thoughts around real world spam

[guaka]

On nomadwiki we use ConfirmAccount to keep spammers out. We still get attempts to create accounts daily. So we can't just disable ConfirmAccount and set $wgGroupPermissions['*']['createaccount'] = true;

Currently this extension is doing most stuff inside JS, including createAccount(username, data.query.tokens.createaccounttoken);, which relies on the above group permission.

...