I guess mainly:
Activity Pub is actually official W3C standard. There are yearly conferences, development and it’s open.
That AT protocol is owned by Bluesky, they decide how it’s developed, what gets in, what goes out and to my knowledge it’s actually not implemented anywhere else (yet).

I think it might have been an idea to make instance federation to default into a whitelist instead of relying on everyone having to blacklist random raspberry pies around the world.

Yeah, if that kind of thing is part of your threat model.

The tools to protect users on fedi are a bag of shit (partly due to the federated nature of it all, but also due to the fact that no one really thought about “what to do about abuse”).

Yeah, not much you can do about it apart from the things outlined in the OP.

A nazi dickhed running pleroma on his rapsberry pie isn’t going to respect federation moderation messages, DMCA or GDPR. You can try to complain to their ISP, but chances that someone is reading the abuse mailbox and acts on it is… slim.

So act like there’s no privacy at all.

1. Don’t expect privacy. Everything you post is public.
2. Goto 1

you follow nobody

You can import/export most things to CSV (follows, lists, blocks etc)
This way it’s easy to set up a new account on new server (as I said, I’ve been instance hopping for a long time).

You can also download your media archive in its entirety. And you should.

You should also turn on scheduled deletion of your old posts. You don’t really want to leave >6 month old messages behind you. You don’t have to lose your stuff, just stick the archive somewhere safe (local disk, or dropbox, whatever). These are all standard Mastodon features.

unless they authenticate you in some other way and that’s a major pain.

You should always authenticate yourself on Mastodon if you’re “serious” about your identity. It’s very easy to do and re-pointing it to your new “official” identity is just one line of HTML.

Mastodon has also feature for moving instances and forwarding your old identity to your new one.

If your instance admin suddenly disappears and shuts down the service, it’s a pain, but obviously you run the same risk with any commercial company shutting down your account without notice or recourse to re-open it. So keeping regular backups of your data is a good idea, the import/export tools are there.

The only thing that isn’t automatic is followers. And if your followers are a huge concern (for example, part of your livelihood/patronage) you should probably adopt a multi-platform social media strategy anyway. This way you can always reach your followers, no matter what happens to Twitter or Mastodon (or whatever network). You should be on ALL the networks.

But for most people who are not “content creators” the amount of followers isn’t really very relevant. It doesn’t mean anything. The quality of the discussions is important. And you can participate in discussions without any followers. It’s not like other commercial networks where the algorithm squelches you if you don’t have enough “clout”. You don’t need followers to discuss with people on Mastodon.

will come and go and users will lose their identity or home base each time this happens along with all their followers and their connection to the wider social graph. This seems not great.

I’m not sure what this “wider social graph” you mention is, but you don’t really lose your identity - you verify it with external website, so it’s easy to switch the pointer to a new identity (I’ve been around since 2017 and I instance-hop often, I go back and delete old accounts couple of times per year)

Losing followers - well yeah, that sucks if your livelihood depends on your social media reach and patronage, but in that case, you should probably have a more solid base for all your social contacts, random Mastodon instance is probably not the best choice.

Also, Lemmys devs have pretty radical political views and I don’t want to support sites that don’t care about human rights