8 ms·

I've been wondering if there's anything like "page knocking" like you open a series of pages in a certain order and that grants access? For example maybe every

I've been wondering if there's anything like "page knocking" like you open a series of pages in a certain order and that grants access? For example maybe everything 404s unless you start with a specific unlisted url

blharr 1y ago
This would be user unfriendly regardless of how you design around it. If I save a bookmark or send a link to a friend, they're going to get a 404.
- fluidcruft 1y ago
  It can be less unfriendly than requiring them to create an account and login. You could send 403 instead.
chongli 1y ago
How does that allow authorized users to get access? Note that they want regular people to be able to find the project from a SERP and start browsing without creating an account or authenticating in any way.
- fluidcruft 1y ago
  I think it depends on what you mean by authorized users. If you're saying everyone is authorized then relying on public scrapers isn't going to work with unlisted pages. Search engines are bots, too. I'm thinking more if it's people coming from email or QR code or link from other sites that keep bots out. It can also be more about sequence of accessing pages. The idea is having behavior unlock the site. Because it should be pretty easy to cause people and bots to behave differently. For example, you could set it up such that access to gitea requires simply accessing the documentation site first.
  - chongli 1y ago
    The issue here is with publicly hosted git repositories for open source projects. Everyone is authorized, including anonymous users arriving from Google.
    - fluidcruft 1y ago
      Nobody needs access to a git repo directly via Google. Things that are needed in Google are documentation or landing sites. Landing on one of those could perform the "knock" to open the domain holding the git. Nobody using Google would notice.
      - chongli 1y ago
        Nobody needs access to a git repo directly via Google. I agree with this. The repo page should just have static HTML pages with information for people new to the project. Dynamic information and especially expensive computations such as git blame should be restricted to logged in users with an account. This would make it easy to ban anyone who was abusing the system or even implement CPU quotas without affecting ordinary users arriving from Google.
gcr 1y ago
I've seen the opposite of this -- have a link on the site footer that's unlikely to be clicked by a user or prefetched, but as soon as a robot GETs it, the rest of the site is replaced by syntactically valid gibberish.

blharr 1y ago

This would be user unfriendly regardless of how you design around it. If I save a bookmark or send a link to a friend, they're going to get a 404.

fluidcruft 1y ago
It can be less unfriendly than requiring them to create an account and login. You could send 403 instead.

chongli 1y ago

How does that allow authorized users to get access? Note that they want regular people to be able to find the project from a SERP and start browsing without creating an account or authenticating in any way.

fluidcruft 1y ago
I think it depends on what you mean by authorized users. If you're saying everyone is authorized then relying on public scrapers isn't going to work with unlisted pages. Search engines are bots, too. I'm thinking more if it's people coming from email or QR code or link from other sites that keep bots out. It can also be more about sequence of accessing pages. The idea is having behavior unlock the site. Because it should be pretty easy to cause people and bots to behave differently. For example, you could set it up such that access to gitea requires simply accessing the documentation site first.
- chongli 1y ago
  The issue here is with publicly hosted git repositories for open source projects. Everyone is authorized, including anonymous users arriving from Google.
  - fluidcruft 1y ago
    Nobody needs access to a git repo directly via Google. Things that are needed in Google are documentation or landing sites. Landing on one of those could perform the "knock" to open the domain holding the git. Nobody using Google would notice.
    - chongli 1y ago
      Nobody needs access to a git repo directly via Google. I agree with this. The repo page should just have static HTML pages with information for people new to the project. Dynamic information and especially expensive computations such as git blame should be restricted to logged in users with an account. This would make it easy to ban anyone who was abusing the system or even implement CPU quotas without affecting ordinary users arriving from Google.

gcr 1y ago

I've seen the opposite of this -- have a link on the site footer that's unlikely to be clicked by a user or prefetched, but as soon as a robot GETs it, the rest of the site is replaced by syntactically valid gibberish.