This summer I set up a small social network for a music community — people who took the same college courses I did, plus anyone else interested in the science of musical sound. Not a Facebook group. An actual site of our own, at our own address, on a server we control.
Why bother? Because a Facebook group lives on Facebook's terms. The algorithm decides who sees a post. The rules change without warning. And if the group disappears one day, there's nobody to call. Owning the space costs about $12 a month and some patience. This post is about the patience part — the things nobody tells you until after launch. I'm planning to do this again for a dietitian community, so these lessons are fresh for a reason.
First, though, three bits of context that make the rest of this make sense.
"Mastodon" is a brand name, not the network
People say "Mastodon" the way they say Kleenex or Hoover — the brand name standing in for the whole category. It's worth untangling, because the real picture is better than the shorthand.
Mastodon is one piece of software. Underneath it is a shared language called ActivityPub, and any software that speaks it can talk to any other. Email works the same way: Gmail and Outlook are different products from rival companies, but a Gmail user emails an Outlook user without thinking about it, because both speak "email."
So our little music server doesn't just talk to other Mastodon servers. It talks to video sites, photo-sharing sites, blogging platforms — anything on the shared network, which people call the fediverse. Even Facebook's Threads speaks a bit of the language now. When a stranger's server found ours (more on that below), it didn't matter what software they ran. We spoke the same language, so we connected.
We don't even run plain Mastodon
Mastodon is open source, which means anyone can read the code and anyone can make their own variant. Ours is a variant called glitch-soc — same software underneath, maintained by volunteers who add features the main project moves slowly on, then keep folding in everything the main project releases.
Why bother? Posts, mostly. Plain Mastodon caps posts at 500 characters. Ours allows 2,000, because people discussing synthesizer circuits need room. That's the whole appeal of this world: when the software doesn't fit your community, you're allowed to pick a variant that does — or make one.
What you're actually renting
The "server" is a rented computer in a data center in Finland, about as powerful as a mid-range laptop. It runs the site, the database, and the software that talks to the rest of the network, and it does all of that without breaking a sweat — a community of a few hundred people probably wouldn't wake it up.
The monthly bill: about $10 for the computer, $2 for backups, and under a dollar for image and audio storage. Call it $12 or $13. The email service and the sites around it ride on free plans. The scarce resource isn't money or computing power. It's attention — which is what the rest of this post is about.
Your address becomes permanent before you feel ready
Here's the strangest one. Our server could talk to thousands of other small servers around the world — that's the whole point. I assumed we'd decide when to introduce ourselves.
Wrong. Three days in, a stranger's server found us and followed us. From that moment, our address was written into other people's systems, permanently. Changing it would break every connection. It's like your phone number spreading through other people's contact lists — once it's out there, it's out there.
The lesson: settle every name — the site, the accounts, all of it — before the site can be found. Not "before you announce it." Before it's reachable at all. Being discovered isn't something you control.
Your signup form can be pointed at innocent people
The ugliest surprise. One morning there were 201 signup requests, all identical, all fake. Spammers had signed up 201 real strangers' email addresses — mostly people in Japan — so that our server would send each of them a confirmation email they never asked for. Multiply that across thousands of small sites and those strangers' inboxes drown. Our site wasn't the target. It was the weapon.
Two things saved us. We'd already set signups to require approval, so none of the fakes got in. And we required one written sentence — "why do you want to join?" — from every applicant. All 201 fakes carried the same canned sentence, which made them easy to spot and easy to delete in one sweep.
That one-sentence question turned out to be the best moderation tool we have. A real person writes something human. A bot writes the same thing 201 times.
Email is the part that breaks quietly
When someone signs up, the site emails them a confirmation link. If that email lands in spam, they don't dig it out — they just leave, and you never know it happened.
Getting those emails delivered reliably turned out to be its own small project, with its own daily limits — our free plan allows 300 a day, and the spam wave above was quietly eating into it. If a friend says "I signed up and nothing happened," believe them and check the mail system first. It's the part that fails without an error message.
The short version
- Names are permanent the moment your site is reachable. Decide them first.
- Make every applicant write one sentence about why they're joining. It's the cheapest spam filter there is.
- Confirmation emails fail silently. When someone says signup didn't work, check the mail first.
- Mastodon is one brand of software on a shared network, the way Gmail is one brand of email. The network is the interesting part.
- And the honest one: our backups exist but we still haven't done a full practice restore. Do the practice restore. We're one storm away from learning that lesson the hard way too.
I'm in deep enough now that I'll be attending the next FediForum — the online gathering where the people building this network compare notes. If you're curious what a community that owns its own space could look like for your field, that's a good window into it. Or ask me. I have opinions now.