On 9/5/26 16:53, Georg Lukas wrote:
Storing a recipient-side edit/retraction history is the only reasonable way to cover harmful / abusive messages - once they were delivered to at least one of the recipient's clients, that is. In fact, that would actually be an argument for keeping the original message in MAM, instead of replacing it with a tombstone.
There is obviously a highly important design trade-off between the interest of the sender (oops, I disclosed a secret to the wrong person) and the recipient (I don't want abusive messages to disappear, leaving behind no evidence). I think that LMC (or, well, AMC) is a very reasonable resolution to that trade-off.
For sure it is a much better trade-off than allowing the sender to delete an abusive message right after it was seen by the recipient, and I guess it is also a better trade-off than leaving an inadvertently disclosed secret visible for all time (but still accessible with a few clicks). In fact, given that there is no *guarantee* that '424 will delete the message (as clearly stated in the XEP), any secrets need to be considered as compromised anyway.
The '424/'308 use case is distinctly different from the '425 Moderated Message Retraction use case, where the moderation decision was made by a third party, which is supposed to not be collaborating with an abusive sender.
Ultimately, I think that the same business rules should apply to both '308 and '424 - it doesn't make UX sense to give a longer period for retractions than for edits, and vice versa.
As an author of the XEP, I'm strongly against this, because it privileges the recipient over the sender. Imagine sending a nude photograph of yourself by mistake and then having it kept on record after you've removed it. I understand that client and server incompatibility means that deletions aren't guaranteed, but to me that's quite different from the XEP mandating that records of retracted messages be kept. I also don't see how LMC is a reasonable solution to that trade-off. To me, part of the distinction between corrected and retracted messages is that with the former you can (in some clients) view the history and with the latter you can't. JC