The web does not need gatekeepers: Cloudflare’s new “signed agents” pitch

The private tracker community have long figured this out. Put content behind invite-only user registration, and treeban users if they ever break the rules.

This doesn't scale to the general web, does it? I think invite-only might work to build communities, but you end up in the situation we're in today where people are buying/selling invites, and that's with treebans in place.

I do fear the actions of the current bot landscape is going to lead to almost everything going behind auth walls though, and perhaps even paid auth walls.

I've been considering making this for the web. Why wouldn't it scale? Those selling invites would get banned soon enough if the people they distribute their invite to then send abusive traffic. Mystery shoppers can also make that a risky business if it's disallowed to sell invites (forcing them to be mostly free, such that the giver has nothing to gain from inviting someone who is willing to pay)

One of the practical problems I rather saw was bootstrapping: how to convince any website owner to use it, when very few people are on the system? Where should they find someone to get invites from?

As for tracking (auth walls), the website needs not know who you are. They just see random tokens with signatures and can verify the signature. If there's abuse, they send evidence to the tree system, where it could be handled similarly to HN: lots of flags from different systems will make an automated system kick in, but otherwise a person looks at the issue and decides whether to issue a warning or timeout. (Of course, the abuse reporting mechanism can also be abused so, again similar to HN, if you abuse the abuse mechanism then you don't count towards future reports.)

Ideally, we'd not need this and let real judges do the job of convicting people of abuse and computer fraud, but until such time, I'd rather use the internet anonymously with whatever setup I like than face blocks regularly while doing nothing wrong

I don't think it scales, because I'm not sure it scales on private trackers already. I'm not deep into that space, but I think there's a lot of problems with it that will scale as adoption scales, particularly around policing the sale of invites - the hope would be it self-police through treebanning, but I'm not sure it does.

I think a sort of pseudo-anonymous auth system with backed in invites and treebans that website owners could easily adopt is interesting though. I'm not sure it's a business - for adoption reasons it likely needs to be a protocol - but it's an interesting idea, if it doesn't just turn into a huge admin headache for publishers.