Allow content to be deleted/revoked

[gordonbrander]

(A) As the author of a note, when I accidentally publish a note, or change my mind about publishing a note, I want to be able to remove that note from IPFS syndication, including past historical revision, and have other peers revoke those revisions as well.

(B) As an author saving or transcluding someone else's note, I want to be able to delete that note from my corpus.

This issue covers cases where individuals wish to un-publish, delete, revoke, or tombstone content. Please discuss related user stories and topics here.

Related stories: https://github.com/subconsciousnetwork/noosphere/issues/27

[gordonbrander]

Note that A is in conflict with

(C.1) As a user, I want to be able to keep a personal archived copy of notes that I save, transclude, or link to.

(C.2) As an archivist, I want to be able to keep an archived copy of notes for historical record, or for public record.

There's a tradeoff here. However, my sense is that (A) takes precedence in importance for most cases. There are likely exceptions, such as archivists of political figures, public figures, journalistic use-cases, public data, etc.

Note that, just as with email, there are limitations on enforcing revocation in any distributed system. However, we could make respecting revocation requests from the original author a default behavior for peers.

It may even by possible to soft-enforce norms around revocation by peers through reputation. For example, peers that revoke content and see other peers syndicating it after being notified of revocation could stop peering with that peer. This is probably related to user stories around peer reputation for other purposes, such as spam prevention.

[bfollington]

Much like the internet of today it seems impossible to guarantee deletion since a malicious client can choose to implement the protocol improperly. I like the peer enforcement model, especially if most users are accessing Noosphere via first-party clients and gateways. However, I wonder if there's significance to the motive for retraction? I feel like there's a difference in the way we might want to handle:

1. retraction of banal content after accidentally publishing
2. retraction because you no longer support the content you published
3. retraction because of personal abuse or safety concerns (doxxing etc.), and
4. retraction of illegal content

For both 1. and 2. it seems like tombstoning is sufficient. If you want to walk the version stream and find the retracted content then that's fine so long as you realise you're going against the author's wishes.

Not sure how we're thinking about 3 and 4. Jack's thoughts on moderation/deletion via algorithmic choice are appealing to me but the proposed system doesn't actually square with protecting the abused or following the law as it exists today. A post-deletion future seems inevitable but culture will take a while to integrate it.

Worth calling out: perhaps the best solution is to try and discourage publishing content that would need to be retracted in the first place? We can minimise accidental publishing or perhaps warn users "hey looks like you could be publishing sensitive info here!" etc.