Slashdot Mirror
Hackers Spawn Web Supercomputer On Way To Chess World Record
New submitter DeathGrippe sends in an article from Wired about a new take on distributed computing efforts like SETI@Home. From Wired:
"By inserting a bit of JavaScript into a webpage, Pethiyagoda says, a site owner could distribute a problem amongst all the site's visitors. Visitors' computers or phones would be running calculations in the background while they read a page. With enough visitors, he says, a site could farm out enough small calculations to solve some difficult problems. ... With this year's run on the value of Bitcoins — the popular digital currency — security expert Mikko Hyppönen thinks that criminals might soon start experimenting with this type of distributed computing too. He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else."
Better than looking at ads.
Lets just load a monolithic OS kernel written in javascript into visitor's RAM with the full OSI stack. Distribute your website to these small OSs and have them serve everyone else in the local network....
At last! A practical form of "micro"-payments
... only need to get ten trillion users for three days to get 0.001 BTC.
I can already hear the hoards of criminals running to do this.
My understanding was this wouldn't work well for BitCoin, because the raw computing power people are throwing at it with GPUs and ASICs easily dwarfs even significant numbers of zombies, and even WebGL can't help you (too limited an instruction set).
Of course by this point the matter is hearsay... but still, Bitcoin is a tough nut to crack these days.
The World Wide Web is dying. Soon, we shall have only the Internet.
I'm... kind of okay with this? Modern operating systems are hella-good at maintaining usability under high CPU loads, and the extra electricity consumed by the increased load wouldn't make much of a difference to me. If this is how they want to monetize web content, I'll take it over click-to-mute popunders any day. The "crooks" thing seems like it's just thrown in to increase the shock factor. Why wouldn't the site owners do this?
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
The Australian Government just passed a law allowing them to claim your money in your bank account as their own if you haven't used it in a while.
I pick government.
A practical form of "micro"-payments
For all you may claim that the sign on the back of your front door states that I consented to be raped by you when invited to into your home, you still don't have the right to do it and are a criminal if you do.
Seven puppies were harmed during the making of this post.
As an alternative revenue stream to ads, this might make sense for some websites. Many of the flashier (so to speak) ads waste many resources as well, but to no productive end other than getting your attention.
I was thinking the same thing. I don't know that this is actually illegal or even unethical. We implicitly agree to watch ads etc when we visit a website. This could be a source of revenue far greater than advertising.
Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system. It doesn't really matter if it's displaying animated kittens are calculating bitcoin blocks. Indeed, we should all hail this as a great thing if it means criminals becoming less criminal...
I think you've missed the idea. From TFA:
He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else
The criminal activity isn't mining bitcoins on someone else's machine, it's putting your code on someone else's website without their consent. It's not a new type of criminal activity, just a new incentive to do it.
You'll need each visitor to stay on your page long enough for them to complete a significant amount of computation and upload the results.
If the amount they compute is less than what is required to for the fork and join process in the problem, then its easier to not fork and join and do the computation locally.
Every visitor that doesn't stay long enough wastes resources doing work that is thrown away. They'll also waste your own resources by asking for the input data and never giving you a result. That means its either going to take longer for that piece of input to be computed, because you could have given it to someone who stayed, but you don't know how long it will take to computer because you don't know the load of capacity of the node that is doing the work, so you'll need to wait a relatively long time before giving it to another node - or give the same data to several nodes at once - wasting resources again.
TFA tells us that people can do this or do that to the visitors' computers (or smartphones) but there's no hint on how to block all these ...
Anyone can share a little insight on what kind of precaution that we can do in order to block out all those things from entering our own device in the first place --- other than not visiting those websites, I mean ...
Muchas Gracias, Señor Edward Snowden !
Microsoft has refused to implement WebGL in any released version of IE for security reasons. Apple implemented it in Safari but disabled it by default on the Mac and restricted it to use only by iAds on iOS.
I've often wondered if including a programming language in a browser is a good idea.
On the functionality side, I don't really think it adds much required functionality. The only useful functionality seems to be in validating web form data (Don't let the user submit without required fields, make sure no spaces are in the CC number, &c). The vast majority of these could be handled by changes in the HTML specification with fields specific to type, flags, and so on. Video and other media players should be built-in to the browser and be based on standardized formats.
There's a number of useless features that everyone clamors for, such as showing text in a box that changes when you click in it (such as "search" boxes), worthless animation, and clever actions that don't appreciably add to readability or access.
On the negative side, there's the innumerable ways in which the user can be taken advantage of - popups and pop-under, spreading malware, insufficient sandboxing, privacy leakage, tracking, and so on.
By turning the browser into a general-purpose computer, the industry has created yet another attack vector. All for something which is for the most part a static, read-only experience.
Microsoft added ActiveX to their E-mail reader, and it was a disaster. I put Javascript on websites in the same category.
But it's not rape if there is consent, given by passing through the door...
That's EULA logic, right?
Yeah, try it on a judge. Let me know how it went.
Seven puppies were harmed during the making of this post.
it's that or those damn flash ads using up all my computer resources anyway.
May just as well at least get rid of the ads =P
But tens or hundreds of thousands of phone miners would. Finally, a step #2 for the classic 1. Hack big company's website 2. ??? 3. Profit! And considering how bloated most big companies' websites are, nobody would even notice.
I remember sigs. Oh, a simpler time!
"Kittens vs. Zombies 3 requires WebGL to function. Please enable or switch to a different browser to continue."
For one thing, iPad and Surface users can't just "enable or switch to a different browser" without dropping hundreds of dollars on hardware that runs a less-closed operating system. For another, users would react to something that doesn't work in their preferred browser by thinking "I don't think these guys are very bright" and clicking away, if iamhassi's comment is any indication.
I mean it's in the title, got me all interested. Then I read the summary and it's all about a stupid approach to bitcoin mining. So what was this "Chess Record" they were talking about? You expect me to RTFA for that?
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
I like this idea, except it would probably have to use something where mining takes "less work", otherwise, as AC pointed out below, you'd have to have millions of users just to get epsilon money.
But if you make mining easier, then everyone else pulls out their old mining rigs and exhausts the supply of coins that much quicker. Unless you build a large amount of inflation into the system, or put an expiry on the coins.
It would be nice if distributed problems had a standard value. (E.g. The solution to this protein folding problem is worth $1, incidentally giving the currency an intrinsic value). Then some one like Google could distribute the problems ("DistWords"), and website operators would collect the revenue of solved problems.
Plan My Week for iPhone
Not unless a radical new battery technology becomes ubiquitous first.
People would notice when their devices are bled dry in the time it takes to find what they want on the site.
There a startup named CrowdProcess doing something similar. Their business plan is to pay websites to include their javascript, and sell the computation time to developers. This way, the websites can cover hosting costs without resorting to ads.
I posted just this idea on one of the bitcoin stories recently.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
Mining Bitcoins is over. Doing it with an ordinary CPU is hopeless. Doing it with a GPU barely pays for the power consumption. Doing it with FPGA hardware still sort of works, but not for much longer. Doing it with ASICs requires dealing with slimeballs who insist you pre-pay for hardware and deliver months later, if at all.
Remember, more than half the Bitcoins that can exist have already been mined, and it gets steadily harder.
Stealing other people's GPU cycles has a track record of success. But it's hard to do that from JavaScript.
Not really profit. Considering you'd need MILLIONS of javascript miners to equal a single ASIC miner.
TODO: Something witty here...
Whenever you visit any web page with Javascript enabled, you are inherently agreeing to execute some code on your system.
Just because you tricked the user into running your code doesn't mean it's OK to do whatever you want with their system. Users would never agree to run such code if they knew what it did ahead of time. If your software relies on lazy users who don't understand what they're agreeing to, then congratulations, you're a malware author.
We never do that...
This sig left unintentionally blank.
The ZeroAccess botnet is known to be mining BTC. I've seen estimates of 1-3 million USD worth mined each year. Mind you, difficulty has gone up a lot since I saw that.
http://en.wikipedia.org/wiki/ZeroAccess_botnet
It gripped her hand gently. 'Regret is for humans,' it said.
That is pretty bad, because you're going to have a hard time 'proving' all your money and belongings are yours rightfully. However, I'd say this Australian one is a little bit worse because it is a proactive law. This Swedish law you refer to sounds like it 'could' be used against you should the government decide to. However, the new Australian law is proactive, they are actually taking your 'unused' money right now, no questions asked.
It shouldn't be that hard proving the house and car are yours.
A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
I agree. Real geeks should know that bitcoins aren't worth doing CPU mining. Litecoin is the place for that until all the GPU bitcoin miners move over to LTC.
This idea is not exactly a new one.
Just recently there was that thing:
http://www.cbc.ca/news/technology/story/2013/05/02/technology-esea-bitcoin-mining.html
The efficiency is so bad, coupled with expected user backlash, it is a dangerous joke at best.
Why not just purchase a botnet? It's cheaper and easier than getting millions of people to visit a website. And you don't have to limit yourself to JS.
The Information Revolution will be fought on the command line.
Came here for the "chess world record" mentioned in TFT and didn't find a single word about it, neither in TFS nor in TFCs... Did anyone realize how this article is actually about a bunch of guys parallelizing the eight queens puzzle, running it first on anything from browsers to Blackberrys, then porting it to Hadoop, and on the way to break the world record computing the number of solutions for a chess board of 27x27 tiles?
TFA mentions the word "bitcoin" in the last 2 paragraphs out of 23, and everybody goes crazy about it. Welcome to Slashdot 2013.
Yeah, I pulled that number out of my ass, but it's probably not far from the truth. A web giant like Google implementing this on all their sites would probably make an MW worth of profit ($50 an hour?) and waste a GW of electricity worldwide.
Now, if something like this could be used for... real... projects, like Rosetta@Home or other good BOINC projects, they could potentially do some real good.
It is EULA logic.
EULA's mean shit all, at least here in the UK.
Here, a contract is deemed illegal if it's unfair. It's extremely difficult to prove the fairness of a contract that is written and "signed" prior to money changing hands.
Even if the only terms in the contract were "1. we hope you enjoy our product and expect that you tell your friends about it if you do enjoy it" there's absolutely jack the company can do to me if I do enjoy the product but remain silent.
Explain that to me at time of purchase and I'd be considered liable.
For the last fucking time (hopefully) CPUs and even ideal advanced GPUs like the king of them all, the Radeon 5830 STILL CANNOT MATCH THE NEW ASICs. Normal computers (and TVs and phones) cannot effectively mine bitcoins anymore. You could mine on my i5-2400 24/7 for an entire year straight and come up a couple dollars. Unless anyone has an ASIC miner, they could control 100,000 computers and run them at a nice and undetectable 25% indefinitely and make a tiny, tiny amount of money.
WebGL might allow you to access the raw frames being displayed by the video card.
In other words: it's Microsoft's desire to suck the dick of the RIAA that's behind it.
I'd be inclined to give Microsoft the benefit of the doubt that someone might be displaying a confidential document on half of a 1920x1080 monitor and a web page on the other half, and the user doesn't want the web page to be able to "steal" the user's employer's trade secrets.