18 ms·
Show HN: No Coin – A browser extension to block coin miners
- detaro 9y agoWhy is this an extension and not a filter list for existing adblockers?
- keraf 9y agoBecause it is different than ads. On a site, you might want to leave ads blocked for privacy reasons but just enable the miner to pass the coin-hive Captcha for example.
- richdougherty 9y agoIn uBlock you can just click the big off button and then click it on again. I see that No Coin has a 'disable for 1 minute' button, which is slightly different, but probably not worth a separate extension for most people. https://github.com/gorhill/uBlock/wiki/How-to-whitelist-a-web-site https://github.com/gorhill/uBlock/wiki/How-to-whitelist-a-we...
- rodorgas 9y agoOTOH I'm ok with ads, but not ok with miners. So wouldn't make sense have an ad blocker that doesn't block ads. People seems allergic to browser extensions this days. I also get the "why is this an extension and not a filter?" on a non ad-related extension.
- detaro 9y agoMore browser extensions means more potential for conflicts, slowdowns and more UI clutter (assuming they have an interactive function like this one). Browser extensions getting hacked or bought and turned into malware is a concern. My adblocker is available for all browsers I use (and not just Chrome) and I know it's UI already - disabling a single block temporarily is done in 2 clicks. That's why I'm skeptical of new browser extensions for things that the ones I have can already cover. Doesn't mean everybody else has to feel like that (e.g. I honestly hadn't considered someone might want to install this but not a generic configurable blocker - even if you aren't aggressively blocking ads uBlock would be useful for me)
- Sir_Cmpwn 9y agoYou can turn off the filters in your adblocker and just enable a few select filters, like this one. This would be silly of you, since ads are a popular vector for spyware and malware, but hey, you can do it. Extensions are also vectors for adware and malware so it's better to trust established extensions, and questioning an extension whose behvior could be trivially accomplished without is a reasonable concern to raise.
- AndrewCHM 9y agoThere is no ad blockers There are blockers which can use lists, some of those lists might contain ad domains, some of those lists might contain miner domains.
- rodorgas 9y agoWell, they're not marketed like this.
- contravariant 9y agoThings is, all the funcionality to block certain content has already been created and tested (at length) in uBlock Origin. Using a different addon for exactly the same purpose but for different content is the worst kind of separation of concerns.
- rodorgas 9y agoBrowser APIs to block content are fairly simple. There's no reason to use a huge piece of software if you just want to block some urls. Ad blockers have their own issues, including trust about maintainers intentions.
- Philomath 9y agoIt's funny because just yesterday I was at a hackathon and made AddCoinPlus [1], a browser extension that uses a very tiny bit of your CPU to mine for non-profits of your choice. People really loved it because it is your choice to do so or not, it's not a website making your CPU work for their own profit. [1]: http://addcoinplus.com/ http://addcoinplus.com/
- granitosaurus 9y agoI feel that extension as a medium is a werid choice here. Shouldn't it be some individual app? When computer is an relative idle state (e.g. playing a movie) it could fire up some mining. Why would anyone want already slow javascript web to load even slower?
- ComputerGuru 9y agoFor context: The Pirate Bay is now launching a javascript-based Monero miner in all visitors' browsers to mine coins for them in the background (possibly as an alternative to ads).
- eyezick 9y agoCPU mining is so unprofitable, but I suppose with thousands of users..
- ComputerGuru 9y agoAccording to the reddit thread on the matter, even at TPB's scale they were looking at only < $500 a month. I wonder why CoinHive isn't using WebGL for this.
- benologist 9y agoThat $500 was probably what they made within the hours they tested the code, as they do millions of pageviews an hour. Reddit still thinks they're lucky to cover a handful of servers LOL.
- tentaTherapist 9y agoBut if most users have integrated graphics, and even with dedicated graphics cards the improvement is nowhere near an order of magnitude, would it be much better?
- akx 9y agoQuoting CoinHive's site: > [...] There are solutions to run the Cryptonight algorithm on a GPU instead, but the benefit is about 2x, not 10000x like for other algorithms used by Bitcoin or Ethereum. This makes Cryptonight a nice target for JavaScript and the Browser. [...] Our miner uses WebAssembly and runs with about 65% of the performance of a native Miner. [...]
- Yoric 9y agoCan you actually use WebGL for this? I mean, don't you need a user-visible graphics context? That's a serious question, I have used WebGL only once in my life and that was years ago. On the other hand, WebGPU looks exactly like the kind of technology that would make web-based GPU-enabled bitcoin mining realistic.
- tombrossman 9y agoTitle could be improved - this is for Google Chrome only. Anyone using an ad blocker can simply add... https://coin-hive.com/lib/coinhive.min.js ...to their custom block-list instead, no need for an extension.
- atroll 9y agowhat if its named something else?
- have_faith 9y agoWhat if they self host the code?
- PUSH_AX 9y agoYou need an extension, pretty much anyone doing this won't use a CDN for this very reason.
- keraf 9y agoIt is not exactly Google Chrome only, you can run it in any Chromium based browser such as Opera, Yandex, Vivaldi, etc... And I do also have plans to port the extension to FireFox (I haven't read their docs yet but I guess it shouldn't be too hard). Regarding the custom list for an adblocker, as said in other comments, the idea was to keep it separate from adblocking. Coin mining in the browser is a different issue. Where ads are tracking you and visually interfering with your browsing experience, coin mining, if abused, is eating your computer ressources resulting in slow downs (from high CPU usage) and excessive power consumption. You might be OK with that and not with ads, or vice versa. Or you might just want to keep ads blocked entirely and just enable the coin mining script for a minute to pass a Captcha. That's why I believe having a separate extension is useful.
- abdullahdiaa 9y agoHere's the addon with the same code on firefox: https://addons.mozilla.org/en-US/firefox/addon/no-coin/ https://addons.mozilla.org/en-US/firefox/addon/no-coin/ Can you please share your email to make you the owner of it?
- erikb 9y agoImo: instead of a separate extention this should be a maintained blacklist for ad blockers.
- keraf 9y agoFrom another comment: "The idea was to keep it separate from adblocking. Coin mining in the browser is a different issue. Where ads are tracking you and visually interfering with your browsing experience, coin mining, if abused, is eating your computer ressources resulting in slow downs (from high CPU usage) and excessive power consumption. You might be OK with that and not with ads, or vice versa. Or you might just want to keep ads blocked entirely and just enable the coin mining script for a minute to pass a Captcha. That's why I believe having a separate extension is useful."
- erikb 9y agoI understand, but still I don't want to maintain a thousand separate tools that basically do the same thing: block websites.
- amriksohata 9y agoCan anyone explain to me like I'm a five year old why would anyone need to block coin miners on their browser and why they would be mining there in the first place?
- bdibs 9y agoPeople are experimenting with replacing ads for coin mining scripts. Coin mining uses a lot of resources, which costs you electricity and responsiveness (I’d guess).
- Keeeeeeeks 9y agoAccording to ComputerGuru's post below, TPB is switching from ads to coin mining in the background. Without disclosure/client choice it could slow down someone's computer and and be portrayed as malicious ("If they can mine potentially valuable coins while I'm on the site, what else could they be doing while serving my browser content?")
- aembleton 9y agoMining consumes power. If you're on a mobile device, that power is limited and will result in you having a flat battery sooner than you otherwise would. They are used because the coins that are mined can be sold and the money used to pay for hosting and food.
- quickthrower2 9y agoI do Eli 5s every day: Mining makes the battery die quicker. They are mining to make money so they can buy food. A silly man pays the bad man money for the tiny baby numbers they find in your phone when they mine it. You can still watch Frozen. The battery isn't dead yet.
- johnhenry 9y agoSome sites are starting to add bitcoin miners to their pages to raise funds instead of, or in addition to advertising. https://torrentfreak.com/the-pirate-bay-website-runs-a-cryptocurrency-miner-170916/ https://torrentfreak.com/the-pirate-bay-website-runs-a-crypt...
- Animats 9y agoThe extension is simply blocking a list of blacklisted domains in blacklist.txt. Some way to detect that a non-visible page or service worker is using excessive CPU time or GPU assets would be useful. How long until porn sites start doing mining in the background?
- Zelmor 9y agoThat's actually a great idea.
- maxencecornet 9y ago>How long until porn sites start doing mining in the background? How long have porn sites being doing mining in the background ? Remember that porn sites are always the front line of innovation on the web, some are probably already doing it
- komaromy 9y ago> Remember that porn sites are always the front line of innovation on the web Often stated, rarely with any actual support.
- keraf 9y agoBlacklisting was the shortest way to a working solution. I'm looking into other ways of blocking coin mining in browsers. If you have any ideas, feel free to submit an issue or a PR on Github.
- adtac 9y agoThis made me think: I wonder if there are WebAssembly based miners?
- shadowfacts 9y agoCoin Hive already uses WebAssembly: https://coin-hive.com/#hash-rate https://coin-hive.com/#hash-rate (3rd paragraph under 'My Hash Rate Seems Low').
- einrealist 9y agoIs there a way to exploit the miner scripts? I mean in a way: Never trust the client? If the proof is calculated on the client, how does the server confirm that the proof is correct?
- slig 9y agoGenerally, checking the solution is trivial. Hashing billions of hashings to find what you want is want takes resources.
- einrealist 9y agoSo when I intercept the script and send a bad proof back, it would not do any harm? So no https://xkcd.com/327/ https://xkcd.com/327/ for the bad miners? I guess, we need browser extensions that just send the correct proof to my own wallet then?
- slig 9y agoThe bad proof can be trivially checked and discarded. If you want the results of the mining it makes more sense to run yourself with a native miner than run on the browser. This coinhive thing only makes sense [to run on a browser] because they're exploiting the resources (hardware and electricity) from the visitors.
- Roshie5u 9y agoIt is true for checking final solution, but what in case of partial results? I am not sure about monero but with BTC I could claim I checked range assigned to me and found no solutions. I guess mining pools have solved it in some way. edit: I see that Coinhive pays only for solved hashes, so there is no way to "harm" them, and for website owner it makes no difference if hashes are not computed at all or invalid results are submitted.
- cbarrick 9y ago> how does the server confirm that the proof is correct? The point of proof-of-work algorithms is to be hard to compute but easy to verify. As a simplified example, a proof-of-work might be to take some input and find a corresponding salt that leads to a sha256 with 10 leading zeros. The user works hard to find that salt (the proof-of-work) using some brute force search, but the server easily verifies that the proof is correct because checking a sha256 is easy. So the proof is verifiable by the definition of the algorithm.
- pishpash 9y agoUse of excessive resources should be a privileged action, isn't something like coinhive a malicious vector?
- superkuh 9y agoNo more than the existing trend of 'web app' entirely Javascript rendered websites. My solution to both is very simple: I run JS only from white-listed domains. Sure this breaks many sites but, well, fuck those sites.
- AlexAffe 9y agoSomeone mentioned a CoinHive Captcha. This is usually when my NoScript approach breaks. There would be no way around enabling the captcha script, therefore enabling the miner. Normally I then... fuck those sites, but what if that's reaaaally becoming a thing and say StackOverflow does it? You would need some way of adjusting allocated browser resources real fast and precise. Only way I can think of right now...
- granitosaurus 9y ago> Sure this breaks many sites but, well, fuck those sites I wish general population would subscribe to a similar paradigm. Web-space is probably one of few mediums where vote-with-your-wallet philosophy can have a substantial effect.
- wyc 9y agoFor those wondering how it works, it seems to be a blacklist. Here's the crux of it: chrome.webRequest.onBeforeRequest.addListener(details => { // ... // Is domain white listed if (isDomainWhitelisted(domains[details.tabId])) { return { cancel: false }; } return { cancel: true }; }, { urls: blacklistedUrls }, ['blocking']); It's kind of sad how much boilerplate is required to write a simple extension. I wonder if there's a framework for saving labor while building cross-compatible browser extensions. Then again, maybe the world doesn't need yet another JavaScript framework.
- fiatjaf 9y agoThat's what was attempted with Greasemonkey and Tampermonkey, wasn't it? Userscripts and so on.
- wyc 9y agoI loved using those tools, but I think many browser extensions today are more involved than small shim scripts. A lot of them have CRUD operations, data editing interfaces, css/image assets, etc. I was thinking about something a bit more composed like create-react-app.
- jacalata 9y agoI wrote a grease monkey script that allowed you to annotate a website and save the notes permanently to local storage. It had all of the above features. The only real limitation is the sandboxing.
- PrimHelios 9y agoDo you have a link to the script? Sounds like something I'd use.
- jacalata 9y agoI don't think I have a copy since userscripts died, but on cursory inspection this Reddit script looks like it does similar things - http://userscripts-mirror.org/scripts/review/170091 http://userscripts-mirror.org/scripts/review/170091
- fiatjaf 9y agoAsking people to mine for you on your website is just like asking customers to wash the dishes at your restaurant. Even if you have a ton of them it is still annoying and doesn't pay.
- thinkloop 9y agoI really like the idea of a proof-of-work captcha, but can it work? The hash requirement needs to be low enough for mobile devices, but scraping and automation are usually done on powerful servers. Is there an equilibrium where it's comfortable for end users, but a real deterrent for servers?
- codexon 9y agoNo there isn't, that's why it won't work.
- thinbeige 9y agoToday I read that The Pirate Bay tested this new form of monetization (running a miner in you browser). I thought that might solve website monetization finally. We still have to figure out stuff like battery draining on mobile but it is the first step and I can buy some Monero which is well suited for JS/CPU mining (or in other words, it doesn't have a huge upside when mined on GPUs). And what do I see here? That before it even started people are fighting it. Found this solution better than ads and infinetely loading ad-tech JS files.
- banku_brougham 9y agobetter than ads and trackers, i agree. but shortly we'll be getting all three.
- sametmax 9y agoAnd this is why we can't have nice things.
- narrowtux 9y agoI don't know. If you run those on a laptop you pretty much kill battery life, same thing with phones.
- r3bl 9y agoIf HTML5's battery API ever became a thing, this issue could be solved without any user interaction.
- wrinkl3 9y agoCan you elaborate how?
- sergiotapia 9y ago"is this user on a mobile device or laptop? Don't mine."
- oh_sigh 9y agoIt would be nice if there was some way to integrate charging status into this. I would be fine donating a few seconds of CPU/GPU time for an ad-free experience, but I would only want to do it if whatever device I was on was running off of wall power and not it's battery.
- paultopia 9y agoWait, people are actually doing this? Using client-side resources not to deliver content or applications to clients, or even to visibly deliver things like advertisements, but to divert user CPU cycles for their own purposes? I want to know more about this. Are they seeking any kind of consent from the users, or even disclosing it to the users? If not, I have serious doubts about the legality of this behavior.
- icebraining 9y agoWhat law do you think would prohibit this?
- paultopia 9y agoAs I said, I have doubts. I'm not saying "definitely illegal," just dubious as all hell. In terms of specifics, maybe not anything criminal (though a prosecutor could try the CFAA), but on the civil side tort law trespass theories, maybe also unjust enrichment theories, would be well worth a try for a plaintiff's lawyer. But really, I'm thinking in terms of more abstract legal ideas that could use some caselaw development to flesh out---the notion that there's an implied license to use resources on a user's computer to an ordinary extent and for an ordinary purpose---and grabbing onto those resources for this kind of extraordinary purposes without prior notice violates that license in just the same kind of way that (eg) triggering a more conventional malware download would. If you buy that theory (and I tentatively do), then there are lots of concrete legal doctrines to hook it to.
- hobofan 9y agoOne point of reference: World of Warcraft and other games (apparently Windows 10 too) have used P2P (torrent-like) patch systems in the past, where after you downloaded a content update, you also distribute it to other users. AFAIK this was opt-out rather than opt-in. I think that falls under the same category of using the users' computer for an extraordinary purpose.
- 9y ago
- oliwarner 9y agoCurrent generation browsers are blocking [bad] adverts and plugins. How long before we see hard CPU time limits on scripts? I can't imagine it's hard to implement but what a waste of developer time. This is why we can't have nice things.
- SCHiM 9y agoLeaving the problem with battery life behind for a moment, this really has the makings of a perfect solution to the monetization problem imo. It's decentralized, democratic, etc. Also when taking the problem with battery life into consideration, if the website notifies you that it does this you're free to find another website.
- smegel 9y agoThe only reason anyone would do this is if you actually wanted to take down torrent sites.
- readams 9y agoThis would make a lot more sense as a blocklist for ublock than as its own extension. Actually I wouldn't be that surprised to learn it's already blocked.
- knodi 9y agoThe only reason i don't like browser based mining for websites is due to it all being contingent on volume of visitors and not the actual content of the site.
- cpeterso 9y agoHow long until a major consumer site like Facebook or Twitter starts mining on users' timelines? How much could they generate?
- rdiddly 9y agoTried the Chrome extension, but it just toggles between "Enable No Coin" and "Unpause No Coin." I didn't disable it, but I have to enable it? Repeatedly? And I didn't pause it, so why would I be unpausing it? Where do I look if I merely want to find out whether it is currently 1) enabled and/or 2) paused? And how do I toggle either or both of those? Does it need to be this complicated?
- keraf 9y agoThis is a bug that is happening when the background script doesn't run. It only happened to me in an outdated version of Opera. Updating my browser fixed it. It is a very early version of the extension, improvements are on their way.
- rdiddly 9y agoI've got the browser sandboxed... and adblocked... and ScriptSafe'd and sometimes HTML5-blocked... so maybe that has something to do with it too! Will test it again with all that stuff turned off.
- colanderman 9y agoThough I'm opposed to the idea of web sites leeching mining time from me, honestly it would probably use less CPU than so many websites that deluge me with video ads…
- PhasmaFelis 9y agoMaybe, but I already block those.
- thsowers 9y agoWorth noting that I found jsFiddle running coinscript this morning
- gras 9y agoI think it's interesting to see a group of people get their panties in a twist over background mining while they vehemently support ads, ostensibly because it uses less energy. I personally don't care about the energy usage as long as the page still runs smoothly (and if I want to block the mining I think that's my/my browser's responsibility, serves me right for having JS on by default) but I object to the manipulation that advertisements constitute, and the power advertisers get to strong-arm media platforms to censor, case in point: YouTube. I assume these "protesters" have a vested interest in the advertisement model, either because it's their business model, or because they are aligned with groups that benefit from the control over users and platforms that the ad model provides. Why else are they shilling for ads?
- gargravarr 9y agoAnd thus the arms race begins.
- helb 9y agoIssue at uBlock's GitHub – "[Request for block] Crypto Miners": https://github.com/uBlockOrigin/uAssets/issues/690 https://github.com/uBlockOrigin/uAssets/issues/690
- drumttocs8 9y agoTrading content for processing power seems like a logical and satisfactory solution to an age-old problem- people wanting free stuff, businesses wanting to stay in business. I think it's a beautiful example of new economic models enabled by tech. Are people's main concerns battery life/power usage?
- stordoff 9y agoMy concern is that I can't leave a tab open long-term without risking a performance hit. Of course that's also true now (with ads or heavy JS), but those generally aren't deliberately trying to induce high(er) CPU loads.
- drumttocs8 9y agoIt makes sense. Maybe a cryptocurrency could be used to symbolize that transaction, and limit the amount of allowed processing power.