While personal messaging is an important part of many communities, it can also be a very personal avenue to interact with others. We have seen from many of the larger social networks that having granular permissions surrounding personal messages (sometimes referred to as “DMs”) has been key to reducing targeted harassment and bullying.
That being said, in many of these same social networks, the permissions are extremely coarse or reactive, and this applies to Discourse as well. You can choose to disable the receipt of all personal messages, or, if you do not wish to speak with someone, place them on ignore to prevent further PMs from that user. The first option basically means you can no longer be messaged by anyone, and the second only helps after you have been contacted.
For vulnerable segments of the population, having a user contact you cold can often feel like an incursion into your personal/safe space. This is especially true for users that choose to take disagreements private to continue them, and I often see these sorts of engagements flagged, even though moving such a discussion private isn’t against any sort of rule or policy.
So, it’s become clear to me that regardless of intention, the effect of open PMs can very much affect the feeling of safety and security in a community.
As an administrator, I have few options to combat this. I can disable PMs for TL1/2s and restricted it to trusted members of the community, but at the price that I have effectively removed PMs from the majority of the userbase altogether (and when I say “remove” I mean it - Discourse literally hides the Personal message section altogether!). I can try and craft some sort of policy around PM etiquette but as this isn’t at all a norm in other online communities, it’s very likely this will only be read after one’s first infraction, which doesn’t resolve the problem and remains a reactive solution.
Other social networks have responded to this in various ways - only those you friend/put on an allowlist can message you, for example - but I think most of these are also insufficient, because they force someone wishing to make a new connections to publicly request it first.
Instead, I’d like to propose a setup like the following:
- either a sitewide or per-user option to require approval for all first-time PMs by user. Staff PMs would obviously be exempt, and an optional list of “always allowed” groups could be included as a config option as well.
- with this feature enabled, any new PM you receive would show a message indicating what user has sent a PM, and possibly the subject of said PM. The user can choose to accept or deny the request.
- If the request is accepted, the PM becomes available, and the user is added to the allowlist for future messages, and conversation continues as normal
- If the request is denied, nothing happens, the notification is removed, the PM is not shown to the recipient, and crucially the requestor is not told their message was rejected. This is to avoid retaliation by the requestor.
- Optionally a checkbox could be added to the rejection option to also add the user to your ignore list to prevent future PM requests, which would cause this user to get a message that “The user you are messaging is not accepting PMs” going forward.
- The allowlist and ignorelist would, of course, be editable by users to change these permissions at any time.
I think this proposal solves the problem of having to ask permission to message publicly before doing so, while also ensuring that abuse/bullying/harassment potential is greatly reduced (as the body of the PM is not visible unless accepted), and avoids letting requestors be aware that they are being muted/ignored/etc. as well.
