructure to do this, would be that you wouldn't have to rely on "BlueSky moderators" as your only group of people willing to put their reputations on the line to assert "yeah, this is who they say they are; they're really in charge of this business; and this business is a real thing—the one you'd think of when you see the name." You can go out and ask any company specialized in "having a reputation for making identity-validation assertions that everyone trusts" (i.e. an X.509 CA) to do it for you.
Not a good look.
Domain verification was genuinely all the verification needed. This checkmark system is just a copy-paste troublemaker from Twitter, and we all saw how well that turned out whenever a celebrity or billionaire's account got hacked to shill grifto schemes. Training users to only look for a symbol just desensitizes them to the complexities of identity and sanctioned speech.
This is what their users are looking for. They don't want complexity, they want to know who they're supposed to listen to.
That said, your gray-status is exactly why I long since stopped pointing out that's what people want, and instead shifted my argument towards educating readers why that's bad. The dearth of informed electorates is a crisis plaguing humanity as a whole, and we sorely need to start shining a light on the practices that create this harm ("answer engines") rather than shaming users that engage with those traps alone.