{"action":"created","issue":{"url":"https://api.github.com/repos/Gargron/mastodon/issues/223","repository_url":"https://api.github.com/repos/Gargron/mastodon","labels_url":"https://api.github.com/repos/Gargron/mastodon/issues/223/labels{/name}","comments_url":"https://api.github.com/repos/Gargron/mastodon/issues/223/comments","events_url":"https://api.github.com/repos/Gargron/mastodon/issues/223/events","html_url":"https://github.com/Gargron/mastodon/issues/223","id":191243110,"number":223,"title":"Write a spec to implement and support private messages (DMs)","user":{"login":"hach-que","id":504826,"avatar_url":"https://avatars.githubusercontent.com/u/504826?v=3","gravatar_id":"","url":"https://api.github.com/users/hach-que","html_url":"https://github.com/hach-que","followers_url":"https://api.github.com/users/hach-que/followers","following_url":"https://api.github.com/users/hach-que/following{/other_user}","gists_url":"https://api.github.com/users/hach-que/gists{/gist_id}","starred_url":"https://api.github.com/users/hach-que/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hach-que/subscriptions","organizations_url":"https://api.github.com/users/hach-que/orgs","repos_url":"https://api.github.com/users/hach-que/repos","events_url":"https://api.github.com/users/hach-que/events{/privacy}","received_events_url":"https://api.github.com/users/hach-que/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-23T11:10:30Z","updated_at":"2016-11-23T16:12:08Z","closed_at":null,"body":"We should write a spec to support the sending private messages to other users in a federated network in a secure manner.  As far as I'm currently aware, this functionality doesn't exist in Mastodon, and doesn't existing in the wider federated network.\r\n\r\nThe basis for the spec so far is something like:\r\n\r\n* Makes use of private/public key pairs.\r\n* Each user's account Atom feed supplies a public key.\r\n* When sending a private message to a user, the sender encrypts the message with the user's public key.  Only the instance on which the target user resides can decrypt the message.\r\n* The encrypted message is then posted into same feed / messaging protocol as public messages, but with an additional flag to indicate that it's encrypted.\r\n* Instances and clients hide messages that they can't decrypt (even if they don't hide the message, all users will see is the encrypted content instead of the actual message)\r\n* Implementations of the protocol that have users receiving private messages can decrypt the content for those users and display it in some form of private messaging area of their system\r\n\r\nWhile I have a rough idea of how I'd like to extend the Atom feed to incorporate this information (e.g. what it would like in https://mastodon.social/users/hq.atom), but I don't yet have a clear picture of the Pubhubsubbub side of the things for real time communications.\r\n\r\nI'm probably going to have a go at drafting up an XSD that covers the additional flags that would exist in the Atom format to support this functionality."},"comment":{"url":"https://api.github.com/repos/Gargron/mastodon/issues/comments/262559071","html_url":"https://github.com/Gargron/mastodon/issues/223#issuecomment-262559071","issue_url":"https://api.github.com/repos/Gargron/mastodon/issues/223","id":262559071,"user":{"login":"Gargron","id":184731,"avatar_url":"https://avatars.githubusercontent.com/u/184731?v=3","gravatar_id":"","url":"https://api.github.com/users/Gargron","html_url":"https://github.com/Gargron","followers_url":"https://api.github.com/users/Gargron/followers","following_url":"https://api.github.com/users/Gargron/following{/other_user}","gists_url":"https://api.github.com/users/Gargron/gists{/gist_id}","starred_url":"https://api.github.com/users/Gargron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gargron/subscriptions","organizations_url":"https://api.github.com/users/Gargron/orgs","repos_url":"https://api.github.com/users/Gargron/repos","events_url":"https://api.github.com/users/Gargron/events{/privacy}","received_events_url":"https://api.github.com/users/Gargron/received_events","type":"User","site_admin":false},"created_at":"2016-11-23T16:12:08Z","updated_at":"2016-11-23T16:12:08Z","body":"Salmon already uses private/public keys to verify origin of a message. I advice against \"encrypting\" (or using the term \"encrypt\") messages because it would be dangerously misleading since the server is the owner of its users' private keys, so it's not end-to-end private. Also, people need to be aware of the risk that a rouge server might choose to publish private messages it receives (but this should not be a problem if end-users will be vetting who they're talking to anyway, e-mail is kind of the same risk anyway)\r\n\r\nWhat you bring up is super important though: I really really need new Atom elements to demarkate when a feed is private and you're supposed to send a follow request vs. following directly. (Also an element for demarkating sensitive content would be great). Afaik there are no currently existing Atom extensions that do this."}}
{"actor":{"display_login":"Gargron"}}