Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding a flag that the deletion of accounts returning 410 will not be done automatically #15303

Closed
orlea opened this issue Dec 8, 2020 · 5 comments

Comments

@orlea
Copy link
Contributor

orlea commented Dec 8, 2020

Pitch

#14989

Change Webfinger resolution to queue full account deletion when it encounters a HTTP 410 error for an account that's still in the database

This is overkill.
Is it possible to implement a flag that does not automatically delete the data of a closed old server?

Motivation

I don't want to delete old posts (from closed Mastodon, Pleroma, or others) left on the Mastodon server that I administrate.

@Gargron
Copy link
Member

Gargron commented Dec 8, 2020

Closed servers don't usually return HTTP 410 for deleted accounts as that requires knowledge that the account existed and for the server to still be online. Servers that have gone offline will either not resolve via DNS, timeout, return HTTP 500 or 404. HTTP 410 indicates the intent of the owner of the account for the account to be deleted and should be honoured.

@orlea
Copy link
Contributor Author

orlea commented Dec 8, 2020

For the 410 response with the intention of deleting the account from account owner, I completely agree about deleting it from the other servers in the federation as well.

But, For example, when a server is closed, the administrator may set up the server to return 410 for all HTTP requests for a period of time.
(Many of the Japanese Mastodon server administrators I've seen do this when they close a server.)
In this case, will all accounts on the server being closed down be deleted from the other servers that were associated with it?

In such cases, there is no intention that the account holder will delete the account.

@noellabo
Copy link
Contributor

noellabo commented Dec 8, 2020

If the closed server returns 410, it is a manifestation of the intention to delete all accounts, similar to running a tootctl self-destruct.

This is indistinguishable from the case where the account is deleted at the will of each user.

There is a problem with the habit of returning 410 Gone on server that chooses to shut down.

We should document the server closure guide.

@Gargron
Copy link
Member

Gargron commented Dec 8, 2020

I understand wanting to preserve old valuable posts but if the server shutting down does not signal account deletion, then how is the original account owner supposed to enforce their right to delete their account? It hinges upon other servers -- eventually -- removing data that is no longer online (Unfortunately, automatically detecting that a server is "gone" as opposed to temporarily offline is impossible in my experience, so it relies on admins manually running tootctl domains purge with specific domains. But if the server is kind enough to return HTTP 410, it is the best signal one could have).

@orlea
Copy link
Contributor Author

orlea commented Dec 8, 2020

A closing guide would certainly be nice to have.
It would be nice to be able to distinguish between when an account is deleted but the server is still alive and when the server is closed, but maybe it would be difficult and in a way it might be evil.

@Gargron @noellabo
Thanks for letting me know.
I'm closing this issue.

@orlea orlea closed this as completed Dec 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants