and now we wait..
there's been 2 actual spam signups again since I enabled registration this morning... so it shouldn't be long till I see some logging that isn't my testing

fuck...
gitea-registration-proxy Signup request: bvhrcuxqnd (cedotze@gmail.com): "please leave this empty"

they actually use a browser, maybe even doing this shit by hand

so yeah, none of that hidden form field stuff is going to work

I might continue working on this as a manual approval thing, integrating it with a matrix bot

@dumpsterqueer my naive approach right now is changing the signup template to put the email in a differently named form field, while adding a hidden field with the name="email". If that one is filled in (by a bot) the request is denied. We'll see if that's enough