/

After the Feed | How you'd actually build it (deep dive)

October 21, 2026 • 4 min read • after-the-feed technology protocols deep-dive
After the Feed | How you'd actually build it (deep dive)

Part 5 of After the Feed, a field guide to how social media gets rebuilt. See all parts →

Heads up: Parts 5 and 6 are the deep dives — the actual mechanics. If you’re here for the story rather than the plumbing, skip the deep dives and you won’t miss the argument. Still here? Good. Let’s build the thing from Part 4.

The one idea that makes it possible: take the network apart

Every incumbent social platform is one company holding four things at once: your identity, your data, the feed that ranks it, and the moderation that governs it. That bundling is the source of the lock-in — and of the ad-driven feed you can’t escape.

The move is to unbundle it. There’s an open standard for exactly this — the AT Protocol, the plumbing under Bluesky — and its whole premise is that those four jobs should be separate layers that different parties can run and swap. Split them apart and portability, verification, and non-ad business models all become possible, because no single company owns the whole stack anymore.

Concretely, a post travels through five roles:

Five-layer pipeline Capture signs the photo as real; a personal data server stores it; a relay broadcasts it; an AppView builds feeds and re-checks signatures; a labeler stamps verified or flags unverifiable posts. 01 · CAPTURE The camera signs the shot Secure hardware marks it real at the shutter. 02 · PERSONAL DATA SERVER You own the storage The signed photo lives here — not in a silo. 03 · RELAY The firehose Broadcasts new posts across the network. 04 · APPVIEW Builds the feed you see Indexes posts and re-checks each signature. 05 · LABELER Stamps “verified real” Or flags what can’t be proven.
The pipeline. The two gold steps are where trust is created and checked; the rest is just moving data. Because the layers are separate, you can own your data and still use anyone's app.

The two highlighted steps are the whole point of the exercise. Everything else — storage, broadcast, indexing — is ordinary infrastructure. Trust gets created at capture and checked at the label.

Signing the photo at the shutter

Here’s the part that makes “verified real” more than a marketing badge. Modern phones have a secure enclave — isolated hardware that already guards your fingerprint, face scan, and payment keys. At the instant you take a photo, the app can ask that hardware to do two things: attest that the app itself is genuine and untampered (via Apple App Attest or Google Play Integrity), and cryptographically sign the raw image plus a C2PA manifest — sensor data, timestamp, a hash of the pixels — before the file is ever written to disk.

That signature is the receipt. It doesn’t prove the content is meaningful or honest; it proves the provenance — this is light that hit a real sensor at a real moment, not a generated image. And critically, you’re not trying to detect fakes after the fact (unwinnable). You’re proving the real ones at the source (tractable).

The hard part isn’t the crypto. It’s hiding it.

Every decentralized, cryptographic consumer product in history has died on the same hill: seed phrases, key management, wallet jargon, ten-step onboarding. Normal people will not do any of it, and they shouldn’t have to. So the rule for this whole build is one line: the protocol lives entirely beneath the presentation layer. If a user ever sees the word “cryptographic,” you’ve failed.

In practice that means:

  • Sign-up is a passkey, not a seed phrase. The account key is generated in the secure enclave and unlocked with Face ID — the same gesture people already use a dozen times a day. No twelve words to write on paper.
  • The data server is managed for them. Behind the scenes they get a personal data server on a hosted fleet; on screen they get three normal toggles — just me, my circle, everyone.
  • Identity looks like a username. Under the hood it’s a decentralized identifier; on screen it’s @you.theapp.
  • Portability is a button. If a power user ever wants to leave and self-host, one export hands them their whole signed archive and repoints their identity — no lost followers. The escape hatch exists, which is why you can trust the front door, but almost nobody needs to open it.

Done right, signing up and posting feels exactly like any normal app. The sovereignty is real; it’s just invisible.

Don’t launch on an island

The last piece is distribution. A brand-new network with no one on it is dead on arrival — the cold-start problem that Part 2’s winners all solved. Because this is built on an open protocol, you get a cheat code: publish to the wider network too. Every verified capture can also cross-post into the standard Bluesky ecosystem as an ordinary photo, with a link back. You inherit an existing audience and graph on day one, while your own app is the only place the verification, the optics, and the print options actually render.

None of this is exotic research. It’s assembled from shipping standards — an open protocol, secure enclaves, an open provenance format, passkeys. The novelty isn’t any one piece. It’s putting them together and then making them disappear.

Which leaves one honest question: if you’re not selling ads, how does a thing like this pay for itself? That’s the last deep dive.

Next in the series: Part 6 (deep dive) — how it pays for itself without ads, and whether the unit economics actually work. See all parts → · Get new parts by email

References

Related Posts

Comments