

The Free Software Foundation requires “CLAs” as well. I have no fear that they’re going to rug-pull. I don’t think we can use that as the indicator. IMO, it’s even a good idea to have a CLA so that’s no conflict that the project owns the code.
The warning for me is if the project is run by a company, especially a VC-backed company. Joplin isn’t, so I would be comfortable using it (although I don’t).
For those who don’t know, Bluesky isn’t really federated. The only way to host a non-Bluesky instance required 1TB of storage in July 2024, and 5 TB of storage in Nov 2024. Could be way more than that now.
You basically have to be a company to federate into the ATProto (Bluesky) ecosystem. You can’t just “stand up an instance”.
Lots of detail: https://dustycloud.org/blog/how-decentralized-is-bluesky/
(I know you’ve already realized that you were conflating Mastodon with Bluesky, I’m putting this here for others who come along so they can get the facts).