I went to look at how bsky wrote age verification, and holy lord, people don't just say that LLMs produce mountains of flaming hot dogshit for their health.
14
Replies
·
0
Boosts
So how does bluesky get an account's birthday to know if it needs age verification ? There's a system in bsky's code "useQuery" where you can provide a) some cheap way to initialize a value, and b) some query that can keep it updated from the server. Or so its supposed to go.
This is just one of many hilarious fallbacks: there is a clientside birthday cache. For some reason. For slop reasons. The thing containing birthday is "other required data." Sure. There is a function "get other required data from cache" - that's the "fast initial data" method. Then there's the "slow correct data" function, just normal "get required data"
However in the "get required data" there is.... Also an unconditional read from the birthday cache that overwrites whatever came from the server. So.
@jonny when you can’t tell if the code was generated by an LLM or by some dude at 3AM after pulling two all nighters… you probably should burn it to the ground and try again by hand after a nap.
@wordshaper
Oh no this is distinctly LLM, much much worse than all nighter dude code because all nighter dude code doesn't drown you in very serious sounding boilerplate
Essentially every single part of the system is so littered with fallbacks there are bound to be dozens of ways to bypass it clientside. Why is any of this clientside anyway? I can't even start to point to all the fallbacks. The region detection is baffling. All the greatest hits are here. Endless fallback chains, many ways to get the same value, comments that say "this is bad to do" and then doing it right away.
there are bound to be dozens of ways to bypass it clientside
There's a few client side ways here:
https://gist.github.com/mary-ext/6e27b24a83838202908808ad528b3318
I'm using the Self-hosted PDS Nginx config myself
@tom
Great to have a concrete list. I just kept staring at the code like "0% of this code should be here and 100% of it goes on the other side" - I was looking at the region fetching and good to know my hunch was right. Prefilling the response to just return "access: full" is also extremely funny
To be clear, fuck age verification, but this is like top tier slop. Only explanation that isn't swiss cheese brain is "doing it so mindblowingly badly on purpose for plausible legal cover to say you did it and make it hard to tell you didn't"
Only explanation that isn't swiss cheese brain is "doing it so mindblowingly badly on purpose for plausible legal cover to say you did it and make it hard to tell you didn't"
Aha! Finally, an important use case for LLMs!
I can't spend any more of my time on this. I won't spend any more time on this. I won't lose another day to marveling at how shitty the thing people tell me must become my new god is.
@jonny I love how they wrote it because you can just add one line to your adblock filter and it bypasses it.
@neuralreckoning @jonny yeah this is a well known method (well among some subset of people) to bypass it
tbh I think there's a fair chance bluesky knows this and it's there sorta on purpose in a "we think we are legally required to do this but 😉" sort of way
@ricci
@neuralreckoning
It is much much funnier than that
