Mastodon is not a Twitter replacement
One of the worst things during this Twitter migration is that a lot of people (including technologists) have positioned Mastodon as a Twitter replacement. It isn't. The federated model means it can't be in a lot of ways, ever.
For example, this Mastodon thread highlights one of the big challenges when it comes to becoming a centralized emergency platform, the way Twitter has. Mastodon, quite literally by design, can't currently become that.
A friend of mine ventured into Mastodon this week and immediately was turned off by the inherently challenging UX from the start. Things that should be simple, aren't. (And this is something I've also highlighted before.) Like, the act of following someone when they are on an instance other than yours, is non-trivial, which is a huge issue for new users. Or liking someone's post when they are on another instance is shockingly difficult. These are the things which have to be solved for it to ever gain mass appeal. Even I, a fairly capable technology user and fan of Mastodon, grow tired of these issues.
Moderation is an ongoing issue and discussing how it will be handled. If you report a tweet, if they are on your instance, great the mods can deal and action accordingly. As it is, if you report a tweet of someone who isn't on your instance, it goes to your instance mods. They can discuss if they want to block this user from the instance, or if they are seeing a lot of users from a particular instance get reported, it could escalate to them unfederating with that entire instance. Imagine 4chan opened a Mastodon instance. Imagine those trolls letting loose on Mastodon. The network would simply block that server and refuse to work with them.
But that doesn't solve harassment and attacks. Another part of Mastodon's design is of minimizing exposure. People can't simply search for a keyword and find people to attack like on Twitter. You, the poster, have to choose to use a hashtag, doing so gives your post potentially more exposure to people who search that hashtag or who follow it. If you do then you're opening your self up to possibly random people engaging. But this is only a first-level defense. Someone is going to, eventually, build a bigger Mastodon search engine which does enable full text search, etc.
Scaling and malicious attacks. Handling attacks from malicious actors. There has already been a moderate scale attack by folks on a domain attempting to basically DDOS the network. Seeing this play out has convinced me that I don't ever want to run my own instance. It would seem fun to be on my own for branding and the act of owning my Mastodon identity, but things like this would put it very-much out of my skill technologically right now.
All of that said...
I continue to really like Mastodon, but that is because I've found a good instance with a strong overlap of my own interests. I don't know how much of that is because of Mastodon itself.
As much as social media relies on you finding and following the right accounts, I have come to believe Mastodon's success for each individual relies on them finding the right instance for them. Which is no different than finding the right forum, or discord, or just - community.