throttling based on sessions kind of works; we're headed in the direction that sites like Reddit will probably prevent logged-out users from viewing threads (as they already do with mobile devices)

Once the LLMs create sockpuppets to get around that, the web services will need to resort to profiling users more aggressively so that they know which actual human an account corresponds to.

If someone has a malicious browser extension that uses their session to scrape Reddit then, they're probably going to see significant usage obstacles.

We are headed to a very user-hostile place.