Home of the sh.itjust.works instance.
So far, we have a captcha on account creation now and it seems to be working (from what I've seen, anyway)
It'll be a tough balancing act though. Relatively frictionless sign-up has been great for us, and anything that deals with bots will also affect that. Whatever else we may end up doing will need to be carefully considered.
Great question, great read. Thanks for posting this.
Personally, I think adding a recaptcha and possibly a recovery email are reasonable to add to sign in.
When I made my account this past weekend, it was refreshing to only need a username and password, but it's also way too easy to abuse.
I'm not sure email even does anything though. It will depend if that instance even has SMTP set up.
I think obviously botted instances that aren't doing anything about it should be defederated. It can only cause harm to communities that allow those bots to interact with them.
