NSFW, because this is a pattern for him. So, he used to work on Beaker, a Web browser built on top of the Dat/Hypercore DHT. I recall my experience chatting with him and others on IRC. I had been interested because Dat and Beaker were supposedly built with ocap theory, and at the time I was helping to produce a capability-safe object-oriented programming language. Relevant highlights:

• He did not grok the idea that users might dig below the chrome and directly access APIs. This dovetailed with a lackluster approach to security. In capability theory, users are expressly permitted to do anything they are capable of doing; but Beaker's philosophy was that users ought to restrict themselves to only clicking buttons in Beaker's chrome.
• In general, interoperability was not a big priority. I'm not sure if there's multiple Hypercore implementations yet, but at the time, there was only one reference implementation and not enough documentation to reimplement it from scratch. So, I wouldn't be able to federate with their DHT using my custom software.
• I didn't know who the project leaders were. One time, one of the project leaders came onto IRC, and I made the mistake of greeting them. As a result, I was immediately banned from their IRC channel. However, none of them knew how IRC works, and so they did not kick me; in the aftermath, I listened as they went around the room and disavowed me, covering their asses by explaining that they didn't know who I was or why I was in the room.

Those first two points rhyme with his actions here. The third point is where I think we can see things heading in the future.

I actually kinda agree with him that these are not the biggest issues around. It is a very common issue (Discord for example has various bugs like this (and iirc even excludes security flaws like this from their bug bounty)) and at least they are working on workarounds.

The bigger issue here is the bad response to the person reporting the bugs.

Paul is one of the most approachable and reasonable of the bsky devs. Take someone like Why, who is a crypto dweeb, a rationalist and a Vibecamp regular.

If you start at rationalists, crypto bros or rationalist crypto bros, you may not be picking from the top of the barrel.

Bluesky has one of the best user bases and it's run by rationalist crypto bros who totally aren't nazis, they're just the other ten guys at the table. I think of them reading Scott Alexander rant for the past ten years about the EVILS of feminists, leftists, social justice warriors and non-race-scientists, and GUESS WHO YOUR USERBASE IS MFs