Bluesky AT Protocol surge and the choice for decentralized developers

Bluesky has 40 million users. Only 0.3% of these users have 1,000 followers. 50% of users have exactly one follower. Between late October and mid-December, the user base grew from 11 million to 25 million. This 14 million user increase makes the AT Protocol a priority for developers building decentralized social media. You already know the basics of protocol interoperability. The AT Protocol provides the most practical path for user data portability. This protocol allows users to move their content, including posts and likes, between different applications. ActivityPub, the protocol used by Mastodon, operates differently. In ActivityPub, a reply thread might look different depending on which server a user uses because not every server knows about every reply to a post. Because the AT Protocol uses a firehose to combine activities from all servers, every user sees the same reply thread and the same total count for likes on any given post regardless of which server they host on. This design prevents the fragmentation seen in other federated systems. The daily active user count is between 3.5 and 4 million. Community tools like starter packs drive growth on the platform. There are 335,000 starter packs available. Researchers at Lancaster University, TU Darmstadt, and City St George’s found that 43% of all follows come from starter packs. Nearly 20% of follow relationships are attributed to packs. If a creator includes a user in a pack, that user can see an 85% increase in followers.

Identity management is a challenge

Identity management requires developers to choose between different security models. The AT Protocol uses decentralized identifiers, or DIDs, to allow users to self-identify. This process allows users to avoid proving their identity to a centralized entity. However, a Personal Data Server (PDS) operator can post as a user, like content as that user, follow people as that user, or change profile settings as that user. These actions remain cryptographically valid, which means the activity is indistinguishable from the actual user. A PDS handles AT Protocol actions, so the operator holds significant control. Discussions regarding the ability of a PDS to pretend to be a user document this risk. This risk contrasts with Nostr, where servers manage identity and social relationship chains. In Nostr, the server decides which usernames are available and who can use them. This hierarchy allows servers to act as central authorities over user data and identity. In Nostr, identity is a request made to the server, which then provides a designation. In GitHub, users sign commits with private keys on their local computers. This prevents the service from making arbitrary commits in their name.

Developers must account for the fact that a hosting provider can take down a domain or redirect traffic to different IPs. DNS providers can also obtain TLS certificates to impersonate a site. If the U.S. issues a legal request for data of an EU citizen, Microsoft says it will comply regardless of EU law. This makes regional data hosting less effective for sovereignty.

Developers face a choice between migration and bridging

The ecosystem is expanding with applications like Blacksky and Gander Social. Blacksky focuses on the Black online community, while Gander Social is for social media users in Canada. Developers use the AT Protocol to build niche experiences. Feed builders like Graze and Surf allow users to create custom feeds for specific topics. Users can also use these feeds to follow content for specific interests like video games or baseball. The "Atmosphere" of the AT Protocol includes photo-sharing, livestreaming, communication, blogging, and music apps.

The technical challenges of bridging protocols remain high. Mismatched features and cultures between protocols like Nostr and ActivityPub make direct integration difficult. Bridging can also struggle to work through NATs and firewalls. Multi-protocol clients like Steampipe exist, but developers still face the problem of protocol mismatch. Developers also note that bridging can bypass instance-level blocking, which requires blocking bridge users instead. This method is awkward. Will a standardized identity layer eventually unify these fragmented networks? Developers must choose between the migration capabilities of AT Protocol and the bridging needs of the Fediverse.