5 stories
Waag migrated its Bluesky data to Eurosky, an EU-based host, using an 'EU-Haul' service. Because AT Protocol stores your posts on a movable personal data server, the account, history and followers came along.
The thread's flip: this buys portability, not privacy. A Bluesky-using engineer notes AT Protocol replicates everything publicly by design — 'there's no privacy at all.'
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
Roughly 99.9% of ATProto accounts sit on Bluesky's own servers and never register a backup rotation key. That single gap turns the operator into a custodian who can impersonate you across Tangled, Grain, and Leaflet, not just one app.
The theory said you would hold the private keys. The product decided otherwise, because making millions of people manage cryptographic material would have crushed signups.
The fix is unglamorous: make backup-key enrollment mandatory at account creation, baked into the client.
His argument is architectural. Mastodon bundles hosting and app into one server, so federation is server-to-server and identity is tied to your home instance. ATProto splits them: your data lives in a Personal Data Server, while apps aggregate across everything, like Feedly over the whole blogosphere.
Engineers in the thread pushed back hard. There's one PLC directory, a handful of relays, and in practice one AppView, all mirroring Bluesky's moderation. Decentralized in protocol, one company in practice.
W Social bills itself as Europe's sovereign alternative to X. In June 2026 the European Commission, the ECB, Ursula von der Leyen and Christine Lagarde migrated their accounts to it from Bluesky.
Elena Rossini's post notes the platform is a for-profit Swedish LLC that quietly deleted its GitHub repo, going closed-source, while an open non-profit network on the same protocol, Eurosky, drew no press and no politicians. The thread's verdict: the same private-platform mistake all over again.
The bill leaves messaging out (WhatsApp, Signal) and exempts YouTube Kids, then threatens multimillion-dollar fines for non-compliance, plus floated extras: overnight curfews and limits on infinite scroll for under-18s.
The author discloses he sits on a social-media board, which the thread treats as both a tell and a reason to discount him.
The harder asterisk comes from Australia's live version: a 15-year-old visitor reported it didn't touch existing accounts at all, because age checks there only gate newly created ones.
