Will apps built on permissionless social protocols have lasting moats?