Verifying verification

Imagine it’s the late 90s, and you want to see what the New York Times has to say about your favorite political topic this week. Now you’ve heard they’ve finally gotten on the InterNet? The World Wide Web? You’re not quite sure what to call it, but you have a Sunday edition in your living room, and it has a web address in the masthead.

You open up Netscape Navigator, type in http://www.nytimes.com and your DSL connection chugs for a second as more kilobits than a computer from the 80s would know what to do with fly into your shiny new Dell.

After all of that though, you know you’re at the New York Times’ website, since you went there right from their physical paper. There wasn’t a middleman, or anyone telling you that they were in fact the Gray Lady, you just did a little bit of leg work.

Time Warp

Now it’s 2010, and you want to see what the Times has to say about your favorite political topic this week. You could head to their website, grab the paper from the guy on the corner, or for your first time you could open up this new website called Twitter, and there’d just be a handful of words written by the Times, summarizing a story, and you wouldn’t have to go anywhere. How do you know if it’s actually the Times? Well Twitter thought of that for you, and they added a little blue checkmark next to their account for you. ¹

Now you can trust that @nytimes is the Times on Twitter, right? Right? Well for a while you used to be able to, but eventually it all fell apart. And in my opinion, that’s a large part of why Bluesky is popping off (or “has the juice” as the kids say) as Twitter / X slowly begins the doom spiral that any site sees in the future as they become no longer relevant.

The “problem”

So Bluesky / ATProto is created to decentralize Twitter (originally, then is spun off entirely pre Musk acquisition), and a primary tenet of both Bluesky PBLLC (the corporation) and ATProto (the protocol itself) is to ensure that long term, the ecosystem is protected from any actor in the space from turning hostile. There’s no “special sauce” that Bluesky PBLLC has (other than chat/DMs but we’ll set that aside for the time being) that is exclusive to them.

Every part of the ecosystem then needs to be designed to be hostile-proof, from where user data lives, to how users consume and create data. This goes as far as how user identities are stored and referenced. There’s been a lot of work put in to ensure that in the long run, you are totally in control of your identity, not Bluesky PBLLC.

So the “problem” here is that Bluesky doesn’t have a concept of verification, at least not the way Twitter had. There is no “central arbiter” of trust, because how can you have a central arbiter of trust when the entire ecosystem is designed to avoid that single point of failure?

Instead all the “verification” is done with domain names, and there’s been more than a few folks upset / weirded out / annoyed that there isn’t as much verification as there was on Twitter.

The more I think about it though, the less I think it is a problem, and more us as a social media using society not remembering the olden days.

Why this matters

We’ve spent the last 10-15 years forgetting that the web is a protocol, not a platform. Mike Masnick touched on this in Protocols, not Platforms (and in fact is now on the board of Bluesky PBLLC). In the example of the 90s, there wasn’t a platform saying whether or not the NYTimes on the web was “verified”, there was just a little bit of legwork to check and crosscheck that indeed this website was theirs. There was no middleman, just a protocol.

However, in the next time warp, we’re instead relying on these centralized parties to decide who is and isn’t verified, and shifts us to treating the web as a platform, not a protocol. People don’t browse the web, they use Facebook, they use Twitter.

The concept of domain handles, verification, the whole nine on how Bluesky handles this is the first step on getting us as an internet-using society back to protocols.

A domain is the most ownership of anything you can have on the web. If a new ATProto social site opens up, you know that jack.is there is also me, just like you know it’s my Bluesky account, just like you know it’s the site you’re reading right now. I own my identity, not Instagram, or Twitter, or Bluesky, and I think that means something more than a little check in a circle that gives me the good feelings.