"Who can register accounts?" should be set to "Administrators only" by default.

Makes sense, but that's not really major.

I have created a patch by changing the default configuration set to "Administrators only"

As it is suggested above "Who can register accounts?" should be set to "Administrators only" by default, It is still by default not set to Adminsitrator only. Check the following screenshot

This is not right.

Based on patch #17.

Formatted summary and added screenshots from patch #20.

The comments in minimal_install() and standard_install() need to be updated to take the new functionality into account.

+++ b/core/profiles/minimal/minimal.install
@@ -21,7 +21,7 @@ function standard_install() {...

+++ b/core/profiles/standard/standard.install
@@ -16,5 +16,5 @@ function minimal_install() {...
 
   // Allow visitor account creation, but with administrative approval.

Also, if you can create an interdiff (https://www.drupal.org/documentation/git/interdiff) this makes it easy to review updated patches :)

Thanks @John Cook.

The screen shots from #21 still apply as the patch from #24 only changes comments.

This achieves the goal described in the summary, so setting to RTBC.

The issue summary claims there's a security issue, but the 'adminstrator approval required' setting does not allow those registered users to log in until they're activated.

I'm really not sure why we'd make this change - for a new site having no register option could be equally confusing.

Tagging for usability and product manager review since this affects the standard profile.

I am not really sure, why this adds value. Users who are unfamiliar with Drupal will assume it doesn't allow registration - because of a option somewhere deep down in configuration.

I think "Visitors, but administrator approval is required" is the better default for what Drupal wants to be as a product.

I'd say this is a won't fix.

How about, instead of assuming one way or another we ask the user on install as part of the "Configure site" step? There is already other site specific settings in there, such as Default country.

It could be made mandatory and left blank to ensure that the user actually makes a choice rather than just accepting whatever the default is.

Any thoughts?

Nope, we shouldn't just add checkboxes. The installer needs to remain simple. http://limi.net/checkboxes-that-kill/ is a good rationale, for why we shouldn't be doing this.

I think we are close to won't fixing this.