So why does Bluesky provide direct unauthenticated access to the PDS getBlobs endpoint? Once again illustrating the beauty of open source, there is an
issue describing the original motivation. In it, image labeling and user content export, as well as additional future use cases, are enumerated. There is also a
mention of the possibility of users hotlinking content and Bluesky for free hosting, so these issues are clearly top-of-mind. The
original implementation did not include the proper security headers, but they were
subsequently added.
Traditional social platforms can place more restrictions on blobs at time of upload because there is a limited set of valid content. The extensibility of Bluesky and the AT Protocol, which is what differentiates it from traditional networks, also necessitates more complexity. However, I, and clearly the awesome folks building Bluesky, think it’s clearly worth it.