Hacker News Reader

Comment by danabramov | Hacker News Reader

I responded to this here (https://news.ycombinator.com/item?id=45471337) but I want to emphasize this: your domain is "just" a handle. If something happens to it, you still control your identity, so you can point it at a different domain. Apps just display "invalid handle" instead of your handle but your posts/follows/data stay intact. You can go through a "change handle" flow then and fix it.

Unlike with web redirects, you don't need cooperation from whoever owns the old domain because it's the DID Document that controls which handle you use, and you still control the DID Document even if you lose your handle. (That's part of what my article tried to explain by showing the flow: domain is resolved to DID, DID is resolved to hosting, links are stored with the DID.)

When you change your handle, all your followers/posts/etc stay with you, it just seamlessly updates in the apps you use.

View on HN

Thanks for trying to explain this to us.

You are insisting here on talking about the "handle" part, though isn't the crucial part of the complete chain weather we use either did:web or did:plc?

So as you outlined yourself in the article. If you a) use did:web b) ever loose access to that domain you are cooked. No amount of handle changes can help here. If one looses a handle domain one can loose a did:web domain also, so that just moved the problem to a more opaque place.

So your identity is always either a) attached to a domain you might loose b) to some plc provider that might stop work for you.

Please correct me if i get anything wrong here, as that is just how i understand it.

The PLC is being spun out into a separate entity independent of Bluesky. The intention is for it to become something analogous to ICANN. So hopefully, with time, even Bluesky shutting down wouldn’t affect it.

It’s also very simple software and is not difficult to run. People are already running PLC mirrors (e.g. https://plc.wtf/). So if push comes to shove it should be possible to figure out the next step. Although this does require trust and coordination across the ecosystem which is tricky.

See https://updates.microcosm.blue/3lz7nwvh4zc2u for some thoughts on that.

What happens if whoever has the old domain now connects a DID with it? Is this where the rotational key + the fact that everything is signed with it comes in? My concern here is with embeds and links on the wider web that have no notion of ATProto DIDs and only know example.com/@example.com

Yes, that's why did-based links are better for web permalinks. But that's not different from usernames being recycled on other social sites.

> DID is resolved to hosting

Yes, via DNS, of which you have lost control if you use did:web, unless you decide to have your did:web links resolve to a secondary domain under a separate TLD, registrar, and payment method, which only the most paranoid individuals will accept the overhead of doing.

Because you lost control of DNS, the new domain controller may decide to take those DIDs offline, or direct them to a different server for which the domain controller will receive a valid web PKI cert from the likes of Let's Encrypt since domain control is used to determine ownership. This will break pre-existing links.

Your claims are true only when using did:plc, under which your identity is ultimately controlled by a third party, with associated risks, see original post. Yes, domain control is also controlled by third parties (either the TLD owner or a registrar could steal your domain), and there's a good-faith debate to be had over which is safer, which is why the reigning advice is to use a neutral TLD and boring registrar with a good reputation.

Wait until the Chinese, etc. start to come in and threaten to start to block ATProto-based social sites en-masse (Bluesky in particular but other ones as well) until plc.directory takes down the DID links to dissident content, then we'll see how small the risks of did:plc really are.

Reply on news.ycombinator.com