@phurd @Gargron I think it means new registrations have to be manually approved - not that they have to be invited.

Which for any open instance will probably have to be considered - this kind of attack distributed across multiple servers would be bananas.