is this really needed? I already have an effective mechanism for not discovering anybody on bluesky.

solid burn

It's a retirement home for elder millennials who just happen to be insane. Not the same thing.

Ok, let’s not have the is Bluesky decentralised discussion again. Kudos to Bluesky’s PR efforts to use complex technology to basically sell themselves as whatever people want to hear (like NFTs but social media). There are a number of X/Threads clones out there, but I’d take a group chat on some relatively secure messaging platform over “social media” any day. Even better if it’s something I can self host or join into one from many servers (remember IRC? Good times).

We really need to rethink this “one corp owns all the keys and all servers” setup.

  > Even better if it’s something I can self host or join into one from many servers (remember IRC? Good times).

What's stopping you? Even threads can connect to BlueSky

> Even threads can connect to BlueSky

I thought Threads only interoperates with Mastodon/the fediverse in some limited capacity. Did I miss some Bluesky integration announcement?

You just need a bridge, as with connecting any decentralized platforms

https://fed.brid.gy/

That's opt-in, mangles usernames, and on top of that quite a few people on Mastodon seemed allergic to the very idea of bridging/federation the last time I looked into it.

  > That's opt-in

So? It's just an example. I'm sure you could do it in a cleaner way. They use different protocols. If you can run your own server and connect with open source tools, it's decentralized. Though of course that doesn't mean a decentralized protocol isn't highly centralized. See email

Yup

> highlights the risks associated with the centralization of instant messaging services

Any cervices, really

so matrix? (which has it's own issues, but will hopefully overcome them eventually)

I’m just glad we didn’t have the conversation again

I was peripherally looking into this for a similar problem domain: https://en.wikipedia.org/wiki/Private_set_intersection

Related to Zero Knowledge Proofs, the advantage is that phone numbers need never be shared in cleartext, preempting whole classes of attacks. However, could be overkill for your needs, and I am not sure how well current techniques would scale.

The RFC addresses security, but does not mention anything about privacy. I think the scheme ultimately boils down to trusting the server/instance.

It would be great if users don't have to share the actual number with the server, a hash or something like that but that would make it impossible to verify the number and verification is required to prevent spoofing.

Another way maybe is to have a trusted 3rd party (something like EFF, LetsEncrypt) that can be used by users to validate their numbers and applications can get the hashes from there.

phone numbers aren’t unique enough for hashes, a lookup table would not be that much effort

Ah its great you bring this up, it's timely as my app is adding contacts syncing soon and I want to do it in a secure/private way. If you choose to go ahead with this, are there any plans to make it open source? ty!

Yeah, it will be