DAPPCON 2025: BlueSky's Not the Limit, Hacking Stuff with AtProto - Edmund Edgar

Transcript

Thanks, Fernando. So, I'm going to be talking about Blue Sky and Approto. I should be clear, I'm not going to be speaking for Blue Sky. I don't work for Blue Sky. I didn't help design App Proto. I do reality, which is a smart contract oracle. Um, I'm going to talk about Approto because I like it. But what I've done is if you go to my profile, goat navy on blue sky, I've pinned um a link to a whole load of stuff including some stuff by the original uh people who actually did build approto um and a whole bunch of other resources. Um so that's not good. Do I need to point this somewhere?

Not seem to be moving to the next slide here. Ah, here we go. Okay. Okay. So long, long ago, the internet kind of looked like this. If I wanted to um to publish something and share it with my friends, I would make my HTML page and upload it to my web server. And then you could uh use your browser, download it from the web server. This, of course, is not a peer-to-peer arrangement. It's a client server arrangement, but it has some really nice properties that we're often looking for when we do peer-to-peer stuff. So, anybody can publish. Nobody can stop you publishing. You can self-host if you want to. I think at one point I did. Um, but normally you use shared hosting. And the great thing about when you're using shared hosting is it doesn't really

matter what the hosting does, right? The hosting is unopinionated. The hosting doesn't have editorial control over what you're putting on that web server. Um, and if the hosting does screw you, then you just like move your DNS over somewhere else, restore from backups, and then you carry on, right? So, so the user doesn't really uh doesn't really notice. Um, but then we we went a different way on the internet. We did web 2.0. Um, and this brought us a load of stuff that was missing in like the original web one that we wanted like social connections. We wanted the social graph so I could see what my friends were following. I wanted to see all my friends in one view. Um, we needed identity built in. We needed like data structure. So, um, on a tweet you've got, you know, a tweet and a retweet and

likes and all this stuff. Um, and we also needed kind of resilience. So often in the early web if you just if your thing went viral and you got a lot of traffic the web would would fall over. Um we solved that in web 2.0 by everybody using the same like three websites right so we had an internet that looks more like this um all your stuff goes in a database on some guy's web server. One of those guys was Jack Dorsey web 2.0 know entrepreneur and sometime in about 2018 he went to Myanmar and he medit meditated in a cave and he came back and he read a thing by Mike Maznik uh called protocols not platforms and he said you know what I

shouldn't have editorial control over your entire life Twitter should have been a decentralized protocol rather than a centralized server so he got together a team of people that was supposed to decentralize Twitter um and that brought what was originally the root blue sky project and app proto. Um so the constraint that these people had in building app proto was it was supposed to be able to run Twitter. Okay. So that means it's got to scale to the size of Twitter and you also have to have a user experience like Twitter. You can't say this is decentralized so you're just going to have to suck it up if the notifications don't arrive or something. Um it has to it has to work like um a normal web 2.0 u product from the point of view of the user. Um, so

they designed that proto. Then while they were doing that, Elon Musk took over Twitter and they ended up running a completely separate kind of rival Twitter clone built on their protocol. But the the idea was always that Blue Sky would be the first application on this protocol and a load of other stuff could could also um could also run on it. Um, the slogan was the company is the future adversary. So you remember Google had like don't be evil which was sweet. Um the the thinking here is that if you use blue sky now and you're relying on some blue sky infrastructure, sooner or later blue sky is going to screw you, right? So sooner or later we we need you to be able to move off blue sky. And when you move off it, ideally,

not only can you preserve your social graph and all that stuff, but ideally you'd actually preserve the entire experience. So you shouldn't really even have to notice that you're no longer on blue sky infrastructure. Um, so they they released Blue Sky. Um, a bunch of people showed up. Jack Dorsey had a really bad time on Blue Sky and he threw a massive huff and flounced and left the board. So, he's no longer in any way uh connected. It's just in this entirely separate organization um that is standardizing at Proto and supposed to be maybe handing that off to another standards organization. So, how does it work? Well, the core thing at the center of it is what's called the PDS. So this is my web one slide and I've just rubbed out web server and I've written in PDS.

So how's a PDS different? Well, it's for structured data. So everything that goes in there follows some lexicon that you've defined that decides how the data all relates to each other. It's attached to an identity which I'll get to in a second. Your records in it are also connected to other people's identities. So you've got your whole social graph is preserved inside these records and it's content addressed and cryptographically signed. Um, so this means that you don't necessarily have to get your data from the place that originally published it. So if I'm hosting my own PDS, I can do that on a really really tiny little um rubbish VPS. And that doesn't matter because if my content goes viral, people aren't going to be getting it from my

PDS. They're going to be getting it from some cache or some other party, right? Um, and because it's content rested encrypted graphically signed, they can verify that uh that it's what it should be. Okay, there's a little bit more infrastructure. So, if you just had users with their clients and they were connecting directly to the PDS's, that would actually work. Um, but it wouldn't be that performant and it wouldn't be that convenient. So, there's a load of infrastructure in uh in between. Um, I'll kind of skim over it. There's a piece in my links at the end by um Paul Frasy um talking about turning the data center inside out, which I'd really recommend. Um, but what you've got here is you've got the relay. The job of the relay is to connect to all these PDS's

and catch all of the latest changes and then just kind of splurge them out in what's called the fire hose. So you have this kind of constant stream of all of the new changes happening on the entire network or a subject of the of the network. Um then you've got your app views. These are kind of backend servers that the clients are going to use. So so the these will depend on kind of exactly what the client wants and what the client is for. Um so when we started off this was all stuff that Blue Sky company was running. Um now we've got quite a lot of independent infrastructure. Other people have are standing up relays and app views.

So all of the data in the PDS lives in a um a Merkel tree. It's a slightly exotic kind of Merkel tree called a Merkel search tree. Um again in the links there'll be some stuff about why a Merkel tree search tree was was chosen and what is interesting about it. Um, but what we're going to do is if we if we make a post, we're going to take its hash, make a C ID. Um, this is a content ID that looks just like IPFS um, ids. Um, that's going to go in some node in that tree and that will allow us then to always make a proof um, that that is somewhere in the tree and it uh, it will update the root hash and then we're going to sign that root hash and that will allow us to verify the data.

For identity, there are two standards in approto. There's one called did web. This is an old W33C standard. Um, basically you put an identity document on a web server. The other is did PLC. Um, the idea of PLC is we want to get as close as we can to content address data. Right? So ideally you could get all the data in that identity document and you could um look at the ID and verify that um that the data was correct. Um, and that absolutely works for the f the first um the absolute first update and it kind of works for sub subsequent updates with with a a few slightly cursed edge cases. So let's talk about makes making some stuff. So the first

thing is what can we do on blue sky? So all of the curation and the moderation and all of that stuff is unbundled in blue sky. So, if you're using Twitter, you have, for example, the for you feed, and that is what Elon Musk and his algorithm decided you should have uh in your feed. In Blue Sky, there is also a built-in feed. It's called discover, and it's really rubbish, but luckily, you can make your own. So, this is my Blue Sky um like when when I'm logged in. Um I've got a bunch of different feed feeds that I've added. I've taken out the discover one cuz it's awful. Um, I spend a lot of time on like likes and likes.

This is something that some guy in Japan made. Um, it's just like things that people whose stuff I like at one remove, which turns out to be actually a really good algorithm. Just really simple. Um, I've got quiet posters. This is people who um who I follow who don't post very much and I want to see what they do post. Um, and of course you can also do like thematic stuff. So if you want to see stuff about goats, you can make a feed of goats. Um, and this is really easy to build. So, you make a program that's just going to ingest the what's called the fire hose. This this this information from the relays of just all of the new stuff getting posted to the network. You decide what you like and you output this ID for that user. And that's all you have to do and then the

user can really easily add it to their client and automatically subscribe to to what you're posting. Um, similar story for block lists. So, on um on Twitter, Elon Musk decides who shouldn't be seen. Um, on Blue Sky, you can make your own decisions about who who you don't want to see. So, you can put people in lists. Anyone can make a list. Um, you can make lists of people you want to follow because their stuff is good or you you want your friends to follow and people you want to be blocked. So, I'm on a list of goat posters cuz I post um incredible goat content. Um, I'm on a technology list for people who like technology and I'm on a tech list for people who don't like technology and just hate web 3 and crypto and this entire thing which is I don't know it

may be wise. Come on. Okay, so let's talk about blockchain bots. So um I make a thing called reality. This is a question and answer system. Basically an optimistic oracle. Um people put questions in it. we they then have uh people post answers and when they post answers they put up bonds and so there's a incentivized system to um get the right answers. So the first thing we did with this is to uh make a bot to just post all of the questions that we see on the blockchain onto um onto Blue Sky. Very simple. Um once we've done that, it's really easy to put comments into our DAP front end because we know the ID that we posted with. We did that in a deterministic way. So it only needs a tiny little bit of JavaScript to just

pull those um all of the the replies to that question in and show them in our app in line. Um but we can also go the other way. We can take actions from app proto and we can send them to the chain. So um I wanted to do some stuff about misinformation for a long time with with reality. Um, so this is just on test net so far, but we got like a bot that you can tag the bot, put in a question and it will send the question to the uh to the blockchain and create it in reality. So that anybody can answer it. Um, when we do this, we're creating a nosis safe on chain so that that becomes kind of the user's avatar like attached to to their uh to their key on blue sky. Um, we can also answer a question. So if I

see a question I know the answer to, I can tag the answer bot and I can put my answer and then put my bond and that will create the onr onchain transaction that will u make that happen. Um, now I've seen stuff like this on Twitter before, other chains I've seen it done. But the thing about this is this is entirely trustless, right? Because the content is all on the user's PDS. It's arranged in in a Merkel search tree and the Merkel search tree root is signed. So we can take some content, we can recover the CD, um, we can find the CD in the tree, make a proof that it traces up to the uh, the root hash and then we can check who signed that commit node. Um, so, uh, a nice side effect of this is that since we're creating these

automatic Nosis safes, we kind of inadvertently create a crypto account for 36 million Blue Sky users whether they like it or not. Okay, let's talk about some new stuff because everything I talked about so far has been about blue sky, but at proto is a lot more than blue sky. So, think about this. the the the basic thought behind everyone having this PDS is this. Everybody in the world gets a self-s sovereign cryptographically verifiable semantic data store. Everyone gets a self-s sovereign cryptographically verifiable semantic data store. This is the correct way to do the internet. Right? This is what we

should have done when we went to web 2.0. So just looking at some stuff. So and it's really easy to write to this store. So um if you've got a decentralized app, you can you can do this. You don't necessarily need a server. You can do it with a um just a a static front-end um app, you can authenticate against the user's PDS via oorthth and that will give you the right to write to their PDS um and to save records on their behalf. Um there's also something in the oorthth flow where you can put in a host of PDS's. Um so mo right now blue sky basically hosts most of the PDS's um but a few different people now hosting them.

So you can put in the PDS host and then that will automatically onboard them onto proto and then bring you back and allow you to to write to their um their data store. So a couple of examples of this um one is tangled. This is a decentralized GitHub replacement. Um another one is smoke signal. This is an events management system. There's a really nice in the link in the links there's a really nice thing by Ligy who some of it you probably know um who's written about um why the existing hosted events management systems are not uh doing it for us. Um another thing that dropped after I made these slides is that the Linux foundation just did a thing called the fair package manager which is a package manager for

WordPress. So WordPress recently has some sort of politics where the WordPress the company that built WordPress has been kind of exploiting its control of the um the package manager used for plugins. So the Linux Foundation have built their own. So the way I see this is now we have two choices for kind of different purposes when we're building decentralized applications. Some applications will need like a consensus history, right? Some applications need a piece of data that everybody shares and after you've written it, you can't necessarily delete it. Okay. Um, and because that's a commons, because it's got to have a consensus, that gives a whole b uh gives us a whole bunch of constraints, right?

So, we we have gas costs we've got to deal with. We have potentially slow finality. We have just all this pain that we deal with as blockchain developers. But a lot of the stuff that web 2.0 O did was not like that. A lot of stuff in web 2.0 is things where the user should have control over their own data. And the problem that we're trying to solve is we need to be a be able to easily aggregate all that data and show it in different ways to different people. Um so that's where I think app proto fits in. Um when you've got user controlled data, the user can do what they like with it. The user owns the data. um you can put it on their PDS and that will alleviate all this pain that

we had to deal with if we have to do everything with a blockchain. And and I I don't want to do this sort of whole hype thing, but I feel like the use cases of consensus history are probably less numerous than the use cases of user controlled history. So many things in web 2.0 are user controlled history and and not consensus history. So, I'm kind of really excited about having this new tool to do this stuff. So, like I say, I put up a bunch of links. Um, there's stuff by the people who actually built the protocol, uh, Jay Greyber, Paul Frasy. Um, there's a starter pack if you want to if you're not on Blue Sky and you want to get started, there's some some people to follow that I can suggest. Um, and then a whole load of technical details, stuff to help you get

started writing bots, uh, all that stuff. Okay. So, I I feel like this has really kind of restored my optimism about the internet. I'm I I don't know if anyone else is pumped about this. I'm really excited about this. I really hope people will give it a try. Okay, [Applause] thank you so much. I'll open it up for questions. One question, two questions. I'm interested in building building access.

How is that? Um, so I I guess the easiest thing was would be that you can take any of the existing open source clients. Um so really just depending how much of a like how different that is to the thing that you then fork uh it will vary like you know you you could imagine you you pretty much take an existing client decide which records you want and then it works. If you want to change a lot of stuff obviously there's more work. Um but what one of the great things about this ecosystem is that it really is a free software hackers ecosystem. And this is the difference to some some of the the other projects in the kind of in the crypto space is that everybody is

committed to free software. So you you you can take the original Blue Sky client or one of a bunch of other clients um and and and work with that quite easily. I think thank you very much. Um for the personal data um storage um data storing is also provisioning data to others u making that accessible as a general concept and there's also then bandwidth stuff like this. Do you have something like a payments layer for it for a host then or is this a concept that would be like the next step? Um there's no payments layer.

Um I don't know how people will feel about like paying for for PDS data right now. If you're if you're use doing just blue sky data, then you generally are not talking about vast amounts of data. Um I wouldn't be surprised if Blue Sky do some kind of premium thing with with I don't know what features that will have. Um I hope other people will also do kind of paid services. Um as far as an actual layer goes, um there are a couple of people now doing crypto integration. Um uh my friend, uh Stella just did um just did a really nice proposal where she's linking uh Ethereum addresses and putting in a whole a whole

lo of kind of payment stuff. Um so so we certainly could put in kind of kind of crypto-based payments. Um, I suspect it's more likely to look more like kind of traditional models of like um somebody stuffs in some ads or uh people keep go, you know, people sell other stuff. Um I I I I don't think there's much um demand for kind of micro payment type stuff. Um and one of the nice thing about Blue Sky is that you don't really have to do that if you're just hosting a little bit of data. Um, again, this is the problem. If you if you're trying to do a data commons with a blockchain, then you have the problem of, okay, how do we prevent that being abused? So, you

need gas payments, you need storage rent, and all this stuff. Um, but if it's just a little bit of data on a server, there's a lot of ways to get the little bit of money that you need to uh to serve that.