❗️Admins: REQUIRE E-MAIL VERIFICATION OR A CAPTCHA FOR REGISTRATION - NRDLemmI
lemmy.nrd.li
It is currently possible, through Lemmy’s API, to create accounts automatically and without limit if verification by email address or captcha is not activated. I’d advise you to activate one or both of them NOW! After registering x number of accounts (currently I could do thousands), all you have to do is list all the existing communities for each of the account to publishes one new post per community, or more. I’ll leave you to picture the mess. (I apologise to the administrators of sh.itjust.works, I should have done the test with my own server.)

Apparently Lemmy’s user creation API is wide open, making it trivial to make accounts en-masse. This should not be a huge issue as this instance requires an application to be filled out to create an account.

To reduce likelihood of such accounts being made and overwhelming my ability to review applications captcha will be enabled until this issue is fixed. The difficulty is currently set to “Medium”, which may be adjusted.

I am guessing this will be fixed in the upcoming 0.18 update which has several significant changes, some of which may require some downtime to apply. Details of what that update entails are currently not clear, including the timeline for its release.