Anubis charges bots once. It charges humans forever.

Any anti-scraper proof-of-work gate that issues a reusable cookie is, in practice, a regressive tax on humans. The challenge solves once for a bot fleet and then lives in a cache. The same challenge re-runs on every fresh visit for a person, on a phone, on a screen reader, on a Raspberry Pi. Bots amortize to zero. Humans amortize to nothing.

Zakaria's piece on Anubis, the HTTP proof-of-work proxy now guarding lore.kernel.org, makes the asymmetry concrete. The cost that disappears for the bot does not disappear. It moves. It lands on the human who waits through the spinner, on the text-browser user locked out, on the RSS reader that never executes JavaScript, on the visitor whose battery drains so an AI crawler does not have to think. The same author built anubis-fetch, a bypass that solves the challenge natively and spoofs a real Chrome TLS fingerprint; the bypass proves the mechanism by being the mechanism.

The strongest counterargument, voiced in the Hacker News thread on the same piece, is that Anubis is meant to raise the cost of mass scraping, not block it: a 100x cost hike makes a fixed scraper budget scrape 100x less, which is the goal. That defense concedes the asymmetry and treats it as a feature. The defense is also right, on its own terms, which is exactly why the pattern is portable. Any site that adopts a reusable-token PoW gate is choosing to charge humans on every visit in exchange for charging bots once.

The mechanism is the cookie, not the hash.