I kinda doubt that it's even possible to even make a gdpr-compliant general AP server, there's no way to 'take back' posts and no way to know how far a post federated.
@lain You can somewhat know how far a post federated with hard-requiring signed fetches but that's only the first step, you'd also need things like batch deletes ("Let's send out one Delete per post" is pure madness). But at the end of the day, something sent to a ton of independent servers tends to stay forever so the "right to be forgotten" is quite limited (but we could do better).
@phnt@lain For example even without GDPR or whatever privacy concerns, having deletes working is important in the same way a working garbage collector is. It's often useless to keep invalidated data and in the case of ActivityPub, things like not having proper deletes of following relationships means higher network loads, and no delete of accounts means higher database loads. And as far as I can tell both aren't really working properly.
@phnt@lain You don't work around GDPR that way, it's not a technical standard, it's a law.
Also I think you've missed the "somewhat" keyword, I'm not talking about guarantees but about doing better (GDPR or not in fact).
> Generally what you put on a decentralized network will stay on it for almost forever.
You're literally rephrasing what I've already said here:
> But at the end of the day, something sent to a ton of independent servers tends to stay forever so the "right to be forgotten" is quite limited (but we could do better).
@lanodan@lain I don't see this ever happening. You can try to minimize the number of servers that have your message/post, but it's never guaranteed to be that way. The Mastodon way of sending out rejects to every instance that might have the object is pretty close to what you can achieve without relying on servers not lying. Generally what you put on a decentralized network will stay on it for almost forever.
GDPR is a joke anyway. Most parts of it got worked around in weeks.