for what it's worth, privacy, follower control, were added later at the behest of some people. i was part of one of the first groups of people who brought it up, and at first lots of people were telling me about how that's simply impossible because ostatus doesn't support it... because every post went on the global timeline by default, including replies. there weren't image or text CWs either, though all of these appeared within about a month. though locking accounts took longer and follower-only posts waited until then.

when those privacy settings were first implemented, it was solved by just having them not federate. but then there were enough mastodon instances, and enough users on mastodon.social itself that it was lagging, and people were moving to other servers. this caused a problem where lots of people's friends would post follower-only posts, so of course you have to be on the same server as them. this caused a big strain on smaller servers' admins, quite a few instances closed signups. then the private post federation was implemented, and now.. we have the box that says "do you trust everyone who follows you??" and stuff.

at any rate, mastodon was a much more vanilla ostatus implementation to begin with, and slowly morphed due to user feedback, a lot of these features were implemented as github merges when other people made the feature work which previously had been thought not to work. there's also activitypub which i just read about, but unsure of the details there.

i didn't know gnusocial has groups though, that's soemthing i've wanted mastodon to do for a while. though i'm not sure how gnusocial does them, since i imagine using groups to restrict who receives certain posts more granularly than current options...