commit f98206034a98933e282d6d03aae173266fd46e8e · bmann.ca/bmannconsulting.com

+19

_notes/ATProto and MCP both picking OAuth.md

···

       1
       1
       +
       [[ATProtocol]] and [[MCP]] are both picking OAuth as their authorization layer.

     

       2
       2
       +
       

     

       3
       3
       +
       In both scenarios, the need is for a wide set of distributed participants that need to authorize, who can't do pre-registration of all the different endpoints that are available.

     

       4
       4
       +
       

     

       5
       5
       +
       This is made possible by [[OAuth]] advancements like RFC 7591 [Dynamic Client Registration](https://oauth.net/2/dynamic-client-registration/):

     

       6
       6
       +
       

     

       7
       7
       +
       > The OAuth 2.0 Dynamic Client Registration extension provides a mechanism for dynamically or programmatically registering clients. This spec was derived from the OpenID Connect Dynamic Client Registration spec and is still compatible with OpenID Connect servers.

     

       8
       8
       +
       

     

       9
       9
       +
       And increased security with RFC 9449 [Demonstrating Proof-of-Possession (DPoP)](https://oauth.net/2/dpop/):

     

       10
       10
       +
       

     

       11
       11
       +
       > [DPoP](https://datatracker.ietf.org/doc/html/rfc9449), or Demonstrating Proof of Possession, is an extension that describes a technique to cryptographically bind access tokens to a particular client when they are issued. This is one of many attempts at improving the security of [Bearer Tokens](https://oauth.net/2/bearer-tokens/) by requiring the application using the token to prove possession of the same private key that was used to obtain the token.

     

       12
       12
       +
       

     

       13
       13
       +
       [[Aaron Parecki]] who works on the OAuth spec has also written [[Let's fix OAuth in MCP]] which goes into more details.

     

       14
       14
       +
       

     

       15
       15
       +
       ---

     

       16
       16
       +
       

     

       17
       17
       +
       [[UCAN]] as a way to delegate capabilities also plays in this space. I am actively looking for high value use cases where these OAuth approaches do not solve the problem.

     

       18
       18
       +
       

     

       19
       19
       +

+17

_notes/Aaron Parecki.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       tags:

     

       3
       3
       +
         - person

     

       4
       4
       +
         - OAuth

     

       5
       5
       +
         - IndieWeb

     

       6
       6
       +
         - developer

     

       7
       7
       +
         - IETF

     

       8
       8
       +
       link: https://aaronparecki.com/

     

       9
       9
       +
       ---

     

       10
       10
       +
       

     

       11
       11
       +
       [[OAuth]] bio:

     

       12
       12
       +
       

     

       13
       13
       +
       > Aaron Parecki is Director of Identity Standards at Okta. He is the author of [OAuth 2.0 Simplified](https://oauth2simplified.com/), and maintains [oauth.net](https://oauth.net/). He regularly writes and gives talks about OAuth and online security. He is a member of the [OAuth working group](https://aaronparecki.com/oauth/), and is the co-founder of [IndieWebCamp](https://indieweb.org/), a conference focusing on data ownership and online identity. Aaron has spoken at conferences around the world about OAuth, data ownership, quantified self, and home automation, and his work has been featured in Wired, Fast Company and more.

     

       14
       14
       +
       

     

       15
       15
       +
       [[IndieWeb]] bio:

     

       16
       16
       +
       

     

       17
       17
       +
       > Aaron Parecki is the co-founder of [IndieWebCamp](https://indieweb.org/), an annual unconference on data ownership and online identity. Aaron helps people own their online content by creating specs such as the W3C [Webmention](https://www.w3.org/TR/webmention/) and [Micropub](https://www.w3.org/TR/micropub/) specifications. He also participates in the OAuth working group, maintains [oauth.net](https://oauth.net/), and wrote [OAuth 2.0 Simplified](https://oauth2simplified.com/). He has spoken at conferences around the world about OAuth, data ownership, quantified self, and even explained [why R is a vowel](https://www.youtube.com/watch?v=FGVJ0eXTRpw).

+13

_notes/Airtime.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://www.airtimetools.com

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - app

     

       5
       5
       +
         - saas

     

       6
       6
       +
         - video

     

       7
       7
       +
         - organization

     

       8
       8
       +
       aliases:

     

       9
       9
       +
         - mmhmm

     

       10
       10
       +
       ---

     

       11
       11
       +
       Airtime used to be called **mmhmm**, and is a video creator app. It includes a virtual camera that can do overlays and branding, and then has a subscription service that does video storage and sharing.

     

       12
       12
       +
       

     

       13
       13
       +
       Founded by [[Phil Libin]]

+16

_notes/Autonomous Communicator Protocol.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://www.germnetwork.com/blog/autonomous-communicator-ac-protocol

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - protocol

     

       5
       5
       +
         - MLS

     

       6
       6
       +
         - e2ee

     

       7
       7
       +
       permalink: /notes/acprotocol

     

       8
       8
       +
       ---

     

       9
       9
       +
       Protocol designed by [[Germ Network]] for secure, e2ee messaging using [[MLS]]

     

       10
       10
       +
       

     

       11
       11
       +
       > The AC Protocol encapsulates our chosen message security protocol, Messaging Layer Security (MLS), under a new identity layer, and above a new transport layer. In doing so, we decouple identity from transport, allowing us to remove identity from message envelopes in transit, and free both identity and transport layers to flexibly evolve identifiers to serve the divergent needs of each.

     

       12
       12
       +
       >  

     

       13
       13
       +
       > This protocol is an internet-native reimagination of your contacts — no longer a rolodex of stale information I accumulated about someone else, but a living, cultivated set of connections over E2EE messaging, within which we safely and consensually update each other as our ends of relationships evolve and move.

     

       14
       14
       +
       > 

     

       15
       15
       +
       > Alongside this post, we are open-sourcing our [Swift implementation](https://github.com/germ-network/autonomous-comm-protocol) of the protocol under the MIT license.

     

       16
       16
       +

+12

_notes/Castopod.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://castopod.org/

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - podcast

     

       5
       5
       +
         - ActivityPub

     

       6
       6
       +
         - app

     

       7
       7
       +
         - opensource

     

       8
       8
       +
         - PHP

     

       9
       9
       +
       git: https://code.castopod.org/adaures/castopod

     

       10
       10
       +
       github: https://github.com/ad-aures/castopod

     

       11
       11
       +
       ---

     

       12
       12
       +
       Open source podcast hosting software that is [[ActivityPub]] enabled. Each podcast has an AP account that can be followed / mentioned / replied to, and it embeds each episode so that it can be played directly from your feed.

+3

_notes/Germ Network.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://www.germnetwork.com/blog/autonomous-communicator-ac-protocol

     

       3
       3
       +
       ---

+33

_notes/Groundmist.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://groundmist.xyz

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - ATProtocol

     

       5
       5
       +
         - Automerge

     

       6
       6
       +
         - localfirst

     

       7
       7
       +
       ---

     

       8
       8
       +
       Groundmist is a series of experiments using [[Automerge]] for local first editing and private sharing, combined with [[ATProtocol]] for login and public publishing.

     

       9
       9
       +
       

     

       10
       10
       +
       It also explores using ATProto [[Lexicon]] in a local first context for data composability.

     

       11
       11
       +
       

     

       12
       12
       +
       ## Experiment 1: ATproto as Distribution for Local-First Software

     

       13
       13
       +
       

     

       14
       14
       +
       [Exploring the AT Protocol as a distribution layer for local-first software](https://hackmd.io/@grjte/groundmist-distribution)

     

       15
       15
       +
       

     

       16
       16
       +
       ## Experiment 2: Legibility

     

       17
       17
       +
       

     

       18
       18
       +
       ### Groundmist Notebook

     

       19
       19
       +
       

     

       20
       20
       +
       https://notebook.groundmist.xyz/

     

       21
       21
       +
       

     

       22
       22
       +
       > Groundmist Notebook is an AppView for the [WhiteWind](https://whtwnd.com/) blog entry lexicon _com.whtwnd.blog.entry_. All public WhiteWind content is available.

     

       23
       23
       +
       > 

     

       24
       24
       +
       > A local-first content editor is available at [editor.groundmist.xyz](https://editor.groundmist.xyz/). Use it to create your own notes and keep them off atproto until you're ready to publish.

     

       25
       25
       +
       

     

       26
       26
       +
       <https://github.com/grjte/groundmist-notebook>

     

       27
       27
       +
       ## Experiment 3: Composability

     

       28
       28
       +
       

     

       29
       29
       +
       ### Groundmist Sync

     

       30
       30
       +
       

     

       31
       31
       +
       > Groundmist Sync is a self-hosted personal sync server which is owned by your atproto identity. When you log in to other Groundmist applications (Library or Notebook), data will automatically sync to this server, unifying your local-first data into a personal data store that is analogous to your atproto PDS, but private.

     

       32
       32
       +
       

     

       33
       33
       +
       <https://github.com/grjte/groundmist-sync>

+19

_notes/Let's fix OAuth in MCP.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protocol

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - article

     

       5
       5
       +
         - OAuth

     

       6
       6
       +
         - MCP

     

       7
       7
       +
       published: 2025-04-03

     

       8
       8
       +
       author:

     

       9
       9
       +
         - Aaron Parecki

     

       10
       10
       +
       ---

     

       11
       11
       +
       [[Aaron Parecki]]'s thoughts on fixing OAuth in [[MCP]], where he walks through a bunch of OAuth flows. I'll quote the last bit which makes it clear how this impacts LLM usage:

     

       12
       12
       +
       

     

       13
       13
       +
       > The problem is only made worse with the explosion of AI tools. Every AI tool will need access to data in every other application in the enterprise. That is a lot of OAuth consent flows for the user to manage. Plus, the user shouldn't really be the one granting consent for Slack to access the company Google Docs account anyway. That consent should ideally be managed by the enterprise IT admin.

     

       14
       14
       +
       > 

     

       15
       15
       +
       > What we actually need is a way to enable the IT admin to grant consent for apps to talk to each other company-wide, removing the need for users to be sent through an OAuth flow at all.

     

       16
       16
       +
       > 

     

       17
       17
       +
       > This is the basis of another OAuth spec I've been working on, the [Identity Assertion Authorization Grant](https://datatracker.ietf.org/doc/draft-parecki-oauth-identity-assertion-authz-grant/).

     

       18
       18
       +
       > 

     

       19
       19
       +
       > The same problem applies to MCP Servers, and with the separation of concerns laid out above, it becomes straightforward to add this extension to move the consent to the enterprise and streamline the user experience.

+40

_notes/OAuth.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       link: https://oauth.net/

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - OAuth

     

       5
       5
       +
         - specification

     

       6
       6
       +
         - IETF

     

       7
       7
       +
         - login

     

       8
       8
       +
         - authorization

     

       9
       9
       +
       ---

     

       10
       10
       +
       > OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. This specification and its extensions are being developed within the [IETF OAuth Working Group](https://datatracker.ietf.org/wg/oauth/about/).

     

       11
       11
       +
       > 

     

       12
       12
       +
       > [OAuth 2.1](https://oauth.net/2.1/) is an in-progress effort to consolidate OAuth 2.0 and many common extensions under a new name.

     

       13
       13
       +
       ## RFC 7591 Dynamic Client Registration

     

       14
       14
       +
       

     

       15
       15
       +
       https://oauth.net/2/dynamic-client-registration/

     

       16
       16
       +
       

     

       17
       17
       +
       > The OAuth 2.0 Dynamic Client Registration extension provides a mechanism for dynamically or programmatically registering clients. This spec was derived from the OpenID Connect Dynamic Client Registration spec and is still compatible with OpenID Connect servers.

     

       18
       18
       +
       

     

       19
       19
       +
       https://datatracker.ietf.org/doc/html/rfc7591

     

       20
       20
       +
       

     

       21
       21
       +
       > This specification defines mechanisms for dynamically registering

     

       22
       22
       +
          OAuth 2.0 clients with authorization servers.  Registration requests

     

       23
       23
       +
          send a set of desired client metadata values to the authorization

     

       24
       24
       +
          server.  The resulting registration responses return a client

     

       25
       25
       +
          identifier to use at the authorization server and the client metadata

     

       26
       26
       +
          values registered for the client.  The client can then use this

     

       27
       27
       +
          registration information to communicate with the authorization server

     

       28
       28
       +
          using the OAuth 2.0 protocol.  This specification also defines a set

     

       29
       29
       +
          of common client metadata fields and values for clients to use during

     

       30
       30
       +
          registration.

     

       31
       31
       +
       

     

       32
       32
       +
       ## RFC 9449: OAuth 2.0 Demonstrating Proof-of-Possession (DPoP)

     

       33
       33
       +
       

     

       34
       34
       +
       https://oauth.net/2/dpop/

     

       35
       35
       +
       

     

       36
       36
       +
       > [DPoP](https://datatracker.ietf.org/doc/html/rfc9449), or Demonstrating Proof of Possession, is an extension that describes a technique to cryptographically bind access tokens to a particular client when they are issued. This is one of many attempts at improving the security of [Bearer Tokens](https://oauth.net/2/bearer-tokens/) by requiring the application using the token to prove possession of the same private key that was used to obtain the token.

     

       37
       37
       +
       

     

       38
       38
       +
       https://datatracker.ietf.org/doc/html/rfc9449

     

       39
       39
       +
       

     

       40
       40
       +
       > This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.[¶](https://datatracker.ietf.org/doc/html/rfc9449#section-abstract-1)

+13

_notes/Phil Libin.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       wikipedia: https://en.wikipedia.org/wiki/Phil_Libin

     

       3
       3
       +
       tags:

     

       4
       4
       +
         - person

     

       5
       5
       +
         - founder

     

       6
       6
       +
         - investor

     

       7
       7
       +
         - venturestudio

     

       8
       8
       +
       ---

     

       9
       9
       +
       Phil is probably best known as the CEO of Evernote.

     

       10
       10
       +
       

     

       11
       11
       +
       > born February 1, 1972 in Leningrad, USSR and moved to America when he was eight years old. He was CEO of the Silicon Valley software company [Evernote](https://en.wikipedia.org/wiki/Evernote "Evernote") from 2007 to 2015, then became Executive Chairman of Evernote's board. In September 2015, Libin joined General Catalyst Partners as its fourth general partner in Silicon Valley. In September 2016, Libin stepped down as Executive Chairman of Evernote's board of directors to focus on his role at General Catalyst Partners.

     

       12
       12
       +
       > 

     

       13
       13
       +
       > Currently, Libin runs the Startup [[Airtime]] (formerly mmhmm) and the [All Turtles](https://www.all-turtles.com/). Libin is a proponent of the benefits of hybrid and remote work and resides in Bentonville, Arkansas

+41

_notes/Protocols for Publishers.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       tags:

     

       3
       3
       +
         - protocol

     

       4
       4
       +
       ---

     

       5
       5
       +
       Web publishers are facing challenges on multiple fronts, which are in turn changing culture as a whole.

     

       6
       6
       +
       

     

       7
       7
       +
       - Search engines have broken the social contract with end users, where low quality sites float to the top, and that’s before we look at the integration of AI summaries or generated results (Google)

     

       8
       8
       +
       - Social platforms control algorithmic reach, gated by paid boosts and ads (Facebook, Twitter, Instagram)

     

       9
       9
       +
       - People are turning to answer engines in the form of LLM chat bots, with unknown bias, or reformulated content that often times doesn’t link to the original, published source (ChatGPT, Perplexity, Gemini)

     

       10
       10
       +
       - The pivot to video has just lead to new platform owners where publishers are forced to be participants to access reach (TikTok, YouTube, Instagram)

     

       11
       11
       +
       

     

       12
       12
       +
       Things are shifting, and the question is not of keeping up, but rather of working together to chart a path for publishers and share learnings together.

     

       13
       13
       +
       

     

       14
       14
       +
       ## Protocols for Publishers Summer Workshop

     

       15
       15
       +
       

     

       16
       16
       +
       July - August 2025 • Virtual & In person NYC

     

       17
       17
       +
       

     

       18
       18
       +
       - Invited Web Publishers

     

       19
       19
       +
       - Select Protocol Partners

     

       20
       20
       +
       

     

       21
       21
       +
       ### Virtual hackathon

     

       22
       22
       +
       

     

       23
       23
       +
       The virtual hackathon will run July 14th → August 8th. We’ll have a private chat server where participants will have access to resources, peer check ins, and direct support for protocol questions and troubleshooting.

     

       24
       24
       +
       

     

       25
       25
       +
       We’ll start with an overview and briefing of major trends and protocols, and share knowledge and challenges.

     

       26
       26
       +
       

     

       27
       27
       +
       We’ll focus on three emerging protocols:

     

       28
       28
       +
       

     

       29
       29
       +
       - MCP (Anthropic)

     

       30
       30
       +
       - Web Applets (Unternet + Mozilla)

     

       31
       31
       +
       - AT Protocol (Bluesky + Graze)

     

       32
       32
       +
       

     

       33
       33
       +
       Each week we’ll start with a deep dive and example of the protocol, and live discussion. Each web publisher team will work on one or more self guided learning exercises or experimental project. You can check in with your peers,

     

       34
       34
       +
       

     

       35
       35
       +
       ### Protocols for Publishers Summit in New York @ Betaworks

     

       36
       36
       +
       

     

       37
       37
       +
       After the virtual hackathon, we’ll plan to meet in New York for an in person summit, plus a few select guests. We’ll recap what we learned during the virtual hackathon, and share challenges and opportunities as publishers exploring protocols.

     

       38
       38
       +
       

     

       39
       39
       +
       An evening demo day will include a wider group of public demos and explorations of protocols, all hosted at Betaworks.

     

       40
       40
       +
       

     

       41
       41
       +
       Publisher teams are welcome to present publicly if they would like to share, otherwise we will showcase an inspiring selection of makers and builders on what they’re up to with protocols.

+33

_notes/Unnamed Good Pod.md

···

       1
       1
       +
       ---

     

       2
       2
       +
       tags:

     

       3
       3
       +
         - podcast

     

       4
       4
       +
       link: https://podcasts.cosocial.ca/@unnamedgoodpod

     

       5
       5
       +
       ---

     

       6
       6
       +
       A podcast that I did with Serena & Max from [[1RG]]. Using [[Castopod]] hosted at [[CoSocial]].

     

       7
       7
       +
       ## EP01: Introducing Unnamed Good Pod, 1RG Incubator, and AT Protocol

     

       8
       8
       +
       

     

       9
       9
       +
       <iframe width="100%" height="112" frameborder="0" scrolling="no" style="width: 100%; height: 112px;  overflow: hidden;" src="https://podcasts.cosocial.ca/@unnamedgoodpod/episodes/introductions-1rg-incubator-and-at-protocol/embed/light"></iframe>

     

       10
       10
       +
       

     

       11
       11
       +
       The first episode of Unnamed Good Pod.

     

       12
       12
       +
       

     

       13
       13
       +
       We introduce ourselves

     

       14
       14
       +
       

     

       15
       15
       +
       Max and Serena introduce [[1RG]] space & community in Toronto, and describe the new [1RG Incubator](https://incubator.1rg.space/).

     

       16
       16
       +
       

     

       17
       17
       +
       Boris goes deep on [[ATProtocol]], the open social protocol that powers Bluesky and other apps.

     

       18
       18
       +
       

     

       19
       19
       +
       ## Mentions and Links

     

       20
       20
       +
       

     

       21
       21
       +
       [[UKAI]] talking about cultural R&D:

     

       22
       22
       +
       

     

       23
       23
       +
       > At UKAI, we seek and test out approaches to culture that make sense of the world we are creating and handing down to future generations.

     

       24
       24
       +
       > 

     

       25
       25
       +
       > We call this work cultural research and development, and just like R&D in other fields, we are trying to make things better. In our case, we are trying to build resilience to massive volatility and change.

     

       26
       26
       +
       

     

       27
       27
       +
       Erin Kissane, saying we can't just have technologists retreat to cozy web spaces that THEY are capable of inhabiting, writing in [Against the Dark Forest](https://www.wrecka.ge/against-the-dark-forest/):

     

       28
       28
       +
       

     

       29
       29
       +
       > The public social internet is worth designing and governing in a way that demonstrates less than total amnesia about the history of human civilizations and the ways we’ve learned to be together without killing each other. For people with the ability and willingness to work on network problems, the real choice isn't between staying on the wasteland surfaces of the internet and going underground, but between making safer and better places for human sociability and not doing that.

     

       30
       30
       +
       

     

       31
       31
       +
       The [ATProto Browser](https://atproto-browser.vercel.app/) lets you look at the data in your user repo. You'll see Bluesky posts if that's all you've tried, but as an example [Recipe Exchange](https://recipe.exchange/) is an app that stores recipes in your account. This very much demonstrates user-owned data.

     

       32
       32
       +
       

     

       33
       33
       +
       You can [browse Boris' account](https://atproto-browser.vercel.app/at/bmann.ca) to get a sense for different types of data.