Audit registrations

[AndrewKvalheim]

Not really sure if we’d want this, but exploring the idea. Now that we’re administering Synapse we have the ability to add custom Synapse modules.

In past years we’ve been blind to actual user registrations and relied upon observing room membership as a proxy, but that risks missing problems like conference attendees failing to join the space or deliberate abuse. As a simple mitigation, this hooks into on_user_registration and logs each new user in a moderation room for human review.

[strugee]

I'd like this to go to a room on the ephemeral homeserver, not our production space. Rationale: if like 10,000 bots sign up or whatever, we've just permanently DoS'd Seattle Matrix's database.

[AndrewKvalheim]

@altsalt ^ Recommendations on where to send this?

[altsalt]

Perhaps we can setup some sort of a bot log channel (though of course this is more than just bot), where there is an expected large number of items to be continuously coming in.

[altsalt]

I mean, given the title, perhaps #audit or #syslog?