Do At-Proto Users Know This Is Public?

Do At-Proto Users Know This Is Public? Thu, Oct 29, 2026 I’ve been exploring the AT Protocol “atmosphere” that Bluesky runs on to get a better understanding of what people are doing with it. What I’ve found is a bunch of private data I’m not sure people know is public. Not only public, it’s easy to find.

AT Protocol 的用户知道这是公开的吗？2026 年 10 月 29 日，星期四。我一直在探索 Bluesky 所运行的 AT Protocol “生态”，以更好地了解人们正在用它做什么。我发现了一堆我不确定用户是否知道其已公开的私人数据。这不仅是公开的，而且很容易找到。

To start my exploration I used two websites that catalog AT Protocol apps: atstore.fyi and atmosphereaccount.com. I’m a long time RSS user, so I got curious about feed readers first. I found this one called Skyreader and I noticed that their page on atstore.fyi contained reviews and mentions of the app by people who have used it. We’ll come back to this in a minute.

为了开始我的探索，我使用了两个编录 AT Protocol 应用的网站：atstore.fyi 和 atmosphereaccount.com。我是一名长期的 RSS 用户，所以我首先对订阅源阅读器产生了好奇。我发现了名为 Skyreader 的应用，并注意到它在 atstore.fyi 上的页面包含了用户对该应用的评论和提及。我们稍后再回到这一点。

Something to know about Bluesky is that you can self-host what they call a personal data server or “PDS.” It’s where your data on Bluesky and other apps are stored, and it’s mostly public. Using a website like PDSls.dev you can explore it yourself. So if you wanted to see my data it’s here. I can’t control how or what you do with it, it just exists.

关于 Bluesky 有一点需要了解，那就是你可以自托管他们所谓的个人数据服务器（PDS）。这是你在 Bluesky 和其他应用上的数据存储之处，而且大部分是公开的。使用像 PDSls.dev 这样的网站，你可以亲自探索它。所以如果你想看我的数据，它就在这里。我无法控制你如何处理它或用它做什么，它只是存在着。

I didn’t want to authenticate my account with Skyreader without knowing what it would store publicly. So remember those reviews that people left for Skyreader on atstore.fyi? They’re all listed next to their account names, so I put their handles in to PDSls to get a sense of what would be public. From this I learned that each feed you subscribe to is published in the lexicon (what Bluesky calls an object of data with a schema) app.skyreader.feed.subscription which contains a key called feedUrl that contains the RSS feed.

在不知道 Skyreader 会公开存储什么内容的情况下，我不想用我的账户进行身份验证。还记得人们在 atstore.fyi 上给 Skyreader 留下的那些评论吗？它们都列在各自的账户名旁边，所以我把他们的账号输入到 PDSls 中，以了解哪些内容会被公开。由此我得知，你订阅的每一个订阅源都会发布在词汇表（Bluesky 对带有模式的数据对象的称呼）app.skyreader.feed.subscription 中，其中包含一个名为 feedUrl 的键，里面存有 RSS 订阅源。

Cool, so now I know not to put feeds I don’t want my name associated with in there. Without trying, I found someone’s private Club MacStories feed, which gave me full access to their content. With a little effort I found paywalled feeds for 404 Media’s full text feeds, Patreon backer exclusive feeds, and private RSS feeds for Gitlab repositories.

酷，现在我知道不要把我不希望与我名字关联的订阅源放进去了。我不费吹灰之力就找到了某人的私人 Club MacStories 订阅源，这让我可以完全访问他们的内容。稍微花点功夫，我还找到了 404 Media 全文订阅源的付费墙订阅源、Patreon 支持者专属订阅源，以及 Gitlab 仓库的私人 RSS 订阅源。

This led me to seeing what else someone could do with all this openly available data. So I investigated searching across a Bluesky relay (like bsky.network) to pull down every collection record for app.skyreader.feed.subscription. It’s not as simple as one API call, because what this returns is an array of DIDs (decentralized identifiers) and from there you can look up the PDS server to request those collection records with the actual data.

这促使我思考，别人还能利用这些公开可用的数据做什么。因此，我研究了如何通过 Bluesky 中继（如 bsky.network）进行搜索，以拉取 app.skyreader.feed.subscription 的每一条集合记录。这并不像一次 API 调用那么简单，因为它返回的是一组 DID（去中心化标识符），从那里你可以查询 PDS 服务器以请求包含实际数据的集合记录。

This gave me over 1,300 RSS feeds people had subscribed to on Skyreader. No authentication, no real restrictions. It’s all just publicly available data on the internet. It’s not just a Skyreader thing, I’ve noticed a few Discord clones store every message openly. There’s a Twitch clone that is the same way. I can watch as people chat all across Stream.place and even search the data. If you could easily search all of Twitch chat I think that would make some people sweat bullets. I’m sure some people will say, “Sure, that’s the point,” but I’m not convinced the users understand the risk. Permalink post bluesky

这让我获得了人们在 Skyreader 上订阅的 1,300 多个 RSS 订阅源。无需身份验证，没有真正的限制。这些全都是互联网上公开可用的数据。这不仅仅是 Skyreader 的问题，我注意到一些 Discord 的克隆版也会公开存储每一条消息。有一个 Twitch 的克隆版也是如此。我可以观察人们在 Stream.place 上的聊天，甚至搜索这些数据。如果你能轻易搜索所有的 Twitch 聊天记录，我想这会让一些人冷汗直流。我相信有些人会说：“当然，这就是重点所在”，但我并不认为用户了解其中的风险。永久链接 帖子 bluesky