selfhosted.social

We have been made aware of some possible issues with logging in both via password and OAuth sessions if you have 2FA turned on. Our very best developer has identified the problem and is testing the fix as we speak.

Looks like the upstream Bluesky AppView is having a bit of issues tonight. Watching to see if there's anything that can be done on the PDS side. Reminder: you can still use Bluesky using one of these clients that do not depend on Bluesky's AppView reddwarf.app blacksky.community

Can expect some down time tonight on 04-04-2026 around 02:00 UTC, or 10pm eastern on the 3rd. We are hoping this should take only 30mins or less. Can also expect there will be some more down time next week, but details will follow.

If you're a PDS admin and also interested in this can find the script here tangled.org/strings/did:...

Can expect some down time tonight on 04-04-2026 around 02:00 UTC, or 10pm eastern on the 3rd. We are hoping this should take only 30mins or less. Can also expect there will be some more down time next week, but details will follow.

The deets: Every record/event written to a PDS is sent on the "firehose". That's how it goes from the PDS -> relay -> appview. The order of those events and some info is stored in a sqlite db named sequencer. The PDS does not trim that automatically, so since the PDS has been running it has been..

ATProto devs did you know you can use selfhosted.social for users to create brand new accounts on the atmosphere in your applications? Both deckbelcher.com and blento.app uses our PDS. A user's journey into the atmosphere does not always have to be started from Bluesky. It can start from your app.

To do this you just pass the full PDS url prefixed with https, instead of a handle on oauth. This will give them a screen where they can create a new account, then redirect authenticated to your app. On this page users can also review our T&S and privacy policy before they create the account

Hey everyone. We're back! I am terribly sorry about the outage today. I wrote a postmortem to explain better what happened. tldr: We had a large influx of create records, which led to us learn the rate limit was not on and to be rate limited by the relay for a few hours

selfhosted.social appears to be having some issues where posts are delayed before showing after they are created. This affects new posts, replies, and likes. Looking into it. Details: I think we are experiencing high volume of create records and the relay may be rate limiting us a bit

We were indeed vulnerable to this type of attack, and it has now been patched. This would have only affected you on our landing page at selfhosted.social, nowhere else like inside of the bsky.app. Also, we have no reports that anyone attempted this before the vulnerability was found and patched

I am sorry this went under the radar and I appreciate everyone's patience and the atproto community. For those curious about it. It was an XSS vulnerability on loading links made in posts. I was not sanitizing those URLs. You can view the patch and full source code of the landing page here

I was made aware of this possible attack vector last night and was kindly informed that we could be vulnerable to it on our landing page. As soon as I was made aware I turned off our landing page till it could be tested. All PDS operations are still operational, but the landing page is down for now.

This would have been a XSS on the landing page and could affect you if you visited the page and a bad actor had posted this malicious record on the PDS. It is never fun to find a vulnerability that could put users at risk that trust you as a dev, and for that I apologize and feel awful about it.

selfhosted.social members now have another backup for their blobs and repos with a new PDS MOOver node instance. If ever needed, and as long as you have a rotation key, you can use one of these two links UpCloud, Chicago, US pdsmoover.com Railway, Amsterdam, Netherlands eu.pdsmoover.com