Forgot your password?
typodupeerror
The Internet Cloud Supercomputing

Hackers Spawn Web Supercomputer On Way To Chess World Record 130

Posted by Soulskill
from the distributed-computing-now-with-more-distribution dept.
New submitter DeathGrippe sends in an article from Wired about a new take on distributed computing efforts like SETI@Home. From Wired: "By inserting a bit of JavaScript into a webpage, Pethiyagoda says, a site owner could distribute a problem amongst all the site's visitors. Visitors' computers or phones would be running calculations in the background while they read a page. With enough visitors, he says, a site could farm out enough small calculations to solve some difficult problems. ... With this year's run on the value of Bitcoins — the popular digital currency — security expert Mikko Hyppönen thinks that criminals might soon start experimenting with this type of distributed computing too. He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else."
This discussion has been archived. No new comments can be posted.

Hackers Spawn Web Supercomputer On Way To Chess World Record

Comments Filter:
  • Cheap (Score:5, Funny)

    by Anonymous Coward on Tuesday June 04, 2013 @07:23PM (#43909531)

    Better than looking at ads.

    • TFA tells us that people can do this or do that to the visitors' computers (or smartphones) but there's no hint on how to block all these ...

      Anyone can share a little insight on what kind of precaution that we can do in order to block out all those things from entering our own device in the first place --- other than not visiting those websites, I mean ...

      • Re: (Score:2, Funny)

        by Anonymous Coward

        Insert smarmy statement regarding how long I've been running noscript here

      • by Anonymous Coward
        You could disable Javascript to be sure, or install NoScript and spend a lot of time enabling various Javascript sources every time you visit a new website, trying to figure out what sources are needed to make the site work or if the site is just not worth it. Or you could just not care unless you notice the site slowing down your computer, in which case you would probably get one of those popups from the browser warning you Javascript is using too much CPU and asks if you want to stop it.
      • by Algae_94 (2017070)
        As the AC mentioned, you can use NoScript to block these scripts from running on a site. You could also universally disable javascript in the browser. NoScript is the most granular blocking that I'm aware of, and it's granularity is by domain. This means if xyz.com has this sort of script on their site and you block xyz.com, the site would also not be able to do a lot of other javascript stuff. This can be range from no problem for the site to making the site unusable.
        • Re:How to block ? (Score:4, Interesting)

          by Cenan (1892902) on Wednesday June 05, 2013 @02:48AM (#43912005)

          The problem with noscript is that once you allow a domain, it's allowed regardless of which site you allowed it on. This is a huge problem, since I might trust domain x to use jQuery's CDN, but not site y. If I allow jQuery CDN it's allowed for both. Try blocking google-analytics for instance, and see how many sites break - for no other reason than that they want analytics to run, and their scripts check for this (or depend on it in some retarded way, I'm not sure). That means in order to use a handful of sites that have retarded dependencies, I have to allow this idiocy for every site i visit.

          The other problem with the granularity is that most professional sites pull in javascript from multiple domains, so it turns into a treasure hunt trying to find the handful of domains you need to unblock before the site works. And it's even more fun when the site has hidden dependencies, that only pop up after you allow a domain on the list - making the already long list expand dynamically. And of course there's no way to see the script you're allowing unless you want to sift through the entire source of the page.

          This is why noscript remains a nerd tool, the menu has a function that allows all scripts on a given site, a ripe choice of you already have the "click through" mentality. What a user sees is "lots of choices, this one makes the problem go away" and once that is learned the whole point of noscript goes the way of Windows UAC - yes, yes, yes, oh shut up.

          TL;DR: noscript is good advice, although it requires far more user maintenance than resonable.

          • I block google-analytics and haven't noticed any problems whether it be http or https traffic. No problems whether it's on a blog or a shopping cart. Blocking Google APIs or GStatic can break functionality, however.
            • by Cenan (1892902)

              Yeah I rechecked my settings after posting and you're right. It's Google APIs that break stuff. However, site owners still have retarded dependencies on those. I frequently run into problems with sites that have a little map in a widget off to the side. If Google APIs are blocked, the whole site stutters and falls on it's face, when it shouldn't.

    • by Cow007 (735705)

      Better than looking at ads.

      You're on to something, it seems like the usefulness and positive benefits to customers, science etc. Is being all but ignored.

    • Re:Cheap (Score:4, Interesting)

      by Mathness (145187) on Wednesday June 05, 2013 @05:49AM (#43912603) Homepage

      It actually could be a fair exchange of resources instead of ads, I use some of yours when visiting your site and "consuming" your work and I give some back by doing some "work" for you. If what I provide is a reasonable use of my resources, I would have no problem with it as long as it is legal.

  • by socceroos (1374367) on Tuesday June 04, 2013 @07:26PM (#43909547)
    Lets just load a monolithic OS kernel written in javascript into visitor's RAM with the full OSI stack. Distribute your website to these small OSs and have them serve everyone else in the local network....
  • At Last! (Score:2, Insightful)

    by Anonymous Coward

    At last! A practical form of "micro"-payments

    • Yeah, I pulled that number out of my ass, but it's probably not far from the truth. A web giant like Google implementing this on all their sites would probably make an MW worth of profit ($50 an hour?) and waste a GW of electricity worldwide.
      • by ikaruga (2725453)
        Not their electricity, not their problem.
        I think the risk of bad publicity and potential lawsuits, from both users and governments, is just not worth it.
    • I saw this and thought is this news? Hackers were caught (Well spotted if not incarcerated) using bot nets to generate bitcoins last year. And one of the principle bitcoin engines is written in Java script just so you can add it to your website. News What News?
  • Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system. It doesn't really matter if it's displaying animated kittens are calculating bitcoin blocks. Indeed, we should all hail this as a great thing if it means criminals becoming less criminal...

    • by Dunbal (464142) *
      For all you may claim that the sign on the back of your front door states that I consented to be raped by you when invited to into your home, you still don't have the right to do it and are a criminal if you do.
      • by Kaenneth (82978) on Tuesday June 04, 2013 @08:04PM (#43909807) Homepage Journal

        But it's not rape if there is consent, given by passing through the door...

        That's EULA logic, right?

        • by Dunbal (464142) *
          Yeah, try it on a judge. Let me know how it went.
        • by Anonymous Coward

          It is EULA logic.

          EULA's mean shit all, at least here in the UK.

          Here, a contract is deemed illegal if it's unfair. It's extremely difficult to prove the fairness of a contract that is written and "signed" prior to money changing hands.

          Even if the only terms in the contract were "1. we hope you enjoy our product and expect that you tell your friends about it if you do enjoy it" there's absolutely jack the company can do to me if I do enjoy the product but remain silent.

          Explain that to me at time of purchase a

    • I was thinking the same thing. I don't know that this is actually illegal or even unethical. We implicitly agree to watch ads etc when we visit a website. This could be a source of revenue far greater than advertising.

    • Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system. It doesn't really matter if it's displaying animated kittens are calculating bitcoin blocks. Indeed, we should all hail this as a great thing if it means criminals becoming less criminal...

      I think you've missed the idea. From TFA:

      He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else

      The criminal activity isn't mining bitcoins on someone else's machine, it's putting your code on someone else's website without their consent. It's not a new type of criminal activity, just a new incentive to do it.

    • Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system.

      Just because you tricked the user into running your code doesn't mean it's OK to do whatever you want with their system. Users would never agree to run such code if they knew what it did ahead of time. If your software relies on lazy users who don't understand what they're agreeing to, then congratulations, you're a malware author.

  • by Anonymous Coward on Tuesday June 04, 2013 @07:28PM (#43909571)

    ... only need to get ten trillion users for three days to get 0.001 BTC.

    I can already hear the hoards of criminals running to do this.

    • ... only need to get ten trillion users for three days to get 0.001 BTC.

      Have you used Javascript lately? Modern optimizers are very good. With WebGL [wikipedia.org] you can use Javascript to run code on the GPU.

      • Microsoft has refused to implement WebGL in any released version of IE for security reasons. Apple implemented it in Safari but disabled it by default on the Mac and restricted it to use only by iAds on iOS.
    • by c (8461)

      ... only need to get ten trillion users for three days to get 0.001 BTC.

      To be honest, I've heard of dumber micro-payment schemes...

  • by FooAtWFU (699187) on Tuesday June 04, 2013 @07:29PM (#43909583) Homepage

    My understanding was this wouldn't work well for BitCoin, because the raw computing power people are throwing at it with GPUs and ASICs easily dwarfs even significant numbers of zombies, and even WebGL can't help you (too limited an instruction set).

    Of course by this point the matter is hearsay... but still, Bitcoin is a tough nut to crack these days.

    • it's that or those damn flash ads using up all my computer resources anyway.

      May just as well at least get rid of the ads =P

    • by AmiMoJo (196126) *

      All the smart people are moving to LiteCoin. BitCoin is basically deal for mining, and the difficulty is going to rapidly increase now that ASIC miners are becoming available.

      LiteCoin is still easy enough that you can make a reasonable ROI with a GPU, barely.

  • by Sneftel (15416)

    I'm... kind of okay with this? Modern operating systems are hella-good at maintaining usability under high CPU loads, and the extra electricity consumed by the increased load wouldn't make much of a difference to me. If this is how they want to monetize web content, I'll take it over click-to-mute popunders any day. The "crooks" thing seems like it's just thrown in to increase the shock factor. Why wouldn't the site owners do this?

    • Functionally it's identical to blocking ads to prevent.

      • Functionally, this means the ultimate end of javascript. Because this means even ultimately secure code does not mean it can be trusted.

        Nor does it mean secure code isn't malicious, it just isn't malicious in the present sense of the word ....

        And that new abuse that does not fit the historical definition is coming down the pipeline.
    • by Cow007 (735705)
      A fail with a mobile device- the extra power requirements eating up the battery.
  • A practical form of "micro"-payments
    • by Anonymous Coward

      oops, we just plain forgot to turn off the ads

  • As an alternative revenue stream to ads, this might make sense for some websites. Many of the flashier (so to speak) ads waste many resources as well, but to no productive end other than getting your attention.
  • You'll need each visitor to stay on your page long enough for them to complete a significant amount of computation and upload the results.
    If the amount they compute is less than what is required to for the fork and join process in the problem, then its easier to not fork and join and do the computation locally.

    Every visitor that doesn't stay long enough wastes resources doing work that is thrown away. They'll also waste your own resources by asking for the input data and never giving you a result. That mean

  • I've often wondered if including a programming language in a browser is a good idea.

    On the functionality side, I don't really think it adds much required functionality. The only useful functionality seems to be in validating web form data (Don't let the user submit without required fields, make sure no spaces are in the CC number, &c). The vast majority of these could be handled by changes in the HTML specification with fields specific to type, flags, and so on. Video and other media players should be b

    • You would be absolutely correct... if this was 1995. Web sites haven't been a "static, read-only experience" in ages (many of them, anyway). You interact with web pages, not merely consume them, as you would an RSS feed. While I hate javascript with a passion, it has made it possible for us to move from web pages to web apps. Many of the sites most people use everyday would be completely impossible without client side scripting. I wish that scripting would be done in something that doesn't suck as hard as j

  • I mean it's in the title, got me all interested. Then I read the summary and it's all about a stupid approach to bitcoin mining. So what was this "Chess Record" they were talking about? You expect me to RTFA for that?
    • by Anonymous Coward

      Nothing to do with chess.
      Just solving the N-queens problem for a larger N than ever solved before. Yawn.

  • There a startup named CrowdProcess [crowdprocess.com] doing something similar. Their business plan is to pay websites to include their javascript, and sell the computation time to developers. This way, the websites can cover hosting costs without resorting to ads.
  • I posted just this idea on one of the bitcoin stories recently.

  • Mining Bitcoins is over. Doing it with an ordinary CPU is hopeless. Doing it with a GPU barely pays for the power consumption. Doing it with FPGA hardware still sort of works, but not for much longer. Doing it with ASICs requires dealing with slimeballs who insist you pre-pay for hardware and deliver months later, if at all.

    Remember, more than half the Bitcoins that can exist have already been mined, and it gets steadily harder.

    Stealing other people's GPU cycles [tomshardware.com] has a track record of success. But it's

  • The ZeroAccess botnet is known to be mining BTC. I've seen estimates of 1-3 million USD worth mined each year. Mind you, difficulty has gone up a lot since I saw that.
    http://en.wikipedia.org/wiki/ZeroAccess_botnet [wikipedia.org]

  • This idea is not exactly a new one.

    Just recently there was that thing:
    http://www.cbc.ca/news/technology/story/2013/05/02/technology-esea-bitcoin-mining.html [www.cbc.ca]

    The efficiency is so bad, coupled with expected user backlash, it is a dangerous joke at best.

  • by smutt (35184) on Wednesday June 05, 2013 @02:37AM (#43911961)

    Why not just purchase a botnet? It's cheaper and easier than getting millions of people to visit a website. And you don't have to limit yourself to JS.

    • by gl4ss (559668)

      because then you wouldn't have an article about an idea everyone had years ago.

    • Why not just purchase a botnet? It's cheaper and easier than getting millions of people to visit a website. And you don't have to limit yourself to JS.

      Presumably buying a botnet is more expensive than the gain from the mining you would realize with it.

  • by xded (1046894) on Wednesday June 05, 2013 @02:56AM (#43912039)

    Came here for the "chess world record" mentioned in TFT and didn't find a single word about it, neither in TFS nor in TFCs... Did anyone realize how this article is actually about a bunch of guys parallelizing the eight queens puzzle [wikipedia.org], running it first on anything from browsers to Blackberrys, then porting it to Hadoop, and on the way to break the world record computing the number of solutions for a chess board of 27x27 tiles?

    TFA mentions the word "bitcoin" in the last 2 paragraphs out of 23, and everybody goes crazy about it. Welcome to Slashdot 2013.

  • Now, if something like this could be used for... real... projects, like Rosetta@Home or other good BOINC projects, they could potentially do some real good.
  • For the last fucking time (hopefully) CPUs and even ideal advanced GPUs like the king of them all, the Radeon 5830 STILL CANNOT MATCH THE NEW ASICs. Normal computers (and TVs and phones) cannot effectively mine bitcoins anymore. You could mine on my i5-2400 24/7 for an entire year straight and come up a couple dollars. Unless anyone has an ASIC miner, they could control 100,000 computers and run them at a nice and undetectable 25% indefinitely and make a tiny, tiny amount of money.
    • by neminem (561346)

      Um. I have no idea of the actual math behind running bitcoin miners on different computers, but if you could mine a couple dollars on your computer if you ran it for a year, then if you ran 100,000 computers you'd get a couple hundred thousand dollars a year. If a couple hundred thousand dollars a year is a "tiny, tiny amount of money" to you... could you send me a tiny, tiny amount of money?

If I had only known, I would have been a locksmith. -- Albert Einstein

Working...