You're missing the point. The issue is not that the project has problems - the issue is that the Diaspora devs are making elementary mistakes that should never have been made. The problems that have been pointed out essentially mean that they're clueless about how to write secure code, and as such anything they write / are responsible for is automatically suspect.
In order for Diaspora to be at all credible, the devs need to learn a hell of a lot about security first, or someone else needs to take over the project - the kind of mistakes they're making here are elementary, and shows that not only do they have almost no knowledge of how to make a web application secure, they also aren't thinking through the logical consequences of what they're writing.
Diaspora isn't doomed because it has flaws, it's doomed because the developers have proven themselves to be fundamentally incompetent.