search

swicg / general

General issue tracker for the group
https://www.w3.org/community/swicg/
43 stars 2 forks source link

"Private user" discovery #11

Open strugee opened 7 years ago

strugee commented 7 years ago

Mastodon would like the ability to proactively discover if a user's account is "private" or not, so it can properly inform users in the UI. It was suggested on today's ad-hoc Mumble call that this could be done with a binary field on the actor profile.

Gargron commented 7 years ago

Not sure if this needs to be mentioned here or not, but we agreed that such an "extra" indicator could be in an extension rather than the core ActivityPub protocol.

ghost commented 7 years ago

You might wish to define what you mean by a private account. My projects have a wide range of permissions and this could map to a subset of those permissions which you have lumped together to indicate 'private'. Is this permission to view the profile, the stream, be shown in directory listings, display friends/followers, set permissions on outgoing posts, etc. or some combination of these ? Is a person allowed to hide their profile photo and name? How about their discovery URL? We also have slightly different settings for private forums than are applied to private social accounts. In my view it makes more sense to enumerate the specific permissions which are being withheld, because my private accounts might have completely different settings than yours; and in fact two 'private accounts' on my service might have completely different privacy/permission settings from each other.

Not sure if this needs to be mentioned here or not, but we agreed that such an "extra" indicator could be in an extension rather than the core ActivityPub protocol.

Yes and no. Agreed that this could vary widely across different services, but presumably we don't want to get into another situation like the mastodon:scope issue.

Gargron commented 7 years ago

We are looking to mandate that each Follow must be answered with an Accept before it counts, and you could either Accept automatically instantly, or manually review and Accept/Reject. That'd be the difference here - instant-follow account vs pending-follow-request account. Because Follow->Accept would be mandated at protocol level, there would be no protocol-side downside to not knowing in advance whether the account is "locked" or not in this way, it would be merely a user-facing indicator. So it could be in an extension.

strugee commented 7 years ago

Right. So to clarify, by "private" I meant, "an account that will require approval for follows". Nothing more, nothing less.

ghost commented 7 years ago

That's our default behaviour incidentally, so I understand. This should really be a permitted behaviour in the spec.

5.3 Followers Collection Every actor SHOULD have a followers collection. This is a list of everyone who has sent a Follow activity for the user, added as a side effect. This is where one would find a list of all the users that are following the actor. The followers collection MUST be either an OrderedCollection or a Collection and MAY be filtered on privileges of an authenticated user or as appropriate when no authentication is given.

That really needs re-wording to indicate that the act of following is not an automatic right granted by the requestor but MAY be subject to approval by the requestee.

One could provide an optional 'follow-pending' collection containing not yet approved followers. I'd be happy to support that, but not all folks will want to share this information, so it MAY be filtered|empty. The mere existence of such a collection could infer that following requires approval. As suggested a binary flag would also be suitable.

Anyway I'd be happy to support this in any form you come up with, but I think it needs a more descriptive name than 'private' to indicate it's a follower approval requirement.

strugee commented 7 years ago

That really needs re-wording to indicate that the act of following is not an automatic right granted by the requestor but MAY be subject to approval by the requestee.

Yeah, this was raised today in w3c/activitypub#244. I can't speak for Chris but I think this will probably make it in.

Anyway I'd be happy to support this in any form you come up with, but I think it needs a more descriptive name than 'private' to indicate it's a follower approval requirement.

Right. I typed this issue up in a hurry, sorry :-)