Commit 42: We Replaced Cookies with One Sentence — and Gandhi Showed Up

A story about Ahimsa in software, 190 lines vs 1,400, and why the rod matters more than the fish. It was 3am. Commit number 42. I'm building CrowdBooks — a collaborative book platform on IPFS. No cloud. No vendor lock-in. No surveillance. Just people writing books together. We had a cookie problem. Not a legal one. A philosophical one. The Cookie Was a Lie Most web apps carry cookies like luggage. CSRF tokens, tracking pixels, session sprawl. Every cookie is a small compromise: "We need to remember you — trust us." We replaced the whole thing with one sentence in our tagline: "We don't sell the fish — we give you the rod." That sentence forced a decision. If we're giving people the rod, we can't be secretly netting their data in the background. So we ripped out the CSRF cookie. Replaced it with HMAC-signed tokens. Now there's exactly one cookie: session . That's it. Smaller attack surface. Cleaner architecture. And honest. Two hours after pushing that commit, I opened Umami analytics.