Hackers Spawn Web Supercomputer On Way To Chess World Record

New submitter DeathGrippe sends in an article from Wired about a new take on distributed computing efforts like SETI@Home. From Wired: "By inserting a bit of JavaScript into a webpage, Pethiyagoda says, a site owner could distribute a problem amongst all the site's visitors. Visitors' computers or phones would be running calculations in the background while they read a page. With enough visitors, he says, a site could farm out enough small calculations to solve some difficult problems. ... With this year's run on the value of Bitcoins — the popular digital currency — security expert Mikko Hyppönen thinks that criminals might soon start experimenting with this type of distributed computing too. He believes that crooks could infect websites with JavaScript code that would turn visitors into unsuspecting Bitcoin miners. As long as you're visiting the website, you're mining coins for someone else."

Comments

Cheap

[Anonymous Coward]

Better than looking at ads.

Re:Cheap

[Mathness]

It actually could be a fair exchange of resources instead of ads, I use some of yours when visiting your site and "consuming" your work and I give some back by doing some "work" for you. If what I provide is a reasonable use of my resources, I would have no problem with it as long as it is legal.

Why stop there...

[socceroos]

Lets just load a monolithic OS kernel written in javascript into visitor's RAM with the full OSI stack. Distribute your website to these small OSs and have them serve everyone else in the local network....

Bitcoin mining in Javascript.

[Anonymous Coward]

... only need to get ten trillion users for three days to get 0.001 BTC.

I can already hear the hoards of criminals running to do this.

My understanding was this wouldn't work well

[FooAtWFU]

My understanding was this wouldn't work well for BitCoin, because the raw computing power people are throwing at it with GPUs and ASICs easily dwarfs even significant numbers of zombies, and even WebGL can't help you (too limited an instruction set).

Of course by this point the matter is hearsay... but still, Bitcoin is a tough nut to crack these days.

Re:That's not actually criminal

[Kaenneth]

But it's not rape if there is consent, given by passing through the door...

That's EULA logic, right?

Re:How to block ?

[Cenan]

The problem with noscript is that once you allow a domain, it's allowed regardless of which site you allowed it on. This is a huge problem, since I might trust domain x to use jQuery's CDN, but not site y. If I allow jQuery CDN it's allowed for both. Try blocking google-analytics for instance, and see how many sites break - for no other reason than that they want analytics to run, and their scripts check for this (or depend on it in some retarded way, I'm not sure). That means in order to use a handful of sites that have retarded dependencies, I have to allow this idiocy for every site i visit.

The other problem with the granularity is that most professional sites pull in javascript from multiple domains, so it turns into a treasure hunt trying to find the handful of domains you need to unblock before the site works. And it's even more fun when the site has hidden dependencies, that only pop up after you allow a domain on the list - making the already long list expand dynamically. And of course there's no way to see the script you're allowing unless you want to sift through the entire source of the page.

This is why noscript remains a nerd tool, the menu has a function that allows all scripts on a given site, a ripe choice of you already have the "click through" mentality. What a user sees is "lots of choices, this one makes the problem go away" and once that is learned the whole point of noscript goes the way of Windows UAC - yes, yes, yes, oh shut up.

TL;DR: noscript is good advice, although it requires far more user maintenance than resonable.