For online services, is there a fundamental tension between openness and permissionless-ness, and exploitability by bots?