Two DDoS attacks in under a week against major decentralized social platforms, first Bluesky and now Mastodon's flagship server, should tell you something important: resilience is not a feature you can bolt on after launch. It is the product. When the servers that host the town square go dark under a flood of junk traffic, the promise of a decentralized alternative to Big Tech starts to look like a technicality. The people who run these networks are not failing because they are careless. They are failing because they are being tested, and the test is not whether the software works, but whether the infrastructure can absorb hostility.
For you, the person who moved your work or your community to these platforms, the practical takeaway is uncomfortable but necessary: your data may be safe, but your access is not guaranteed. A DDoS attack does not steal your posts or expose your private messages. It simply makes the service unreachable, sometimes for hours, sometimes longer. If you rely on Mastodon for time-sensitive updates, customer support, or coordination with a team, an attack like this is not an inconvenience. It is a shutdown. The same applies to Bluesky. The fact that both were targeted in such a short window suggests this is not random vandalism. It is a stress test of the entire model, and right now, the model is showing cracks.
What should you do about it? Not panic, and not abandon ship. But you should stop treating any single server as your permanent home. The strength of a decentralized network is that no one node is essential. The weakness is that most people still act as if theirs is. If you are an individual, keep a secondary way to reach your contacts, whether that is a newsletter, a simple website, or a group chat on another service. If you run a business or a community, do not build your entire presence on one instance, no matter how established it looks. The flagship server got hit precisely because it was the flagship. That is the price of being the default.
The real lesson here is about expectations. Decentralization was never going to be a magic shield against the internet's darker habits. It is a system of redundancy, and redundancy only works if you actually use it. The attacks will continue, and some will succeed. That is not a reason to retreat to the centralized platforms that have their own set of problems. It is a reason to treat every platform, centralized or not, as a tool rather than a home. Build your presence, but keep your address portable. The network is not fragile because it is decentralized. It is fragile because we keep pretending that one server should be the center of it all. Stop doing that, and the next attack will be someone else's headline, not your outage.