RE: https://mastodon.social/@fediversereport/116500458153780336
the eYou people, a closedsource european twitterclone that is now using didplc for identity, seem to be reading my posts and have figured out the fairly horrifying implications of it
<img src="https://files.mastodon.social/media_attachments/files/116/816/842/940/866/974/original/2c4c7f56e3eec3aa.png" alt=" Jasseem Allybokus Jasseem Allybokus • 2e Co-founder & CEO @eYou — The social media you can trust. Mijn website bezoeken 2 d • Bewerkt • <p>A lot of you have been asking us the same question.</p> <p>“Why isn’t eYou built on the AT Protocol?”</p> <p>I owe you a real answer. And today, I’ll give you two.</p> <p>Because we’ve also just shipped something: you can now sign in to eYou with your Bluesky identity. It’s live. People are using it.</p> <p>Let me explain both.</p> <p>First. Why we didn’t build on AT Protocol.</p> <p>AT Protocol is impressive engineering. Real respect for the team behind it.</p> <p>But look closely at how it works, and at what European law requires of us.</p> <ol> <li> <p>The firehose. The moment you post, relays crawl your PDS and store full copies of your data. A public stream called the firehose broadcasts every post, like, and follow. It requires no authentication. Anyone can subscribe, capture, archive, and republish. Forever.</p> </li> <li> <p>The right to erasure (GDPR Article 17). When you delete on AT Protocol, your PDS removes its copy. But the firehose has already broadcast it. Relays hold their own copies. Scrapers have indexed it. The protocol provides no mechanism to force them to delete. Erasure becomes a polite request, not a right.</p> </li> <li> <p>The Russmedia ruling (CJEU, December 2025). This Grand Chamber decision (C-492/23) holds that platforms hosting user content qualify as joint data controllers under GDPR, with preventive obligations before publication. It also confirms that the Digital Services Act safe harbor does not displace GDPR. Applied to AT Protocol, where Relays and AppViews actively ingest and index user data, this creates a serious compliance problem. Preventing third-party copying of personal data is exactly what federation is designed not to do.</p> </li> <li> <p>The did:plc identifier. AT Protocol’s default identity method relies on a cryptographically chained, append-only operation log, operated as a central directory by a single US-based company. Erasing entries breaks the chain’s integrity. Article 17 requires full erasure to be possible."/></p> </li> </ol>