The underlying infrastructure of Bluesky relies on personal data servers that can be examined through public tools such as PDSls.dev without any access restrictions. An investigation into the Skyreader feed application demonstrated that user subscriptions are openly logged, leaking over 1,300 feeds that included access to paywalled outlets and private repositories. Beyond RSS readers, network-based Discord clones and streaming platforms similarly expose user messages and chat logs to outside monitoring.
Key points
Applications developed on the AT Protocol default to public data storage that exposes use…: Applications developed on the AT Protocol default to public data storage that exposes user activity to external surveillance.
Sensitive links to paywalled media and private code repositories can be extracted by quer…: Sensitive links to paywalled media and private code repositories can be extracted by querying decentralized network identifiers.
Everyday users face significant privacy exposures because messaging and media application…: Everyday users face significant privacy exposures because messaging and media applications lack basic access controls on their servers.
Sources checked by our analysis pipeline: 1
I’ve been exploring the AT Protocol “atmosphere” that Bluesky runs on to get a better understanding of what people are doing with it. What I’ve found is a bunch of private data I’m not sure people know is public. Not only public, it’s easy to find.
To start my exploration I used two websites that catalog AT Protocol apps: atstore.fyi and atmosphereaccount.com. I’m a long time RSS user, so I got curious about feed readers first. I found this one called Skyreader and I noticed that their page on atstore.fyi contained reviews and mentions of the app by people who have used it. We’ll come back to this in a minute.
Something to know about Bluesky is that you can self-host what they call a personal data server or “PDS.” It’s where your data on Bluesky and other apps are stored, and it’s mostly public. Using a website like PDSls.dev you can explore it yourself. So if you wanted to see my data it’s here. I can’t control how or what you do with it, it just exists.
Major retailers have rolled out seasonal promotional pricing on smart home climate controls and personal gadgets ahead of colder weather. This specific hardware markdown delivers expanded HVAC compatibility, cross-platform smart home integration, and automated temperature regulation for homeowners seeking energy savings. The discount aligns with broader retail price drops spanning wearable fitness trackers and item-tracking accessories.
Private security contractor ZeroFox issued removal notices to scrub government personnel data from a watchdog platform that publishes leaked contact details of federal staff. A hosting provider rebuffed the attempt on public interest grounds, yet the domain registrar subsequently blocked the address anyway. The effort highlights growing federal investments into AI-driven removal services to shield agency rosters from public scrutiny.
Critical infrastructure across the platform is facing widespread disruptions following a security incident. The fallout affects essential components including networking, certificates, services, addons, and pipeline operations like builds and jobs. However, external administrative interfaces and customer-facing API endpoints have managed to remain operational during the event.