Tom Sherman

https://bsky.brid.gy/r/https://bsky.app/profile/tom.sherman.is

Software Engineer in Norwich. he/him

Working on @frontpage.fyi

[tom-sherman.com](https://tom-sherman.com )

🌉 [bridged](https://fed.brid.gy/bsky/tom.sherman.is ) from 🦋 [tom.sherman.is](https://bsky.app/profile/tom.sherman.is ), follow Bridgy Fed for the Atmosphere (Bluesky) (npub1pqr…2sck) to interact

Web site: https://bsky.app/profile/tom.sherman.is
Link: https://tom.sherman.is
Link: https://tom-sherman.com

Public Key

npub1qux5n793hwtlt4sesjycq3apmkluqg2zc5thtllvyjvgx267ajcqggrsa9

NIP-05 Address

tom.sherman.is_at_bsky.brid.gy@momostr.pink

Profile Code

nprofile1qqsqwr2flzcmh9l46cvcfzvqg7sam07qy9pv29m4llkzfxyr9d0wevqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyg8wumn8ghj7mn0wd68ytnhd9hx2pu0xah

Publishing to

relay.momostr.pink

nostr.wine

relay.damus.io

Author Public Key

npub1qux5n793hwtlt4sesjycq3apmkluqg2zc5thtllvyjvgx267ajcqggrsa9

Show more details

Last Notes

2026-10-08 21:20:33 UTC

- reply

The confusing part to me though is that the document is linked to a publication, and that publication has a URL. What does it mean for that document to be served on a different domain to the publication? Is that just implicit syndication or this an invalid/unverified document?

2026-10-08 21:14:46 UTC

- reply

Yeah I guess another framing is that this is purely an app decision, but I feel like there could be support in the lexicon for something like canonical syndication too

2026-10-08 21:02:18 UTC

Can I author posts on somewhere like @leaflet.pub (that owns my [standard.site](https://standard.site ) publication) and integrate/render the post on my own site with @standard.site metadata? Even though the publication URL will be different of course
In other words: how does syndication work?

2026-04-15 19:20:56 UTC

When will pds switch to better-sqlite3 v12 so I can upgrade to node 24 😭
@npub1c9d…2llc i feel like you would know the answer to this? 😅

2026-04-03 21:01:32 UTC

If I have server-side atproto auth and want to do a service-to-service call, should I use PDS service proxying or fetch a token with getServiceAuth and call the service directly myself?
What are the tradeoffs? Proxying should be faster I guess (fewer round trips)?

2025-12-08 16:44:10 UTC

It seems like the messaging behind React Server Components being a distinct environment, separate from SSR, was completely lost
People are just saying SSR now to mean "React code running on the server" 😭
Such a shame because it massively complicates the model and selling point for RSCs

2025-12-04 10:06:50 UTC

For anyone that missed it, the React Server Components critical vulnerability has a name and website now
Please refer to this before sharing any supposed POCs
[react2shell.com](https://react2shell.com/ )
[React2Shell (CVE-2025-55182/CV...](https://react2shell.com/ )

2025-10-22 23:42:37 UTC

Next.js cache components are not ready for prime time. They're "GA" but it really feels the same as when they advertised app router as stable in v13
Many bugs and missing features

2025-10-07 14:17:25 UTC

This message (and solution) is probably something that is very obvious to many on this app
[The Web is Going to Die](https://www.youtube.com/watch?v=oOyQpwPrf2Q )

2025-10-05 22:58:54 UTC

marking myself safe from the atproto feed censorship event

2025-10-03 09:47:42 UTC

I got an instance of @npub10vg…h0np's scrobbler running, super super easy
Is there a tool to import existing last.fm scrobbles into my PDS?

2025-08-12 23:01:57 UTC

Atproto PDS devs: Does anyone have recommendations on which endpoints to start developing first? I wanna prove a concept out as quickly as possible
I'm thinking:
putRecord, getRecord, subscribeRepos

2025-08-08 15:01:56 UTC

Also very happy to see the other libraries by the same author (eg. openid-client) use the same no-nonsense style. Auth code really should have as few layers of indirection as possible
RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3lvvg3fq7p25s
#note1gll…rdad

2025-08-08 14:01:29 UTC

The code inside [github.com/panva/oauth4weba…](https://github.com/panva/oauth4webapi ) is such a pleasure to read. I have to spelunk and debug through this code a few times and it's always a pleasure. Absolutely zero layers of indirection, zero fluff.
[GitHub - panva/oauth4webapi: L...](https://github.com/panva/oauth4webapi )

2025-04-21 21:34:17 UTC

"trusted verifiers" makes a lot of sense, i'd like to be able to opt out of each verifier though as a user. ie. Bluesky trusts orgs X and Y, as a user I only trust X. Don't show the badge for accounts verified by Y

2025-02-17 22:11:25 UTC

Long press the version number in settings to enter developer mode, you'll get new options on posts and profiles
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreia6qxmm2l7apjz5drqsxook3amrrif6oc6dzlbtoacwhs3pkazv5a

2025-02-05 17:59:02 UTC

I've just learnt how limiting Threads custom feeds are and: lmao

2025-01-23 22:50:23 UTC

Opened a Skeetdeck PR to add import/export of settings (deck and column config). Will save me from having to dive into local storage myself again when switching machines lol
[codeberg.org/mary-ext/skeetde…](https://codeberg.org/mary-ext/skeetdeck/pulls/11 )
[Implement settings export & im...](https://codeberg.org/mary-ext/skeetdeck/pulls/11 )

2025-01-14 14:34:39 UTC

Someone should build a private mastodon-like ActivityPub instance that uses the did:plc and did:web for authentication and take advantage of the Bluesky social graph. Combine it into a single client and look mum we made private accounts on Bluesky

2024-12-09 23:44:42 UTC

Seeing lots of retconning to make starter packs out to be this flawed thing that we all knew had issues from the start and not something that has great power that we are only now after months of usage realising has very nuanced consequences

2024-11-13 22:59:25 UTC

Can we please make domain handles an option in the onboarding flow?

2024-10-29 23:52:10 UTC

Frontpage communities are shaping up, I think I'm almost ready to start writing an RFC on this.
It's gonna be using the protocol in a couple of ways that haven't really been done outside of Bluesky yet so want to make sure we've thought of everything 😅

2024-09-22 11:21:24 UTC

feeling cute might ship oauth in [@frontpage.fyi](https://bsky.app/profile/frontpage.fyi ) later

2024-09-08 16:36:22 UTC

My hot take is that the Bluesky AppView is centralised and that's a good thing actually

2024-09-07 19:17:32 UTC

We're live!
Different stream link mb: [www.youtube.com/watch?v=BMpd...](https://www.youtube.com/watch?v=BMpd0IkLj3M )
RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3l3l4q46pma2o
[Frontpage and ATProto Developm...](https://www.youtube.com/watch?v=BMpd0IkLj3M )
#note13kq…mncq

2024-09-07 14:52:27 UTC

Kicking this off in 4 hours 😄
[@will.frontpage.fyi](https://bsky.brid.gy/ap/did:plc:lhldvebr3louno6ylqen3u2x ) and I will be crying into our keyboards trying to finish oauth on Frontpage
[www.youtube.com/live/-5mnF2i...](https://www.youtube.com/live/-5mnF2iiNqo )
RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3l3i6u3ii5k7h
[Frontpage and ATProto Developm...](https://www.youtube.com/live/-5mnF2iiNqo?si=Z40GcCd4NtXQvDpx )
#note19es…jlkk

2024-09-06 10:52:29 UTC

Ok, gonna do it. Streaming some atproto dev at 8pm UTC tomorrow
Event here if you want to RSVP: [smokesignal.events/did:plc:2xau7wbg…](https://smokesignal.events/did:plc:2xau7wbgdq4phuou2ypwuen7/3l3i6sg6wxd2n )
Stream link here: [youtube.com/live/-5mnF2iiNqo](https://www.youtube.com/live/-5mnF2iiNqo )

2024-09-06 08:39:59 UTC

Ah, the three genders
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreibd5gskz7rchoqqhfdvhfxvvnbwlwhzbs4ugqvqtq7wtwoafzwnpe

2024-09-03 12:24:41 UTC

Trying so hard to resist the urge to start working on another new atproto project...

2024-08-29 22:47:41 UTC

Is YOUR 🫵 firehose consumer running out of memory? Lagging behind?
Are you fed up with the GIL getting you down?
Try rewriting in rust (or forking drainpipe) today!
[github.com/likeandscrib...](https://github.com/likeandscribe/unravel/tree/main/packages-rs%2Fdrainpipe )

2024-08-29 20:20:26 UTC

atproto-browser plays videos now!
[atproto-browser.vercel.app/at/did:plc:p2cp5…](https://atproto-browser.vercel.app/at/did:plc:p2cp5gopk7mgjegy6wadk3ep/app.bsky.feed.post/3l2uv4ow3m42b )

2024-08-29 18:14:13 UTC

I've said this before on here but one thing I really love about atproto is the pragmatic approach to developing it.
I find many decentralised and crypto ecosystems intimidating because they are very dogmatic - either you're fully decentralised or don't bother.

2024-08-27 22:20:57 UTC

I added RSS feeds to atproto-browser
Subscribe to my Bluesky likes, if you want
[atproto-browser.vercel.app/collection-r...](https://atproto-browser.vercel.app/collection-rss?u=at://did:plc:2xau7wbgdq4phuou2ypwuen7/app.bsky.feed.like )

2024-08-27 15:13:36 UTC

Atproto Devs, would you pay for a relay/firehose with more features?
Something with filters, multiple transport mechanisms (eg. Webhook), guaranteed delivery, priority delivery...?

2024-08-27 10:34:14 UTC

Seeing this being worked on is getting me so excited for bsky video 👀
RE: https://bsky.app/profile/did:plc:t6xqfwencuwg4sjm5uhloc7r/post/3l2oumm6xr72x
#note1vrs…zlec

2024-08-13 15:22:24 UTC

Would be cool if there was a way to know a record was created via an oauth app and not directly via the PDS or AppView.
Like a "sent from my iPhone" email signature
RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3kzmbnfwwy42o
#note1sev…ktlc

2024-08-13 15:02:41 UTC

Hello from OAuth!!!

2024-08-13 14:59:10 UTC

Are there any mitigations in place to prevent this kind of impersonation? Feels like a bit of a risky hole in atproto
Imagining a utopia where atproto is as common as email, surely we can put mitigations in place now to prevent the many phishing and other abuse attack vectors that spawn from this?
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreifs4owev4euocjhn6msclwnjhrtzuzn5bjszfqbg2cfvziqvb6mxm

2024-08-11 15:10:43 UTC

- reply

The Relay doesn't have to ingest the whole network, it only needs to listen to the PDSes that dependent AppViews care about. And if you have an app with a handful of users (maybe a newsfeed with a fixed number authors or something) you may not even need the Relay

2024-08-06 07:28:23 UTC

Building an atproto browser. The idea is that you can browse at:// URIs like a web browser allows you to browse hypertext
[atproto-browser.vercel.app](https://atproto-browser.vercel.app )
[ATProto Browser](https://atproto-browser.vercel.app/ )

1970-01-01 00:00:00 UTC

hello from the dawn of the unix epoch