Screenshot of me, accessing my posts through a simple GET request through my browser without authentication.

Notices where this attachment appears

1. Mario Zechner (badlogic@mastodon.gamedev.place)'s status on Tuesday, 17-Oct-2023 19:21:36 JST Mario Zechner

   The past two nights I wrote a "thread reader app" for BlueSky.

   https://skyview.social

   Oh boy. The protocol is absolutely insane. RPC galore, responses are only partially typed. The docs are pretty much useless.

   But the "funniest" part is this: there's no privacy. And I don't mean missing DMs.

   All your posts are available through API endpoints. Without any authentication. By design.

   The "invite-only" thing may have you think otherwise.

   Here are my last 100 posts.

   https://bsky.social/xrpc/com.atproto.repo.listRecords?repo=badlogic.bsky.social&collection=app.bsky.feed.post