This Box is Mine
The goal of this post is to give a high-level, non-technical overview of why I like atproto, the technology behind apps like Bluesky. If you’ve tried Bluesky, it probably felt like a Twitter clone, and as far as the UX goes that’s fair.
The short version: I really like using it, and unlike everywhere else, I can leave without losing anything. The rest of this post is about why I think that’s really important.
One huge box per app and they do not talk to each other.
Let’s start with the current state of the web, focusing on social media. At a high level, you can think of every social media app as a huge box, owned and run by a single company. You sign up, and if your connections sign up too, you get to hang out in this box together. The boxes don’t talk to each other — you have to be in the same box as your connections. If you leave a box, you lose all your content and connections.
Most of these boxes started out as pretty nice places to be. But as we have seen, all the major ones have been enshittified.
A quick tangent on enshittification. The term was coined by Cory Doctorow, and I’ll borrow his brief explanation:
“Here is how platforms die: First, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.”
I don’t want to get deep into it in this post. But it’s not hard to see why the current box model plus the economic incentive to maximize shareholder value ends up producing a degraded experience for users, however noble the initial vision might have been. Once the users are locked in and the investors want their money back, the value has to come from somewhere. And once you go public, you have a very real responsibility to make the number go up, user experience be damned.
The important part is that the box is what makes it work. Enshittification is only a viable strategy if leaving is expensive. Your content, your connections and your years of history all live inside someone else’s box, so you stay and you take it.
Now here’s a different approach.
This box is mine and I use it for the apps.
Imagine if your Facebook, Twitter, Instagram and Reddit content, likes, follows and images were all stored in your own Dropbox or Google Drive, and the apps were just reading from it and writing to it. If you got fed up with one app, you would switch to another one and everything would still be there, because it was never theirs to begin with.
That’s roughly how atproto works.
Notice that the box just got a lot smaller. Instead of one giant box per app with everyone’s stuff in it, everyone gets their own box. And you own yours. Apps write to it and read from it, but they don’t hold it.
You don’t have to host the box yourself. Usually that’s taken care of for you by a service. When you first join Bluesky, they will happily host your box, and you don’t even have to know there is a box to get an (arguably better) Twitter-like experience out of the gate.
But once you learn there is a box — and let’s say you’re European and concerned about depending on US tech — you can move it. Eurosky, for example, runs European hosting for exactly this, on servers in Germany operated by a Dutch non-profit. Or if you like running things at home, you can absolutely self-host it.
Moving your box is not yet a couple of clicks, but it is getting better quickly, and you can now move back to Bluesky’s hosting as well, which wasn’t possible at first. But the thing that matters is that it’s possible at all, which is far more than Facebook will ever offer you.
And while Bluesky is the most popular atproto app, what goes in your box isn’t limited to posts. There are apps that let you write and publish blogs. There are Instagram-like alternatives for photos. There is even an alternative for the abhorrent LLM hellscape that is LinkedIn.
A slice of the atproto app ecosystem, browsable on atstore.fyi.
What’s especially cool is that these apps can reuse the stuff other apps put in your box. When you sign up for a new atproto app, it can pull in your Bluesky follows, so your feed isn’t empty on day one. And if you leave an app because it shuts down or the experience degrades, you can join an alternative and your content, your follows and your history come with you. Or you could go build that alternative yourself.
But isn’t Bluesky just another company that might do the same thing?
Bluesky the company has investors. The overwhelming majority of people on the network today use Bluesky’s app and Bluesky’s hosting. So yes, they could absolutely make their app worse.
The difference is in what would happen next. When Instagram degrades, you either eat it or you start over from zero somewhere else. When Bluesky degrades, you take your box and open a different app, and your posts and your followers are still there. That doesn’t make bad decisions impossible. It makes them expensive, because the punishment is actually available to users instead of being theoretical. A company that can’t hold your stuff hostage has to keep earning your time.
That’s why I care about owning the box. Being able to leave is what keeps apps honest. It’s definitely not the whole solution, but at least it’s a start.
But the most important part will always be the user experience. With Bluesky and other atproto clients, you pick your own feeds. No billionaire shoving his own posts into what you see. The main reason I open Bluesky every day is not that I get off on the plumbing — it’s that I like using it. You could even build your own feeds, but I’d recommend starting with the For You feed that @spacecowboy17.bsky.social runs off his gaming PC.
Anyway, I’m still missing some of you over there. Come join, and reach out if you have any questions.
And if this piqued your interest in the technology itself, I would recommend starting with these posts by Dan Abramov:
AT Protocol folks: feedback on anything I’ve oversimplified here is very welcome. Keep in mind this is written for my friends and family rather than for you.
Q&A
I’ll try to answer some questions as an addendum to the post. The atproto community is actively building, so these things are subject to change. Mind the updated date.
1. What happens if Bluesky implodes before you get your box out? Is there any built-in redundancy?
That’s a recoverable situation, with some caveats. There is a public mirror for the whole of atproto called Hubble, but they do not mirror blobs (images, videos, etc) and private app data. Right now that project is supported by a grant from Bluesky, so I guess future funding is an open question.
You can also back up your box using a community project called PDS MOOver. But it’s not something I would expect most people to do.
I glossed over a lot of technical details in the post, but there is additional plumbing that atproto relies on. One of those pieces is how identity is managed. And for the time being, that is centralized and operated by Bluesky. But replicas of that data exist as well. It is possible to take back some control over that using your own domain, but realistically there’s always going to be some third party involved in the chain.
There’s nuance to all of this, but the services are getting more user-friendly all the time. For example, migrating from Bluesky to Eurosky was made almost seamless using their EU-HAUL tool.
2. Can a malicious vendor prevent you from exporting your box?
Yes, they could make it painful, but not impossible if you prepared. Migration is currently non-adversarial and if a vendor tried to lock you in, you have adversarial options available. My hope is that those facts align the incentives for atproto platforms to not fuck us over.
3. Are there any services that merely provide “box hosting”?
Yes, for example selfhosted.social. You can check out this discussion as well. Storage-only is a pretty thin business model though, so most hosting providers have additional offerings.
4. Are there any limitations to what can be stored on “the box”?
Yes. There’s two types of “files” that can be stored in the box: records and blobs. Records are things like posts, likes, follows, RSVPs and so on. The size limit for a record is 1MiB. Blobs are images, videos and other media. These live separately and are references by records. There’s no protocol-wide size cap. But last I heard, Bluesky is planning to raise the default blob size on “their box’s” configuration limit to 300MB, because folks wanted to uploade longer videos.
This is not meant for arbitrary data storage. Atproto apps define what kind of data is stored on your box. An awesome tool for visualizing that data just dropped today, here’s mine. pdsls.dev is also a great tool for looking into the actual records.
5. What if I want to join another atproto app and don’t want my friends and follows to come with me? Can the import be filtered?
Not really, because there is no real “import”. When you sign up for a new app, that app just integrates with your existing box. They might choose to not use your follows. For example, tangled.org does not automatically make me follow all the repositories hosted by people I follow on Bluesky. But more realistically if you would like to have a separate social graph on a new app, you would likely create a a separate account on an atproto hosting provider.
6. How private can my box be?
Right now, it comes with glass walls. Some app-specific data is not stored on the box, like mutes or DMs (although real end-to-end encryption for messaging is still a work in progress) on Bluesky. But most of it has been designed to be public.
There is active work being done on what’s called “permissioned data” that would support non-public data with explicit access controls. Both the Bluesky team as well as the community are working on this.
The open design is a feature and part of the credible exit story, but I am hopeful about the community and the work they are doing on permissioned data.
7. What’s the business model? (Hi mom!)
The protocol itself is just a technology, every app provider needs to figure out their own business model. Whether that is ads, premium features, subscription fees or something else. I think a lot of current apps survive on enthusiasm and community donations and to be clear, some are VC-backed. But although the protocol doesn’t hand anyone a novel business model, my hope is that it takes away some of the worst ones — enshittification through insane switching costs.
I don’t think the tech is enough. The fact that we get to keep our phone numbers when switching our operator is something we take for granted, but this was not always the case. It was regulation that made it happen. And for better or worse, social media has arguably taken up a larger presence in our lives than simple phone calls and texting. So we should demand better.
Loading comments…