I kinda doubt that it's even possible to even make a gdpr-compliant general AP server, there's no way to 'take back' posts and no way to know how far a post federated.
@lain You can somewhat know how far a post federated with hard-requiring signed fetches but that's only the first step, you'd also need things like batch deletes ("Let's send out one Delete per post" is pure madness). But at the end of the day, something sent to a ton of independent servers tends to stay forever so the "right to be forgotten" is quite limited (but we could do better).
@phnt@lain You don't work around GDPR that way, it's not a technical standard, it's a law.
Also I think you've missed the "somewhat" keyword, I'm not talking about guarantees but about doing better (GDPR or not in fact).
> Generally what you put on a decentralized network will stay on it for almost forever.
Here you're literally rephrasing what I've already said here:
> But at the end of the day, something sent to a ton of independent servers tends to stay forever so the "right to be forgotten" is quite limited (but we could do better).
@lanodan@lain I don't see this ever happening. You can try to minimize the number of servers that have your message/post, but it's never guaranteed to be that way. The Mastodon way of sending out rejects to every instance that might have the object is pretty close to what you can achieve without relying on servers not lying. Generally what you put on a decentralized network will stay on it for almost forever.
GDPR is a joke anyway. Most parts of it got worked around in weeks.
@phnt@lain For example even without GDPR or whatever privacy concerns, having deletes working is important in the same way a working garbage collector is. It's often useless to keep invalidated data and in the case of ActivityPub, things like not having proper deletes of following relationships means higher network loads, and no delete of accounts means higher database loads. And as far as I can tell both aren't really working properly.
@mkljczk@lain Which for me has more issues related to spam, and interoperability rather than privacy ones, like you could just block threads.net (in your instance or user) or quarantine it (in your instance) if it's a concern. Like threads.net could be like gmail.com, which is de-facto the one setting the standards of how email works while being one of the biggest sources of spam.