• Starting from 2025-02-15, registering new accounts will be suspended.
• New users should log in using SSO (GitLab.com and GitHub).
• New users will be able to create forks without requesting their accounts to be cleared.

Since Xfce started hosting its own GitLab instance, two ways to create accounts were available: plain username/password and SSO. Unfortunately, spammers exist, and as a mitigation, we had to disable the ability to fork by default. Users had to request it via the mailing list or Matrix, which was a hassle for both sides.

Even that wasn't enough. We added reCAPTCHA to counter automated bots, which helped to some extent, but fake accounts are still created daily—sometimes in the tens. While we have routines to block them automatically, they are far from perfect. We're in the “business” of making a Linux desktop, not fighting spam.

Recently, we received an email from Google stating that reCAPTCHA now requires a Google Cloud Platform account and a credit card. Yes, we are currently on the free tier, and yes, we have a good amount of money over Open Collective. However, none of the core developers are motivated to maintain yet another piece of our anti-spam defenses. Moreover, GitLab does not support alternative captchas such as hCaptcha.

From 2025-02-15 onwards, sign-ups will be disabled. New users will have the option to log in via their GitLab.com or GitHub accounts (SSO). This may sound like a drastic approach, but it's exactly what other projects 1 2 have done.

If you still want a regular username/password account, please contact us via Matrix and provide Name, Username and Email.

As a tentative measure, we will remove the limitation that prevented new users from creating forks. If spammers abuse this again, we will consider reinstating it.

Ultimately, we aim to reduce the time spent fighting spam and unlocking accounts for new contributors — time that could be better spent hacking on Xfce. As a side effect, requesting fork permissions will no longer be necessary, which we hope will lower the entry barrier.

Some people strongly oppose SSO logins, which is why we have kept the possibility of manually creating accounts upon request.