*This essay is an extended version of a talk I gave at Jesień Linuksowa 2026, adjusted for the written form.*

# The burning of the Information Superlibrary

Everyone knows of the magnificent Library of Alexandria and its fiery fate. Ancient scrolls burned centuries past, making humanity's knowledge harder to access, sometimes impossible.

Not much has been left of the Library of Alexandria.

I feel like history is repeating itself on the Internet: knowledge is becoming more difficult to access, sometimes impossible.

## Web today

Just take a look. I'm sure you'll recognize some of those screenshots. What do they have in common?

Those are:

• Anubis, bot protection,
• Cloudflare's Turnstile challenge,
• Google's image CAPTCHA,
• new old.Reddit.com,
• a paywall.

Bot blockers and pay/loginwalls are unavoidable on today's Web. Their purpose is **to make information harder to access**, and they work. In the past couple months, I was blocked by Reddit, Stack Exchange, the Linux kernel mailing list archive, and like a hundred others unless I jump through hoops that waste my time and/or give up my privacy.

I could access Stack Exchange using an anonymizing proxy for a while, but that's gone now too.

The result is that every day, I feel like this xkcd.

Except without the closeness and romanticism and the exasperation. Actually, I just feel numb and hopeless.

Even freaking (English, Finnish, German, Polish) Wikipedia asks me to sign some third party (USA-based company) terms and conditions before editing now. How low have we fallen?

The Web hasn't always been like that.

## The past

Back in the early 2000s, when I came online, it was a lot more open. The moment you plugged the Ethernet cable, you could explore the Internet from your Windows box unimpeded – and even the other way around.

Email addresses were handed out like candy. Apparently today's kids can hardly believe all you needed to get one was a browser (they would also hardly believe that login data was usually sent unencrypted. I couldn't find online sources but logging in to my email at o2.pl, you could check a box if you wanted the password form encrypted or not). With the email came free Web hosting, and the hottest thing for a 15-year-old to do was to write her own blog. The second hottest was to come to a public chat room resembling IRC, login optional, and just start talking. When Chatroulette appeared, it opened the doors to something that only compares to international travel. The innocent fun of staying at a hostel, chatting up strangers from faraway lands (before it inevitably got flooded with people seeking not so innocent fun). Oh, and Wikipedia. That stayed.

If you lived through the same period but had a different experience – I'm sorry. You missed out.

## Information Superhighway

Internet rolled out with a promise: that all the information of the world will be reachable to everyone connected. The greatest library anyone has ever built, and accessible to anyone.

Let this BBC material from 1994 explain that to you.

Yes, cool lasers were an integral part of the experience. Computers used to have an aura of nerdy mystery. We hoped that networking them all would create a friendly global village and heal the world of bigotry and ignorance.

Well, you know how that went.

The library ideal has actually been on track though. Websites dedicated to connecting people with knowledge as well as each other popped up steadily around this time, covering a good chunk of interest areas.

Chart showing the creation years of an arbitrary selection of services connecting people and information. Dates from Wikipedia.

Wikipedia took over encyclopedias, with no barrier to contributing. Google used to be amazing at finding what we wanted (what is SEO?), blogs and forums let people connect over any topic you could imagine (yay phpBB), later on to be joined by StackOverflow for coders, and sites gathering physical manufacturing knowledge and designs.

And they kept growing. Taking arXiv as an example, it's all up and to the right. It's not even linear: arXiv keeps growing *faster* with time. I don't expect anything else from all the other sites: the knowledge kept growing explosively.

The chart of arXiv's new submitted articles until 2020.

## Dog

There was another ideal of the Information Superhighway that was perhaps not part of the marketing materials, but it was very much *felt* at the time.

It was **radical openness**. Everyone was welcome to use the knowledge on the Internet, regardless of their background. No profiling, no hoops to jump through. Everybody was invited to participate in online communities just the same. The library wanted to be maximally accessible.

In practice, you could really read anything you wanted without paywalls or loginwalls. It was not perfect when it comes to participation. Even though you could go on Wikipedia and edit an article without any questions asked, most of the Web – which, to me, meant forums – required an email address to create an account and post. Thankfully, as I already covered, getting an email address was not a problem – as long as your chosen username@kissme.com hasn't been taken already. Has it? username1973 it is then.

Even a dog could participate, as this New Yorker cartoon testifies.

## The forces of regress

Unless you've been living under a rock, you can see that the Internet and the Web are not the same now. Back then, people would go online to take a break from the meatspace and to regain some sanity with people who *make sense*. Today, I keep hearing of employers which expect workers to be always online. The other day a friend daydreamed of picking up botany to never have to touch a computer again (hi Alina).

Am I right when I say Internet stopped being empowering and a place of freedom, or is it just nostalgia for my teenage years?

I think the Internet really did change. It moved from a peripheral position in society and in everyone's lives into a central one. That unleashed some dynamics that resulted in it being less open to participation and the spread of knowledge.

## Nothing lasts forever

I'll start with a force that isn't in itself malicious, and not even limited to the digital real: entropy. Decay. Knowledge left alone disintegrates. Books rot, ink fades, fossils disappear in subduction zones. Languages vanish, digital data bit rots. If you want your bits and bytes to stay reachable, you need to put in some effort to keep them up. Maintain the servers, pay for the domain... stay alive. Seed it.

Nokia lost interest in Maemo, taking down original repositories for my N900 phone (thankfully I mirrored the data, contact me if interested).

The composer Kirill Pokrovsky took it to the next level by flat out dying. The family posted an obituary on his website that hung there for an appropriate amount of time, but then they apparently moved on, and his website died together with his music downloads. Eventually, the domain got bought by someone else. The website lives on as a mirror. But how long until the story repeats?

How long until *this* article disappears in a puff of bits? Right after I die? Or perhaps someone will consider it important enough to preserve – are you still reading it on dorotac.eu?

Natural causes rot the Information Superlibrary.

Information destroyed by termites.

There's nothing you can do. Or is it? You can skip to solutions if you're impatient.

## The bad

But there are real problems with the Internet, experienced by well-meaning people running services on the Internet, with solutions that make Open Web less open.

As far as I can identify them, the problems are:

• spam,
• other antisocial behaviours,
• money,
• legal burdens,
• the need for control.

I'll introduce you to each of them, but don't expect a nice table summarizing the problems. The problems are overlapping (complying with the law can cost money), and one solution can address several problems at a time. What I want to do instead is to show that the Internet gets worse not (always) because website operator are evil, but instead because they are trying their best to address some needs.

And perhaps if we knew those needs, we could propose better solutions.

### Law

Perhaps, after reading the previous section, you decided to archive your favourite online resources, and maybe even share them with others. That's the spirit of a true librarian and an archivist!

And, apparently, of a criminal.

#### Intellectual property

Law, when faced with the choice between letting knowledge spread freely and putting up barriers, largely chose barriers. Data can be copied at basically no cost? Plug up that bottomless basket! Forget living in a post-scarcity utopia.

Meaning, according to the law in basically everywhere, you can't just copy someone's Web site and preserve it.

As a result, we live in a world internally split between Information Superhighway ideals and the old way of doing things.

What's the information freedom side? Most people realize that downloading copyrighted movies is illegal. Or is it? But seeding copyrighted works on bittorrent definitely is, because that's sharing. Which makes sharing memes illegal. And subtitles. Often game mods. And song lyrics. Even creating arguably your own art can be illegal. How many people actually realize that? Just look around a little – everyone either doesn't know or care. Scarcity-minded law is in conflict by the actual practice of the everyday life.

The relevance to you, an online community administrator, is that you're stuck between conflicting cultures. On one hand, complying with the law to the letter is nonsense to your users and won't benefit the world. On the other, letting your users do what's socially acceptable or what benefits the sum of human knowledge is also likely to end badly.

Strict compliance with law saves you from legal responsibility headaches. That is a real and serious need, but doing it has costs to knowledge and communities.

What limited access to knowledge more successfuly? Book burning or intellectual property laws?

#### Panopticon

Let's not forget age verification laws. Sure, there is a problem to address. I don't know how to solve it. But I'd like to point out that such laws have consequences to the ability to be yourself online – a version of yourself you can't be if people know you by name. And if you're an admin, you may have to choose between that authenticity and safety in your community, or legal consequences.

In short, law sets fire to the Information Superlibrary.

### Spam

Automated link spam and scraper bots DDoSing your web site, that's what I'm talking about. When you see it, it's immediately clear what's going on. Unlike the next section, no one here is pretending that they are acting in good faith.

Simple spam is an attack on admins' time: someone needs to delete all the spam.

Bots are an attack against admins' wallets or time: in order to keep the server running, the admin must spend money and upgrade to a more powerful server, with a wider pipe to the Internet – or spend time optimizing the service to handle the increased useless load.

What's the path of least resistance? Put up a bot protector like Anubis in front of your web site. It will catch the least sophisticated bots which run without Javascript, or at least hopefully slow them down to manageable levels because now they have to spend some time doing a useless calculation before being allowed through.

You can always crank up the level to catch more advanced bots: Cloudflare Turnstile does more browser checks before you can do anything.

For spam bots, you can go one level up and install a real CAPTCHA at the submission form. Bots can't detect traffic lights, can they?

#### The costs

Do that, and you make life harder for real, good faith people. In several ways.

#### Challenge-based protection

Let's take a closer look at this thing.

Anubis, even when it works correctly, wastes the time of every one of your visitors. As a user, you have to wait until your browser does an otherwise useless calculation to tie up your computer's CPU for a couple of seconds to fulfill the "proof of ~~waste~~ work" challenge. Sounds familiar? Yep, it's the same idea as in Bitcoin. But it's different than Bitcoin, where you waste CPU cycles and get a generally useful currency token in exchange. With Anubis, you waste your electricity to get an access token valid for the specific web site only. Oh, another difference: with Anubis, you also waste your time staring at the progress bar. Double the price for the same experience!

You might already understand the purpose of Anubis: it is to get rid of clients which are not ready to destroy their own resources (electricity, time) in exchange for access to the web site, and to slow down the rest.

*Next*!

Image CAPTCHAs are pretty similar. What they ask you to spend is your time: the time needed to solve the mathematical challenge, or to click the traffic lights.

Are you running challenge-based protection? I get why you would do that. Saving time and money are real needs, but now you're making your users waste them. Is that cost proportional to the benefits?

#### Fingerprintwall

More advanced bot protectors *don't* work that way. Instead, they rely on *fingerprinting* your browser: retrieving information like your browser version, your location, the characteristics of the device you're using, what languages you speak, operating system version. The more "normal" you look, the less likely you are actually an automated bot, and the less problems you will encounter.

What's "normal"? Well, if you block cookies, you're not, you weirdo. Oh, you're using a limited browser which supports no Javascript because you want some calm in your life? Or because you're paranoid about your privacy? Such deviance is characteristic of bots!

Cloudflare Turnstile saved the day again by keeping that freeloader DorotaC from browsing StackOverflow!

I hear you protest:

> "What a first-world problem! Complaining about cookies and JavaScript is something only a paranoid nerd can do. Normal people use Chrome and Firefox, and maybe even Brave if they are privacy-oriented. You want something out of that web site? So shut up and accept that tiny compromise. And if you worry about your personal data, then there are laws in place that prevent anyone from misusing them."

"mimimi" is apparently a German thing.

If you said that, you would even be right. There are laws punishing misuse. Look at all those headlines! Facebook fined 25 billion. Facebook fined 1.2 billion. Amazon got fined, Google got fined, and many more. The laws are working!

…except that only proves that the laws are not actually *preventing* anyone from misusing my data. You will get abused and you won't even know it. Again and again. I personally lodged a complaint about WizzAir who sent me marketing spam despite "deleting" my email several years ago!

Facebook loves data privacy. It's a troubled love.

What's the best way to not get your data leaked? It's to not produce it in the first place. Don't get fingerprinted and tracked. No cookies, no WebGL, no Javascript as the default policy.

That leaves the privacy-conscious user barred from large swathes of the Internet. I like how NerdVPN puts it:

> Bot protection should not require surrendering your users' privacy!

and on the same page:

> Users should also expect that the era of exotic, niche, or heavily patched browsers (e.g. privacy hardened forks) passing without problems is coming to an end.

That doesn't stop them from building a solution that blocks my browser unless I trust them with my privacy by unblocking several fingerprinting-friendly features. I appreciate the honesty in their double-think though.

Cherry on top? Fingerprints are persistent across web sites. That makes them worse than cookies: you can remove cookies from your browser manually. With fingerprints, you can't prevent anyone from tracking you across web sites and building a dossier out of your browsing habits. To ensure you're a real person, browsing sensible sites over some time, not a bot created 5 minutes ago, of course.

Keep me safe? My ass.

The problem with Javascript-based bot protection is mainly a problem of trust. A visitor may trust you, but they may not trust Cloudflare or Google. Conversely, a visitor may trust Anubis, but may not trust *you*. Running a stripped-down browser may give them enough assurance to still visit your site, but challenges make that harder.

Dear admin, are you running a new bot protection without an image challenge? Of course, I understand that you want to save your time and money, but you're asking users to trust you with their privacy – and if you're using a Big Tech solution, chances are that you're misusing that trust.

Again: the path of least resistance burns the Information Superhighway.

### The antisocial element

Unwanted political and commercial agitators, old selfless trolls, disgruntled community members, manipulators with their sock puppets, artificial intelligence agents, and clueless newbies that need to be shown the way.

They differ from regular spam in that it's not immediately clear that you want them limited. A lot of them are acting in good faith – or will in the future, after calming down. Even deliberate breaking of rules sometimes means someone's grandma died, rather than they are a bad person that needs a lifetime ban.

So, dear admin, you end up having to spend your time making a careful decision to ban someone. You don't want the person to just register again, and just the same you don't want a Russian government troll to split up into a hundred accounts and create fake consensus on whatever topic.

#### Proof of identity

In other words, you want a way to fight Sybil attacks. How to do it? You'd need to somehow get an unforgeable identity of every one of your users. That sounds hard.

Don't worry, such databases already exist! With different levels of verification. You could rely on national identity cards, where the governments of the world already did the hard work of deanonymizing all their citizens. If that's too direct, you could require a valid phone number, which is often also connected to the same ID database at purchase. A phone number also costs money and effort to get, limiting the practical number of sock puppets you can have. Still too on the nose? Require an email address. It's often connected to… you guessed, a phone number.

Now, about the downside…

Remember how on the internet nobody knew you were a dog?

Hey, admin. Do you offer login only through GitHub? Do you require an email address, a phone number, or some other externally enforced identifier before someone can interact with your community? Yes, I get that dealing with the antisocials costs time and sanity. But it has costs: you're excluding various kinds of dogs from participating. Dogs from abroad, dogs who can't get a permit, dogs who don't have cash on them, dogs who don't want to be in the system.

That path singes the Information Superhighway.

#### Social scoring

Does the above seem wrong? There are other solutions. One particularly popular way to solve the identity problem is to rely on social trust instead. Trust that has to be earned, but that good members of your community earn anyway.

I'm talking about reputation systems. Karma, points, levels. They represent how much effort someone put into participation, so they make spawning lots of throwaway accounts difficult: each would need work put into it before… what? Before whatever the admin decides.

On Hacker News, you need to gather some karma before you can report comments to the admins. Private bittorrent trackers may require seeding before you can leech.

If an account is below some threshold of activity, the damage it can do is limited. Great!

Unfortunately, the contribution a new account can do is also limited. Not great.

Some subreddits may treat you like a leper if you only came to ask a question. At least Reddit seems to realize that it's a problem.

My own karma fail story was when I tried to participate in a Linux Mobile related discussion on xda-forums. They required new accounts to post something in general forums first. The problem? Xda-forums is an Android-first community. I've never had an Android device and I actively don't want to. I simply have nothing to say about Android. I sent out an email explaining this, hoping to get my account unblocked. I never heard back and didn't contribute. Bonus: I can't verify any of this because fingerprintwall.

When you choose a social scoring model, you limit participation of people with knowledge but without motivation. Sure, it saves you time and sanity dealing with the troublemakers. Those are real and important needs, but social scoring is not without costs.

(Extrapolate: Nosedive).

Social scoring fries the Information Superlibrary.

#### Invite only

Perhaps there's a better way? Invite-only is quite popularity recently. Fediverse servers, Discord channels, link aggregators use them.

With invite-only, every new user is already trusted – because someone in our community invited them – so there's no need to limit their powers! They can contribute as much as they want from the start!

Or so it appears. In reality, the filtering just moved a step earlier: invite-only communities no longer admit strangers without social connections to existing members. I don't know about you, but I had no prior connection to the communities I joined at the dawn of the Internet. A game forum? Found it randomly. Electronics? I probably asked the search engine. Sure, back when only 20% households had computers, it was harder to find an offline connection to any community at all. But even today I don't know any food community which could give me an authoritative answer to how businesses decide between cans and jars. And I'm sure those communities exist, outside my social bubble, with a diversity of ideas I never encountered.

As usual, I recognize your need to save time rather than spend time keeping your community civil. But you must not forget that this sacrifices the ease of participation.

Restricting openness sets fire to the Information Superlibrary.

Perhaps the tradeoffs could be different. But that's for later.

### Money

The lack of money can be a problem. Just the same, wanting more money can push people and organizations to implement "solutions", like deanonymizing all your users. Twitter limiting its API. Reddit doing the same – closing off third party clients, then limiting access to the last good interface, with the goal to end anonymity completely. While raking in increasing profits.

That's how I imagine the business plan of a typical crowdsourced business:

1. Start a open community.
2. People contribute knowledge into your control.
3. Close off that knowledge.
4. ???
5. Profit.

Have you ever tried to find a schematic for your laptop's motherboard? What did you see? Yup, it's a paywall. Not only does it rob you of the anonymity, you also lose actual money. A lot of press outlets implement paywalls, too.

Then, you get underhanded gatekeeping tactics. I can hardly believe it, but apparently on Instagram, you can't just post links to the outside of Instagram. Linkedin apparently throttles links in posts. Outbound links in posts hurt reach and engagement. What the hell? That's like, using the Web to destroy the Web. Not that I expected otherwise from Facebook and Microsoft.

Oh, and if we're on the topic of post ranking algorithms… isn't favoring advertising or content otherwise preferred by the company rather than the user a kind of manipulation of knowledge and community? With advertising's only purpose being making others think something you select, I don't think I even need to elaborate.

Out of those, I kind of understand the journalists who are desperately trying to find any source of money. I even understand greed a little. Making numbers go up is fun enough to be a game genre.

Still, manipulation distorts knowledge, and closing it off, well, closes it off. Requiring users to doxx themselves turns their right to be themselves into admin's money. Those are the costs.

This is how greed torches the Information Superlibrary.

### ███████

███████████ ██ █████████ ████████████ ████ █████████████ ███ ████ ██████ ███████ ████████ ███ ████ ██████ █████ ███ ████ ██ ██ ██ ████████ ██ ████████ ███ █████████ ████ █████ █ ████ ████████ ███████████ ███████████ ██ ██████ █████ █████████ ███████ ████████ ██████ ████████████ █ █████ ████ █████ ████ ███ █ ███ ██ █████ ██████████ ██ ███ ███████████ █ ██████ ██ ███ ████ ██ ███ █████████ █ ████ ██████ █████ ██ █████

(This section has been removed by the author. This burns the Information Superlibrary.)

### Hiding in darkness

There's another way of closing off, and it's retreating out from the public and into private spaces. A Discord channel, a Telegram group, a Signal group, a closed Mattermost instance, reachable only with an invite link. It may seem like it's the invite scenario I described above, but I'd like to focus on something else: those closed groups are *not visible from the outside*. Participation suffers if you need an invite link. Participation suffers worse if you don't even know there is somewhere to get invited into. Knowledge suffers if there's no way to see what's inside and when search engines can't index what the community created. (Discord is planning to make a little step towards indexing, at least.)

I think this happens mostly because of familiarity and comfort. Place the community where people already are. Who wants to learn a new thing just for you? Sadly, many popular things online are closed by default: Discord and Facebook groups. The new community joins the knowledge hole.

Oh, that last section. Did you feel a bit disappointed that I decided to censor myself and withhold an insight into a problem? Good. That's how I feel every time someone deletes a useful post, leaving a hole in the conversation.

When we share things, we may consider them too personal to let them stay online forever. We have the need for *privacy*. So we apply a policy of deleting everything, without regard if what we wrote was personal or merely technical.

Or we don't want to share our work with those we view as freeloaders. A sense of *justice*?

I'll group both needs as the need for *control*. A completely valid need which has its costs. Keeping knowledge hidden as well as removing it from public spaces makes the Information Superhighway burn in darkness.

### The identified needs

We can now see that there are several problems, and they infringe on some of our needs, especially as community admins:

• time wasted battling spam and bad behaviour (that includes LLMs),
• time and money spent making sure the infrastructure can deal with the influx of bots,
• money needed to support oneself from the activity,
• money again, the plain old desire to have more,
• the need to control how our creations are shared,
• the need for life peace by staying out of legal trouble.

Time, money, control, law.

This is what the admins are trying to preserve. On the other side, there are regular users, members of the community. They also have their needs, which get infringed by the solutions presented:

• the need to separate their identities (for example, family, legal, prosecuted minority),
• the need to keep intimate information about themselves hidden (browsing habits),
• the need not to waste time or money on CAPTCHAs or staring at progress bars.

In my impression, the balance skews towards the admins' needs. A user that is restricted from participating in the community won't necessarily be ready to give up their needs. Even if they do, is complaining about things like CAPTCHAs going to change anything? Please message me if you can provide examples.

Neither side is going to just give up on their needs. So what is everyone going to do?

## Business-as-usual

The majority of people will probably do nothing. Governments are unlikely to take reins, either. I predict that businesses will keep leading everyone according to their own needs, and the public will simply follow. And you will follow, too, in order to have a chance of functioning in the society. Extending some lines that already have been drawn:

### Attestation will get more widespread

Attestation already exists. TL;DR you need a device from an approved list, with software from an approved list. You look odd, you can't access $service. Choose between being in control of your device and fully participating in society. What does it mean "odd"? That's up to the device manufacturers to decide. Ad blocking, for example, keeps getting called illegal and even taken to courts. I can't help but notice that the biggest operating system manufacturer is really an advertising business.

I suspect there are multiple ways attestation is used. One, because it shifts responsibility around. Perhaps the bank is responsible for losses due to misconfigured software, so instead of dealing with user complaints, they railroad users into a software that has been tailored by a business, for businesses.

Another thing I suspect attestation helps with is identity. Having your phone identified as an evildoer's phone and banned forever is going to be expensive, and that limits bannable offenses.

That wouldn't be so bad if the attested phone wasn't connected with an identity, and if the software was minimal. Even then, how many people would carry two phones, no matter how minimal the software on one of them?

### Identity verification

I'm actually too late for this to be a prediction, but here it goes: identity verification will get a lot more widespread. We're seeing the first waves of laws to require age checks in online services. It can be done anonymously, but let's be real: it usually won't.

Discord found an alternative which isn't necessarily better. Rather than relying on the skin-deep identifier which is your ID, they analyze your behaviour to guess your age instead. I don't know about you, but my behaviour says a lot more about me than my name.

Oh, I do actually have a prediction here: by 2040 I shoot for a 50% chance that you won't be able to browse the 'Net anonymously at all in at least one what we today call a Western democracy. Thanks for showing the way, China.

### Micropayments

There have been multiple attempts at micropayments before, and none of them ever took off. Except… remember Anubis? Anyone using the concept of wasting electricity is taking a few microcents off your bank account through that energy you've burned. Finally, a micropayments system that everyone is using!

## Finding a way

As users hungry for knowledge, we can turn to archive websites. The Internet Archive, archive.is, Anna's Archive, SciHub are some examples. They preserve ancient scrolls without seeking the contents of those who wrote them. When facing the choice I stated a couple sections above – between knowledge rather than compliance with the law – they choose knowledge. Sometimes with consequences.

You may not like the other way out, but it's getting more popular. Even when the data is not hard to access. Do you know the answer?

That's right, it's asking an AI assistant.

AI companies have been accused of relentlessly scraping the Web for all kinds of data. Large language models don't work without heaps of knowledge, and big tech companies don't always care about law. As a result, they have also been on knowledge's side. Models are literally stores of (lossily) compressed knowledge.

Where this breaks down is on closed models. Where this breaks down less is censored open models. They are actually pretty respectful of the users' needs! If you download a model and run it locally, you don't need to identify yourself. It won't send your behavioural data who-knows-where if you don't give it Internet access. It won't deliberately make you waste your time.

It also won't learn and won't create a healthy community to gather more, better knowledge. (I'm not counting agent-jockeys. But even with them, I'm not seeing communities out of LLMs creating public projects much.)

## Communities

What are all those admins worth without users? I see publishing as ultimately a social activity: you want other people to get something from you. No matter what it is. But that's a bit reductionist, so let's focus on online projects.

The needs we covered before – time, money, control over information, freedom from legal trouble – are the needs of the admin, without taking into account the need to build a strong community. What are the needs of a community gathered around a project? Let's see.

A successful project needs to be useful in some way, and it needs to be resilient. As members retire, new members should come in. And those community members want to be respected.

Unfortunately, the solutions preserving administrators' needs can conflict with the needs of the community.

### Respect

Every time a community member wastes their time on a CAPTCHA, it's wasting their time. Perhaps compare it to being late to a meeting: disrespectful.

### Resilience

A project whose communication channels can go down because of infrastructure problems is not resilient. A library that gets closed after its members lose interest is not useful.

### Privacy

An online service that asks community members to deanonymize themselves beyond what they themselves want to disclose doesn't respect the *privacy* of the participants.

### Human factor

A project that doesn't attract new people will have it harder to stay relevant.

## Solutions

Now that I analyzed the problem, here's the part where you disagree with my solutions. So let's take a look at some things that tackle the same problems in different ways.

### Against disappearing: Resilient libraries

There's a way to make your data harder to erase. Perhaps you don't need to have your server at all. And the more popular your data is, the easier it becomes to distribute to the interested. More resilience against bots!

Have you heard about IPFS before?

TL;DR: distribute your data among everyone interested. Kind of like BitTorrent.

Upsides: lower costs of static data as popularity grows.

Downsides: not so dynamic, pretty much no one is using it.

IPFS could take away some headache around hosting costs and time. But it won't unless we put an effort to make it popular. So start publishing there. (I am mostly saying this to myself.)

### Against costs: Less logic on servers

But we need something today, not after a revolution. So here's how I would save money and work on servers. First off, solutions requiring work – only paying off in the long term. Architectural changes:

• static websites. This blog is static. Static resources are cheap on the CPU, helping you put off upgrades.
• Limit access to expensive functionality. If your website shows a code diff, limit it to logged in users. Or, even better,
• process data client-side. Are you hosting a Git repository? Don't show a diff at all, but instead publish the entire repository and have them git clone; git diff.

If you drop resource usage per request enough, you'll be able to remove CAPTCHAs and restore some respect and/or privacy to your users. Unfortunately, it costs time to implement those precautions. It may require a change in web software itself, and that takes time. It's a tradeoff you have to make, admin.

The last proposal deserves more explanation. Git has a standardized protocol, so you can easily send data and process client-side. But what about other use cases? Simulations? Filling out forms?

I would propose sending the user a Web application that contains the software, alongside with the raw data, and keep the computation off the server. That is not helping a whole lot in the privacy department if you ask your users to trust you enough to run your Javascript, but at least your server will last longer.

#### Against costs: Caching

If you can't invest the time to do the above, there's a way with less architectural changes: caching. Put a reverse proxy in front of your Web site, and it will prevent recomputing the same thing over and over again when requested repeatedly.

Mind you, I'm not a Web developer and I'm still on static websites. If you can come up with something better, I'm all ears.

### Against wasting time: Governance and goals

Dealing with the community can sap the time and patience of admins and moderators. Explaining the same things over and over, or prolonged internal arguments don't help with sanity. Getting project's directions clear sounds to me good on the community resilience scale.

How does your project work socially? "We accept no outside contributions" is an example of a clarifying statement, making the internal social structure transparent and saving people from disappointment. There's nothing as demotivating as spending time doing a contribution – bug report, a new feature, a documentation – and never seeing an answer. Not good either for individual respect, or building a community.

What is your project about? Some Open Source projects are focused on producing a product, and some are primarily about building a community where they feel good. Until recently, those have been the same thing, but in a world where LLMs can replace community members, maybe it's useful to state what's more important. You automatically get clarity on whether LLMs are welcome and to what extent you should go to fight bots. Less confusion and arguing within the project.

### Against trolls: New member induction

You don't have to check the IDs of everyone who wants to join your community.

Humanity has lived in communities long before IDs became a thing. And there is a revolutionary, old school solution: have a chat with the candidate. Yes, like a job interview, except for your project.

Sounds like work? It is. But it preserves respect to the candidates who have been treated as peers to talk to, rather as intruders to defend from. I also think it could have good outcomes in selecting people to build a strong community.

Except when the project's inbox gets spammed with a thousand "can I have a chat with you" messages… So maybe it's not for every project.

### Against legal responsibility: uh

There is no slam dunk here. Like I wrote, the law, the practice, and the ideal of the Information Superlibrary pull in different directions, and there are no technical solutions. It's up to every individual admin to choose where to place their priorities.

### Against lack of privacy and control: Choose the right place, be selfless.

By all means, take your private things to private spaces. You don't deserve to be profiled.

Different story if you take part in searching for Truth. Technical discussions. Historical investigations. Corrections. Truth in art? Even if they are in the form of shitposts on Mastodon. Make them public, contribute to the commons.

Don't delete it if you posted *knowledge*. Don't keep your stuff hidden in fear of freeloaders. We're all freeloaders on the scale of civilization. If Odyssey had never been published because Homer worried that he wouldn't get credit for his work, I would have been poorer. Wait, was Homer the author? Are we crediting a random name? Is Homer a freeloader? Names of what great humans have we lost? Whatever, I don't care. And no one will care about my own name in the future, either. That's fine. I placed a scroll in the Library of Sum of Human Knowledge, and that's what matters. The more "freeloaders" carry my contribution into the future, the better.

It makes matters even more confusing that the same LLMs which seem to be freeloading on free content, at the same time restore access to information when used locally.

So here's an idea: go ahead scrape this website if you like it. Just don't make it fall over. I mean, breaking a website limits access to information. 1 request per second should be enough. Or maybe don't listen to me and do it against my will. Even better! Hammer it, then, if you must. Make me unhappy about building the Library (paradox!).

Perhaps you're thinking I'm naive now. What I create carries my voice. Those are my speech patterns and my inner thoughts exposed. I'm going to be analyzed. I may be a little jaded here – just like the game is long over with avoiding your picture taken (CCTV everywhere, phone cameras everywhere), the game is also over with not getting your psychological profile analyzed. Or is it? How many other blogs do I have where I our my heart out but no one knows it's the same person? How often do I pass my thoughts through a statistical model to remove my distinct style and leave as close to the raw message as I can?

Tradeoffs again. We all end up somewhere on the spectrum between favoring humanity's knowledge and our own security.

## Open Source

You probably already figured out that when I say "community", what I have in mind is an Open Source project. It's simply what I'm most familiar with.

I also believe Free, Libre, Open Source communities are the most at risk as the Internet changes shape. The open source culture has been tied to the development of the Internet, and its values look similar to what the Information Superhighway promised. I don't think that's accidental. Information Superhighway is basically Free Software's utopia, and when it's damaged, I believe Free Software suffers.

Open Source communities have historically been open and welcoming to anyone who wanted to join them, without questioning their identity, based only on their contributions. You had no trouble being a dog. That principle is now uncertain, when thinking bots try to contribute. Some communities started to draw a distinction between human and machine contributors, and suddenly, identity matters for them. Consider that people who don't speak English frequently get identified as bots, and people who speak English often get identified as bots – all without solid evidence.

I don't like the atmosphere of paranoia this creates. Maintainers, instead of being welcoming, need to be suspicious towards newcomers. Newcomers have to prove a negative: "I didn't use a LLM". Never mind that there is no way to know for sure that text came from human or machine.

Projects can decide to sidestep this problem by turning to social proof, like invitations. As explained before, this has bad consequences for newcomers.

Worse, a lot of projects are moving into closed spaces. Both prominent and less prominent projects hide themselves from search engines, and behind loginwalls which prevent anyone from lurking anonymously – setting up a new account being more effort than the usual deanonymizing captcha.

On the other hand, people using LLMs may have less of a need to contribute to your project. Machines can generate the same functionality from scratch, taking your project out of the loop completely. Knowing how to program isn't even necessary to create programs.

A Free Software project carries more than just its software. It carries the Free Software culture: the ideal that software should serve the user. Culture spreads by participation in the community.

As a result, what I see today is that participating in a Free Software community is becoming both more difficult (gatekeeping) and less desirable ("LLMs will code for me"). As communities get more closed, learning the culture by casually encountering it gets more difficult. Lurking is the first stage of joining a community, but the harder it is to lurk – login required – the harder to build the motivation to join the community in an active way. The feedback loop closes, and the stream of valuable new contributors drops.

I don't know how far along this loop we are now, but the closing off is definitely happening. I worry that the time to act is right now, and if we don't find a good way out, our communities will simply die out due to lack of interest. Taking the Free Software ideals with them.

So, how can we remain open and attractive, without going crazy and bankrupt in the deluge of spam and bad actors?

## Internet 2.0

Internet at its beginning was pretty close to the Information Superhighway. It was open and attractive, and everyone on it was trusted by default, yet it wasn't constantly on fire. What's the reason for that? Humanity wasn't a species of angels 30 years ago. Could we identify the conditions for such widespread trust and re-create them?

I have to thank those who were at my talk for supplying some of the following observations. Internet was:

• limited to those who could afford it (not everyone had a computer back then),
• technically somewhat difficult to access (you had to learn to operate the computer and configure the IP addresses),
• full of youngsters (in my impression),
• heard of by everyone (?) due to heavy marketing by ISPs,
• on a computer shared by the family,
• commercially worthless.

Let's stop for a moment here to recognize a fundamental tension: the Internet was not open to participate for everyone, so it was counter to one of Information Superhighway principles. Openness is also a principle of today's public libraries. On the other hand, limiting access is – what I suspect without hard evidence – enables granting anyone trust by default. In larger groups, sooner or later you see more misbehaviour and the need to create formal rules to police it.

That would make the Information Superlibrary a true ideal that can be tried for, but never achieved. It would only be useful as a guiding star, as the digital utopia that can never truly be.

Even if we find a way to repeat the Internet phenomenon, as we make it more accessible, if the tension is real, it's likely to fall into the same traps we see today. But I think it's all right. We'll get another 5 years of real good fun.

### What early Internet was like, what is similar today

In my recollection, there was a whole lot of nerds on the 'Net back then. And kids. I don't know about you, but I felt that parents whose goal was to educate their kids well were driving the adoption of computers. That creates a bit of a shared culture, but at the same time, it was diverse enough for all kinds of shared interest circles to appear. After all, it has been rolling out through much of the world at the same time, creating a truly global community.

We were kids, so we didn't have bank accounts. Payment cards weren't even a thing in my part of the world, so I couldn't buy that Mind Rover CD no matter how hard I tried, even when it was available for sale. Scammers had to go through the same technical hurdles as everyone else, and there was not much to win, so spam was quite limited, and viruses did damage for the lulz, rather than deliberately take down infrastructure.

What are today's social networks sharing some of those characteristics? What niche is being occupied by happy, knowledge-sharing nerds? In no particular order:

#### Secure Scuttlebutt

It's a kind of a sneakernet-compatible Internet. I haven't yet met someone who uses it who could explain it to me. It seems to work by tight-knit, handshake-based social networks, so I'm guessing the diversity is not so great.

#### Amateur Radio

It needs equipment which costs money. It needs a nerd's motivation to learn. It's commercially worthless. It spans the world on AM frequencies. Overall quite a close match, a high-trust niche.

Obligatory operator certification kills the openness aspect though.

#### Mesh networks

They need equipment and the motivation to set up fiddly network protocols. A nerdy niche. The problem is that they are necessarily geographically limited, so you don't get much diversity of thoughts and interests needed to collect unbiased knowledge.

#### Overlay networks like Tor or Yggdrasil

You might be aware of Tor as a way to browse the Web anonymously. That's not the use I have in mind, though. What I mean is operating entirely within the Tor network, using .onion web sites not directly reachable from the normal Internet, and creating their own niche.

Those let you operate a more-or-less regular Internet stack, without geographical limitations, only by using special software. The setup may be a little bit nerdy – setting up an .onion service or joining Yggdrasil is not the same as buying a Web hosting package – but copying the existing architecture of the Internet means that you can do many the same things as on the base Internet. Namely, inject money into it.

#### Networks reshaping the 'Net

Like IPFS, which is a kind of overlay network, but it doesn't copy the existing architecture. Rather, it comes up with a differently-shaped one. Such overlays are hard to analyze, and each probably has a different set of tradeoffs. Some can probably run without Internet as the transport layer. I'll drop Reticulum here, since it was mentioned after the talk.

### Gemini

The Web, but smaller. No pictures. Only text. You can't pay.

Looks good? I trust it.

#### Crypto token projects

This is one of the suggestions from the public. I don't actually know much about the cryptocurrency/web 3.0 space, but what I can tell is that it's super nerdy, protective of their freedom (or at least the first wave has been) and it costs money to join (in tokens). The same tokens make it different from the early Internet as there is plenty of money sloshing around, to be tricked out of, attracting bad actors to the general area.

## So what now?

If you're reading my blog, you're probably the nerdy, admin-y type. And as an admin, you have a difficult decision to make: the choice of whose and which needs you're going to respect more and whose and which you'll disregard.

Your needs as an admin:

• saving time,
• saving and making money,
• staying out of legal trouble,
• control of your data,

the needs of the community you're helping create:

• being respected,
• making a useful project,
• being part of a resilient community,

the needs of users:

• keeping intimate information private,
• saving time and money.

Perhaps you might not have encountered the issues I bring up as a user. Perhaps I'm paranoid and that's why I encounter all this. With how many things I stopped using because I refuse to comply with CAPTCHAs and Cloudflarewalls, I'm definitely oversensitive. But take advantage of this: if I'm just the first of many, then perhaps we can still catch ourselves and find other solutions before we plunge into some sort of Internet Dark Ages, where the Superlibrary is as burned and dead as the Library of Alexandria.

If there's one takeaway, it's that your decisions as an admin are important. You have choice, and you have the power to shape our future. And don't give me the crap about having no choice. In the extreme, you still have the choice is to take up botany and never touch a computer again. So do the right thing, while you're in the position to do so.

Because if the ideal of sharing knowledge dies, humanity will be worse off than before. And I'm going to be very sad.

So, how do we firefight for a better future?

*Thank you to Grzegorz and everyone at Jesień Linuksowa for helping create this blog post.*