<story><title>So this guy is now S3. All of S3</title><url>https://chaos.social/@jonty/110307532009155432</url></story><parent_chain><item><author>smcl</author><text>Last night I opened this, saw the HTTP 429 and figured &amp;quot;ah too many requests, I&amp;#x27;ll check the comments and try in the morning&amp;quot;. The comments were all people swooning in shock about why some non-specific &lt;i&gt;they&lt;/i&gt; (S3? Amazon? Someone else?) didn&amp;#x27;t use &amp;quot;.well-known&amp;quot; and others complaining about Mastodon and&amp;#x2F;or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0].&lt;p&gt;What this is actually about: BlueSky is Jack Dorsey&amp;#x27;s new Twitter clone, it is &lt;i&gt;eventually&lt;/i&gt; intended to be some sort of fediverse thing but it&amp;#x27;s not there yet and it&amp;#x27;s not the source of the fediverse gripes here. You can authenticate your BlueSky user as the owner of a given domain or subdomain by placing a certain file with a given content somewhere under that domain&amp;#x2F;subdomain. However that &amp;quot;somewhere&amp;quot; was just a location one of the devs at BlueSky chose, rather than somewhere &lt;i&gt;relatively&lt;/i&gt; standardised, like under the &amp;quot;.well-known&amp;quot; path (which you might recognise from things like OpenID Connect where the configuration doc is located @ example.com&amp;#x2F;.well-known&amp;#x2F;openid-configuration). So one user exploited this and became the &amp;quot;owner&amp;quot; of that Amazon S3 domain by setting up a storage account on Amazon S3 and following BlueSky&amp;#x27;s setup instructions. That is the main story here - some non-Amazon rando is now officially the Amazon S3 guy on Bluesky.&lt;p&gt;The next part is that someone posted about it on this &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;chaos.social&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;chaos.social&lt;/a&gt; Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don&amp;#x27;t belong to chaos.social, and &lt;i&gt;that&lt;/i&gt; is why people are upset about Mastodon.&lt;p&gt;Interesting story, but I&amp;#x27;m not interested in Dorsey&amp;#x27;s version of Twitter 2.0 unless it actually allows you to signup[1] and brings something compelling that Twitter didn&amp;#x27;t and Mastodon doesn&amp;#x27;t.&lt;p&gt;[0] - game with an intricate story that does its damndest to not actually tell you. If you want to know the story you have to piece it together yourself by picking up dozens of items scattered throughout the game and reading all their descriptions. Or you can do what I did - watch a video on YouTube.&lt;p&gt;[1] - they&amp;#x27;re doing an open beta and letting a little trickle of users on, who post about it on their Twitter&amp;#x2F;Mastodon&amp;#x2F;whatever. Feels a bit deliberate, like they&amp;#x27;re trying to build anticipation and frankly I detest little manipulative things like that so I&amp;#x27;m out</text></item></parent_chain><comment><author>neilalexander</author><text>&amp;gt; [1] - they&amp;#x27;re doing an open beta and letting a little trickle of users on, who post about it on their Twitter&amp;#x2F;Mastodon&amp;#x2F;whatever. Feels a bit deliberate, like they&amp;#x27;re trying to build anticipation and frankly I detest little manipulative things like that so I&amp;#x27;m out&lt;p&gt;Frankly this cynicism feels unwarranted. Bluesky is not a finished product — it is still being built and, even with the small number of invited users so far, there have been problems that have needed attention. The moderation story is still being developed, the feeds are still being tweaked, the app still has bugs, federation still doesn&amp;#x27;t work yet. Having &lt;i&gt;some&lt;/i&gt; users makes for a valuable feedback loop but the team would rapidly become inundated and burnt out (and the platform would possibly turn into a wild-west hellscape with irreversible reputational damage) if they were to open the floodgates entirely at this stage.</text></comment>
<story><title>So this guy is now S3. All of S3</title><url>https://chaos.social/@jonty/110307532009155432</url></story><parent_chain><item><author>smcl</author><text>Last night I opened this, saw the HTTP 429 and figured &amp;quot;ah too many requests, I&amp;#x27;ll check the comments and try in the morning&amp;quot;. The comments were all people swooning in shock about why some non-specific &lt;i&gt;they&lt;/i&gt; (S3? Amazon? Someone else?) didn&amp;#x27;t use &amp;quot;.well-known&amp;quot; and others complaining about Mastodon and&amp;#x2F;or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0].&lt;p&gt;What this is actually about: BlueSky is Jack Dorsey&amp;#x27;s new Twitter clone, it is &lt;i&gt;eventually&lt;/i&gt; intended to be some sort of fediverse thing but it&amp;#x27;s not there yet and it&amp;#x27;s not the source of the fediverse gripes here. You can authenticate your BlueSky user as the owner of a given domain or subdomain by placing a certain file with a given content somewhere under that domain&amp;#x2F;subdomain. However that &amp;quot;somewhere&amp;quot; was just a location one of the devs at BlueSky chose, rather than somewhere &lt;i&gt;relatively&lt;/i&gt; standardised, like under the &amp;quot;.well-known&amp;quot; path (which you might recognise from things like OpenID Connect where the configuration doc is located @ example.com&amp;#x2F;.well-known&amp;#x2F;openid-configuration). So one user exploited this and became the &amp;quot;owner&amp;quot; of that Amazon S3 domain by setting up a storage account on Amazon S3 and following BlueSky&amp;#x27;s setup instructions. That is the main story here - some non-Amazon rando is now officially the Amazon S3 guy on Bluesky.&lt;p&gt;The next part is that someone posted about it on this &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;chaos.social&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;chaos.social&lt;/a&gt; Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don&amp;#x27;t belong to chaos.social, and &lt;i&gt;that&lt;/i&gt; is why people are upset about Mastodon.&lt;p&gt;Interesting story, but I&amp;#x27;m not interested in Dorsey&amp;#x27;s version of Twitter 2.0 unless it actually allows you to signup[1] and brings something compelling that Twitter didn&amp;#x27;t and Mastodon doesn&amp;#x27;t.&lt;p&gt;[0] - game with an intricate story that does its damndest to not actually tell you. If you want to know the story you have to piece it together yourself by picking up dozens of items scattered throughout the game and reading all their descriptions. Or you can do what I did - watch a video on YouTube.&lt;p&gt;[1] - they&amp;#x27;re doing an open beta and letting a little trickle of users on, who post about it on their Twitter&amp;#x2F;Mastodon&amp;#x2F;whatever. Feels a bit deliberate, like they&amp;#x27;re trying to build anticipation and frankly I detest little manipulative things like that so I&amp;#x27;m out</text></item></parent_chain><comment><author>account42</author><text>&amp;gt; The next part is that someone posted about it on this &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;chaos.social&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;chaos.social&lt;/a&gt; Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don&amp;#x27;t belong to chaos.social, and that is why people are upset about Mastodon.&lt;p&gt;It&amp;#x27;s like all these newfangled webapps don&amp;#x27;t understand the concept of caching static pages for anonymous users. There is absolutely no reason that something like this should result in more than one request (plus a handful more for static resources) handled entirely by the frontent webserver&amp;#x27;s in-memory cache for each person linked from other sides. But instead its all dynamic and the page shoots off more API requests before being able to show anything.</text></comment>