Post

One thing I want to make clear! If you set your username to a domain, you can change it later without any loss to your account. Let me step through some scenarios:

Is there anything preventing to link multiple domain names to the same account? If we go with the idea that verification is done via domain name you might want to verify that you both are part of the Bluesky team (with paul.bsky.team) and that you own your personal domain

Shouldn't it be as easy as to remove the DNS entry or the .well-known page from the directory? Like, if say _dan.ign.com gets laid off, ign should just need to remove that subdomain and then they just get the invalid domain for the account.

How often does it go out to re-verify the domain handle, though? It would be nice if the domain owner had a way to proactively hit an API to trigger the invalidation.

To help with this it would be suuuper helpful if the original handle was reserved (with option to release) when you add a custom domain. I naively assumed it would be and now I *can’t* change back because someone else nabbed it before I realised. They now post on my old handle so I can’t change back

Scenario: I set my username to pfrazee.com but forget to renew the domain name, and I lose it Outcome: When it expires, the servers notice and will stay "Invalid handle" on my account Solution: I change my username to something else. I don't lose my account or followers

This came up in the context of orgs setting subdomains for their members. There ARE effects to doing that. Web links to your profile or posts depend on your username. But I did want to make it very clear, it only affects your username. An org-given username does not hand over control beyond that.

They’re building something intended to outlast the company itself; so solutions that rely on Bluesky the company are inherently flawed. Domain based verification is used in the SSL certificate world too, see the DNS challenge here letsencrypt.org/docs/challen...

letsencrypt.orgChallenge TypesWhen you get a certificate from Let’s Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as defined by the ACME standard. Most of the time, this va...

But weblinks to your profile can (and sometimes already do?) use your DID instead. There should be a setting for that, actually, because I sometimes link posts in my notes for reference, and having a link with a DID instead of handle makes it hardened against "handle rot".

If I run an org and have employees use a subdomain as their handle, can I change that handle? Scenario: An employee provides me his DID. I create the record for phil.timmons@my.thing. Due to events beyond MY control I decide his handle should be big.fartass@my.thing. Can I just set a new DNS entry?

The employee would have to also choose to migrate to the new handle but yeah, no problems there. If you just change it and nobody does anything on the account you’d get an [invalid handle] situation

So let’s say I have a domain based handle associated to my did of my employer today and I post some things that have context today. Flash forward 3 years I have a new employer and I update my handle with a new domain based handle. If someone reads my posts from 3 years ago which handle is shown?

Ah, I know this one! In the current Bluesky code base, your posts show your current handle and address, for all posts past and current.

Do we have an easy way to generate a link to our profile's DID somewhere? I want to swap it over to that on sites I use infrequently so they stay pointed correctly

Hmm wonder if it's worth adding a "share permalink" or some equivalent to the menu for profiles. It's not super easy to get a did link to a profile otherwise

Why not redirect back to your new name if that happens? Similar to how github handles it. At least for the post level, assuming the post still exists. I feel like this is a pretty good incentive to not attach your account to an org, otherwise. Even good people leave good companies.

Orgs should always set up org-specific accounts, to be honest. If your PR guy leaves, do you really want to lose all the eyeballs, too? Typically, you'd have your own email domain, etc. so that when someone leaves, you retain control of that data - why wouldn't you do the same for Bluesky?

Is there a reason why the bluesky webapp and native apps prefer handle name based links instead of DID based links? I feel like defaulting to DIDs would help protect against linkrot and name hijacking abuses. Especially for users like journalists who's handles are subdomains of their employers.

Is there a way to avoid this, like if you link to posts with a did identifier rather than username-based link? I feel like this could become a big issue, and why Twitter links to posts rendered based on status id no matter what username was used in the link.

I feel like there's ways of fixing that, but it would be complicated as IIRC the record ID is not unique. But the AppView could store when indexing a post/record: DID Index time Record ID Based on that, and knowledge of what handle a DID was using at the time, the right profile could be found.

I work with Fedica - it lets you save drafts, cross post and schedule up to 10 posts at a time for free. bsky.app/profile/fedi...

Fedica@fedica.com

Friendly reminder to all the newskies: You can schedule posts, threads, media, alt text, and auto-link-cards, for free :) This is how to set it up👇

Are there any plans to fix the links breaking issue? It's not ideal considering it seems like, with domain validation being the main form of validation, one's username could change relatively often.

Ok, what about the reader's perspective? If a journalist/company is verified by Bsky, I assume the post is genuine. But if it is verified by domain and it is not a widely recognized domain (like nytimes) or a newly registered domain, how many steps to confirm that a post I read on Bsky is authentic?

I read a post on Bsky, then go to the website to confirm the legitimacy of the person who posted it, then go to whois.com and confirm the legitimacy of the website (assuming that the information there is correct)? So many scenarios that even these checks do not guarantee authenticity...

You have to create an alt account and squat on the bsky account to keep it, or else someone else will. The latter is bad because it is likely that you want something similar in name, in your case pfrazee.bsky.social. And now someone could be impersonating you since you gave up the bsky one.

A possible solution is something similar to wordpress/github. You can use custom domains, but they could be like cname to your core account - bsky one, or some other pds. But I am sure the protocol folks have already gone over this scenario.

cname would be a good solution to link multiple usernames, especially for company subdomains, your main could still be your private, but your company could link to it

...hold authority to keep the record for that subdomain, whether to be not be able to use again or to be able to use but only for you. Because that's probably how the website works too and this is the part where Bsky is also considered decentralized because there's no center authority on that part.

that does feel like it would be a good change. if nothing else it would be handy for people who forget who has custom domain handles so if they try to look you up they can be redirected and still find you.