What runs it, and how old is it

Counting servers and counting use give almost opposite answers about what the fediverse is made of.

Servers versus activity

By server count this network is mostly ActivityPub-enabled blogs. By activity it is overwhelmingly Mastodon. The right-hand column — monthly actives per server — is the one that separates a publishing tool from a social one.

software	servers	monthly actives	actives per server
ghost	11,208	3,970	0.4
mastodon	8,438	833,957	98.8
wordpress	4,435	3,147	0.7
peertube	1,797	48,716	27.1
misskey	1,079	1,862	1.7
writefreely	752	136,946	182.1
pixelfed	677	171,579	253.4
sharkey	486	1,462	3.0
lemmy	447	30,376	68.0
friendica	353	1,962	5.6
akkoma	322	2,124	6.6
pleroma	263	2,636	10.0
owncast	247	247	1.0
gancio	213	0	0.0
Mobilizon	160	0	0.0

That distinction matters for regulation, which mostly turns on user-to-user services. A blog federating its posts is a different object from a server hosting other people's accounts, and every published fediverse statistic adds them together.

Version currency

Nobody publishes this for the fediverse, and it is a security posture measure sitting in plain sight: every server announces its exact version to anyone who asks. An instance several minor versions behind is running known, published, patched vulnerabilities.

Mastodon version	servers	cumulative
4.8	162	1.9%
4.7	4,294	52.8%
4.6	1,343	68.7%
4.5	1,190	82.9%
4.4	303	86.4%
4.3	457	91.9%
4.2	306	95.5%
4.1	164	97.4%
4.0	84	98.4%
3.5	73	99.3%
3.4	25	99.6%
3.3	7	99.7%
3.2	7	99.8%
3.1	14	99.9%
3.0	4	100.0%
1.6	1	100.0%
0.0	1	100.0%

2,636 Mastodon servers are on a release older than the three most common. A long tail is still on the 3.x series, which predates the current major line entirely.

Version strings are self-reported and some forks report the upstream version they were built from, so read this as the version each server claims. That is also exactly what an attacker reads.