@bonifartius @gabriel @matthew one of the issues we've had with Pleroma is that we ran a Gitlab with open registration (because why not?) and this was just a constant source of headaches.
It doesn't matter if you put up a captcha, those are too easily broken but a lot of the spam/abuse is coming from real humans working out of places like Vietnam. They're just paid to register accounts and paste spam everywhere. We could get 3000 new spam accounts per day easy. And GitLab doesn't offer tooling for bulk deletion of accounts...
Yes, the accounts required activation. So they'd register an email address on Gmail, sign up with us, verify their email, etc and then spam. It doesn't really matter what your defense or rate limiting are, they'll just keep going at a steady pace and overwhelm your server.
And this is *before* the LLM bots started hitting us. So now I'm doing things like importing blocklists to completely stop anyone coming from Vietnam or the ASNs of some Chinese companies training LLMs...
What I'd like to see is a first class email support in Gitea/Forgejo. It's not there yet but it's close enough. My thoughts are:
1. core team has real accounts and full access; world has read only view
2. any outside contributor should be opening an issue/pr via email
3. we can spam filter the incoming emails. We know this can work, especially doing a little bayesian training on the latest trends in spam crap that comes through
4. if someone is a good contributor and we want to invite them in, we just have to activate their account and send them the password reset link
this should keep a lot of the junk out while still being "open".
