This summer I set up a small social network for a music community — people who took the same college courses I did, plus anyone else interested in the science of musical sound. Not a Facebook group. An actual site at our own address, on a server we control.
Why bother? Because a Facebook group lives on Facebook's terms. The algorithm decides who sees a post. The rules change without warning. And if the group disappears one day, there's nobody to call. Owning the space costs about $12 a month and some patience. This post is about the patience part — what you only learn after launch. I'm planning to do this again for a dietitian community, so the lessons are fresh for a reason.
First, three bits of context that make the rest make sense.
"Mastodon" is a brand name, not the network
People say "Mastodon" the way they say Kleenex or Hoover — the brand standing in for the category. The real picture is better than the shorthand.
Mastodon is one piece of software. Underneath it is a shared language called ActivityPub, and anything that speaks it can talk to anything else that does. Email works the same way: Gmail and Outlook are rival products, but a Gmail user emails an Outlook user without thinking about it, because both speak "email."
So our music server doesn't just talk to other Mastodon servers. It talks to video sites, photo-sharing sites, blogging platforms — the whole shared network, which people call the fediverse. Even Facebook's Threads speaks a bit of the language now. When another server connects to ours, nobody checks what brand of software either side runs. Same language, so it works.
We don't even run plain Mastodon
Mastodon is open source, so anyone can make their own variant. Ours is called glitch-soc — the same software underneath, maintained by volunteers who add what the main project moves slowly on, while folding in everything the main project releases.
Why? Posts, mostly. Plain Mastodon caps posts at 500 characters. Ours allows 2,000, because people discussing synthesizer circuits need room. That's the appeal of this world in one sentence: when the software doesn't fit your community, you're allowed to pick a variant that does.
What you're actually renting
The "server" is a rented computer in a data center in Finland, roughly a mid-range laptop. It runs the site, the database, and the software that talks to the rest of the network without breaking a sweat — a community of a few hundred people probably wouldn't wake it up.
The bill: about $10 for the computer, $2 for backups, under a dollar for image and audio storage. The email service and the sites around it ride on free plans. The scarce resource isn't money or computing power. It's attention.
Your address becomes permanent before you feel ready
Our server could talk to thousands of others around the world — that's the point. I assumed we'd decide when to introduce ourselves.
Wrong. Three days in, a stranger's server found ours and followed us. From that moment our address was written into other people's systems, permanently. Changing it would break every connection — like a phone number spreading through other people's contacts. Once it's out there, it's out there.
Settle every name — the site, the accounts, all of it — before the site can be found. Not "before you announce." Before it's reachable. Being discovered is not something you control.
The week our signup form was aimed at strangers
The ugliest surprise. One morning there were 201 signup requests, all fake. Spammers had signed up 201 real strangers' email addresses — mostly people in Japan — so that our server would send each of them a confirmation email they never asked for. Multiply that across thousands of small servers and those inboxes drown. We weren't the target. We were the weapon.
Two settings saved us. Signups required approval, so no fake got in. And every applicant had to write one sentence — "why do you want to join?" All 201 fakes carried the same canned sentence, which made them easy to spot and delete in one sweep. We blocked the worst network ranges, checked our email reputation, and moved on. I felt pretty good about that one sentence. The cheapest spam filter there is, I told people.
That filter was already obsolete
About seventy-two hours later I signed up for an account on Hachyderm, one of the big established servers, and got flagged as a suspected bot.
Their welcome email explained why: they're drowning in bot signups whose join reasons sound human. Varied, plausible, community-aware — written by AI, at volume. The email pointed to a write-up by an admin who runs a niche forum, titled "The future of forums is lies, I guess." His conclusion, after watching AI-written applications sail through careful review: there is no longer a reliable way to tell a sincere applicant from a bot by reading the application.
Our 201 fakes were the lazy version. The competent version writes 201 different sentences, each one sounding like a person who genuinely loves synthesizers. Reading the answer stops working. So what still works?
- Raising the cost. Hachyderm's fix: approve nobody on prose alone. New applicants complete a small series of tasks — set up two-factor login, file an appeal, show they glanced at a linked article. Trivial for a person, annoying to automate. Not bot-proof; the forum admin is honest that even interviews can be automated. But every step raises the price.
- Provenance over prose. How someone arrived says more than what they wrote. An applicant using an invite link a member handed them, or whose name we recognize from the group, is verified in a way no essay can be. Growing through invites beats judging strangers' essays.
- Watching behavior, not applications. In that forum admin's account, the bots that wrote flawless applications were caught by what they did after getting in — spam links, shared infrastructure. At our size, reading every new member's first few posts is entirely doable. The gate can be fooled; the first week of behavior mostly can't.
There's an honest limit here: none of this is solved, and nobody credible claims it is. Our real defense is being small and specific. A hundred-member synthesizer club is not worth much automation budget. Yet.
Email is the part that breaks quietly
When someone signs up, the site emails them a confirmation link. If that lands in spam, they don't dig it out — they leave, and you never know it happened.
Getting those emails delivered reliably is its own small project, with daily limits — our free plan allows 300 a day, and the fake-signup wave was quietly eating into it. If a friend says "I signed up and nothing happened," believe them and check the mail system first. It fails without an error message.
The short version
- Names are permanent the moment your site is reachable. Decide them first.
- A required "why do you want to join?" sentence catches lazy bots. It will not catch the current ones — nothing you can read will.
- What still works: raise the cost of applying, grow through invites, and read every new member's first posts.
- Confirmation emails fail silently. When someone says signup didn't work, check the mail first.
- Mastodon is one brand of software on a shared network, the way Gmail is one brand of email. The network is the interesting part.
- And the honest one: our backups exist but we still haven't done a full practice restore. Do the practice restore. We're one storm away from learning that lesson the hard way too.
I'm in deep enough now that I'll be attending the next FediForum — the online gathering where the people building this network compare notes. If you're curious what a community that owns its own space could look like for your field, that's a good window into it. Or ask me. I have opinions now.