HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
bluesky-social
atproto
TypeScript2022–2026
bluesky-social / atproto

atproto

Social networking technology created by Bluesky

42Distinct people
53Mentions
0Explicit recommenders
9.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Social networking technology created by Bluesky

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year53 dated mentions

Observed mentions: 2022-05-04 20:26:28 UTC to 2026-08-12 13:05:33 UTC.

0510152022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 10 mentions; 3 submissions, 7 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 10 mentions; 4 submissions, 6 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 10 mentions; 2 submissions, 8 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 15 mentions; 1 submissions, 14 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC1037
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC1046
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC1028
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC15114
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC808

What Hacker News says

53 sources
If you don't like BlueSky managing your keys, the alternative to did:plc is did:web. Unfortunately, afaiu, it's not possible to migrate[0]. If this is something you really care about, and you trust yourself to manage your own private keys, you should probably bite the bullet and do it now. Make a pinned post on the old account to point to the new one. That's the one part you can't migrate; everything else you can change while retaining your followers, posts, etc. Setting your handle to a domain name via DNS[1] is intended to be easy for non-technical users (especially with registrars adding one-click forms for doing so) and also decoupled from actual PDS hosting. Many users just want their handle to reflect their identity on the web, and are ok trusting BlueSky to host their PDS for free. Migrating to a new PDS is possible in both the coo
Read the rest
perative case[2] or in the adversarial case[3]. The gist is that A: you should take regular backups by exporting your account data, and B: if you're using did:plc instead of did:web, you should register a backup key that has a higher priority than the key held by your PDS, so a malicious PDS can't simply migrate you back. [0] https://github.com/bluesky-social/atproto/discussions/2705 [1] Alternatively there's an option for HTTP handle resolution instead via `/.well-known/atproto-did` [2] https://atproto.com/specs/account#pds-account-migration [3] https://www.da.vidbuchanan.co.uk/blog/adversarial-pds-migrat...
In ActivityPub over ATProto (2023)
Permissioned data is probably the most fundamental, the part I looked most deeply into myself. People want privacy over blasting everything out to the internet for anyone to scrape. The public by default forced upon users is a bad choice. The purported benefits never materialized. Many of the atmo developers have this belief they can skip the network effects, grift the data and social graph for their own use. Here's the User Intent proposal that is super easy to implement, yet they have been sitting on it since: https://github.com/bluesky-social/atproto/discussions/3617 This would have been at least a middle ground to permissioned data, as would have been personal private data (bsky prefs generalized). After that money, which I see as less of a protocol thing. A protocol or platform has to enable the people to make way more money than its
Read the rest
elf, at least 10x. (1) Bluesky should have created subscriptions for their service, they wouldn't have needed the private equity had they. (2) Bluesky did more to block others making money than enable it. Graze was in talks with them to enable the creators using their feed system to make money, until Bluesky walked away. (3) Permissioned data would unlock monetization without blockchain. Permissioned data is being worked on, but the commentary from Bluesky is not promising. (1) Nobody in ATProto has built a permission system (that I'm aware of) (2) Bluesky are proposing a very simplistic system. This will put burden on app developers and create opposition the credible exit philosophy. Record history / editing. The former should be at the protocol level, the later on feature that is highly desired, possible today, but they resist with fervor. Bluesky could have put way more funding into the ecosystem, especially in hindsight with the $100M they picked up just after peak. Now they are struggling and stepping on that ecosystem, re: replacing Graze instead of supporting and integrating them with their latest "ai" stunt. Compare this to Hytale and what they are doing. Night and day. The Bluesky team has also made several PR mistakes, upsetting their base, they are really tone deaf. Hope the waffles are tasty!
In I'm betting on ATProto
I think they're saying using PLC as an identity method is not tied to buying into the whole AT spec. So you can use it for something else. >Isn’t PLC tied to bluesky (or some other central authority)? Yes, PLC is currently tied to Bluesky, and is in the process of moving out into a separate legal entity (https://docs.bsky.app/blog/plc-directory-org). It would indeed remain centralized. >Why didn’t they use some mechanism for decentralisation, like a DHT (e.g. did:pkarr)? AFAIK Bluesky is open to supporting more did methods in atproto in the future as long as they can act as permanent identifiers. I found a response from Bryan about `did:dht` here: https://github.com/bluesky-social/atproto/discussions/2705#d...: >did:dht is interesting and maybe could work, for atproto, but there have been many DHT projects in the history of decentralized
Read the rest
computing, and only a small handful have really worked out. AKA, been resilient to abuse, attacks, neglect, etc, over years and decades. magnet links are cool but kind of the exception to the rule. I think if the W3C standardized did:dht it could be a real contender, but somebody needs to carry the flag and demonstrate it working "in real life" with millions of users, and I suspect that will be difficult, and I would not expect Bluesky to lead that charge (we already have our own pet DID method to maintain and support).
In Where it's at://
If you did hijack the DNS and say `TXT _atproto.<handle>` points to `did:web:mycontrol.example` then that's a plausible attack, I guess, against did:web, but not against did:plc. And it'd assume that software in between hasn't cached the previous mappings, which typically it has. This is noted in the did:web spec, which isn't from Bluesky PBC / AT Protocol: https://w3c-ccg.github.io/did-method-web/#dns-considerations I should note though, that for many implementations, that'd mean poisoning a large DNS provider like google, cloudflare or quad8, since those are the DNS servers typically queried from servers, instead of going directly to the authoritative server itself. There's more technical details here: https://github.com/bluesky-social/atproto/tree/main/packages...
In Where it's at://
Great questions! Yeah, this is something I want to write about it in the future. An app can write to PDS if the user grants it access via OAuth. Currently this access is very coarse (which is bad!) although backing up the entire repo is easy (which is good! but should be made more accessible to normies). There is an active workstream on OAuth Scopes (already partially deployed) which will let apps request more granular access (e.g. apps can write to "their own" collections but also ask to write e.g. Bluesky posts). In UI, this is done through sort of "bundles" of permissions. See https://github.com/bluesky-social/atproto/discussions/4118 for tracking issue. > what if it pretends to write data in the Bluesky format, but e.g. leaves out a field that the Bluesky Appview expects, or writes data in a different format than it expects? Atproto d
Read the rest
ata is governed by "lexicons" which are essentially type definitions used by app authors. E.g. `app.bsky.feed.post` type definition is maintained by the Bluesky team. There's a codegen that generates validation code from that definition. If validation doesn't pass, the Bluesky app server will just ignore that record. Records are generally treated by apps as untrusted input, similar to form submissions. They can be validated during ingestion or in the process of usage later.
In Where it's at://

Showing the 15 most recent of 53 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.