I had to password-protect my sites [LWN.net]

I had to password-protect my sites

Posted Aug 31, 2026 12:51 UTC (Mon) by marcH (subscriber, #57642)
In reply to: I had to password-protect my sites by mb
Parent article: Ryabitsev: Creepy crawlies

> I have implemented this by always automatically setting a cookie on entry from the main site entry point and then checking this cookie on entry to restricted sub-sites (mainly cgit) that cause heavy load.
> So this is essentially an automatically granted and stored account, if the service is entered from the "human side".

This is "half-anonymous" access and we need to perfect and generalize this everywhere (I don't know how)

Anonymous access is dead because bots just killed it.

Authenticated access is a privacy and complexity nightmare.

We desperately need something in the middle.

> AI scrapers are not (yet) clever enough to circumvent this.

As long as they are stupid enough to query git objects one by one...

to post comments

I had to password-protect my sites

Posted Aug 31, 2026 16:08 UTC (Mon) by mb (subscriber, #50428) [Link] (1 responses)

Actually, the cookie is fully anonymous. It is identical for everybody. There's not really an account created on the server side. I was just paraphrasing to make the mechanism more clear.

I had to password-protect my sites

Posted Aug 31, 2026 16:24 UTC (Mon) by marcH (subscriber, #57642) [Link]

By all means, please find a better name than "half-anonymous" for that middle-ground!