Can we make a discussion private?

[Gregoirevda]

Does Github discussion support private discussions between the library owners and a user?

[TomLewis]

+1

Then we can use it like a ticket system too.

[ArtyomCZ]

Exactly, I had a comparable idea to use the discussions as communication with users who don't have an account on GitHub to report bugs and support tickets. #2864

[becca]

Would you ever expect a discussion to go from private to fully open?

Would the entire conversation in ☝️ scenario be moved from private to open or will a private discussion always remain fully private to the folks with access to said discussion?

[Gregoirevda]

I would expect it to stay private. If you currently want to contact authors of public repositories privately, you go to twitter or gmail and that's annoying (finding the person on twitter, switching to gmail, not contacting everyone in the repo, but a specific person, ...)
Being able to have a private chat with the library authors would be 💯

[TomLewis]

It may be best to include the option to change from private to public because of human nature, you may have people submitting private discussions that shouldn't be private.

One of the main reasons I want this, is so that people can report security bugs in a live application, if they submit it as a public issue then if someone reads it before me they could then exploit this now public bug/security issue.

But on the other side, people could just use it to ask silly questions thinking they will get direct conversation with the developers as there is no private messaging system on GitHub, so we don't want to have search engine results excluded that may help other people with a similar issue searching for a fix with the content being hidden behind a private conversation.

So yes, we would need to be able to set it to public.

[becca]

If someone is reporting a security vulnerability should that not be done in a security vulnerability report?

[andriemc]

@becca If someone is reporting a security vulnerability should that not be done in a security vulnerability report?

those are reports for vulnerabilities that are of dependencies, and generally not apps, and they are public after github's review.

[TheJaredWilcurt]

Private discussions would also be very useful for the core team of a project to discuss topics within that group before making more public decisions. This type of private discussion is currently easier to do off-site (Discord/Slack, email thread, etc). However, for internal project documentation, being able to go back and look at these conversations in context of the project, and being able to freely link to these private discussions in Issues/PR's knowing that they are only accessible to maintainers, would give a much more cohesive experience.

Based on the use case others have provided, and are more excited about (conversations between maintainers and one user), my proposed concept could be achieved as a side-effect, but simply having the conversation's "user" be one of the maintainers. This would make it a maintainer-only conversation.