yeah i'll add that!

yeah its on my tangled.org/moth11.net

xcvr.org is my project, it's quite similar, more like unix talk, but should be adaptable to ssh-chat
user issues a channel record with a host appview field
host makes an irc-like and issues signet records w/ ref to channel when users start typing
users issue message & media records w/ ref to signet

my god__________________

(i realize maybe it mentions it on the oauth page but i never read that crap)

oh thats cool! in any case i think an advantage of app passwords here is that you delete them in the same place you create them, so it's more clear to you that you can revoke it

i actually think its much worse because i think its harder to revoke haha

However, the AT in atproto stands for "Authenticated Transfer" meaning that if you're technically inclined (and it's getting easier), you can transfer your information from one piece of paper to another and anyone can authenticate that both pieces of paper are made by the same person

in practice you delegate trust to different webapps like bsky.app or deer.social, allowing them to "write to your piece of paper" for you, and they are able to ban users that they feel violate their terms of use

so whereas most social media platforms have total control over one database system that only they have access to, in atproto everyone has their own database

this is what is written in yours:
pdsls.dev/at://did:plc...

in most parts of the internet, you tell a website things, and it writes them down on a piece of paper that only it can look at

in atproto, you write things down on a piece of paper that only you can write on, and any website can look at what you wrote down

its not by default, but oauth scopes is currently being worked on which allows you to determine which lexicons a session can interact with

i think unfortunately scopes is a bit incomplete because this doesnt allow two applications to interoperate with the same lexicon unless you fully trust both

AND THEY SAY SHE FELL OFF

i think the record keys can be most strings so you could be given the option as a user to not use TID and use a custom record key (the bit in the url is the record key part of the uri)

in this thread, bnewbold said that something like record permissions has been discussed; i feel like the combination of oauth scopes and something like unix file permissions would give the user a lot more safety to try random atproto applications. without it, scopes feels a bit incomplete to me