Can't reply, so I'm quoting. They're not completely wrong, it is important to have a PDS you trust because that is your gateway to The Atmosphere. It holds the private key that signs your records, the part I always think is missed here though is it's a two-way relationship/validation... context:
Who Actually Owns Your ATProto Identity? Hint: It's Probably Not You
kevinak.se
Ariel M. (she/her)
cc @pds.dad bc this writing feels a lil over sensationalized but idk and yknow, he is pds dad
Aug 17, 2026 at 4:30 PM
What is required to make a PDS implementation?
This Github thread from July 2024 had a long answer by Bryan Newbold that is included below:
Spinning Up Your Own Corner of the ATmosphere - Mostly Protocols
How to set up your own PDS from scratch - server, domain, email, migration, and all the little details that actually matter when you're trying to run your own piece of the ATmosphere.
Other PDS
Compare other ATproto Personal Data Servers (PDS): see providers, regions, and tips for choosing where your handle and social data should live.
Other PDS
Compare other ATproto Personal Data Servers (PDS): see providers, regions, and tips for choosing where your handle and social data should live.
What the hell is a rotation key? - Hitchhiker's Guide to the Atmosphere
Why it's important that YOU should have a rotation key and backups for your Bluesky/AT Protocol account that is hosted on a third party PDS
What the hell is a rotation key? - HItchhikers Guide to the atmosphere
Why it's important that YOU should have a rotation key and backups for your Bluesky/AT Protocol account that is hosted on a third party PDS
It's true — fetching authenticated data directly from a PDS is a pain in the butt. And it's totally worth it.
Making Websites is More Complicated These Days - And That's a Good Thing
alexanderson.leaflet.pubCan't reply, so I'm quoting. They're not completely wrong, it is important to have a PDS you trust because that is your gateway to The Atmosphere. It holds the private key that signs your records, the part I always think is missed here though is it's a two-way relationship/validation... context:
Who Actually Owns Your ATProto Identity? Hint: It's Probably Not You
kevinak.seAriel M. (she/her)
cc @pds.dad bc this writing feels a lil over sensationalized but idk and yknow, he is pds dad
How can a lay person "own their data" if they have no idea what a PDS is and that they are granted authority over that server and it's data? The idea that they only need to know about "credible exit" if bluesky becomes hostile plays right into the computationally passive cycle we live in.
𝕮
”The distinction between programmer and user is reinforced and maintained by a tech industry that benefits from a population rendered computationally passive. If we accept and adopt the role of less agency, we then make it harder for ourselves to come into more agency.”
Consider this still a beta. It definitely won't mess up your PDS (it only requests access over Atcade records), but it honestly could use more QA. But you can challenge anyone to a game with just their Bluesky handle! atcade.com
atcade
atcade.comI feel like the logical endpoint is ISPs giving you an atproto identity when you sign up, if you don’t already have one. Would that make things easier? Would we be okay with that, assuming nothing breaks and you can change your PDS afterward?
Ariel M. (she/her)
Changing your phone provider = changing your atmosphere provider → keep your phone number = keep your identity (username) Changing your phone = changing what app you use* → keep your contacts & photos = keep your followers, following, posts, etc. You can change providers without changing phones.
Is this in the reference PDS?
Stefan Judis
Quick reminder, if you're working on a SaaS product that requires a login, please check if you've defined the well-known URL to change passwords. Password managers will check `/.well-known/change-password` to offer a quick way to change passwords. w3.org/TR/change-password-url
to reiterate on this, an AppView server should NOT be interposed between the user and the PDS: the client and PDS are in the user sphere of trust, but the service is adversarial. the PDS is the most important write sink and should be primary, since an app can't be trusted to not shut off PDS writes
mary🐇
doesn't mean i shouldn't try. mary.my.id/musings/atproto-and-oauth
So Streamplace has some personal-private data of yours in our PostgreSQL database, like your multistream targets (Twitch stream keys) and Discord webhook URLs. I'd love to move those into a personal-private space on your PDS, let's design what that looks like? We need six things: 🧵
daniel holmgren 🫠
here it is folks! lots of details to still nail down, but this is roughly where our heads are at for the design of a permissioned data protocol give it a read and let me know your thoughts!
