We are aware of an ongoing wave of subscription spam throughout the fediverse.
We are investigating avenues to mitigate this, but they will likely involve deep changes in the sign-up flow that may break sign-up from existing applications.
In the meantime, you can find helpful resources at https://about.iftas.org/2026/09/11/boom-protocol-spam/
about.iftas.org/2026/09/11/boom-protocol-spam/
Replying to @MastodonEngineering@mastodon.social
@MastodonEngineering
Here are some ideas:
1. Account creation should only be done by the instance not apps
2. Accounts cannot be created without confirming email first
3. Emails that are not on popular services (e.g. gmail, hotmail, yahoo etc) should prompt a difficult captcha to solve even before verification is sent
Replying to @samir@m.fedica.com
@samir 2. is already there. The problem with this particular spam wave is that they are using Mastodon servers to flood people's inboxes. The point isn't the mastodon account, it's sending the e-mail. https://en.wikipedia.org/wiki/Email_bomb
en.wikipedia.org/wiki/Email_bomb
Replying to @gunchleoc@mastodon.scot
@gunchleoc @samir this thread / post is specifically about #bpSpam - not saying all the other conversations about spam in general aren't valid, but the OP is about a specific, novel activity that spams third parties via Mastodon account creation.
@jaz @gunchleoc
To be honest Jaz, I don't understand why apps are allowed to register users
It's not a lot of friction to ask users to register directly on the instance then connect the app
I am sure the bp spam will try the instance directly but at least you can have more control on the instance
Replying to @samir@m.fedica.com
@samir @gunchleoc l'll offer a few things in response.
I want an open social web. More friction is bad friction.
Many people expect "the app". They live on their phones. They are mobile-first.
There are a ton of industry standard mitigations that can be applied. Spam is an old problem. Most of this can be mitigated with a mix of time and money. We ask a lot from a very small, overworked team struggling to fund itself.
#GoodNotPerfect needs to be more acceptable to the community at large.
@jaz @gunchleoc I agree 💯 but moving the registration to the insurance instead of API doesn't mean the app is locked out of the process. You just kick the user to the browser or use a webview in the app but the instance is in full control of registration (not the app)
Yes the UI will be different but most users won't even realize what's happening under the hood
⁂