My understanding is that this only works if you're using their centralized PLC DID, which I think only works if you sign up through their website? Maybe I'm mistaken about that or they removed that restriction, I don't see any mentions of that in the docs today. Users using the `web:` DID need to use the .well-known resolution system predicated on owning a domain name and their identity is tied to that domain name.

In general, I guess I'm just pessimistic of the ability for any DID system to exist that isn't either centralized or majorly user-unfriendly. I think that reasoning on a "local scope" like ActivityPub does and worrying less about global identity is just a better long-term solution for users and works better with how people are practically using social media today (think about the proliferation of a million discord servers each with effectively their own user identity....)

Yeah, as you can see from the sub-thread, I maybe over-stepped a small amount here. I am thinking about what is required by the protocol, and that is just 'any DID.' You are right to point out that web: and plc: both have certain practical drawbacks today. I am confident that because this problem is considered carefully by the team, that this will be 100% true in the future, but you're also right that there are real restrictions today. I will be sure to be more careful in the future.

> In general, I guess I'm just pessimistic of the ability for any DID system to exist that isn't either centralized or majorly user-unfriendly.

That's fair. Time will tell :)

At present all the DIDs issued through bluesky use plc for resolution, which is a centralised directory managed by bluesky

Yes, I agree this is a weak point. It's also one that the team is aware of and seemingly has the right amount of discomfort with. I see temporary compromises like this as an example of the pragmatic decision making needed to ship, and trust that they will do the right things here, but I also understand some skepticism.

It's not a 'weak point' it's a fatal flaw.

Given that it is a non-essential part of how the protocol works, I disagree, but I understand that reasonable people may differ.

PLC uses signed logs similar to certificate transparency. We have a lot of options for where to take it. There may be a distributed/decentralized hosting system if we can settle on a consensus model we're comfortable with. Otherwise it will be some kind of org management model.

The other direction we've got is did:web, which is already used in some cases, and has some tradeoffs but is a strong option.

For now. As I understand it (from talking to them in person a few years ago), they don't want it to stay like that forever. They want to eventually invite more organisations to run name resolution servers, and they have some clever ideas about how to keep all those servers & organisations honest.