This post was originally published on 7 NOV 2022; it has since been updated and revised. avoidthehack is actively looking for tips/contributions to this guide in future updates.

What is Mastodon?

Mastodon is an open-source and decentralized microblogging network. Mastodon is also part of a larger decentralized social media network known as the fediverse.

Twitter users may have heard of Mastodon and wish to explore it; this guide is simply a "getting started" point for doing just that. Users are highly encouraged to check out the resources linked in this guide.

Mastoson is probably the most familiar/related to Twitter decentralized social media platform currently available.

Some users may remember Mastodon springing onto the “mainstream” scene for a brief moment in 2017 and again in 2018, during rising user concerns about privacy. At the time, Mastodon was much new(er), lacked a real user base, lacked many features found in the platform today, and buggy.

Over time, Mastodon - and truthfully, the rest of the fediverse - has steadily grown. Mastodon is far more refined and has more useful features than it was in 2017 and 2018 The biggest plus about Mastodon is its decentralization - different servers federate (communicate) with each other. This makes Mastodon resilient to the likes of service outages and censorship;

The Fediverse

The word “Fediverse” is a combination of two words: “federation” and “universe." It is a commonly referenced name for decentralized social media, including (but not limited to) Mastodon.

While Mastodon is arguably the most popular platform on the fediverse - especially for users looking for alternatives to Twitter since the announcement of Elon Musk interest in buying (and then, in fact, purchasing) Twitter — it is not the only platform in the fediverse.

Different fediverse platforms can actually “talk” to each other through the decentralized social networking protocol, ActivityPub. ActivityPub is based on the ActivityStreams 2.0 data format and is an official W3C recommended standard as published by the E3C Social Web Working Group.

Fediverse.party is an excellent guide for learning more about the fediverse and its different platforms.

What does this mean for regular users? Simply put, users on the different fediverse platforms - which in turn have their own decentralized servers or “instances” — can interact with each other, including following and viewing posts without signing up for an account on another platform:

• A Mastodon user can interact with users on a Pleroma (a lightweight microblogging platform, similar to Mastodon) server.
• A Mastodon user can see and follow posts from a PixelFed account (the fediverse’s answer to Instagram.)
• A Mastodon user can follow users across varies instances of Misskey.

Mastodon VS Twitter

Decentralized

Decentralization in Mastodon has nothing to do with blockchain technology.

Mastodon’s decentralized nature makes it resistant to censorship by governments or internet service providers (ISPs), In comparison to Twitter, which is centralized, it can more easily be blocked or censored by governments or ISPs.

Most users may be inclined to think this means Mastodon servers are “isolated” or cannot talk to another instance, however this is not the case.

Mastodon servers can and often do federate with other servers; a single-user instance can federate with 50k user instances, 10 user instances, 8k user instances, and so on. This enables the users of different instances to interact seamlessly with each other. Users are also free to migrate between instances, which is useful if a user’s instance is shutting down or the server is no longer serving the needs of the user.

Mastodon users can also interact with other decentralized social media of the fediverse. For example, assuming the server administration enables this, Mastodon users can interact with Pleroma and PixelFed users.

What if someone spins up a spammy or malicious Mastodon instance? Thankfully, Mastodon instance administrators do not have to “federate” with all instances - so, upon discovery of a spammy or malicious Mastodon server, server administrators can opt out of federating or connecting their users with that instance.

In some specific cases, this may be troublesome for users who wish to communicate with other users on an instance that does not federate with their own. However, with built-in migration tools, users can migrate to a server or instance that better suits their needs.

Open-source

Unlike Twitter, Mastodon’s source code is fully open-source. This promotes transparency and leverages the global development and security communities. With Mastodon’s source code, users can spin up their own servers or instances if desired.

An open-source codebase also allows anyone to audit or fork the code. This audit-for-all system allows anyone to report issues or vulnerabilities to the project maintainer. Forking can contribute to the longevity or continuance of a project, even after the primary maintainer abandons it.

Ads vs No Ads

Mastodon is ad-free, whereas Twitter shows ads and targeted ads. Twitter's targeted ads system relies on collecting/harvesting user information - such as demographics, engagement, and location data - in order to show potentially "relevant" ads.

Twitter's ad revenue is the primary revenue stream from the platform; in 2021, it was estimated ad revenue made up approximately 92% of Twitter's revenue.

Mastodon server/instance revenue vary. Mastodon's development is supported by contributors and company sponsors. For specific instances, typically the servers are supported by the admins (out of pocket) or the users themselves.

Little Personally Identifiable Information (PII) required for registration

Specifics ultimately depend on the server administration - for example, some servers might log IP or other potentially identifying device information. However, unlike Twitter (and other popular social media such as Instagram), users are not required/asked to divulge PII like phone numbers.

Users should be aware that just like Twitter, server admins can see everything posted on Mastodon, including DMs.

Machine-learning Algorithm presence

"Algorithms" of traditional social media platforms rely on machine learning to function. Massive amounts of data is required to adequately "train" machine-learning algorithmic platforms - on social media platforms like Twitter, the data comes from the users, hence the "need" for data collection.

Mastodon does not have an "algorithm" many social media users are accustomed to seeing and dealing with. Ultimately, it's on the users to curate their own feeds and posts. However, Mastodon can show "popular" topics as discussed on the instance and/or federated network should the user choose (via the Explore page).

Ultimately, Twitter's platform is closed-source despite its supposed moves towards a more transparent, and potentially open-source model, so verifying what data it exactly uses to drive the platform's algorithm is educated guesswork at best. What remains true is that Twitter does indeed collect user data to drive its machine-learning algorithm whereas Mastodon does not.

Signing up to Mastodon

Most users will find the signup process easy - until the part where they must pick a server. Picking a server is where Mastodon’s difference from Twitter begins to show for the user; specifically, this is part of Mastodon’s decentralized nature.

Picking a server is not the end all, be all. Users are free to migrate between servers at the click of a button any time after account creation. Joining more than one instance is unnecessary; again, these servers “talk to each other” and will allow you to interact with users of another server.

Possible rules of thumb potentially helpful for picking a server:

• Pick a server that has an interesting-to-you “theme” (such as Information Security, or InfoSec)
• Preference for a smaller (or bigger) server
• Invite-only status of servers
• Pick a server in a specific language other than English
• Pick a server in and/or serving a given region

Above all else, it’s important not to get analysis paralysis.

Servers where you must "Apply for an account" are the server administrators getting a head start on fighting spam and automated bot sign-ups that would detract from the instance. In most cases, Mastodon instances where users must "Apply for an account" approve the account in a matter of hours.

More savvy users willing to spin up and operate their own instance may do just that. However, this isn’t definitive and users should weigh the pros and cons of running their own Mastodon instances.

Mobile clients

Mastodon does not have official apps for desktops - users must use the web client (logging in via the browser, similar to Twitter).

For mobile devices, Mastodon does have an official app - however, its function is limited compared to other third-party app clients and therefore it is recommended to not use the official Mastodon app client. For example, the official Mastodon app does not allow users to view the Federated timeline or create post threads.

Users are highly encouraged to download a trusted, open-source Mastodon client that will liven their mobile experience on Mastodon, such as:

Metatext

Metatext is a highly recommended free, open-source, and accessible Mastodon client. Users can add multiple accounts, view and easily manage the different Mastodon timelines (Home and Federated), and makes most Mastodon features available in the app.

Metatext respects user privacy by refraining from tracking techniques and sharing user information with third parties.

Download

Tusky

Tusky is a lightweight and open-source app client for Mastodon. Tusky supports most Mastodon features and supports creating and saving draft posts. Users can switch between multiple accounts while using Tusky.

Tusky respects user privacy by not sharing user information with third parties or engaging in in-app tracking.

Download

Finding accounts to follow

No programmatic algorithm means the user has far greater control over which accounts to follow and by extension, what specifically shows up in their Home feeds. There are multiple methods to finding accounts to follow. Methods listed here are generally easier to use than manually cross referencing your follow list on Twitter.

Twitodon

Twitodon provides an easy-to-use, automated way to check if who you follow on Twitter also have Mastodon accounts. However, the caveat is users will only see accounts who have also used the Twitodon service.

Visit

Debirdify

Debirdify uses the Twitter API to search for people you follow on Twitter for possible Mastodon (and other Fediverse platforms) accounts. It uses various rules, typically associated with fediverse accounts (like @user@host.tld) to find any possible fediverse account matches.

Visit

Fedifinder

Fedifinder works similarly to Debirdify but was developed separately. Fedifinder looks for typical Fediverse addresses (again, like @user@host.tld) on Twitter accounts you follow.

Visit

Movetodon

Movetodon presents a broad "step-by-step" to moving from Twitter to Mastodon. Users start by logging into to Twitter via Movetodon - Movetodon will search the Twitter accountsin your following lists for profiles linked to Mastodon (via a @user@tld rule).

Visit

Human-curated lists

Fedi.Directory

Fedi.Directory is a small and 100% human-curated list of interesting accounts. The directory is split up into general topics and then broken down further into subtopics.

All accounts listed are public and not necessarily personal accounts.

Hint: You may find avoidthehack listed under Privacy and InfoSec!

Visit

Trunk

Trunk is another human-curated list covering a wider range of topics. Accounts listed here are personal accounts - in the context of they’re not organizational accounts. Accounts listed here are also active on Mastodon, minimizing any crossposting from Twitter.

Visit

Fediverse.info

Fediverse.info makes it easy to follow accounts “looking” for new followers across the entire fediverse (not just Mastodon). Users can search a wide range of topics to find accounts aligning with their interests.

Visit

Hashtag following

Users can follow hashtags aligned with their interests, such as #privacy or #cybersecurity. Following hashtags functions similarly to following persons; users will see posts where the author included the hashtag somewhere in the post.

Following multiple hashtags related to your interests is a good way to also find accounts that may align with your interests; this holds more true the more an account posts in a given hashtag.

Users can easily follow hashtags from the web by:

1. Searching for the hashtag

2. Clicking on the desired search result

3. Clicking the follow button

Posts made under followed hashtags show up automatically in the Home feed.

Most Mastodon mobile clients do not support following hashtags within the app; however, if users follow hashtags via the web client, then the posts under followed hashtags will show in the Home timeline on mobile clients.

Explore

The Explore page is another easy way to see what is popular on either your server instance or across the entire network of federated servers. Users can see posts, hashtags, and news items gaining traction on the network at the current time.

Timeline options

There isn’t a machine-learning algorithm to “suggest” or fill up a user’s timeline from collected and harvested data such as location, network information, or contact scanning; in other words, you won't see the filter bubbles typically present on traditional social media. Users are empowered by this and can create or curate their own feed 100% to their own interests if desired.

Home Feed, Local, and Federated timelines

Three timelines (or “feeds”) exist in Mastodon: Home, Local, and Federated. Home is a feed for the accounts you follow, local shows activity from the server instance, and federated shows activity from servers the instance communicates with.

Lists

Users can segment their feeds per their needs via lists.

Filter languages

On the Local or Federated timelines/feeds there may be many posts in other languages. Users can filter public timelines, only showing languages the user selects.

Reading other "Local" timelines

The Local timeline is specific to your instance. However, it is possible to read/view just the local timeline of other instances - without migrating, creating an account on that instance, or sorting through the bigger Federated timeline. This is also independent of following hashtags.

For example, if I am on the mastodon.social instance and I want to read the Local timeline for the infosec.exchange instance, then in my browser address bar I would type infosec.exchange/public

Filtering unwanted content

Users are not entirely dependent on server admins to block unwanted content or any potentially malicious users/instances.

Fediblock

Fediblock is a helpful website for filtering/blocking users and/or Mastodon/Fediverse instances the server admin has not blocked. Users are free to determine for themselves who to block.

Muting

Users can mute other users, similar to Twitter. Muting hides posts from certain users, any posts mentioning certain users. Muted users can still see your posts and follow you.

Notifications from certain users can be muted indefinitely or for a specific timeframe.

Blocking

Blocking users works similarly to Twitter (and other social media); you will not see content of a blocked user. Blocked users cannot follow or other wise engage with you.

Reporting

Reporting a user alerts the server/instance admin to take action and works similarly to if you were to report a user on Twitter.

Post engagement

As mentioned, algorithms as most users are used to on centralized social media platforms like Twitter don’t exist on Mastodon. Algorithms on traditional social media show posts with more engagement; the more engagement, like “likes” or “shares,” a post receives, the higher the likelihood it gets pushed to other people.

In other words: the platform will not curate or cater posts to you. Instead, you, the user, curate for yourself and the users who follow you.

When users favorite a post, this doesn’t get announced to the world. Rather, a favorite stays between the poster and the user who favorited the post.

Retoots are similar to Twitter’s retweets. Retoots are highly useful to make a post visible to other users; if you want a post seen by other users, including your followers, then you should retoot it!

Bookmarks allow users to save posts for easy reference and/or viewing later, similar to Reddit.

Crossposting between Twitter and Mastodon

For various reasons some users may not want to completely abandoned Twitter, but would still like to explore Mastodon and the rest of the fediverse while remaining on Twitter.

It’s not feasible to manually copy tweets on Twitter to toots on Mastodon for most people. Fortunately, crossposting services for Mastodon and Twitter do exist, making it easier to use both at more or less the same time:

• Twitter Mastodon Crossposter
• moa.party

Most of these services allow users to customize options, refining what types of actions get crossposted across Twitter and Mastodon; for example, users can choose to crosspost original posts but not retweets (Twitter) or boosts (Mastodon).

Users should read the privacy policies of these services.

Final thoughts

While the Mastodon may not be specifically designed to “replace” Twitter as we currently know it, it has demonstrated to be a solid alternative to the “Bird site” over the years. Within recent times, Mastodon’s popularity has grown exponentially and it has potential for breaking into the mainstream.

Mastodon is similar enough to Twitter that many familiar-enough parallels can be drawn by users. Mastodon continues to grow in both server instances, users, and introduced features by maintainers and developers. In time, it could become the alternative for Twitter as is, or for any possible centralized and Twitter-esque newcomer.

For more information on getting started with Mastodon and the fediverse, users are highly encouraged to follow @feditips@mstdn.social and to follow/browse the #FediTips hashtag for more great tips from other users on Mastodon.

With that said: see you on the fediverse!

PS: You can find avoidthehack on Mastodon: @avoidthehack@mastodon.social