Change channel message ingestion from opt-out to opt-in #111

New Issue

2026-10-04T23:01:05+02:00

adam commented

2026-10-04 23:01:05 +02:00

There was a very short discussion about this in https://github.com/l5yth/potato-mesh/pull/537

Why was the blacklist (HIDDEN_CHANNELS) approach taken?
From security standpoint, it would make much more sense to do the opposite: Let users decide to opt-in sharing messages of certain channels - instead of sharing all by default, potentially leaking sensitive information.

As mentioned in the PR, when new channels are added (or in the case of updating PM ingestor to v0.5.7), they are shared by default - leaking new chat messages in all channels to potato-mesh.

Furthermore, all users in a channel that also run potato-mesh would need to apply the HIDDEN_CHANNELS option properly for it to work for a channel.

There was a very short discussion about this in https://github.com/l5yth/potato-mesh/pull/537 Why was the blacklist (`HIDDEN_CHANNELS`) approach taken? From security standpoint, it would make much more sense to do the opposite: Let users decide to opt-in sharing messages of certain channels - instead of sharing all by default, potentially leaking sensitive information. As mentioned in the PR, when new channels are added (or in the case of updating PM ingestor to v0.5.7), they are shared by default - leaking new chat messages in all channels to potato-mesh. Furthermore, all users in a channel that also run potato-mesh would need to apply the `HIDDEN_CHANNELS` option properly for it to work for a channel.

adam closed this issue

2026-10-04 23:01:05 +02:00

adam commented

2026-10-04 23:01:06 +02:00

The way I designed this is to crawl as much data as possible from the mesh, even encrypted communication. A whitelist would stop doing that.

So, I personally have some philosophical resistance. However, I see the need for a whitelist and it's easy to implement and it can even work in addition to the blacklist (with blacklist taking precedent).

I'll add a whitelist to the next release.

The way I designed this is to crawl as much data as possible from the mesh, even encrypted communication. A whitelist would stop doing that. So, I personally have some philosophical resistance. However, I see the need for a whitelist and it's easy to implement and it can even work in addition to the blacklist (with blacklist taking precedent). I'll add a whitelist to the next release.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/potato-mesh#111