Have a restrictive default limit on user registration

[richvdh]

something identified as being helpful in countering abuse: most servers have no need to allow large numbers of users to register. The default config could be quite restrictive.

[GAURAV1-ui]

i want to review this bug. Please assign me this bug.

[richvdh]

Contributions are welcome

[GAURAV1-ui]

Can you help me how can I contribute. I am beginner.

[richvdh]

An alternative suggestion: refuse to start if registration is enabled without captcha and/or email verification, unless you set an i want to spam the federation flag

[reivilibre]

Other thoughts: can we 'encourage' use of token-based registration by default?

[callahad]

Sounds like what we want to do is refuse to start up with open registration unless ReCaptcha or email verification has been enabled. We also want to provide a config flag to override this for administrators that want to have unrestricted registration, but we should be defaulting to a safe configuration.