I think this idea deserves discussion before starting any implementation:

• If we look at Internet practices, it is fair to expect that most users will assume some privacy here, just like some privacy is assumed when they subscribe to newsletters and notifications in general.
• Even in the very transparent MediaWiki/Wikimedia context, users keep some privacy in their decisions to watch certain pages and certain discussions.

Subscribing to a newsletter is an action similar to watching a page: the user has a passive interest in receiving information. This is different than editing, an action consistently logged publicly in MediaWiki spaces.

MassMessage does provide a public record of subscriptions, but I don't think that that should be a reason for the Newsletter extension to follow blindly that principle. To me, MassMessage is the outlier, and we should follow the wider internet practices and expectations.

@Peteforsyth mentions two uses cases for this feature:

• See changes in the raw number of subscribers over time. Sharing numerical data is fine, as it doesn't affect user privacy. Currently we are showing current subscribers, just like wiki pages show number of watchers if you know where to click. Is it possible to check number of watchers of a page over time, and if so, can we reuse anything there?

• Determine when a specific user started or stopped being a subscriber. The first question is why is this data relevant, what would or could someone do with it? I think this use case is especially problematic, because it has a risk of becoming a feature for stalkers. If we want to address it, it should probably be with a solution restricted to publishers / administrators. Again, it would be useful to know what information about watching pages is currently disclosed to whom.

• ... or a publisher. Data about publishers is different. A publisher is an active role, and it is standard practice in the media to disclose who is in charge of a publication. The Newsletter extension shows the current list of publishers to everybody. Why is the history of publishers relevant, what would or could someone do with it? In this case the reason to ask goes more in the direction of evaluating of how worthy is the effort, and which priority should this have.

@Qgil @01tonythomas Maybe just add user option to choose he/she want to be logged?

I also have a personal view on this, but I will not bring it into the discussion, as I do not believe the personal views of a few individuals should impact the decision. Making subscriber lists private represents a change from the status quo. Evidence that should be considered would include:

• Requests from users, accompanied by discussion leading to a clear consensus for change
• Academic research about expectation of privacy around subscriptions
• Polling of a representative sample of users

A few points to consider:

• The privilege to view users' watchlists is reserved for highly trusted users. Administrators and bureaucrats do not have this ability. Under the current implementation, as I understand it, not only do admins and crats have the ability, so do publishers of the newsletter. So, this creates a new, third category: lists that are a little bit private, but not very.

A change from the status quo that I doubt would bother anybody:

Allow the publisher to set whether or not the list is public, and list next to the newsletter whether its list is public, or visible only to publishers/admins. (I recommend against calling it "private," though; English Wikipedia, for instance, has almost 1300 admins, many/most of whom are anonymous.)

In T155273#2946129, @FilipGCI wrote:

@Qgil @01tonythomas Maybe just add user option to choose he/she want to be logged?

Is there a reason a partial subscriber list would be useful to anyone? I can't think of one offhand.

A point I left out:

Any newsletter that complies with the requirements of the extension, will have (or could very easily have) a main page, updated with each edition. Any users concerned about privacy therefore have the option to "subscribe" via their (genuinely private from publishers and administrators) watchlist, by watching that page.

In T155273#2946358, @Peteforsyth wrote:

Any newsletter that complies with the requirements of the extension, will have (or could very easily have) a main page, updated with each edition. Any users concerned about privacy therefore have the option to "subscribe" via their (genuinely private from publishers and administrators) watchlist, by watching that page.

Well, that's a traditional model, but maybe it's not the only one. I'm on a test list now, and the model is more like "Hey, you might be interested in [[weird page]]". There's no central page, no intrinsic need for one, and creating one would mean at least twice as much effort, as the publisher would have to both send the newsletter and document what was sent on wiki.

My proposition:

• While creating a newsletter, now you can specify if the subscription logs are public. Probably add something like a checkbox there ? Default to False
• Add a Subscription activity log to Newsletter:Name bottom. This is only available to publishers/admins when above setting is unchecked. Else, available to public.

Change 447087 had a related patch set uploaded (by 01tonythomas; owner: 01tonythomas):
[mediawiki/extensions/Newsletter@master] [WIP] Introduce logging of subscription activity

https://gerrit.wikimedia.org/r/447087

Some early peeks to the solution (in the patchset above)

We ran into a problem. Newsletter logs are by default logged in Special:Log. Currently, I can configure the extension to not show up this at Newsletter:NewsletterName, but this wont stop it from showing up at Special:Logs/newsletter. Currently, mediawiki-core do not allow some kind of dynamic plugs on this.

Found a hack btw. Now it works like this:

• When the are subscribers logs public is checked, *everyone* see the whole version of the message.
• When its unchecked, publishers see an anonymised version of the subscription logs (also on Special:Log). This would just say - A subscriber was added/removed on Newsletter:Link

seen by publishers:

seen by non-publisher:

Change 470237 had a related patch set uploaded (by 01tonythomas; owner: 01tonythomas):
[mediawiki/extensions/Newsletter@master] Merge branch 'master' into review/01tonythomas/T155273

https://gerrit.wikimedia.org/r/470237

Change 470237 abandoned by 01tonythomas:
Merge branch 'master' into review/01tonythomas/T155273

Reason:
Should go to https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/Newsletter/ /447087/12

https://gerrit.wikimedia.org/r/470237

Change 544417 had a related patch set uploaded (by 01tonythomas; owner: 01tonythomas):
[mediawiki/extensions/Newsletter@master] Merge branch 'master' into review/unknown/T155273

https://gerrit.wikimedia.org/r/544417

Change 544417 abandoned by 01tonythomas:
Merge branch 'master' into review/unknown/T155273

Reason:
Unrelated merge commit

https://gerrit.wikimedia.org/r/544417

I am going to try rebasing this, and bring the patch back up.

Change 858707 had a related patch set uploaded (by 01tonythomas; author: 01tonythomas):

[mediawiki/extensions/Newsletter@master] WIP: Add database migration for new column nl_subscription_details_are_public

https://gerrit.wikimedia.org/r/858707

Change 860971 had a related patch set uploaded (by 01tonythomas; author: 01tonythomas):

[mediawiki/extensions/Newsletter@master] WIP: Add option to make logs of newsletter subscription public

https://gerrit.wikimedia.org/r/860971

Change 858707 abandoned by 01tonythomas:

[mediawiki/extensions/Newsletter@master] WIP: Add database migration for new column nl_subscription_details_are_public

Reason:

Abandoning following: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Newsletter/+/860971

https://gerrit.wikimedia.org/r/858707