[Privacy] Consider not requiring servers & clients to keep timestamps of deleted messages.

[marek-lach]

Suggestion
It seems that the Matrix specs currently has a hard requirement to remember which evens/messages were redacted, and by whom.

Would it be possible to make logging of the usernames, timestamps and the very fact that a user has redacted a message an optional feature in the Spec, rather than a hard-must one?

As it stands, Matrix servers, and clients record, then display a record about each deleted message, such as this one:

@username removed this message 12:34

Despite the message being removed, a 3rd party can still collect enough metadata to know who redacted a message to whom, when. Can this be made optional, or adjustable by admins rather than mandatory in the specification, so that 3rd party servers/clients can also make it possible to turn off such deletion event log messages?

Thanks for considering,
M

[uhoreg]

Clients are not obligated to remember timestamps or the user performing a redaction. These is recorded by the server, and sent to clients.

This behaviour is due to the way redactions are handled in Matrix: they are handled by sending redaction events, which become part of the room event graph. This is done because we want to avoid specialized mechanisms for too many different parts of rooms, and because the event has to be authorized by all participating servers to ensure that it was allowed to be sent in relation to the part of the graph that it is in. So it is a requirement that it stores the person who performed the redaction, because all servers need to be able to tell whether that person was allowed to perform the redaction.

This requirement may be somewhat relaxed with proposals such as MSC1228, which aim to allow user identifiers to be decoupled from events. Also, I don't think the timestamp strictly necessary, but it is present in the standard event format. I'm unsure if removing it would be worth the effort if the user ID cannot also be removed.

[marek-lach]

I don't think the timestamp strictly necessary, but it is present in the standard event format. I'm unsure if removing it would be worth the effort if the user ID cannot also be removed.

This is understandable. It's better to keep the event format standardized across all of the spec, however, #1228 is definitely something that should be completed, and I am looking forward to, so'll keep an eye on.

Thanks for the clear & detailed explanation,
M