1. Open decentralized model is at disadvantage when it comes to moderation. You don't know which nodes to trust, you can't control or even guess their policies and you are supposed to trust any node you don't know yet.

It is pretty much like email and nothing gets more spam, fraud and other malicious interference than email.

2. There isn't any identity verification or fraud control and it is very hard to combine them with anonymity and privacy. Big centralized services can just shove it: "No valid phone number? No Twitter for you! And no, we don't like this number either..."

3. Free services are simply lacking administrative controls because the first spam/scam trolling epidemic is yet to come. There are no spam filters, there is almost zero monitoring over instance content, no remote identity verification before the first contact happens (as I think, maybe I am wrong?), it is very easy to spoof users... In other words free platforms are just underdeveloped in this regard.

By the way malicious actors are already trying the water. So far it doesn't seem an appealing target but only because it is Uncatchable Joe. It can change any moment now.

I believe email is on the contrary a very good example where it is so full of spam, fraud and scam that adequate measures have been devised to thwart them, and they haven't been based on the will of a single company (ok, it's mostly Google, but still). And despite of the onslaught, email is very successfully used to communicate between people.

Again, what makes Twitter and Facebook so appealing to state-actors is the scale and the easiness of the reach. On Twitter, you can drive by popular figure accounts within minutes of creating your account without any prior research, and your reply will appear in front of the eyes of the thousands of people who will open the same tweet. On Facebook you can simply ask Facebook to pinpoint vulnerable people and show them an egregious political ad that will never be public. None of those behaviors related to Russia's interference in the 2016 US presidential elections are technically possible on the Fediverse.

I also believe that the lack of identity verification on the Fediverse means that it is entirely peer-based. There's no risk of a "blue checkmark" verified account being hacked because there's no central authority to deliver an identity verification that could be hijacked. Each user has their own circle of trust that can be close or wide, but there's no way to know in advance and there's no surefire way of making it through as simple a subterfuge as hacking a blue checkmark account and replacing the display name.

And Mastodon, especially through Mastodon.social, may be the spearhead of comprehensive moderation and administrative controls because of its magnitude on the Fediverse. This is something that can be improved without depending on any bottom line.

Email is successful because email evolved and developed measures against misuse - both technical and psychological. I mean you probably have your spam folder full of scammers, spammers and all kind of crap and sometimes it seeps to your clean folders. But you know you have to take anything arrived by email with a grain of salt. With a pound of salt even. Also you know that most of the time you can't do anything about the sender except just delete the message.

Fediverse currently lacks both. No technical measures in place and many users are just not ready psychologically to handle open web, they still expect it to be Facebook-like where everyone is supposed to follow some Code of Conduct and the police is on call to get everyone who doesn't.

I do believe both can be created for decentralized networks. It has to happen at some point but right now I don't see it happening.

Peer validation exists on any social network. However if it doesn't work on Twitter, it won't work on Fediverse for the same reason. Viral reshares do happen here and they propagate just as well. The only difference is the absence of central control which can at some point (hopefully early) intervene and squash malicious influence network-wide. This is generally good thing given how central authorities can't be trusted but it also makes trolling easier and shifts responsibility to fend it off to end users.

I don't know how Mastodon does moderation. How are you supposed to moderate incoming federated traffic? How do you flag objectionable content? Do you end up banning entire instances? What if "attacker" just creates multiple throwaway instances? What if evil guys are hiding among civilians, e.g. malicious traffic comes from big and generally okay node?

As you surely know even Facebook struggles with moderation even though they are so much better equipped. This is not an easy question.