Hackers Spawn Web Supercomputer On Way To Chess World Record 130
New submitter DeathGrippe sends in an article from Wired about a new take on distributed computing efforts like SETI@Home. From Wired:
"By inserting a bit of JavaScript into a webpage, Pethiyagoda says, a site owner could distribute a problem amongst all the site's visitors. Visitors' computers or phones would be running calculations in the background while they read a page. With enough visitors, he says, a site could farm out enough small calculations to solve some difficult problems. ... With this year's run on the value of Bitcoins — the popular digital currency — security expert Mikko Hyppönen thinks that criminals might soon start experimenting with this type of distributed computing too. He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else."
Cheap (Score:5, Funny)
Better than looking at ads.
How to block ? (Score:3)
TFA tells us that people can do this or do that to the visitors' computers (or smartphones) but there's no hint on how to block all these ...
Anyone can share a little insight on what kind of precaution that we can do in order to block out all those things from entering our own device in the first place --- other than not visiting those websites, I mean ...
Re: (Score:2, Funny)
Insert smarmy statement regarding how long I've been running noscript here
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
No (Score:2)
We never do that...
Re: (Score:3)
Re:How to block ? (Score:4, Interesting)
The problem with noscript is that once you allow a domain, it's allowed regardless of which site you allowed it on. This is a huge problem, since I might trust domain x to use jQuery's CDN, but not site y. If I allow jQuery CDN it's allowed for both. Try blocking google-analytics for instance, and see how many sites break - for no other reason than that they want analytics to run, and their scripts check for this (or depend on it in some retarded way, I'm not sure). That means in order to use a handful of sites that have retarded dependencies, I have to allow this idiocy for every site i visit.
The other problem with the granularity is that most professional sites pull in javascript from multiple domains, so it turns into a treasure hunt trying to find the handful of domains you need to unblock before the site works. And it's even more fun when the site has hidden dependencies, that only pop up after you allow a domain on the list - making the already long list expand dynamically. And of course there's no way to see the script you're allowing unless you want to sift through the entire source of the page.
This is why noscript remains a nerd tool, the menu has a function that allows all scripts on a given site, a ripe choice of you already have the "click through" mentality. What a user sees is "lots of choices, this one makes the problem go away" and once that is learned the whole point of noscript goes the way of Windows UAC - yes, yes, yes, oh shut up.
TL;DR: noscript is good advice, although it requires far more user maintenance than resonable.
Re: (Score:2)
Re: (Score:2)
Yeah I rechecked my settings after posting and you're right. It's Google APIs that break stuff. However, site owners still have retarded dependencies on those. I frequently run into problems with sites that have a little map in a widget off to the side. If Google APIs are blocked, the whole site stutters and falls on it's face, when it shouldn't.
Re: (Score:2)
Better than looking at ads.
You're on to something, it seems like the usefulness and positive benefits to customers, science etc. Is being all but ignored.
Re:Cheap (Score:4, Interesting)
It actually could be a fair exchange of resources instead of ads, I use some of yours when visiting your site and "consuming" your work and I give some back by doing some "work" for you. If what I provide is a reasonable use of my resources, I would have no problem with it as long as it is legal.
Why stop there... (Score:4, Funny)
Re: (Score:2)
Not that impossible, actually. [bellard.org]
At Last! (Score:2, Insightful)
At last! A practical form of "micro"-payments
1 / 1000 efficiency (Score:2)
Re: (Score:2)
I think the risk of bad publicity and potential lawsuits, from both users and governments, is just not worth it.
Re: (Score:2)
That's not actually criminal (Score:1)
Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system. It doesn't really matter if it's displaying animated kittens are calculating bitcoin blocks. Indeed, we should all hail this as a great thing if it means criminals becoming less criminal...
The Future of Web 3.0 (or whatever version) (Score:2)
But if you make mining easier, then everyone else pulls out their old mining rigs and exhausts the supply of coins that much quicker. Unless you build a large amount of inflation into the system, or put an expiry on the coins.
It would be nice if distributed problems had a standard value. (E.g. The solutio
Re: (Score:3)
Re:That's not actually criminal (Score:4)
But it's not rape if there is consent, given by passing through the door...
That's EULA logic, right?
Re: (Score:2)
Re: (Score:1)
It is EULA logic.
EULA's mean shit all, at least here in the UK.
Here, a contract is deemed illegal if it's unfair. It's extremely difficult to prove the fairness of a contract that is written and "signed" prior to money changing hands.
Even if the only terms in the contract were "1. we hope you enjoy our product and expect that you tell your friends about it if you do enjoy it" there's absolutely jack the company can do to me if I do enjoy the product but remain silent.
Explain that to me at time of purchase a
Re: (Score:2)
I was thinking the same thing. I don't know that this is actually illegal or even unethical. We implicitly agree to watch ads etc when we visit a website. This could be a source of revenue far greater than advertising.
Re: (Score:2)
Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system. It doesn't really matter if it's displaying animated kittens are calculating bitcoin blocks. Indeed, we should all hail this as a great thing if it means criminals becoming less criminal...
I think you've missed the idea. From TFA:
He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else
The criminal activity isn't mining bitcoins on someone else's machine, it's putting your code on someone else's website without their consent. It's not a new type of criminal activity, just a new incentive to do it.
It's still unethical (Score:3)
Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system.
Just because you tricked the user into running your code doesn't mean it's OK to do whatever you want with their system. Users would never agree to run such code if they knew what it did ahead of time. If your software relies on lazy users who don't understand what they're agreeing to, then congratulations, you're a malware author.
Bitcoin mining in Javascript. (Score:5, Informative)
... only need to get ten trillion users for three days to get 0.001 BTC.
I can already hear the hoards of criminals running to do this.
Re: (Score:2)
... only need to get ten trillion users for three days to get 0.001 BTC.
Have you used Javascript lately? Modern optimizers are very good. With WebGL [wikipedia.org] you can use Javascript to run code on the GPU.
IE and Safari don't have WebGL (Score:2)
"I don't think these guys are very bright" (Score:2)
"Kittens vs. Zombies 3 requires WebGL to function. Please enable or switch to a different browser to continue."
For one thing, iPad and Surface users can't just "enable or switch to a different browser" without dropping hundreds of dollars on hardware that runs a less-closed operating system. For another, users would react to something that doesn't work in their preferred browser by thinking "I don't think these guys are very bright" and clicking away, if iamhassi's comment [slashdot.org] is any indication.
Benefit of doubt (Score:2)
WebGL might allow you to access the raw frames being displayed by the video card.
In other words: it's Microsoft's desire to suck the dick of the RIAA that's behind it.
I'd be inclined to give Microsoft the benefit of the doubt that someone might be displaying a confidential document on half of a 1920x1080 monitor and a web page on the other half, and the user doesn't want the web page to be able to "steal" the user's employer's trade secrets.
Re: (Score:2)
To be honest, I've heard of dumber micro-payment schemes...
Re: (Score:2)
Re: (Score:2)
No, it might have been in a Highlander sequel.
My understanding was this wouldn't work well (Score:5, Informative)
My understanding was this wouldn't work well for BitCoin, because the raw computing power people are throwing at it with GPUs and ASICs easily dwarfs even significant numbers of zombies, and even WebGL can't help you (too limited an instruction set).
Of course by this point the matter is hearsay... but still, Bitcoin is a tough nut to crack these days.
Oh well.. (Score:1)
it's that or those damn flash ads using up all my computer resources anyway.
May just as well at least get rid of the ads =P
Re: (Score:2)
All the smart people are moving to LiteCoin. BitCoin is basically deal for mining, and the difficulty is going to rapidly increase now that ASIC miners are becoming available.
LiteCoin is still easy enough that you can make a reasonable ROI with a GPU, barely.
Yay (Score:2)
I'm... kind of okay with this? Modern operating systems are hella-good at maintaining usability under high CPU loads, and the extra electricity consumed by the increased load wouldn't make much of a difference to me. If this is how they want to monetize web content, I'll take it over click-to-mute popunders any day. The "crooks" thing seems like it's just thrown in to increase the shock factor. Why wouldn't the site owners do this?
Re: (Score:2)
Functionally it's identical to blocking ads to prevent.
Re: (Score:1)
Nor does it mean secure code isn't malicious, it just isn't malicious in the present sense of the word
And that new abuse that does not fit the historical definition is coming down the pipeline.
Re: (Score:2)
We might see heuristic blocking of javascript come to the fore. Bitcoin miners at the end of the day have to upload to BTC hash servers, and produce BTC hashes.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Not unless a radical new battery technology becomes ubiquitous first.
People would notice when their devices are bled dry in the time it takes to find what they want on the site.
Re: (Score:2)
Not really profit. Considering you'd need MILLIONS of javascript miners to equal a single ASIC miner.
At last!... (Score:1)
Re: (Score:1)
oops, we just plain forgot to turn off the ads
Better or worse than ads? (Score:2)
What a waste. (Score:2)
You'll need each visitor to stay on your page long enough for them to complete a significant amount of computation and upload the results.
If the amount they compute is less than what is required to for the fork and join process in the problem, then its easier to not fork and join and do the computation locally.
Every visitor that doesn't stay long enough wastes resources doing work that is thrown away. They'll also waste your own resources by asking for the input data and never giving you a result. That mean
Is javascript a good idea? (Score:2)
I've often wondered if including a programming language in a browser is a good idea.
On the functionality side, I don't really think it adds much required functionality. The only useful functionality seems to be in validating web form data (Don't let the user submit without required fields, make sure no spaces are in the CC number, &c). The vast majority of these could be handled by changes in the HTML specification with fields specific to type, flags, and so on. Video and other media players should be b
Re: (Score:3)
You would be absolutely correct... if this was 1995. Web sites haven't been a "static, read-only experience" in ages (many of them, anyway). You interact with web pages, not merely consume them, as you would an RSS feed. While I hate javascript with a passion, it has made it possible for us to move from web pages to web apps. Many of the sites most people use everyday would be completely impossible without client side scripting. I wish that scripting would be done in something that doesn't suck as hard as j
Stupid summary, what about this "Chess Record"? (Score:3)
Re: (Score:1)
Nothing to do with chess.
Just solving the N-queens problem for a larger N than ever solved before. Yawn.
CrowdProcess is doing this (Score:1)
Ha Ha... (Score:2)
I posted just this idea on one of the bitcoin stories recently.
Mining Bitcoins is so over (Score:2)
Mining Bitcoins is over. Doing it with an ordinary CPU is hopeless. Doing it with a GPU barely pays for the power consumption. Doing it with FPGA hardware still sort of works, but not for much longer. Doing it with ASICs requires dealing with slimeballs who insist you pre-pay for hardware and deliver months later, if at all.
Remember, more than half the Bitcoins that can exist have already been mined, and it gets steadily harder.
Stealing other people's GPU cycles [tomshardware.com] has a track record of success. But it's
Already Happening (Score:1)
The ZeroAccess botnet is known to be mining BTC. I've seen estimates of 1-3 million USD worth mined each year. Mind you, difficulty has gone up a lot since I saw that.
http://en.wikipedia.org/wiki/ZeroAccess_botnet [wikipedia.org]
Didn't we learn this is a stupid idea? (Score:2)
This idea is not exactly a new one.
Just recently there was that thing:
http://www.cbc.ca/news/technology/story/2013/05/02/technology-esea-bitcoin-mining.html [www.cbc.ca]
The efficiency is so bad, coupled with expected user backlash, it is a dangerous joke at best.
What about botnets? (Score:3)
Why not just purchase a botnet? It's cheaper and easier than getting millions of people to visit a website. And you don't have to limit yourself to JS.
Re: (Score:2)
because then you wouldn't have an article about an idea everyone had years ago.
Re: (Score:2)
Why not just purchase a botnet? It's cheaper and easier than getting millions of people to visit a website. And you don't have to limit yourself to JS.
Presumably buying a botnet is more expensive than the gain from the mining you would realize with it.
Chess, anyone? (Score:3)
Came here for the "chess world record" mentioned in TFT and didn't find a single word about it, neither in TFS nor in TFCs... Did anyone realize how this article is actually about a bunch of guys parallelizing the eight queens puzzle [wikipedia.org], running it first on anything from browsers to Blackberrys, then porting it to Hadoop, and on the way to break the world record computing the number of solutions for a chess board of 27x27 tiles?
TFA mentions the word "bitcoin" in the last 2 paragraphs out of 23, and everybody goes crazy about it. Welcome to Slashdot 2013.
Use it For Good (Score:1)
No it most definitely could not, this is BS (Score:2)
Re: (Score:2)
Um. I have no idea of the actual math behind running bitcoin miners on different computers, but if you could mine a couple dollars on your computer if you ran it for a year, then if you ran 100,000 computers you'd get a couple hundred thousand dollars a year. If a couple hundred thousand dollars a year is a "tiny, tiny amount of money" to you... could you send me a tiny, tiny amount of money?
Re: (Score:2, Insightful)
I pick government.
Re: (Score:2)
Re: Crooks definition (Score:2)
Re: (Score:1, Offtopic)
John Corzine stole a billion dollars and walked away without a trial.
The government of Cyprus stole money from people's bank accounts.
HSBC openly laundered money for Mexican drug cartels, and admitted to it. But no charges were pressed, as HSBC is too big to fail.
You could keep giving examples like the ones above for hours on end.
"Crime" is a very selective word these days indeed...
Re: (Score:2)