Discussion about moderation for team/party messages (Feedback wanted)

[ashhhleyyy]

Hello!

This discussions section hasn't really been used for a while, but here I am seeing how well it'll work again :)

There's recently been some mention of improving team chat, as well as implementing a party chat (see NucleoidMC/plasmid#255), and the topic of moderation for these 'kinda-private' messages came up (https://discord.com/channels/733462796582387753/744090136945360936/1045801738181034024), and I thought it would be important to gather some feedback before committing to changes like this.

The current (very rough) ideas were the following:

• Regular public chat is bridged to #multiplayer on Discord, same as always (or do we want to do the same as 'private' stuff and fully log it in the database too?)
• Team, party and /msg are also sent to the backend, but rather than sending to Discord, stored in our database (hosted within the EU in Germany, by Hetzner), potentially along with IDs for sender (+ receiver if a /msg) and potentially the message signature if we wanted to be able to report to Mojang in future.
• All messages in our database would expire after a certain time period (30 days, 2 weeks?) to avoid us storing PII for any longer than is reasonably necessary.
• Individuals can request early deletion of messages (under GDPR or related) as long as it isn't an attempt to remove evidence related to moderation, especially if they contain sensitive information.

The idea behind not putting 'private' messages in a moderator-only channel on Discord is to raise the effort involved in reading these logs, so that they're only observed if necessary.

A few other notes:

• Most major Discord servers already implement something similar for moderation, logging deleted and edited messages (we currently don't do this), and places such as Quilt have a similar policy of deleting older logs.
• I'm calling these 'kinda-private' as players shouldn't really be trusting a random Minecraft server to exchange sensitive information either way, if fully confidential messages are required, they should be using an E2EE messenger, not our /msg.

Please share any thoughts you have about this below (or on Discord in #community-management if you aren't able to comment here)

[mounderfod]

Would we sync the private messages to a moderator-only channel, so they can be monitored without having to check the log files?

[ashhhleyyy]

The idea behind not putting 'private' messages in a moderator-only channel on Discord is to raise the effort involved in reading these logs, so that they're only observed if necessary.

We shouldn't really be 'monitoring' them as such, but it would be useful in the case of a report to be able to search for certain messages

[mounderfod]

I see, that seems better from a privacy perspective

[Madis0]

The current problem with team chat is that it is publicly synced to Discord, which makes it almost useless. Making that private in any way would be a huge step forward.

Team, party and /msg are also sent to the backend, but rather than sending to Discord, stored in our database
The idea behind not putting 'private' messages in a moderator-only channel on Discord is to raise the effort involved in reading these logs, so that they're only observed if necessary.

That sounds good.

Team, party and /msg are also sent to the backend, but rather than sending to Discord, stored in our database [...] potentially the message signature if we wanted to be able to report to Mojang in future.

Storing signatures seems:

• very invasive, potentially against GDPR or ToS
• unnecessarily complex in terms of database structure
• likely useless
  • I don't think Mojang will take action on them considering the reporter wasn't there at the time (so contents can be spoofed, visibility can't be confirmed) and that reporting messages later than what the client allows seems suspicious anyway.

Please don't do that.

[ashhhleyyy]

The current problem with team chat is that it is publicly synced to Discord, which makes it almost useless. Making that private in any way would be a huge step forward.

Yeah this is a bug (which I thought there had been a patch for at some point, but evidently not) which would definitely be resolved during these changes

While I don't think storing signatures would be too complicated in the database (just dump it to JSON or something and stick it in a text column), I do agree that Mojang probably wouldn't accept them, so it probably wouldn't be worth the extra storage space either (I didn't really think about this part too much, but it definitely doesn't seem like much of a benefit to have).