Post

I need opinions on a HappyView feature: inspection for atproto spaces. TL;DR - should the dashboard be give admins a clean view into spaces content? More deets in the thread. 🧵 #atproto

Trezy

@trezy.codes

Basically, spaces are fully accessible to server admins. This is the same for spaces hosted by HappyView, as well as spaces on your PDS. If somebody has access to the database, they can read anything in your spaces.

Trezy

@trezy.codes

From a technical perspective, this is not surprising. Spaces are not encrypted. They provide access control, not privacy. If you want privacy (even from admins), you need some form of E2EE.

Trezy

@trezy.codes

From the perspective of a server operator, it actually makes a lot of sense. The operator of a PDS needs to be able to moderate the content on their PDS. We don't need bad actors creating spaces just to store their CSAM. That would be Very Bad™.

Trezy

@trezy.codes

Having access via the database is one thing, but having a tool for a clean view into that data feels like a whole different ball game. So here's the question: Is it too skeevy for HappyView to provide an interface for browsing space data?

Trezy

@trezy.codes

Of course the goal isn't to give operators a creepy tool to rifle thru your private stuff, but any tool that provides this sort of auditability CAN be exploited in that way.

6/10/26, 1:39 am0 reposts4 likes

Trezy

@trezy.codes

I feel like this is defensible: if I create a private account on Facebook and upload a bunch of sensitive photos, I know there are Meta employees that will have access to that.

threddy 🦖

@threddyrex.org

Seems ok, if: - the tool is accessible only while logged in to the server (not via web admin dashboard) - admins use creds that aren't bluesky accounts to log in - admins use 2fa - admin logins are audited

Trezy

@trezy.codes

If, then, I sign into VeryPrivateService.at with my atproto account, I should have the same expectation that operators of that service have visibility into my otherwise permissioned content... right?

Ezra🦋

@ezraboeth.com

imo, I as a user would expect that admins of the appview for my space would have the ability to run anything programmatically over my data in the space (for the purposes of moderation or indexing or anything else), but I would NOT expect them to have the ability to open individual records and-

Ezra🦋

@ezraboeth.com

inspect them (along with blobs) in a nice viewer. that to me makes inspection *too* easy, to the point where I would actually worry that admins would poke around in spaces just for the hell of it. I think programmatic access of records makes perfect sense, but a viewer is too far.

Ricardo J. Méndez

@ricardo.bsky.social

Seems you are munging two things here: user privacy expectations and admin needs. There is nothing skeevy about adding a tool admins could not only build themselves, but have a reasonable expectation for. It would only be sketchy if you were circumventing some basic spaces privacy capability

Ricardo J. Méndez

@ricardo.bsky.social

User expectations MAY BE that admins do not get access to spaces, either because the feature was poorly communicated, they didn’t check, or simply uninformed assumptions. But that’s for VeryPrivateService to manage, not you (or anyone else on the network stack).