feat: Don't apply chat name and avatar changes from non-members #6976
Conversation
Non-members can't modify the member list (incl. adding themselves), modify an ephemeral timer, so they shouldn't be able to change the group name or avatar, just for consistency. Even if messages are reordered and a group name change from a new member arrives before its addition, the new group name will be applied on a receipt of the next message following the addition message because Chat-Group-Name-Timestamp increases. While Delta Chat groups aimed for chatting with trusted contacts, accepting group changes from everyone knowing Chat-Group-Id means that if any of the past members have the key compromised, the group should be recreated which looks impractical.
Really? Then I was remembering this wrongly. cc @link2xt |
This NB: This PR breaks applying a new group avatar from a just added member if messages are reordered, but i'm not sure it's a frequent scenario. Alternatively, we can leave the code as is and add a comment why we allow group name changes from non-members, but forbid ephemeral timer changes (maybe ephemeral timer is a more critical thing, but i'd say that the group name too because a wrong one can break chat search for users). |
Yes, we ignore the changes by non-members. In theory (https://github.com/chatmail/models) we apply the changes because otherwise no nice properties hold and reordering of messages may break consistency, but in practice we ignore the changes if they come from non-member. This was changed in #6436 |
Eventual consistency still preserves, i.e. if all members continue to send messages and no new group membership changes happen, all members will have the same member list eventually. I think this is sufficient |
|
In theory cases like this break:
Now nobody thinks that Bob is removed except Alice. The group can be in this "inconsistent" state indefinitely. Eventually Alice is added back to the group and with the next message "implicitly" removes Bob. |
I think that if this message has Various group partitioning scenarios are broken, like Alice and Bob remove each other in parallel (and there are no other members, for simplicity), and now there are two separate groups -- one with Alice and another with Bob. But i think it's more practical to allow group partitioning than trying to fix it. |
Non-members can't modify the member list (incl. adding themselves), modify an ephemeral timer, so they shouldn't be able to change the group name or avatar, just for consistency. Even if messages are reordered and a group name change from a new member arrives before its addition, the new group name will be applied on a receipt of the next message following the addition message because Chat-Group-Name-Timestamp increases. While Delta Chat groups aimed for chatting with trusted contacts, accepting group changes from everyone knowing Chat-Group-Id means that if any of the past members have the key compromised, the group should be recreated which looks impractical.
This is in continuation of the discussion in #6901.