This makes a lot of sense for organizations. They control the servers. They own the domain. This is how the Web is supposed to work.
It seems like a wasted opportunity to set up a new domain (in this case: wikimedia.social) rather than use an existing one with a subdomain, e.g. social.wikimedia.org or social.wikimediafoundation.org. With a new domain I still have to do the work to verify whether the domain is indeed owned by the Wikimedia Foundation.
[1]: https://phabricator.wikimedia.org/T337586#8932905 [2]: https://phabricator.wikimedia.org/T337586#8936483
If that's true, for a use case as functionally basic as having a store and a social instance in their respective subdomains, it looks to me like a complete failure of HSTS, a case of technology causing problems that shouldn't exist to begin with.
> it'd involve giving a third party a SSL certificate for wikimedia.org
You can have certificates for subdomains. With Let's Encrypt you still need to control the root domain to generate them so they'd have to setup something for that. But that's more a can't-be-bothered concern than an actual security concern. Teaching the public to trust random domains being authentic is a much much bigger security concern anyway.
We can get half way there with /.well-known/webfinger - but the alias that provides doesn't show up in the feed, so that's not the username I find from links like OP's.
Control is a sliding scale. They could run it on a physical box in Wikimedia headquarters and you could still argue they don't fully control the server because their ISP could always cut them off.
You have to make reasonable decisions based on your threat model and how easy it would be to move up the level-of-control ladder if needed. Getting on Mastodon at all represents a huge leap forward, and frees them up to migrate to a higher level of autonomy later.
Which is the point, the move to a higher level of autonomy is not going to happen later. It's far too much effort once they've already settled in.
We should praise organizations that actually seek to normalize control over servers, not praise relying on yet another "fully managed" service. We can do that while also recognizing that them being on fediverse is nice in general. All of these are possible without stating falsehoods like "They control the servers".
I don't know where in the world you are, but I want to live there. Changing my ISP is far more intimidating to me than migrating a database and a few DNS records.
> We should praise organizations that actually seek to normalize control over servers, not praise relying on yet another "fully managed" service.
What would be enough to satisfy you? A VPS on AWS? A VPS on a smaller provider? A dedicated box at Hetzner? Or would it have to be a machine that they built from scratch and can physically access?
More like: this in how the Internet is supposed to work. ActivityPub is hardly "web" because it's not trying to attract traffic on a specific website.