Thx for doing this wizard researching! So it’s even more complex than activitypub? 🥸 Is there anyone raising a concern about this in the ATmosphere there? /cc nostr:npub1vy22m634y8l3ggw9a4mn0fvd6ss0rftv9kr5yyejkn4nxx4znlwqy2c4uy
Spent a few hours digging through Bluesky's labyrinthian source code. Abstractions on top of abstractions on top of abstractions...
Anyway, they make it impossible to fetch profiles from any PDS or their mega "relay" without credentials. But oddly if you run your own PDS, you can somehow fetch profiles from their central servers without authentication... huh...
So I finally figured out that api.bsky.app is their open domain.
Eg, this one requires authentication:
https://bsky.social/xrpc/app.bsky.actor.getProfile?actor=did%3Aplc%3Azhbjlbmir5dganqhueg7y4i3
But this one does not:
https://api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=did%3Aplc%3Azhbjlbmir5dganqhueg7y4i3
So... they realized they had a problem. In order to be decentralized, you have to allow public access. But instead of just allowing public access to their big mega service, they made a separate service just for PDS installations and then didn't advertise that fact.
Discussion
There are similar complaints from activitypub followers: https://rknight.me/blog/unorganised-thoughts-about-bluesky/