undefined | Better HN

0 pointssteveklabnik1y ago0 comments

Nothing: anyone can hand out verifications to anyone they'd like.

Now, how those are displayed is up to the display software. BlueSky themselves get to decide who gets a blue check based on verification records, but if you wrote your own software, you could do whatever you'd like. There's a bsky fork that already has an account option to let you hide blue checks in your own view.

0 comments

FlyingSnake1y ago

If anyone can hand out verifications to anyone they like then we’re back to square one. Why do we need these “Blue Checks”? It feels like BlueSky is trying to reclaim the lost clout for some of their influential users.

steveklabnikOP1y ago

It's in line with the protocol design. If only BlueSky themselves could verify, that'd be too centralized.

Mind you, just because anyone can create a verification record doesn't mean that the default client shows them.

> Why do we need these “Blue Checks”?

Normie users care about this sort of feature.

FlyingSnake1y ago

> Normie users care about this sort of feature.

That’s a really weak argument because normie users want TikTokified social media with a clout based caste system. I thought BlueSky had a different goal in mind.

anon70001y ago

BlueSky wants to make a social media platform that normies want to use. The whole idea is to design a protocol that can achieve huge scale and behave a lot like existing social media apps (which people "like") while still being open and flexible.

1 more reply

steveklabnikOP1y ago

Bluesky cares about both audiences.

whywhywhywhy1y ago

>Normie users care about this sort of feature.

They don't, but the original Twitter Bluecheck elites who ran to Bluesky really do

steveklabnikOP1y ago

That's not what I'm seeing, but you do you.

ivan_gammel1y ago

I'm not sure about the details of the protocol (maybe someone can check?), but the client software can probably distrust certain trusted verifiers or even use a public list of such revocations. If this opportunity is exploited by malicious actors, there must be a simple and fast escalation path to revoke verification (you complain to verifier, then to maintainers of revocation list).

steveklabnikOP1y ago

> the client software can probably distrust certain trusted verifiers

Any client can do whatever they want with the information, that's right.

> or even use a public list of such revocations.

Revocation is deletion, so it's hard to enumerate revocations.

ivan_gammel1y ago

> Revocation is deletion, so it's hard to enumerate revocations.

In decentralized design it is not. A server can continue to list verified accounts, a 3rd party revocation list may mention some of them, a client will show only accounts not in the list as verified.

azernik1y ago

We need the blue checks to combat impersonation attacks. If a malicious actor pretends to represent a New York Times journalist, or your bank, or a government agency, you don't want users to be tricked into believing them.

tasuki1y ago

Verification is a different thing than a "blue check". I might be against blue checks, but for sure I'm for anyone being able to hand out verifications. It creates a web of trust, and ideally one can choose who they trust and how many transitive levels.

j / k navigate · click thread line to collapse

0 comments

FlyingSnake1y ago

steveklabnikOP1y ago

It's in line with the protocol design. If only BlueSky themselves could verify, that'd be too centralized.

Mind you, just because anyone can create a verification record doesn't mean that the default client shows them.

> Why do we need these “Blue Checks”?

Normie users care about this sort of feature.

FlyingSnake1y ago

> Normie users care about this sort of feature.

That’s a really weak argument because normie users want TikTokified social media with a clout based caste system. I thought BlueSky had a different goal in mind.

anon70001y ago

1 more reply

steveklabnikOP1y ago

Bluesky cares about both audiences.

whywhywhywhy1y ago

>Normie users care about this sort of feature.

They don't, but the original Twitter Bluecheck elites who ran to Bluesky really do

steveklabnikOP1y ago

That's not what I'm seeing, but you do you.

ivan_gammel1y ago

steveklabnikOP1y ago

> the client software can probably distrust certain trusted verifiers

Any client can do whatever they want with the information, that's right.

> or even use a public list of such revocations.

Revocation is deletion, so it's hard to enumerate revocations.

ivan_gammel1y ago

> Revocation is deletion, so it's hard to enumerate revocations.

In decentralized design it is not. A server can continue to list verified accounts, a 3rd party revocation list may mention some of them, a client will show only accounts not in the list as verified.

azernik1y ago

tasuki1y ago

j / k navigate · click thread line to collapse