xmtp

XMTP is getting Universal Allow/Block Prefs (✅/🛑) and I’m stoked.

You can read the technical details of XIP-42 here (https://community.xmtp.org/t/xip-42-universal-allow-and-block-preferences/544), but I also wanted to share what went into it and how it makes the /xmtp experience way better.

So what is it? 👇

Most modern messaging apps have features to allow or block senders. Late last year, popular XMTP inbox apps also added allow/block, but the local choices didn’t persist across.

This led to inconsistency, and a user’s inbox’s contents might look different app-to-app. 😱

Co-founder XMTP, building web3's secure messaging layer ➡️ https://xmtp.org

Predicting this, @converseapp's @polmaire.eth suggested a solution (https://github.com/xmtp/XIPs/pull/28/files) that would allow for sharing allow/block across apps.

Today XIP-42 introduces contact permissioning that's shared among a user’s inbox apps at the network-level, in a way that preserves privacy.

With messages from new senders, users choose allow/block + their app will broadcast the choice to XMTP as a non-displayable “metamessage” which maps the contact permission to the sender, privately.

When the user opens other apps, their choice is read and local state is updated.

Contact permission metamessages shared by inbox apps are immutable, encrypted, anonymized, and only usable by a recipient and the apps they give permission to.

This also goes for the sender whose permission is being affected. A recipient’s choice is private to them.

Allow/block has been available in most XMTP inbox apps, and while it’s early days for XIP-42’s approach, all major inbox apps have already implemented it or plan to do so soon.

It's worth noting, that this flavor of allow/block isn't yet enforced at the protocol level…

I think that app-level, shared contact permissions are a massive leap forward for inbox management. It’s a pragmatic approach to the problem that can be implemented today.

There are some in the XMTP community (me too) that are also interested in exploring network-level enforcement—more on that later.

So…what do you think of this app-level, but shared understanding of contact permissions (allow/block)? Anything you think might make it better?

Personally I'm excited to see this one go out, but really keen to listen to any feedback that might be out there for it!

This is a major security update -- especially for the tools like ours.

Remember asking you about this at Permissionless last year, glad to hear it's been a focus

4444 $degen