> Centralization makes it easier to deal with "bad" actors.
Moderation is a problem that scales terribly. We haven't actually solved moderation at scale, no matter how many algorithms and ML models we throw at it. That was part of the ridiculous opening salvo by Musk, if you'll recall, that Twitter was full of unmoderated bots and if they just sent him a ton of their data his engineers would find a better way to moderate over lunch. They did and his engineers didn't and he reneged on the deal at that point and became a morass for the courts.
Moderation is labor. The number of moderators you need per volume doesn't scale well, no matter how many tools you throw at it. This seems to be the repeating lesson of both Twitter and Facebook. We have too much data from Facebook that auto-moderation tools plus scale make the labor of moderation terrifyingly worse: instead of moderation being a continuous background process of seeing 97% fine posts and the occasional 3% of bad actor posts, moderators are fed streams of the opposite: 97% content from bad actors. This has huge mental health issues with many reports of PTSD and worse from Facebook's human moderators.
Decentralization necessitates more moderators and naturally spreads out the work of moderators to give individual moderators less to do "in their local neighborhood". It returns to a background activity where moderating the bad actors is a small effort compared to other things going on in an instance. Instances may be invite-only, further minimizing the role of a moderator on a small instance versus the threat of bad actors.
Reports of bad activity often get seen by at least two moderators: a moderator on your local instance and a moderator on the remote instance where the bad actor is. Mastodon provides a number of tools to moderators on both sides of that: the local moderator may silence all of a bad actor's content locally and can escalate that to silence or blocking a remote instance if the implication is the remote instance tolerates too many bad actors. The remote instance can put bad actors on probation or kick bad actors. Most of these tools are both quite easy to work with and powerful enough for most needs on Mastodon today.
Decentralization also shrinks the "blast radius" of a potential bad actor: bad actors can create all the instances they want, certainly, but if no one is following those instances, does anyone really notice? It's a tree falls in the forest problem. There's often a lot of "fediblock" drama when new instances from entirely bad actors show up, but often the "fediblock" messages themselves are much more viral than any possible bad actor (because admins/moderators care for each other in a decentralized manner).
> how do I discover people I know?
How do you discover someone's email address? How do you discover someone's blog? How do you discover someone's mailing list or Discord or YouTube Channel or Twitch Channel or …?
Discovery could obviously be better on Mastodon, but discovery is also an on-going process people do decentralized all the time, through word of mouth, through friend's recommendations, through other channels, through in person events, through friends' retweets (boosts in Mastodon) of other interesting people that they follow.
Some of the "huge problem" of discovery on Mastodon has nothing to do with Mastodon and everything to do with network effects. Not enough people use Mastodon so not enough people think to put Mastodon handles on their business or social cards. Not enough people think to add "follow me on Mastodon" after the usual "Like and Subscribe" in a YouTube video. Etc and so forth. From a network effects perspective discovery on Mastodon isn't a bigger catch-22 than "nobody is on it", discovery on Mastodon is the exact same catch-22. That's what makes it a catch-22: nobody is on Mastodon so nobody is talking/sharing about Mastodon so nobody is on Mastodon. Discovery on its own isn't a catch-22, it's a bootstrap problem. It's network effects that make discovery a catch-22.
> How do content creators who want to build an audience (and so create content that would attract users to the platform) get discovered?
How does anyone market anything on any platform? Discovery is marketing. Marketing is getting discovered. It's no different and arguably much better than (from a tooling standpoint) from the early days of Twitter when hashtags were just a search convention and not a built-in feature. All the usual tools from Twitter generally apply to Mastodon: virality and hash tags. Going viral is much harder on Mastodon with no "algorithms" to cajole and machines doing your work for you, just people to convince to boost you. Also, yes, there are a lot of instances that are defiantly allergic to obvious and outright marketing for major corporations or celebrities or general "influencing"/brands/branding. (Though many of those same instances adore small creators working independently and who wear their hearts on their sleeves, so long as they keep their marketing "human" and plain dealing and don't spam it.)