title: "What actually still works for reading X without an account" date: 2026/08/27 tags: [nitter, xcancel, twitter, front-end, login-wall, scraping, privacy]

🌐 last30days v3.3.2 · synced 2026-08-27

What I learned:

Both sites died to a letter, not a court order, and the whole thing was over in about 24 hours - XCancel's own notice, quoted on Hacker News by duckmysick, reads: "On Monday 24th August at 8PM EST, we received at letter from X Corp. asking to cease and desist the service XCancel. The service XCancel is stopped until further notice. We are seeking legal advice and won't share more details for now. Thank you for the trust you have put in these two years of XCancel." TechCrunch reports the compliance deadline was 5 p.m. EST the next day and that the letter invokes the Texas Harmful Access by Computer Act (§ 143.001 and § 33.02) and the Lanham Act (15 U.S.C. §§ 1114, 1125). zedeus posted the operative sentence himself: "X has documentary evidence that you are scraping X Data, circumventing X's API access controls and rate limits, accessing X using X accounts and session tokens in violation of X's rules, and republishing X Data to the public." The zedeus/nitter repo is now archived and read-only at 13,644 stars, 1,072 forks and 156 open issues, and issue #1442, titled "All public nitter instances do not work.", has been locked. The one YouTube item to name the distinction is Chief Skeptic Officer at 117 views, whose title is the whole story: "Nitter Shut Down After Cease-and-Desist Letters, Not a Court Order." The recurring legal reading in the thread, from inigyou, is that compliance was optional: "You don't have to comply with a cease and desist notice, depending on your risk tolerance. They're not legally binding, like court orders. Rather, they are threats, equivalent to 'gimme your lunch money or I'll beat you up'."

The five demands are the interesting document, and demand four is the one that actually kills the software - tossit444 relayed the list from the Nitter matrix group: "1. Permanently take down nitter.net and the GitHub repository, and delete all 'X Data' in both 2. Stop all use of the 'Twitter' and 'X' marks 3. Cease all access to X data, including copies 4. Delete all X account credentials and session tokens 5. Confirm compliance in writing within three business days." Item four is not a takedown request, it is a description of how Nitter works. pessimizer singled out item one as the overreach: "This is the one that they know they have absolutely no grounds to demand, which is why they started with it. Everything else can be conformed with without even really damaging Nitter (the project.)"

The technical kill ran alongside the legal one and it is the half that actually ended the service - the submitter of the top thread, Banditoz, opened with "A lot of instances are showing rate limited too." orange999 described the endgame in detail on 25 August: "Right now, I can do about two searches on xcancel before it gives me the 'instances have been rate limited' message. Then if I completely close out of my web browser, clear my web history from the last hour, and go back into my web browser, I can do another one or two searches", and noted this was not new: "I've run into this problem or similar technical problems about twice a month before when using XCancel. Usually the technical problem is resolved within 2 or 3 hours." pessimizer corrected the diagnosis and named the real mechanism: "You're doing voodoo. It's not you that's being rate limited, it's xcancel itself that is being rate limited... now twitter seems to be actively killing the credentials that nitter instances are using, and they're returning rate limit messages permanently." dawnerd confirmed the last holdout had gone too: "xcancel worked even when nitter had problems before... Edit: I see it's not working either." That matters because it defeats the recurring consolation in the thread, ranger_danger's "It's not like they can stop instances in other countries they have no jurisdiction over" and spiderfarmer's "Let a thousand Nitters bloom." Credential revocation does not need jurisdiction.

"Just self-host it" is the top practical answer and it requires exactly what the letter demands you delete - in Ask HN: What are you using to access x.com at the moment?, runjake gave the standard answer: "I have an X account, so a web browser with uBlock Origin and visiting x.com. You can probably still self-host a Nitter instance, at the risk of a C&D?" and linked the self-hosting guide people point to, whose stated prerequisite is "A burner/temporary Twitter account without 2FA enabled" plus a sessions.jsonl of obtained credentials. Wikipedia records the developer's long-standing position from the 2024 guest-account break: instances "could be self-hosted by having users use their own account, at the risk of the account being banned." So the recommended workaround for reading X without an account is to create an X account. The public instance tracker Nitter Instance Health now reads "Nitter is down" above the standing advice "Please do NOT use these instances for scraping, host nitter yourself."

What still works logged out is narrower than the arguments assume, and it is X's own site - nomel posted the actual boundary with test links: "You can see the last few posts of an account, and the contents of a single posts, but minimal or no comments. Videos play after dismissing the login popup." iamnothere added the qualifier: "They changed this slightly, and 1-3 'top' comments are now sometimes visible, but you can't dig into the thread. And if you click anything you get popups asking you to log in." That matches the guide layer - Tech Tactician lists Nitter first and marks it "(no longer available)", and the remaining methods are direct post URLs, search-engine results, and posts embedded on other sites. The honest answer from the people who used it most is that there is no replacement: Jeremy1026 answered "Nothing. Same as what I've been using to access it for the last ~5 years", and segmondy answered "nothing, if it's that important it will bubble up on another part of the internet."

The loss people actually name is the RSS endpoint, not the reading interface - RSS comes up in 22 separate comments on the top thread, more than any other concrete use case. gl0w put it plainly: "I am already on fediverse. My friends are too... But that is not what I used nitter for. I used nitter to pull posts of organizations and reporters to deliver breaking news in my area to me fast. I did this via the RSS endpoint in nitter. These journalists and organizations only post on twitter that fast. Their websites are updated much slower and often also don't have RSS feeds." antibarbarus lost a smaller one: "I've been using XCancel to retrieve posts of an account via RSS, only posting vintage photos from my hometown." On ResetEra the same note: "I still used some xcancel rss feeds, was very usef[ul]." The standard reply, ghastmaster's "RSS. Website. Both have been around for a long time. We don't need to reinvent the wheel", is answered by the same thread: throw0101a pointed out that "Once upon a time Twitter used to have RSS/Atom feeds for each account", and it was Nitter that had been synthesising them ever since.

The second-order casualty is every forum that banned X links, which now has to pick between the ban and the news - Forbes identifies the real user base: XCancel "was popular on forums where links to X were banned in protest against its owner Elon Musk." The consequence played out inside a sports subreddit within a day - the r/hockey thread titled "Maybe relevant bit of news. Xcancel is apparently no longer usable" runs the entire argument in miniature: "Because people keep reposting stuff from X using things like XCancel." / "Then just post screenshots." / "Here's the bluesky feed" / "Nah. Keep the ban." The timing is sharpest at Daring Fireball, which on 16 August, eight days before the letter, was still explaining the workflow: "it's tiresome and repetitive to include an extra link to XCancel every time I link to a tweet on Twitter/X. If you would prefer to view x.com links on xcancel.com, you should automate the redirection."

The reaction is loud in one place and almost silent everywhere else, including on X - Hacker News carried it at 1,174 points and 1,115 comments, r/privacy at 1,208 upvotes and 177 comments, and Forbes Breaking News on YouTube at 1,108 views. On X itself, the platform whose login wall is the subject, a 30-day search returns 12 posts and 170 likes total, and most of that is off-topic crypto and book-promo noise that happens to match the keywords. The three genuinely on-topic X posts are @jreuben1 at 3 likes explaining what the tools were in the past tense, @AlAzeemRasaq at 1 like, and one reply with zero engagement. The most useful sentence anyone wrote on X came from a reply to Forbes with no engagement at all, @Zamanhassan24: "I get why X wants control over its content, but tools like Nitter were useful for people who just wanted to read posts without creating an account. shutting them down makes the platform feel more closed." The framing that recurs on HN is broader than X, from suddenlybananas: "It's hardly unique to Twitter but it's so frustrating how much 'content' online requires an account... Even Reddit is doing it now", and duskwuff's reminder that the login wall predates the stated reason: "Twitter was doing stupid growth hacks, like requiring login to view replies, even before AI scrapers were a concern. (And I suspect many of the scrapers are just using logged-in accounts.)"

KEY PATTERNS from the research: 1. A cease-and-desist is not a court order and both projects complied inside 24 hours anyway, with a 5 p.m. EST next-day deadline and Texas and Lanham Act claims - per TechCrunch 2. Demand four of five is "delete all X account credentials and session tokens", which is not a takedown request but a description of how Nitter runs - per tossit444 on HN 3. The instances were being rate-limited to death before the letter, and X appears to have revoked the credentials outright, which is why "host it in another jurisdiction" does not work - per pessimizer on HN 4. The top self-hosting guide requires "A burner/temporary Twitter account without 2FA enabled", so the recommended way to read X without an account is to make an X account - per guide-nitter-self-hosting 5. Logged-out X still renders a single post and the last few posts of a profile, with 1 to 3 top comments at most and a popup on any click - per nomel on HN 6. The named loss is the RSS endpoint rather than the interface, because the accounts people tracked for fast local news do not publish feeds of their own - per gl0w on HN 7. The heaviest users were forums that banned X links in protest, and their fallback is screenshots or keeping the ban and losing the story - per r/hockey 8. A 30-day search of X for its own login-wall story returns 12 posts and 170 likes total with only three on topic, against 1,174 points and 1,115 comments on Hacker News - per @jreuben1

title: "Headscale and what breaks when you self-host the Tailscale control plane" date: 2026/08/27 tags: [headscale, tailscale, wireguard, control-plane, self-hosting, vpn, opensource]

🌐 last30days v3.3.2 · synced 2026-08-27

What I learned:

The project is enormous and its own README is the most honest thing written about it - juanfont/headscale sits at 43,220 stars, 2,521 forks and 146 open issues, written in Go, last pushed 2026-08-25. The README does not oversell: "It implements a narrow scope, a single Tailscale network (tailnet), suitable for a personal use, or a small open-source organisation." Exactly one stable release lands inside the window - v0.29.3 on 2026-07-29, day two - against 17 issues opened and 12 pull requests merged in the same 30 days. The pitch everywhere else is frictionless: SSD Nodes says "Headscale replaces only the control server. Every node runs the official client from Tailscale, and you point it at your server with sudo tailscale up --login-server https://headscale.example.com", and Hackaday's Linux Fu on 10 August put it flatly: "Headscale works seamlessly with the existing Tailscale clients."

The single loudest thing in the window is that sentence being false on iOS, and the culprit is the client moving underneath the server - issue #3415, "[Bug] macOS/iOS - no exit nodes available," opened 7 August and still open on 26 August with 18 comments and 22 reactions. Reporter environment: Headscale 0.29.3 in Docker, Tailscale 1.102.2, Debian 13. The symptom is precise - the exit-node list is empty in the GUI, tailscale exit-node list on the CLI is correct, and starting a connection from the terminal makes the list appear until the app restarts. Tailscale's own support desk blamed the server, quoted verbatim by @alexls74: "This is a known class of issue when using a custom/third-party control server like headscale... A Tailscale team member suggested the root cause was headscale not correctly setting the online/offline status bits for peer nodes in the MapResponse."

A user disproved the vendor's diagnosis on the wire and shipped a two-line fix in the ACL policy - @zicochaos verified that approved exit nodes arrive from Headscale with "Online: true, ExitNodeOption: true and a fresh LastSeen" and that online/offline deltas flow correctly, so the MapResponse theory was wrong. The actual cause is a closed-source client change: "1.102 removed darwin/iOS from the legacy Notify.NetMap path... the GUI now consumes Notify.InitialStatus + peer deltas (converted in tailscale/corp#44962, closed source)," and "the hosted control plane marks recommended exit nodes with the suggest-exit-node node attribute... With headscale there is never a suggestion, so on a fresh app start with no active selection the new GUI shows an empty list and the section never initializes." The remedy is not a Headscale upgrade, it is emulating the hosted control plane in your own policy file with nodeAttrs targeting * with suggest-exit-node and suggest-exit-node-ui. Independently confirmed on macOS and iOS by @alexls74, @TAT-Hins, @R0dya, @fulljackz and @Degete. The reporter also filed a genuine protocol-compliance fix as PR #3420 for LastSeen being sent only for offline peers, and noted the honest result: "the LastSeen fix alone did not fix the empty list - the nodeAttrs workaround did."

Client version drift has no escape hatch on Apple platforms, which is the operational fact nobody puts in the setup guides - when @dycw asked the obvious question, "Is it possible to install an old version of Tailscale?", the answer was "The App Store version cannot be downgraded." Only the macOS standalone package could be pinned back to 1.98.10. On iOS there was nothing: asked for a workaround for iPhone and iPad, @alexls74 answered "Nothing at all." That is the shape of the risk in one exchange - the control plane is yours, the client is not, and on two of the five supported platforms you cannot roll back.

The version floor is the actual compatibility contract, and it moves every release - v0.29.3's release notes open with "Minimum supported Tailscale client version: v1.80.0". The unreleased 0.30.0 CHANGELOG already raises it to v1.82.0, and the project documents its policy as aiming to support "the last 10 releases of the Tailscale client." The rest of v0.29.3 is the unglamorous reality of reimplementing someone else's protocol: tagged nodes stuck expired after tailscale logout, ephemeral nodes lingering as disconnected after reconnect churn, registration falsely returning 401 registration timed out, a machine-key check added so a leaked auth ID cannot return the registering user's identity, and /key requests rejected below the supported capability version floor.

ACL policy is where operators get bitten twice, and both bites are silent - the first is loading. The NetSPI red team writeup documents the behaviour exactly: Headscale "checks whether a policy is already loaded in the Headscale database and, if not, applies policy.json from the repository. This only runs once; subsequent docker compose up calls leave the database policy untouched." Edit the file after first boot and nothing happens. The reload path is a systemctl reload headscale or a SIGHUP, and if acl.mode is set to file the web UI cannot edit the policy at all until it is switched to database (headplane issue #233). The second bite is diagnosis, and the collie README names it: "tailscale ping succeeds (disco pings bypass ACLs), and blocked traffic is dropped rather than refused, so the phone just hangs and reads as 'server down'." A working ping and a dead app is an ACL problem that looks like an outage. Meanwhile #2409, asking for IP Sets and Via in Headscale ACLs, sits open with 24 reactions.

DERP is the reason most people self-host at all, and the only first-person measurement in the window is in Chinese - @nash_su on 29 July, 72 likes and 15 replies, reported that Tailscale over 4G/5G in China could not NAT-punch and that Tailscale's public DERP relays ran 500ms or worse, making it unusable. A 5Mbps Tencent Cloud box at 38 yuan a month running Headscale with its built-in DERP took the latency to roughly 30ms. That is the case for the whole project stated as a number. The catch is the default: vpnsmith's architecture breakdown notes DERP is "either use the Tailscale public DERP network (default), or host your own DERP on the same VPS," alongside MagicDNS since v0.23 and a "100%-compatible" Tailscale JSON ACL format. A fresh Headscale install still relays through Tailscale's infrastructure until you change that.

The sharpest articulation of what self-hosting the control plane actually buys came from offensive security, not from the homelab crowd - NetSPI's BOFScale runs a full Tailscale daemon in memory as a BOF-PE with no driver, no service and no disk state, and per @ptdbugs "the server side is built on Headscale with an integrated DERP relay," fronted through CloudFront or Fastly. Replying to Tailscale co-founder @apenwarr, @EthicalChaos reduced it to one line: "Given that BOFscale uses headscale both as the control plane and DERP relay, Tailscale Inc knows nothing about your tailnet." The same window's biggest on-topic community thread is the consumer version of that question - r/Tailscale asking "What's to stop tailscale employees from having access into your network?" at 226 points and 153 comments on 23 August. Gil Ricardo's Proxmox LXC writeup says the quiet part: the coordination server "started feeling like a dependency I didn't need."

What Headscale still refuses to do is now explicitly blocking migrations, while the roadmap moves toward more compatibility, not less - Funnel was closed as not_planned back in 2022 as issue #1040 with 30 comments and 39 reactions, and it was still being updated on 31 July. On 23 August someone reopened the argument in issue #3435, titled "Feature request: Tailscale Funnel support (blocking migration from Tailscale for us)," which also records that the obvious alternative failed worse: NetBird hit "an (apparently known, unresolved) upstream bug where the iOS client completes the WireGuard handshake but never actually passes data through the tunnel." The two heaviest open items touched in the window are the same shape - #2527 tracking tailscale cert and serve at 34 comments, and #1307 asking for Tailnet Lock at 64 reactions, the most-reacted issue in the window. Meanwhile 0.30.0 deletes the gRPC API entirely and moves the v2 API to "OAuth 2.0 client-credentials, the way the Tailscale ecosystem does," so that "the Tailscale Terraform provider and Kubernetes operator drive Headscale unchanged." The direction of travel is to look more like the thing it replaces.

The whole subject is invisible outside the issue tracker, which is why the tracker is the only useful source - Hacker News carried zero Headscale stories in 30 days. The loudest English-language X post about it, @therandomeng_ on 25 August, is a hashtag promo reading "MANAGING TAILSCALE NETWORKS PRIVATELY WITHOUT VENDORS IS HARD" with two likes, while the post with an actual measurement in it got 72 and is in Chinese. Reddit's Tailscale and selfhosted communities were busy all month and barely mentioned Headscale by name. The web layer is almost entirely install guides - hwdsl2/headscale-install for eight distros, Serverspace's VPS walkthrough asserting "fully compatible with the official Tailscale clients for Windows, macOS, Linux, Android, and iOS," and SNBForums adding "check out Headplane as well, nice adjunct." Not one of them mentions that a client update in August emptied the exit-node list on two of those five platforms.

KEY PATTERNS from the research: 1. The breakage of the window came from the client, not the server: Tailscale 1.102.2 emptied the macOS and iOS exit-node list against a stock Headscale 0.29.3 - per issue #3415 2. The vendor's support desk blamed Headscale's MapResponse status bits and a user disproved it on the wire, showing peers arriving with Online: true and ExitNodeOption: true - per @alexls74 and @zicochaos 3. The real gap is a feature the hosted control plane has and Headscale does not: suggest-exit-node, and the fix is emulating it with two lines of nodeAttrs in your own ACL policy - per issue #3415 4. There is no downgrade path on iOS and none through the App Store on macOS, so client version drift is a one-way door on Apple platforms - per @dycw and @alexls74 5. The compatibility contract is a moving floor - v1.80.0 minimum in v0.29.3, v1.82.0 in the unreleased 0.30.0, against a stated aim of supporting the last 10 client releases - per Headscale docs 6. ACL policy loads from file exactly once and then lives in the database, so post-boot edits silently do nothing without a reload - per NetSPI 7. tailscale ping succeeds through a blocking ACL because disco pings bypass it, so ACL misconfiguration reads as "server down" - per collie 8. Self-hosting DERP is the measurable win, and it is not the default - one operator went from 500ms+ on Tailscale's public relays to about 30ms on a 38-yuan VPS - per @nash_su 9. The clearest statement of the threat model in the window came from a red-team toolkit, not the homelab crowd: with Headscale as both control plane and DERP relay, "Tailscale Inc knows nothing about your tailnet" - per @EthicalChaos 10. Funnel is still not_planned from 2022 and is now cited by name as blocking a migration off Tailscale, while 0.30.0 drops gRPC for OAuth 2.0 to run unchanged under Tailscale's own Terraform provider - per issue #3435

title: "What ChatGPT referral traffic is actually worth to small sites" date: 2026/08/27 tags: [llm-referral, chatgpt, seo, aeo, traffic, analytics, publishing]

🌐 last30days v3.3.2 · synced 2026-08-27

What I learned:

Every serious measurement of the volume lands in the same order of magnitude, and it is about one percent - @vibhestudio cites Conductor's 2026 benchmarks at "1.08% of all website traffic, with 87.4% of it coming from ChatGPT." The best-instrumented version is half that: Orbit Media pulled 97 GA4 accounts and 28.9 million B2B sessions over a year through June 2026 and found roughly 140,000 from AI sources, which is 0.5%, with ChatGPT at 82.3% of those AI sessions. Elmo reports AI-referred traffic growing 632% year over year and arriving at 0.2% of total visits. ZoneTechify summarises Similarweb and the independent studies as "typically under 2% for most publishers." Four sources, four numbers, one conclusion: growth rates in the hundreds of percent are being applied to a base that rounds to nothing.

The conversion multiplier is where the numbers stop agreeing, and one of them says AI traffic converts worse than email - First Page Sage puts ChatGPT visitors at 4.7% lead conversion against 1.9% for Google organic, a 2.5x edge. Orbit Media's pooled figure is 2.1% against 0.5%, a 3x edge, but its per-site median is 7x and the pattern holds on only about two-thirds of sites individually. Subscribe PR says "up to 4.4x higher than organic." @AgenticOperator posts a channel table reading "Claude: 16.8% / ChatGPT: 14.2% / Perplexity: 10.5% / Google organic: 2.8% / Gemini: 3.0%." And Elmo's number for the same channel is 1.3% in 2025, "up 55% from 0.8% the year before, against 1.9% for email" - which is AI referral traffic converting worse than a newsletter. A channel whose published conversion rate ranges from 1.3% to 16.8% inside twelve months is not a measured channel.

The reason nobody's numbers match is that roughly seventy percent of the traffic never identifies itself as ChatGPT - the standing framing is The 70% Problem: the assistant apps strip the referrer on the way out, so GA4 files the visit as Direct. An Attrifast analysis of 41.2 million sessions puts 71% of ChatGPT visits landing as Direct; a Loamly analysis of 446,405 visits puts it at 70.6%, and finds that unlabelled AI traffic converting at 10.21% against 2.46% for everything else. @AgenticOperator names the same mechanic in the same thread as the conversion table: "AI referral traffic often shows up as 'direct' in GA4. A D2C founder told me last week he w[as]..." The platform fix only landed this summer - per Ryze, "as of July 2026, GA4 automatically classifies traffic from recognized AI chatbots - including ChatGPT, Gemini, and Claude - into a dedicated 'AI Assistant' session channel group." Every conversion multiple published before that was computed on a third of the data.

The two biggest first-person receipts in the window come from companies, not bloggers, and they contradict each other - Shopify's Q2 says AI-referred traffic and AI-channel orders both tripled year over year, new buyer orders from AI channels arrive at nearly twice the rate of other channels, and 75% of AI-attributed purchases came from outside the top 100 product categories, with president Harley Finkelstein calling AI "a complement to search, rather than a substitute for it" while traditional search rose 1.3x over two years and still holds about a third of storefront traffic. Against that, @skift reports "a Booking Holdings exec said recently that paid and organic referral traffic from LLMs amount to fewer than 1% of room nights. That's almost four years since the launch of ChatGPT." The Shopify thread on Hacker News drew 23 points and 15 comments, which is the entire developer-community reaction to the single largest AI-commerce dataset of the month.

The individual site owners posting real numbers are posting small numbers in big language - the most concrete receipt is @adnan30baig on an off-road parts brand: "AI search has already generated $22,700 in directly attributed revenue for Rough Country... AI referral traffic increase 71%... Over one 90-day period, ChatGPT alone sent more than 14,000 sessions." @adampraktika reports going from "Pages cited in ChatGPT answers: 9 → ~100" since June with "50% better engagement rate, better than anything search sends us," and got 6 likes for it. The one niche-site owner who wrote it up in full did it on r/juststart, under the title "ChatGPT sends my niche site more buyers than Google now. Here's exactly what changed on the pages (works at low authority)" - 62 upvotes and 30 comments, which is the ceiling for this subject on Reddit in a 30-day window. The most honest post in the corpus is @PietroPelizzar1: "ChatGPT is sending us traffic. Not a lot. But the engagement from those visitors is surprisingly high. We're not optimizing for it yet. Just watching." The whole X layer for this topic is 24 posts and 643 likes combined, and the loudest on-topic post of the month is @alexgroberman at 53 likes claiming local businesses are losing "$25,000+ per month in potential revenue" - a number with no method attached.

The loss side of the ledger is measured far better than the gain side - Axios has the hardest figures anyone published in the window: "over the past two years, small publishers lost 60% of referrals from search overall, medium publishers 47%, large publishers 22%." Newsweek cites a Reuters Institute projection that "search-driven traffic to news sites could decline by as much as 43 percent over the next three years." Marketplace names Huffington Post and Washington Post as reporting "pretty massive decreases." The only counterweight is a caveat rather than a number - iTechGuides concludes that "the available evidence does not establish that Google AI search has uniformly destroyed traffic across all websites." A publisher can put a percentage on what it lost and only a story on what it gained.

What practitioners are actually building this month is measurement infrastructure, not optimisation - the two Show HNs in the window are both trackers, both tiny: a BYOK library for tracking AI search under MIT at 6 points and 3 comments, and Measure your AI search with BYOK and OSS at 3 points. Trakkr is running a daily-updated "AI Search Traffic Index" of identifiable AI referral page views, attributed across a named list that runs ChatGPT, Claude, Gemini, Perplexity, Copilot, DeepSeek, Grok, You.com, Poe and Phind. The busiest Reddit thread of the month is not about clicks at all - Anyone else checking how ChatGPT describes their company? on r/SEO pulled 74 comments on 42 upvotes, a comment-to-upvote ratio that says people came to compare notes rather than to agree. The sanest framing came from @veeeeking, who got 2 likes for it: a citation "is not a ranking, a traffic promise, or proof that the cited page drove the whole response."

The remedies arriving are all platform-side, and the loudest one is a publisher defecting - Google gave publishers a preferred-source button across Search, Discover and News on 20 August, and it drew 4 points on Hacker News. The thread that actually moved was TIME Is Serving AI Bots a Different Website, with Ads Built In at 267 points and 194 comments, which is a publisher deciding the crawler is the customer. Underneath it sits Tell HN: Even HN is getting heavy traffic by AI crawlers, and on the commercial end @tipsheetai reports Criteo saying ChatGPT Ads "early campaigns are outperforming other referral channels, with more than 80% of ad-driven traffic coming from customers new to a brand." The organic referral is worth about one percent; the paid slot next to it is already being benchmarked.

KEY PATTERNS from the research: 1. Every credible volume measurement lands between 0.2% and 2% of total sessions, with the best-instrumented study at 0.5% across 28.9M sessions - per Orbit Media 2. ChatGPT is 82.3% to 87.4% of all AI referral traffic, so an AI referral strategy is a ChatGPT strategy - per @vibhestudio 3. Published conversion rates for the same channel range from 1.3% to 16.8% inside one year, and one of them is worse than email - per Elmo 4. Roughly 70% of AI visits arrive with no referrer and get filed as Direct, which is why no two studies agree - per The 70% Problem 5. GA4 only began auto-classifying AI chatbots into an "AI Assistant" channel group in July 2026, so older multiples were computed on partial data - per Ryze 6. The two largest corporate datasets disagree: Shopify says AI traffic and orders tripled, Booking Holdings says under 1% of room nights - per @skift 7. Loss is quantified and gain is anecdotal: 60% of search referrals gone for small publishers against $22,700 as the month's best-documented AI revenue receipt - per Axios 8. The community is building trackers rather than tactics, and the biggest thread of the window is a publisher serving bots a separate site with ads in it - per Hacker News