How do these federated forges deal with spam? If merge requests and issues are federated, does that mean that anybody running a radicle node (or interacting with one) can open issues or merge requests on all the repositories that you've made public? Or is there a whitelist (or something fancier?) to allow interaction only with specified nodes?
yes, we currently have just the base building blocks (`rad follow` - allowlist / `rad block` - blocklist) for the fancier things to be built on. When you "seed" a repository, by default you seed it only with "followed" scope, which means you would only see issues and "Patches" (our term for PR/MR) from the repo maintainers + other peers you follow (i.e. in your allowlist).