Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add message redaction #524

Merged
merged 29 commits into from
Apr 9, 2024
Merged

Add message redaction #524

merged 29 commits into from
Apr 9, 2024

Conversation

progval
Copy link
Contributor

@progval progval commented May 26, 2023

Rendered

This is #425 with the following changes:

  • no edits, because it's way more complicated to handle them safely, so IMO it should be deferred to a future spec
  • targetmsgid is moved to a param (instead of a tag, because it didn't really make sense with a dedicated verb)
  • added an optional reason (just because I can)
  • renamed "delete" to "redact" so the cap name doesn't conflict with the other one (and there is some argument esp. in Matrix circles that "redact" better reflects that it's best effort and other clients might not respect it, but I don't really buy it)
  • explicitly gives a lot of freedom to servers wrt chathistory
  • new UNKNOWN_MSGID fail tag (because I noticed that's needed while implementing the spec)

Implementations:

@DarthGandalf
Copy link
Member

  1. client A sends a message
  2. client B receives the message
  3. client B disconnects
  4. client A sends REDACT
  5. client B reconnects

Client B has no chance of deleting the message even if it supports it. Subject to chathistory, if server sent such REDACT upon reconnect, if the buffer was big enough.

@progval
Copy link
Contributor Author

progval commented May 26, 2023

@DarthGandalf It's unreasonable to make it a requirement; but I mentioned in the "Server implementation considerations" that servers may send it in the chathistory batch when clients re-join (Ergo, Insp, and Unreal already send such a batch for clients without the draft/chathistory cap who aren't bots)

Copy link
Contributor

@delthas delthas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😋

extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved

This specification enables messages to be deleted.
Use cases include retracting accidentally sent messages, moderation,
and removing a [`+draft/react` client tag][], amongst others.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What should happen to existing reactions to the redacted message? And what should happen to attempts to redact such reacts later?


* exclude it entirely
* replace it with the `REDACT` message with the same value as `@msgid` tag
* add the `REDACT` message to the response (not counting toward message limits)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does this interact with the event-playback cap?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As in, redacting JOIN/PART/... messages?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My question is basically: are REDACT messages always returned by chathistory regardless of event-playback?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd say yes. The motivation for event-playback is that it's hard to deal with channel state (membership, op list, ...) and not necessarily very useful, right? Here this shouldn't be an issue.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. I agree.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need to be specified in this spec?

@emersion
Copy link
Contributor

Goguma impl (currently untested): https://git.sr.ht/~emersion/goguma/log/redact

As emersion pointed out, it's just too weird
* exclude it entirely
* replace its second parameter and/or tags with a placeholder and
add the `REDACT` message to the response (not counting toward message limits)
* add the `REDACT` message to the response (not counting toward message limits)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not counting toward message limits

This is at odds with #437 (comment).

Clients have no way to differentiate between a REDACT returned implicitly by chathistory due to another message, or a standalone REDACT message,

Standalone REDACT messages are important to return in the case of a mobile client synchronizing its history at regular intervals via chathistory. Example:

  • A PRIVMSG is sent at 20:00
  • A mobile client synchronizes, gets the PRIVMSG via chathistory
  • A REDACT is sent at 20:30
  • The mobile client synchronizes again, queries all messages sent strictly after 20:00

The server must return REDACT at that point, or else the client misses it.

Copy link
Contributor Author

@progval progval Jun 1, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do clients need to differentiate between the two?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the linked discussion above, my clients check whether there is more history to fetch by counting the number of messages. If it's less than the limit, no more messages.

Hm, but now that I've written this, this would only cause the number of messages to exceed the limit, causing needless but harmless chathistory requests in the edge case where there are no more messages. So it should be all fine?

Does a standalone REDACT count towards the limit? I'd say yes. This draws a line between "standalone" and "context" messages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

didn't the linked discussion settle on the empty batch to signify the end?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The discussion hasn't really settled AFAIU, and my clients are still doing the limit check.

Please note, there is an interleaved discussion about what should happen when a channel has chathistory disabled, and this one has settled on empty batches instead of a FAIL. But it's unrelated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ugh, true

Copy link
Contributor

@emersion emersion Jun 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are two ways to fix this issue that I see:

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does a resolution to this issue require changes to the redaction spec, or just to the chathistory spec? i.e. is this a blocker for merge/ratification?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only the chathistory spec IMO

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just spotted this other comment from @emersion that appears unaddressed https://github.com/ircv3/ircv3-specifications/pull/524/files#r1213547049

This PR has become a bit of a nightmare to review lol.

@emersion
Copy link
Contributor

emersion commented Jun 9, 2023

Goguma impl has been tested with Ergo.

@progval
Copy link
Contributor Author

progval commented Nov 11, 2023

@jwheare Anything blocking merge?

@progval
Copy link
Contributor Author

progval commented Nov 17, 2023

@jwheare ping?


* `FAIL REDACT INVALID_TARGET the_given_target :You cannot delete messages from the_given_target`
* `FAIL REDACT REDACT_FORBIDDEN <target> <target-msgid> :You are not authorised to delete this message`
* `FAIL REDACT REDACT_WINDOW_EXPIRED <target> <target-msgid> <window> :You can no longer edit this message`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is the window communicated to clients?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, it's not. It could be an informational mode though.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's an easy thing to add later if needed. I don't believe it's worth blocking this PR because of this.

extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Show resolved Hide resolved

This specification enables messages to be deleted.
Use cases include retracting accidentally sent messages, moderation,
and removing a [`+draft/react` client tag][], amongst others.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I definitely think that react needs a way to unreact that doesn't rely on this spec. We can maybe mention that reactions can be REDACTed and this should have the same result, but that probably belongs in the react spec, not this one.

I would rather remove all references to react in this spec, but I can't think of another TAGMSG for the examples section. Original discussion here: https://github.com/ircv3/ircv3-specifications/pull/425/files#r602543189

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it makes sense to have it both in the intro of this spec, and formally in the react spec

extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
extensions/message-redaction.md Outdated Show resolved Hide resolved
@emersion
Copy link
Contributor

emersion commented Feb 9, 2024

Gentle ping

* Allowing channel moderators or server admins to delete unwelcome messages from others
* Specifying a cut-off time after which message edits are no longer allowed

If a message is redacted while a client is not present in a channel, servers may send the `REDACT` command in a `chathistory` batch when it re-joins the channel.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If a message is redacted while a client is not present in a channel, servers may send the `REDACT` command in a `chathistory` batch when it re-joins the channel.
Servers may send the `REDACT` command in a `chathistory` batch.

Removes the implication that servers are tracking whether clients are present in a channel or not.

Should this section be in the normative part of the spec?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The implication was intentional. And the normative already says REDACT can be sent in chathistory batches.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The spec talks about the chathistory spec, not chathistory batches.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ugh. I guess I meant all chathistory batches rather than just chathistory responses

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still not sure why this implication is necessary. Which servers keep track of past membership when determining whether to send REDACTs in chathistory?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

none of them, but they could if they wanted to

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That could apply to a lot of things, what's the motivation for the special case here. Are you thinking of this in the context of e.g. the server can send a REDACT and omit the original PRIVMSG?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, so that clients end up showing the same things as if they were in the channel the whole time

Co-authored-by: James Wheare <[email protected]>
@jwheare jwheare merged commit 0a9a4f3 into ircv3:master Apr 9, 2024
@jwheare
Copy link
Member

jwheare commented Apr 9, 2024

Merged due to complexity of further review within this PR. Follow up unresolved issues are here #537

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants