We are aware of an ongoing wave of subscription spam throughout the fediverse.

We are investigating avenues to mitigate this, but they will likely involve deep changes in the sign-up flow that may break sign-up from existing applications.

In the meantime, you can find helpful resources at https://about.iftas.org/2026/09/11/boom-protocol-spam/

#MastoAdmin

@MastodonEngineering
Here are some ideas:
1. Account creation should only be done by the instance not apps
2. Accounts cannot be created without confirming email first
3. Emails that are not on popular services (e.g. gmail, hotmail, yahoo etc) should prompt a difficult captcha to solve even before verification is sent

@samir 2. is already there. The problem with this particular spam wave is that they are using Mastodon servers to flood people's inboxes. The point isn't the mastodon account, it's sending the e-mail. https://en.wikipedia.org/wiki/Email_bomb

@gunchleoc @samir this thread / post is specifically about #bpSpam - not saying all the other conversations about spam in general aren't valid, but the OP is about a specific, novel activity that spams third parties via Mastodon account creation.

@jaz @gunchleoc
To be honest Jaz, I don't understand why apps are allowed to register users
It's not a lot of friction to ask users to register directly on the instance then connect the app
I am sure the bp spam will try the instance directly but at least you can have more control on the instance

@samir @gunchleoc l'll offer a few things in response.

I want an open social web. More friction is bad friction.

Many people expect "the app". They live on their phones. They are mobile-first.

There are a ton of industry standard mitigations that can be applied. Spam is an old problem. Most of this can be mitigated with a mix of time and money. We ask a lot from a very small, overworked team struggling to fund itself.

#GoodNotPerfect needs to be more acceptable to the community at large.