Greg Scallan @gregscallan.com · 26/08/2026Agreed, we want users to have control over their data. We are actively working on lexicons to support that. It was only recently that we required an AT account for every surf account, and this is one of the reasons why. Who verifies that email and trust is another concern. 150 5
Greg Scallan @gregscallan.com · 26/08/2026That being said, once you verify your surf account and link a bluesky account, I don't see a reason we could not allow signing in with just bluesky since we only allow a given bluesky did to be mapped to a single surf account 130 3
Greg Scallan @gregscallan.com · 26/08/2026You HAVE to create an account. Your data (custom feeds) are not stored in your PDS or Mastodon instance. We absolutely need a verified email address for privacy compliancy. So, we have to create an account with a verified email address or else we run into all sorts of legal issues. 330 3
Reposted by Greg ScallanMike McCue @mmccue.bsky.social · 26/08/2026@devingaffney.com and @ngerakines.me have built something very special. I'm really excited to see them continue to advance Graze as the ultimate feed building platform while Surf & Flipboard help millions of new users discover and experience these feeds in new ways that we'll be designing together. 67822 78
Reposted by Greg ScallanGraze Social @graze.social · 26/08/2026graze.leaflet.pubBetter, TogetherAn announcement from Graze 1616040 160
Greg Scallan @gregscallan.com · 15/08/2026needed to still restart one of the servers ... hate to ask, but try again? Maybe on web in incognito so no session stuff is cached? 120 2
Greg Scallan @gregscallan.com · 15/08/2026Try now, we rolled out what is hopefully a fix. Let me know if that doesn't work. 120 2
Greg Scallan @gregscallan.com · 14/08/2026Looking at their code, I think this would work. That said, I'm wary of doing it now. We just stabilized this flow after a rough rollout, and getServiceAuth is a direct-PDS call so the aud semantics need real testing before I trust it in prod. Great idea, I'll keep this one on my radar. 110 1
Greg Scallan @gregscallan.com · 14/08/2026We are keeping getServiceAuth?aud=* as it is what authorizes video uploads to your own PDS. The aud=* is broader than we'd like: the real audience is your own PDS, which we can't hardcode per-user, so we're looking at whether we can narrow it still. 100 1
Greg Scallan @gregscallan.com · 14/08/2026Those two (activateAccount/deactivateAccount) were migration-only plumbing we don't actually use in the Surf app itself, so we do not need to ask for it on a normal consent screen. I will remove them today, thanks for catching and saying something. 120 2
Greg Scallan @gregscallan.com · 13/08/2026In general oauth is better than the app password approach, IMHO. A new login (within the last 24 hours) would be ideal to minimize the scopes you granted to surf the last time oauth was used. 120 2
Greg Scallan @gregscallan.com · 13/08/2026Looks like the OAuth is working. The bug's on our side: "Log in" with a Bluesky account that isn't registered on Surf yet returns a generic error instead of sending you to sign-up. To get you in now: use "Sign up / Continue with Bluesky" rather than Log in. Does that work? 100 1
Greg Scallan @gregscallan.com · 13/08/2026We are going back the old way for 3rd party PDS's because they seem in most cases not yet to support these new scopes, will keeo it for bluesky pds for now 100 1
Greg Scallan @gregscallan.com · 13/08/2026ok, finally, the reduced permission set is live 🙏 and ... yeah I broke our own login shipping it (a cached-scope mismatch + a permission-set quirk with app-view reads). Working now with granular scopes, no more transition:generic, and no chat/DMs or email requested. Thanks for the push + patience. 120 2
Greg Scallan @gregscallan.com · 13/08/2026Good callout, we no longer requests transition:generic. We now ask for app.bsky.authFullApp plus only the specific scopes our features actually use (posts, likes, follows, profile, media, custom feeds). This should be live on surf.social now. Appreciate you keeping us honest.surf.socialSurf 130 3
Greg Scallan @gregscallan.com · 02/08/2026I really appreciate you working with us, it has helped us understand how these scammers circumvent various checks many of us have in place. We are continuing to track and stop as our tools uncover them 010 1
Greg Scallan @gregscallan.com · 29/07/2026Is your app to the latest version — recent builds block these automatically and older ones don't. If it happens again, screenshot the page with the web address bar visible (that URL is what lets us block it) and note the time. We're actively killing these — thanks for flagging. 300 3
Greg Scallan @gregscallan.com · 29/07/2026Actually, looking at the code, this can happen with our ad that is supposed to be pinned at the bottom of the screen with a bad actor 100 1
Greg Scallan @gregscallan.com · 29/07/2026These are happening on the publishers website. Do you know the full article (or domain) of the publisher? There is not much we can do about that since this is a web view loaded on the publishers website (just within our app). Same for reader view to a large degree (we don't run that part) 100 1
Greg Scallan @gregscallan.com · 14/07/2026confirmed ... they rotated these bad ads from one dsp to another ... working on it. this is helpful, thanks 210 2
Greg Scallan @gregscallan.com · 14/07/2026they did, we've found the primary culprits and bad ad reports are down quite a bit, let us know if things are not better for you 100 1
Greg Scallan @gregscallan.com · 09/07/2026and the new clients found the rotating bad ad domains ... I've blocked 3 of them, but they will keep rotating. Hopefully beginning now things are much better 110 1
Greg Scallan @gregscallan.com · 09/07/2026We released new clients. I was able to block a bad domain reported in them, it is unclear yet if that will work (need 1 more day to see if the advertisers are lying in what they are displaying). We are close. 110 1
Greg Scallan @gregscallan.com · 08/07/2026Thanks ... we are waiting for apple and play store reviews to complete that have additional data that should help us identify exactly the bad ad ... this scam ad is changing the underlying redirected url but reporting with the 4.3.56 build will give us the exact domain it is happening with. 110 1
Greg Scallan @gregscallan.com · 06/07/2026Thank you, I think we found it. Will work with the team today to get rid of that 210 2
Greg Scallan @gregscallan.com · 03/07/2026Thanks for flagging — and sorry the bot rejected your screenshot. This is a malicious ad redirecting our in-app browser to a fake scan, not the app being infected. We're tracking down the exact creative. Can you DM the date/time + which feed you were in when it last hit? 120 2
Reposted by Greg ScallanAnuj Ahooja @quillmatiq.com · 30/04/2026This is the first of my cross-Atmosphere service experiments, and I hope you enjoy using it as much as I did building it. Go and Disperse your links all over the Atmosphere! disperse.social 4/🧵disperse.socialDisperse 0131 13
Reposted by Greg Scallannilay patel @reckless.bsky.social · 21/04/2026We are going to run away from Wordpress to do this because we need to bridge social back IN. We have plans! @mmccue.bsky.social ;) 8582 58
Greg Scallan @gregscallan.com · 17/04/2026We rolled out what we think is a fix, can you see if it works for you? 120 2
Greg Scallan @gregscallan.com · 10/04/2026What do you mean exactly by multi page support? We have a. Internal beta of site.standard working if you are referring to that 010 1
Greg Scallan @gregscallan.com · 08/04/2026If you log out and access the feed from your current browser, does it work? 111 1
Greg Scallan @gregscallan.com · 08/04/2026Can you try now? We rolled out what should either fix or give us more info. If it still fails, similar pastebin would be phenomenal if possible to do. 110 1
Greg Scallan @gregscallan.com · 06/04/2026Do you know how to use developer tools in chrome (View->Developer->Developer Tools)? If so, it could help us identify the problem if there are any errors in the console or any failed requests to surf.social ... if not, we can and reproduce here with some more testing (I can't repro it)surf.socialSurf 220 2
Greg Scallan @gregscallan.com · 06/04/2026Some screenshots from pckt blogs .... is there a way to get a list of all did's that have posted long form posts for pckt blogs so I can test this better? 130 3
Greg Scallan @gregscallan.com · 04/04/2026It's not. It would be difficult (impossible?) to do that given we try to recommend things based on your actions (you read X things about topic Y). At best, we are pseudonymous usage logs with data minimization: no emails, usernames, real names, no ip addresses, no UA's, etc...). 010 1
Greg Scallan @gregscallan.com · 03/04/2026This is on standard.site? We have an internal prototype working. No ETA on when we release it.standard.siteStandard.site - One schema. Every platform.Standard.site provides shared lexicons for long-form publishing on AT Protocol. Making content easier to discover, index, and move across the ATmosphere. 2101 10
Greg Scallan @gregscallan.com · 03/04/2026I'm not seeing that ... if I got to surf.social/feed/surf%2F... every post has #taco in it. You MAY not see that .... I've seen bluesky posts with 50 hashtags one of which is #taco but we prune it in the UI but still works for search. Send a screenshot to me of what you are seeing maybesurf.social#taco on SurfSurf - #taco 210 2
Greg Scallan @gregscallan.com · 03/04/2026It should "just work" ... I think we have a very short duration PLC directory cache, so it might take a minute or so for the rotation to take affect on our side. 010 1
Reposted by Greg ScallanMarci McCue @marcimccue.bsky.social · 02/04/2026And just for fun, today we also launched a site for @surf.social swag!surfsocial-shop.fourthwall.comSurfWelcome to the official Surf shop, where the swag celebrates a future built on the past. 1309 30
