Allow messaging users without adding them as a contact

[Frooxius]

Is your feature request related to a problem? Please describe.

Currently, it is not possible to message users without first adding them as a contact and having them accept. While this prevents unsolicited messages, it also leads to some issues.

Sometimes you want to message user, e.g. inviting them to a session (especially if it's a new user and you want to help them get setup, or when they're attending an event or game), but don't want to go through the hassle of adding them as a contact.

When receiving contact requests, it could also be helpful if the user could send a message alongside, which states why are they adding you and adding additional context.

Describe the solution you'd like

Allow users to message each other by default even when they are not contacts. You can simply find the user in the contacts list and message them there without needing to do anything extra.

However we also need to add a way to deal with unsolicited messages, since those might become a bigger issue once this change is made.

My proposal is that we add a number of new settings, which will provide more fine grained control:

• Ability to mute given user - they won't cause a ping and they won't show in the global unread counter (this can be useful in general, e.g. when getting auto-invites from headless)
• Ability to block message from given user - you won't be able to be messaged at all
• Ability to configure globally who can message you - Anyone / Contacts you added (regardless if they accepted) / Mutual contacts (both of you accepted) / People you've spent x amount of time in a session with
• Ability to configure message notifications for non-contacts separately - e.g. you can have non-contact messages not cause audible ping

Describe alternatives you've considered

Possibly sending user a "message request", but this isn't that different from sending them a contact request.

Additional Context

We don't plan to make this change immediately. I've created this issue because it's something that came up in the past and something I sometimes run into myself, but I want to open this up for discussion first.

Would this change with the options above for better control be something everyone's comfortable with? Are there any changes/suggestions to the proposed changes and additions you'd have?

Requesters

No response

[shiftyscales]

However we also need to add a way to deal with unsolicited messages, since those might become a bigger issue once this change is made.

I'd consider message requests #943 as a related issue which could help resolve this issue, @Frooxius - this effectively allows the user to screen the message and decide whether or not to respond.

---

There is also some overlap with the notification system rework #1918 and contacts UI rework #1116 in terms of having better interfaces for managing notifications on a per-user/group, etc. basis, and having a better starting point for implementing similar messaging/notification-adjacent features like invite requests #255.

I've previously also given some general thoughts on the messaging system in https://github.com/Yellow-Dog-Man/Resonite-Issues/issues/1508#issuecomment-2067389143.

---

I would recommend that by default we do not allow any user to message any other user with no prior input/interaction. E.g. you had mentioned "people you spend x amount of time in a session with"- I think that could be a good compromise in only permitting messaging between users that have recently been in a session together for some amount of time.

This would implicitly help resolve unsolicited messages by only allowing them from users that you have interacted with/been in the presence of in some form.

Otherwise- per my recommendation in https://github.com/Yellow-Dog-Man/Resonite-Issues/issues/1508#issuecomment-2067389143 - I would suggest we probably don't want message requests/non-contact messaging enabled by default at all. Having an additional quantifier like time spent in the same session could be a good way to make messaging a bit more open, while still also minimizing malicious activity, e.g. solicitation, spam, unsolicited/inappropriate messaging, etc. this feature could otherwise enable.

Other features like #1108 would also help a lot to give additional context to who a user is/where you met them/why they might be messaging you.

[Azavit]

If set to time in world as default, I could see the time thing being confusing to new users. As it would cause inconsistent experiences for new users who may not know the setting exists. (time with someone isn't something that is common on other platforms nor is it something all humans are acutely aware of)

Why could this person talk to me but this other person can't? would become a very common confusion point and players do not like to be confused.

Being able to message new users would also be very helpful for Mentors, Moderators and similar, being able to cover things in private rather than having to say things publicly which could also lead to less awkward situations.

And it's much better to assume the average person is a "decent person" rather than treating everyone as if they could be hostile actor as treating everyone as if they may be hostile only encourages more toxic and clique environments.

[JackTheFoxOtter]

When receiving contact requests, it could also be helpful if the user could send a message alongside, which states why are they adding you and adding additional context.

This would be a massive improvement. I frequently log in to find contact requests from usernames I don't recognize, and currently I both don't know who the person is / where we've met, but I also cannot ask them who they are without accepting the contact request.

[...] People you've spent x amount of time in a session with

I do think this could be a bit confusing, and somewhat counter intuitive to what users might expect from other messaging services. I'd personally suggest only deciding who can message you based on the relation to the other user (Anyone, Contacts, maybe Contacts+?). That would also be more consistent with how session visibility works.

But I do think the underlying idea of knowing if / for how long you've met a non-contact messaging you could be beneficial. Instead of using it as a "hidden" factor to determine if the message goes through or not, I'd propose adding it to be displayed prominently within the contacts dialog. If it would display how long I've hung out with people and (for me most importantly) where I've last met them, this would go a long way in making it easier for me to recognize who the person trying to communicate / add me as a contact is, and how they are related to me. Of course the aforementioned message along with the contact request would also help a lot. Another useful thing to display could be the amount of contacts you have in common with that person, similar to how Discord does it.

[Frooxius]

I don't think not allowing would be a good choice here - it pretty much means that we do not resolve the problems I have outlined in my original post and they will remain problems and keep causing friction, especially to new users.

Message Requests won't really resolve the issue fully - that's essentially the same issues with the contact requests, which are additional friction for new users.

I don't think "time spent in World" by default isn't a good default choice either - it's more complicated, especially for new users and it doesn't resolve the original problem. It's meant to be a choice for users once they become more familiar with the system, not a first time setting.

I feel that Resonite is somewhat of an outlier when it comes to messaging apps. E.g. both Discord & Telegram which I use a lot allow you to receive messages from non-contacts/friends by default. So do a number of other chat apps. It's something you can restrict after, but it's pretty common to be able to communicate with person without adding them first.

I think it's important to rethink how the messaging works, to align Resonite more with what people expect and to resolve a number of friction points, which are making it difficult to bring new users to events and to help get them setup, rather than just keeping status quo.

[shiftyscales]

Message Requests won't really resolve the issue fully - that's essentially the same issues with the contact requests, which are additional friction for new users.

I don't really see how?

Message requests (as it's implemented in Discord at least) lets a user send an initial message, and those messages are sorted away into their own inbox separate from the rest of the user's chats. The receiving user can review the message and either accept (or reply to the message which implicitly accepts it), or decline.

[TisFoolish]

Ability to configure globally who can message you - Anyone / Contacts you added (regardless if they accepted) / Mutual contacts (both of you accepted) / People you've spent x amount of time in a session with

I would definitely like to request a "friends of friends" mode as well. Something you have to opt into

[Frooxius]

@shiftyscales Because big part of the friction with new users is that you need to quickly message or invite them somewhere.

However since they don't have you as a contact, this requires instructing them outside of Resonite to accept a contact request, to be able to get the messages & invites from user helping them.

Similarly separating this into message requests that the user needs to find and accept would pose a similar friction and require instructing them outside of Resonite.

Being able to just message them directly would pose least amount of friction here.

I don't really see any major reasons to not do this change at the moment. It would help with new users getting on-boarded or getting them to events (e.g. one of the regular events I see this happening with is Blood On The Clocktower). The risk of a brand new user getting lots of unsolicited messages is low - they're new and most people don't know about them.

Once they get more familiar with Resonite, they will have options to lock the options down to their liking - we will provide multiple mechanisms to deal with annoying messages, so it's not like there won't be way to deal with them.

[shiftyscales]

Being able to just message them directly would pose least amount of friction here.

Message requests are messaging them directly. As mentioned, they could either just reply to it, in which case, it's accepted and they can continue chatting as usual- or if they wish to- decline it and not receive any further messages.

[Frooxius]

Being able to just message them directly would pose least amount of friction here.

Message requests are messaging them directly. As mentioned, they could either just reply to it, in which case, it's accepted and they can continue chatting as usual- or if they wish to- decline it and not receive any further messages.

Not according to the issue you linked. It states:

A "Message Request" inbox where users can receive incoming messages from users that they haven't "met" before, which then would be hidden, out of sight, or have independent/recluded number badges, to decrease the impact or overwhelmingness of spam.

This suggests a separate, less visible inbox for these messages and likely less or no notifications.

If message requests are just messaging user directly... then there's no difference from just messaging them directly - the feature does nothing that just receiving message doesn't.

[shiftyscales]

the feature does nothing that just receiving message doesn't.

It does though- as it'd prevent subsequent messages until such point as the message request is accepted (or the user replies to the message implicitly accepting further messaging).

Not according to the issue you linked.

If you read it in full you would also see:

or have independent/recluded number badges

https://support.discord.com/hc/en-us/articles/7924992471191-Message-Requests

It is a very prominent/visible thing.

[Frooxius]

the feature does nothing that just receiving message doesn't.

It does though- as it'd prevent subsequent messages until such point as the message request is accepted (or the user replies to the message implicitly accepting further messaging).

That's exactly my point. It adds additional friction to getting to the messages and therefore it doesn't resolve the issue.

Hence why I'm arguing that we should allow users to be messaged by default and once they get situated, have them adjust their settings.

I would appreciate if there are any arguments on why not to actually do this and reduce the friction as much as possible. I've raised that point in my previous comments and it got overlooked. I think those parts are more crucial to the discussion here.

[shiftyscales]

why not to actually do this

Using Discord as a point of inspiration- they do not allow universal/unsolicited messaging from users you haven't had any form of contact with.

In Discord, you need to have a server in common and have messages from server members enabled.

Otherwise, a user would have to add you as a contact on Discord first, just like in Resonite.

Discord still requires a connection to be made before users are able to contact each other, e.g. being in the same server, or being a contact. If that is your point of comparison- that is how Discord implements their messaging, contrary to what you stated above.

Without that base level of protection, unsolicited spam, phishing messages, harassment, and other generally abusive messaging is permitted. This is a problem that will get worse as the platform scales in size.

What I ask from you in turn- what use-cases are there for messaging a user you have never had any contact with at all in Resonite?

If they're a friend external to Resonite- you're presumably already in contact with them/have instructed them how to get in touch with you.

Otherwise if they're a (new) user you've met inside of a Resonite session- then having been in that session together would be the point of contact as I highlighted above- similar in nature to sharing a Discord server with someone.

[Frooxius]

Using Discord as a point of inspiration- they do not allow universal/unsolicited messaging from users you haven't had any form of contact with.

In Discord, you need to have a server in common and have messages from server members enabled.

Yes, but that's due to how Discord itself is built. Not every aspect will translate. Telegram for example allows direct messages too and it doesn't have the same concept of servers.

The setting to allow the messages is also on by default on Discord, not off - you can disable it afterwards to lock things down.

Without that base level of protection, unsolicited spam, phishing messages, harassment, and other generally abusive messaging is permitted. This is a problem that will get worse as the platform scales in size.

I don't understand the point here - my proposal includes adding settings to restrict this down in settings easily, which would combat these.

What I ask from you in turn- what use-cases are there for messaging a user you have never had any contact with at all in Resonite?

If they're a friend external to Resonite- you're presumably already in contact with them/have instructed them how to get in touch with you.

The problem is that this is what causes friction, especially to new users. Explaining things over text can be slow and inefficient, especially if the user is already dealing with a new platform.

The new user can also be in VR and not be checking their Telegram / Discord / other IM methods when they're being onboarded.

I've seen this happen enough times, where users are struggling to get users into a session or event and where just being able to message them directly would work.

[shiftyscales]

I don't understand the point here - my proposal includes adding settings to restrict this down in settings easily, which would combat these.

For a majority of users on any given platform/service, whatever is shipped as defaults will be what they use indefinitely. I just don't believe unfettered access to be able to message any Resonite user on the platform without any form of prior contact is a good/sensible default- an option- sure- but not a default.

[Frooxius]

For a majority of users on any given platform/service, whatever is shipped as defaults will be what they use indefinitely.

Do you have anything to support this claim?

I don't think this is really true, especially if the user gets bothered by unsolicited messages, they will look how to get rid of them - we can make the options very visible to them too.

[shiftyscales]

Do you have anything to support this claim?

I thought it was just a generally known/accepted thing- but tends to be how most services operate- even outside of tech.

E.g. https://www.sciencedaily.com/releases/2021/03/210311123507.htm

Researchers studying the Swiss energy market have found that making green energy the default option for consumers leads to an enduring shift to renewables and thus has the potential to cut CO2 emissions by millions of tons. The study investigated the effect of changes in the Swiss energy market that presented energy from renewable sources as the standard option for consumers - the 'green default.'

https://journals.lww.com/transplantjournal/Fulltext/2004/12270/Defaults_and_Donation_Decisions.4.aspx

The well-documented shortage of donated organs suggests that greater effort should be made to increase the number of individuals who decide to become potential donors. We examine the role of one factor: the no-action default for agreement. We first argue that such decisions are constructed in response to the question, and therefore influenced by the form of the question. We then describe research that shows that presumed consent increases agreement to be a donor, and compare countries with opt-in (explicit consent) and opt-out (presumed consent) defaults. Our analysis shows that opt-in countries have much higher rates of apparent agreement with donation, and a statistically significant higher rate of donations, even with appropriate statistical controls. We close by discussing the costs and benefits associated with both defaults as well as mandated choice.

This article (where I had found a couple of the linked research papers above) covers the impact that default options have. https://prodmapping.com/insights/the-power-of-default-options-in-product-user-experience/

There are many examples in the tech space of defaults being set in a way that benefits the company developing/distributing the software rather than the end-user, e.g. Windows nudging users heavily towards their software suite (and forcing them to create a Microsoft account to use Windows 11 unless they are savvy enough to know a very obscure workaround to use a local account), defaulting privacy settings to send Microsoft data on the websites you browse, the apps you use, etc. Likewise, making their default/preferred option more visibly obvious, e.g. making one of the options not even look like a button.

Websites which had cross-site tracking cookies, etc. until the GDPR stepped in requiring websites to visibly post their cookie policy, and allow users to consent to non-essential cookies (with the default being to not consent).

I don't think this is really true

It might not be of a majority of current Resonite users/VR/tech enthusiasts- but we are the outliers.

Hopefully from the above you can see that defaults can have a substantial impact in all things- not just tech- whether things are opt-in or opt-out can have a significant impact on things- especially in the long-term.

[Frooxius]

It is something that happens a lot in general, but I don't know if those examples are applicable here. For a lot of these issues people do not care enough about the things to make the conscious change.

The scenario here is fair bit different - if user gets pestered by unsolicited or spam messages, that would give them reason to adjust those settings, because they're being directly affected by it.

Would user in such scenario never change the setting either? That seems a fair bit more unlikely to me - and that's why I think it's not true in this context, that user would just leave it unchanged and not use any of the options to combat the spam if they get it.

The change is also done to benefit users - reducing the frustration and confusion when they are being brought into the platform.

---

There is a potential solution there too though - we can default new users to be able to receive messages and then after certain amount of hours/days, we switch them to a bit more restricted settings if they haven't changed them yet.

This will add a fair bit of complexity, so it might not even be something to consider for initial implementation - but we could make such change to combat spam if/once it actually occurs as a substantial problem.

[Azavit]

Changing messaging systems for people seems bad, let them change it on their own.

Follow the footsteps of all other social platforms, they have already done testing and know what is best for a social platform and that is (for the majority of them) free messaging non friends until that feature is turned off.

No messaging by default means no social aspect and that is bad for a social platform.

[shiftyscales]

I'm not asking for no non-contact messaging by default, @Azavit. I'm asking for there to be just a single point of contact- even if that's just having existed in the same Resonite session as the other user- similar to what Discord does. That really doesn't feel like an untenable default to me.

[Frooxius]

@shiftyscales Problem with that is that is doesn't resolve the issue that I am trying to solve with this, so in effect, you're asking for will result the new user friction remaining.

[Azavit]

I'm not asking for no non-contact messaging by default, @Azavit. I'm asking for there to be just a single point of contact- even if that's just having existed in the same Resonite session as the other user- similar to what Discord does. That really doesn't feel like an untenable default to me.

Even that can be a problem... for example needing to message someone from discord and not being able to say "Hey I'm this mentor from discord, we talked earlier." because you haven't been in a world with them. Or "hey I found this project of yours and would like permission to use it in my own" would not be able to be done with out adding contacts or meeting the person first which causes friction.

Resonite doesn't have the infrastructure like discord has nor the concept of servers or similar. (server in discord means something different than a server in resonite)

[JackTheFoxOtter]

As someone who often onbords new users, I fully agree with Froox's rational here. Having to add someone as a contact before messaging / inviting them is a friction point. Splitting messages and message request would be a different friction point.

Adding the ability to receive messages from non-contacts by default, with the option to opt out, sounds like a reasonable way to go about it. I don't think the default settings should be treated as a "security" measure against spam and harassment. The UI should allow users to easily report messages & block the sender in question to provide security in those situations, but that would apply regardless of if the sender is a contact or not, work regardless of configured messaging level, and would be a separate feature.

[Amunak]

Without that base level of protection, unsolicited spam, phishing messages, harassment, and other generally abusive messaging is permitted. This is a problem that will get worse as the platform scales in size.

That can be easily solved later by having an easy way to report people (which by the way is an issue even now, when most new players have no idea moderation even exists let alone how it works).

---

As an idea, what if instead of "you spent X time with this person" you could message anyone you are in any session with, even for, say, up to an hour or so after either of you leave the session? Then if you start the conversation you can message each other normally, but if you don't initiate it it "expires" and you can no longer message them out of the blue. Similarly if you are inactive for a few weeks this would prevent random people (spammers) from just finding you and messaging you.

This would also nicely complement with #954, allowing you to, say, re-invite people who crash, regardless of whether they were there for a minute or 5.

Additionally, you could have options to allow only Patreon members or Mentors (and other official roles) message you, and have that by default, effectively solving issues of mentoring players while not allowing random new (potentially spam) account messaging everyone. It's also much less likely that a patreon member would spam people and risk getting banned, than a new user.

I would consider waiting with setting stricter defaults though and only do it when/if it ever becomes an issue in the first place. You can always change the defaults for new users later.