That's rare, though, right? Since there's often a ton of following going around, especially now?

It's probably also not that hard to make something that easily passes those sorts of quick checks?

> Some instances are fine with search indexing their public timelines.

Which then means anything of yours that gets boosted by someone on a server like that will be indexed.

Not in my experience. I'm on a tiny instance and follows are so rare in general, I can watch them all individually.

There are many users that require follow requests where they verify/vet every single follow.

> It's probably also not that hard to make something that easily passes those sorts of quick checks?

Maybe such that one person doesn't notice, but remember the scale here: if someone is trying to "follow the world" maliciously, they have to make sure that they pass the quick checks of every paranoid person they try to follow. Once a malicious site is "discovered" the #fediblock hash tag moves pretty virally to encourage other paranoid users/instances to (re-)evaluate the bad actor.

> Which then means anything of yours that gets boosted by someone on a server like that will be indexed

(Courteous) Instances don't allow you to boost a Followers Only post to the Public timeline.

Discourteous instances may exist, but when they are found out, they are generally blocked (again, the #fediblock hashtag sometimes moves swiftly and virally here).

Well, there goes thinking I can always just host my own instance, I probably wouldn't be active enough for their tastes. And it adds another concern to joining a smaller instance, seems like I have to rely on other users to make it look more legit if I don't want to be so centralized. Or are they looking for very strictly, literally "lurker only" instances?

If your server only has a handful of accounts that obviously correspond to you and your friends, I don't see why anyone would have a problem with that.

On the other hand, if the server has 100s of accounts, each of which follows a large number of people off-server - yet somehow no one follows anyone else on the server and no one ever talks a single word, that would probably raise some suspicion.

Existing Twitter and Facebook connections (names, followers, friends, etc) to create many secret indexer servers made of easily verifiable Google searches of real people with real friends and GPT-like toot generation to fake just enough activity seems like a pretty straightforward route to avoid suspicion.

Arms races suck -- public data is public, period.

On top of that, arguably Mastodon is full of weird people who often don't look all that like real people and find themselves trying to be their weirdest selves (which is also why protecting the privacy courtesies on Mastodon is seen as important). Instances looking too much like Twitter or Facebook data are suspicious in their own ways.

> Arms races suck -- public data is public, period.

There will always be bad actors, but that's not excuse to ignore common courtesy, throw your hands up, and just claim all private data is public. Mastodon isn't Twitter. Mastodon isn't intended to be 100% public. There is data with an expectation of privacy. Just because people can violate that expectation doesn't mean it isn't private data.

A common analogy here is conversation in public restaurants: just because the restaurant itself is open to the public and serves anyone doesn't give you license to eavesdrop on any conversation you want inside of that restaurant. There's generally an expectation of privacy among the other diners. (And in the real world someone trying that might get their ass beat for trying it.)

The particular combo here, though, is "lurker only instance" that also spams follow requests. If you don't spam follow requests and are selective about who you follow (like a human rather than a bot), you have less risk of this specific paranoia. Lurkers are fine to many Mastodon users. Lurkers spamming following requests are a concern.