Nostr notes by Tom Sherman

The confusing part to me though is that the document is linked to ...

2026-10-08T21:20:33Z

In reply to nevent1q…q6p8
_________________________

The confusing part to me though is that the document is linked to a publication, and that publication has a URL. What does it mean for that document to be served on a different domain to the publication? Is that just implicit syndication or this an invalid/unverified document?

Yeah I guess another framing is that this is purely an app ...

2026-10-08T21:14:46Z

In reply to nevent1q…3scm
_________________________

Yeah I guess another framing is that this is purely an app decision, but I feel like there could be support in the lexicon for something like canonical syndication too

Can I author posts on somewhere like @leaflet.pub (that owns my ...

2026-10-08T21:02:18Z

Can I author posts on somewhere like @leaflet.pub (that owns my [standard.site](https://standard.site ) publication) and integrate/render the post on my own site with @standard.site metadata? Even though the publication URL will be different of course

In other words: how does syndication work?

When will pds switch to better-sqlite3 v12 so I can upgrade to ...

2026-04-15T19:20:56Z

When will pds switch to better-sqlite3 v12 so I can upgrade to node 24 😭

Emelia (npub1c9d…2llc) i feel like you would know the answer to this? 😅

If I have server-side atproto auth and want to do a ...

2026-04-03T21:01:32Z

If I have server-side atproto auth and want to do a service-to-service call, should I use PDS service proxying or fetch a token with getServiceAuth and call the service directly myself?

What are the tradeoffs? Proxying should be faster I guess (fewer round trips)?

It seems like the messaging behind React Server Components being ...

2025-12-08T16:44:10Z

It seems like the messaging behind React Server Components being a distinct environment, separate from SSR, was completely lost

People are just saying SSR now to mean "React code running on the server" 😭

Such a shame because it massively complicates the model and selling point for RSCs

For anyone that missed it, the React Server Components critical ...

2025-12-04T10:06:50Z

For anyone that missed it, the React Server Components critical vulnerability has a name and website now

Please refer to this before sharing any supposed POCs

[react2shell.com](https://react2shell.com/ )

[React2Shell (CVE-2025-55182/CV...](https://react2shell.com/ )

Next.js cache components are not ready for prime time. ...

2025-10-22T23:42:37Z

Next.js cache components are not ready for prime time. They're "GA" but it really feels the same as when they advertised app router as stable in v13

Many bugs and missing features

This message (and solution) is probably something that is very ...

2025-10-07T14:17:25Z

This message (and solution) is probably something that is very obvious to many on this app

[The Web is Going to Die](https://www.youtube.com/watch?v=oOyQpwPrf2Q )

Nostr event nevent1qqsg59rzgzt8y644dgt7q7j43hrwtudun6rvgxvjymlne76a8q859agzyqrs6j0ckxae0awkrxzgnqz858wmlsppgtz3wa0lasjf3qettmktq6mqvss

2025-10-05T22:58:54Z

marking myself safe from the atproto feed censorship event

I got an instance of @npub10vg…h0np's scrobbler running, ...

2025-10-03T09:47:42Z

I got an instance of teal.fm (npub10vg…h0np)'s scrobbler running, super super easy

Is there a tool to import existing last.fm scrobbles into my PDS?

Atproto PDS devs: Does anyone have recommendations on which ...

2025-08-12T23:01:57Z

Atproto PDS devs: Does anyone have recommendations on which endpoints to start developing first? I wanna prove a concept out as quickly as possible

I'm thinking:
putRecord, getRecord, subscribeRepos

Also very happy to see the other libraries by the same author ...

2025-08-08T15:01:56Z

Also very happy to see the other libraries by the same author (eg. openid-client) use the same no-nonsense style. Auth code really should have as few layers of indirection as possible

RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3lvvg3fq7p25s

quoting
note1gll…rdad

The code inside [github.com/panva/oauth4weba…](https://github.com/panva/oauth4webapi ) is such a pleasure to read. I have to spelunk and debug through this code a few times and it's always a pleasure. Absolutely zero layers of indirection, zero fluff.

[GitHub - panva/oauth4webapi: L...](https://github.com/panva/oauth4webapi )

The code inside ...

2025-08-08T14:01:29Z

The code inside [github.com/panva/oauth4weba…](https://github.com/panva/oauth4webapi ) is such a pleasure to read. I have to spelunk and debug through this code a few times and it's always a pleasure. Absolutely zero layers of indirection, zero fluff.

[GitHub - panva/oauth4webapi: L...](https://github.com/panva/oauth4webapi )

"trusted verifiers" makes a lot of sense, i'd like to ...

2025-04-21T21:34:17Z

"trusted verifiers" makes a lot of sense, i'd like to be able to opt out of each verifier though as a user. ie. Bluesky trusts orgs X and Y, as a user I only trust X. Don't show the badge for accounts verified by Y

Long press the version number in settings to enter developer ...

2025-02-17T22:11:25Z

Long press the version number in settings to enter developer mode, you'll get new options on posts and profiles
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreia6qxmm2l7apjz5drqsxook3amrrif6oc6dzlbtoacwhs3pkazv5a

I've just learnt how limiting Threads custom feeds are and: ...

2025-02-05T17:59:02Z

I've just learnt how limiting Threads custom feeds are and: lmao

Opened a Skeetdeck PR to add import/export of settings (deck and ...

2025-01-23T22:50:23Z

Opened a Skeetdeck PR to add import/export of settings (deck and column config). Will save me from having to dive into local storage myself again when switching machines lol

[codeberg.org/mary-ext/skeetde…](https://codeberg.org/mary-ext/skeetdeck/pulls/11 )

[Implement settings export & im...](https://codeberg.org/mary-ext/skeetdeck/pulls/11 )

Someone should build a private mastodon-like ActivityPub instance ...

2025-01-14T14:34:39Z

Someone should build a private mastodon-like ActivityPub instance that uses the did:plc and did:web for authentication and take advantage of the Bluesky social graph. Combine it into a single client and look mum we made private accounts on Bluesky

Seeing lots of retconning to make starter packs out to be this ...

2024-12-09T23:44:42Z

Seeing lots of retconning to make starter packs out to be this flawed thing that we all knew had issues from the start and not something that has great power that we are only now after months of usage realising has very nuanced consequences

Can we please make domain handles an option in the onboarding ...

2024-11-13T22:59:25Z

Can we please make domain handles an option in the onboarding flow?

Frontpage communities are shaping up, I think I'm almost ...

2024-10-29T23:52:10Z

Frontpage communities are shaping up, I think I'm almost ready to start writing an RFC on this.

It's gonna be using the protocol in a couple of ways that haven't really been done outside of Bluesky yet so want to make sure we've thought of everything 😅

feeling cute might ship oauth in ...

2024-09-22T11:21:24Z

feeling cute might ship oauth in [@frontpage.fyi](https://bsky.app/profile/frontpage.fyi ) later

My hot take is that the Bluesky AppView is centralised and ...

2024-09-08T16:36:22Z

My hot take is that the Bluesky AppView is centralised and that's a good thing actually

We're live! Different stream link mb: ...

2024-09-07T19:17:32Z

We're live!

Different stream link mb: [www.youtube.com/watch?v=BMpd...](https://www.youtube.com/watch?v=BMpd0IkLj3M )

RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3l3l4q46pma2o

[Frontpage and ATProto Developm...](https://www.youtube.com/watch?v=BMpd0IkLj3M )

quoting
note13kq…mncq

Kicking this off in 4 hours 😄

[@will.frontpage.fyi](https://bsky.brid.gy/ap/did:plc:lhldvebr3louno6ylqen3u2x ) and I will be crying into our keyboards trying to finish oauth on Frontpage

[www.youtube.com/live/-5mnF2i...](https://www.youtube.com/live/-5mnF2iiNqo )

RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3l3i6u3ii5k7h

[Frontpage and ATProto Developm...](https://www.youtube.com/live/-5mnF2iiNqo?si=Z40GcCd4NtXQvDpx )
note19es…jlkk

Kicking this off in 4 hours 😄 ...

2024-09-07T14:52:27Z

Kicking this off in 4 hours 😄

[@will.frontpage.fyi](https://bsky.brid.gy/ap/did:plc:lhldvebr3louno6ylqen3u2x ) and I will be crying into our keyboards trying to finish oauth on Frontpage

[www.youtube.com/live/-5mnF2i...](https://www.youtube.com/live/-5mnF2iiNqo )

RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3l3i6u3ii5k7h

[Frontpage and ATProto Developm...](https://www.youtube.com/live/-5mnF2iiNqo?si=Z40GcCd4NtXQvDpx )

quoting
note19es…jlkk

Ok, gonna do it. Streaming some atproto dev at 8pm UTC tomorrow

Event here if you want to RSVP: [smokesignal.events/did:plc:2xau7wbg…](https://smokesignal.events/did:plc:2xau7wbgdq4phuou2ypwuen7/3l3i6sg6wxd2n )

Stream link here: [youtube.com/live/-5mnF2iiNqo](https://www.youtube.com/live/-5mnF2iiNqo )

Ok, gonna do it. Streaming some atproto dev at 8pm UTC tomorrow ...

2024-09-06T10:52:29Z

Ok, gonna do it. Streaming some atproto dev at 8pm UTC tomorrow

Event here if you want to RSVP: [smokesignal.events/did:plc:2xau7wbg…](https://smokesignal.events/did:plc:2xau7wbgdq4phuou2ypwuen7/3l3i6sg6wxd2n )

Stream link here: [youtube.com/live/-5mnF2iiNqo](https://www.youtube.com/live/-5mnF2iiNqo )

Ah, the three genders ...

2024-09-06T08:39:59Z

Ah, the three genders
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreibd5gskz7rchoqqhfdvhfxvvnbwlwhzbs4ugqvqtq7wtwoafzwnpe

Trying so hard to resist the urge to start working on another new ...

2024-09-03T12:24:41Z

Trying so hard to resist the urge to start working on another new atproto project...

Is YOUR 🫵 firehose consumer running out of memory? Lagging ...

2024-08-29T22:47:41Z

Is YOUR 🫵 firehose consumer running out of memory? Lagging behind?

Are you fed up with the GIL getting you down?

Try rewriting in rust (or forking drainpipe) today!

[github.com/likeandscrib...](https://github.com/likeandscribe/unravel/tree/main/packages-rs%2Fdrainpipe )

atproto-browser plays videos now! ...

2024-08-29T20:20:26Z

atproto-browser plays videos now!

[atproto-browser.vercel.app/at/did:plc:p2cp5…](https://atproto-browser.vercel.app/at/did:plc:p2cp5gopk7mgjegy6wadk3ep/app.bsky.feed.post/3l2uv4ow3m42b )

I've said this before on here but one thing I really love ...

2024-08-29T18:14:13Z

I've said this before on here but one thing I really love about atproto is the pragmatic approach to developing it.

I find many decentralised and crypto ecosystems intimidating because they are very dogmatic - either you're fully decentralised or don't bother.

I added RSS feeds to atproto-browser Subscribe to my Bluesky ...

2024-08-27T22:20:57Z

I added RSS feeds to atproto-browser

Subscribe to my Bluesky likes, if you want

[atproto-browser.vercel.app/collection-r...](https://atproto-browser.vercel.app/collection-rss?u=at://did:plc:2xau7wbgdq4phuou2ypwuen7/app.bsky.feed.like )

Atproto Devs, would you pay for a relay/firehose with more ...

2024-08-27T15:13:36Z

Atproto Devs, would you pay for a relay/firehose with more features?

Something with filters, multiple transport mechanisms (eg. Webhook), guaranteed delivery, priority delivery...?

Seeing this being worked on is getting me so excited for bsky ...

2024-08-27T10:34:14Z

Seeing this being worked on is getting me so excited for bsky video 👀

RE: https://bsky.app/profile/did:plc:t6xqfwencuwg4sjm5uhloc7r/post/3l2oumm6xr72x

quoting
note1vrs…zlec

New PR: [[Video] Add indicator of time remaining to web (#5000)](https://github.com/bluesky-social/social-app/pull/5000 )

[[Video] Add indicator of time ...](https://github.com/bluesky-social/social-app/pull/5000 )

Would be cool if there was a way to know a record was created via ...

2024-08-13T15:22:24Z

Would be cool if there was a way to know a record was created via an oauth app and not directly via the PDS or AppView.

Like a "sent from my iPhone" email signature

RE: https://bsky.app/profile/did:plc:2xau7wbgdq4phuou2ypwuen7/post/3kzmbnfwwy42o

quoting
note1sev…ktlc

Hello from OAuth!!!

Nostr event nevent1qqsgvk9cxrw444zpufva7rf0wrkl076e9ru4pdrxdtxp0ahclyc2lvszyqrs6j0ckxae0awkrxzgnqz858wmlsppgtz3wa0lasjf3qettmktqs0d02s

2024-08-13T15:02:41Z

Hello from OAuth!!!

Are there any mitigations in place to prevent this kind of ...

2024-08-13T14:59:10Z

Are there any mitigations in place to prevent this kind of impersonation? Feels like a bit of a risky hole in atproto

Imagining a utopia where atproto is as common as email, surely we can put mitigations in place now to prevent the many phishing and other abuse attack vectors that spawn from this?
https://morel.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:2xau7wbgdq4phuou2ypwuen7&cid=bafkreifs4owev4euocjhn6msclwnjhrtzuzn5bjszfqbg2cfvziqvb6mxm

The Relay doesn't have to ingest the whole network, it only ...

2024-08-11T15:10:43Z

In reply to nevent1q…f79s
_________________________

The Relay doesn't have to ingest the whole network, it only needs to listen to the PDSes that dependent AppViews care about. And if you have an app with a handful of users (maybe a newsfeed with a fixed number authors or something) you may not even need the Relay

Building an atproto browser. The idea is that you can browse ...

2024-08-06T07:28:23Z

Building an atproto browser. The idea is that you can browse at:// URIs like a web browser allows you to browse hypertext

[atproto-browser.vercel.app](https://atproto-browser.vercel.app )

[ATProto Browser](https://atproto-browser.vercel.app/ )

Nostr event nevent1qqsdw0ryke8lrymh9dxjkcevdwnfgz09k47gulhndq5hkpan5vuasvgzyqrs6j0ckxae0awkrxzgnqz858wmlsppgtz3wa0lasjf3qettmktqzqax3j

1970-01-01T00:00:00Z

hello from the dawn of the unix epoch