And yeah, for sure the only reason people outside of bluesky cannot see the content is because they're still figuring out how to actually serve image bytes over HTTP, which turned out to be a technically difficult problem that there is no prior research about.
If you dont mind using the console apps, it seems like you are able to query from gosky and slurp all(?) of the data with the bigsky app. Im not sure if that is intended though. I dont even have an account or invite code yet -- just on my local server.
Came here to post the same episode. Strongly recommended; it's eye-opening, and it will give you a good idea of the incentives and the type of people you're dealing with (although you'll see the techniques are the ones you are already know: SIM swapping, social engineering, escalation of personal attacks, etc).
Get on record with law enforcement and state legal reps. Unauthorized authorization is a federal crime, and a paper trail is crucial for seeking recourse.
Contra the above dude, I don't think it's all that strange for Facebook employees to profit directly off of their access to these systems. See this article about how employees charge for verifications: https://mashable.com/article/instagram-verification-paid-bla...
