First, they say that they're going to put you in charge of your data. If you post something that you want to take back, you can delete it. However, how would that work on a distributed network? Let's say that you use Goodbook and I use Ultrabook and we're friends. I post something on Ultrabook and Goodbook grabs it to show in your newsfeed. Then I delete it from Ultrabook - it was embarrassing. Goodbook still has it stored. You can have a good-faith "please delete this" but that doesn't stop another party from keeping it. So, there's actually little control that one can exert over their data in a distributed network and it relies on us trusting not only the provider we've chosen, but the providers of all our friends.
Second, the end-to-end encryption promised doesn't seem so likely. For example, if Goodbook grabs my status in encrypted form and they can unencrypt it, that doesn't make the encryption worth anything. For encryption to be worth something, it needs to be unencrypted by the end user. However, I don't see how they'd do that. Browsers don't integrate this functionality and one could write a plugin, but that's a big barrier to adoption. I could store my public key with my Ultrabook account and then Goodbook could push your status updates to me encrypted with my public key that I could then decrypt using my private key, but that seems like it wouldn't be the most seam-less experience without additional software.
That also ignores the much larger storage cost of storing a message encrypted once for each friend you want to send it to (say, 500 times) rather than storing it one time for everyone, but that's a scaling problem that could be overcome.
If another service provider can unencrypt the updates, you're in a worse position than with Facebook. Right now, I only have to worry about Facebook being evil. In that scenario, I'd have to worry about a bunch of service providers and hope none of them are evil. Likewise, if they're able to store the updates on their server, I'm no longer in control of my data. My provider might have a reason to put me in control (keep me as a user), but I'm likely to be unaware of what other providers are doing and have little recourse (other than de-friending everyone using their service).
I think it's possible to compete with Facebook. It does have a huge barrier to entry, but big companies have been toppled before. No one thought AOL would be relegated to what it is today either. No one thought an upstart like Google could topple the old guard. Frankly, Facebook came in and toppled MySpace. It happens. But I don't think Diaspora has even addressed two of the the fundamental issues they claim to be solving. That's what will stop Diaspora from toppling Facebook - they have yet to really talk about how to solve the two major problems they face.
*Also, if someome has an idea of how to address those two things, I'd love to hear it!