Yes, that is how it works. Lockheed Martin isn’t a governmental body within the United States and is not bound by our Constitution in any way.
Regardless of our opinions on the matter, those are both private companies with their own rights that are not bound like a government under our current laws. People forget that because “corporations are people” they also get Constitutional protections. Our rights end where their rights start and vice versa.
My (limited) understanding of ActivityPub is that it functions on a publish-subscribe model. If you and I both ran instances and federated with each other, every time a message was posted to my instance I’d send a message to you and vice-versa. Now, let’s say a new person comes along with their own instance and they want to federate with us, but they have 1000x more users than we do. If we federate with this new instance, we now both have to handle 1000x more traffic.
This is effectively a Denial Of Service attack.
Threads currently (supposedly) has 70 million users. If only 0.001% of those users are interacting with federated content every second, that’s still 1000 messages every second. Smaller instances are likely not configured or tuned to handle this level of traffic on top of their existing traffic.
Honestly, I feel like the bigger issue is the immense flood of content that’s going to pour out of Threads. I’m not sure if many of the self-hosted instances will be able to federate with it and continue to function.
There’s nothing wrong with OCI Images. If you’re concerned about the security of Docker (which, imo, you should be) there are other container runtimes that don’t have its security tradeoffs (e.g. podman).