3 ms·

Wait, people are actually doing this? Using client-side resources not to deliver content or applications to clients, or even to visibly deliver things like adv

Wait, people are actually doing this? Using client-side resources not to deliver content or applications to clients, or even to visibly deliver things like advertisements, but to divert user CPU cycles for their own purposes? I want to know more about this. Are they seeking any kind of consent from the users, or even disclosing it to the users? If not, I have serious doubts about the legality of this behavior.

icebraining 9y ago
What law do you think would prohibit this?
- paultopia 9y ago
  As I said, I have doubts. I'm not saying "definitely illegal," just dubious as all hell. In terms of specifics, maybe not anything criminal (though a prosecutor could try the CFAA), but on the civil side tort law trespass theories, maybe also unjust enrichment theories, would be well worth a try for a plaintiff's lawyer. But really, I'm thinking in terms of more abstract legal ideas that could use some caselaw development to flesh out---the notion that there's an implied license to use resources on a user's computer to an ordinary extent and for an ordinary purpose---and grabbing onto those resources for this kind of extraordinary purposes without prior notice violates that license in just the same kind of way that (eg) triggering a more conventional malware download would. If you buy that theory (and I tentatively do), then there are lots of concrete legal doctrines to hook it to.
  - hobofan 9y ago
    One point of reference: World of Warcraft and other games (apparently Windows 10 too) have used P2P (torrent-like) patch systems in the past, where after you downloaded a content update, you also distribute it to other users. AFAIK this was opt-out rather than opt-in. I think that falls under the same category of using the users' computer for an extraordinary purpose.
    - icebraining 9y ago
      Skype and Spotify too.
wrinkl3 9y ago
The Pirate Bay just tested that yesterday, apparently. They bundled a Monero javascript miner with some of their pages. The funny thing is that while the legality of that is questionable enough for the more reputable websites not to go down that road, TPB is already shady enough to pull it off - and their users don't really have anyone to complain to. It's worth noting that this isn't exactly a new idea - some MIT students had a project a couple of years ago that was basically that, except they tried to turn it into a startup. The viability of it was questionable back then as well.
- quantumsequoia 9y ago
  I'm intrigued. Do you know what the startup was called?
  - frankacter 9y ago
    Not OP, but this is probably it: https://en.wikipedia.org/wiki/Tidbit https://en.wikipedia.org/wiki/Tidbit
schoen 9y ago
This was studied a few years ago as "parasitic computing": https://en.wikipedia.org/wiki/Parasitic_computing https://en.wikipedia.org/wiki/Parasitic_computing But it's a bit strange that the same broad concept can include subtle things where the indirect result of an activity is a computation that someone else wanted you to make, along with explicit cases where someone asks your device to run a full-fledged applet and it does so (to someone else's benefit).
6nf 9y ago
Pirate Bay trialed this but otherwise nobody is doing this at scale right now. The problem is that users will notice and the ROI is miniscule. Even if your users keep the miner running 24/7 you're nowhere near just regular old ads.
- drusepth 9y ago
  Not arguing with you, but I've seen a lot of people say this has very minimal ROI without giving any numbers. Do you happen to have any to share? Are you considering a higher relative investment based on an inconvenience to the user? I'd love to explore this idea in a more reasonable, less-sketchy, opt-in way, but I'm only just getting started with crypto and I'm not sure what factors go into estimating potential costs/returns yet.
  - detaro 9y ago
    I calculated 2-5 US cents per 24 hours on an average-ish PC (my laptop was more towards 2, someone else quoted hashrates that would result in 5). (In the thread for the original Show HN for the code behind this: https://news.ycombinator.com/item?id=15246145 https://news.ycombinator.com/item?id=15246145 )
andai 9y ago
In 2015 I had the idea to start a meme aggregator and use it as a distributed JS computer where visitors are the nodes. I just didn't know what to do with it. Until now!
ringaroundthetx 9y ago
hm yes this has been going on for years from anonymous services. remember the WannaCry exploit? another group was already using the same exploit to mine monero, it was more profitable than WannaCry's global clusterf* and fixing WannaCry merely exposed the other group's mining operation, and cut it off when the patches rolled out. the only thing new is known organizations trying to do it for revenues.

icebraining 9y ago

What law do you think would prohibit this?

paultopia 9y ago
As I said, I have doubts. I'm not saying "definitely illegal," just dubious as all hell. In terms of specifics, maybe not anything criminal (though a prosecutor could try the CFAA), but on the civil side tort law trespass theories, maybe also unjust enrichment theories, would be well worth a try for a plaintiff's lawyer. But really, I'm thinking in terms of more abstract legal ideas that could use some caselaw development to flesh out---the notion that there's an implied license to use resources on a user's computer to an ordinary extent and for an ordinary purpose---and grabbing onto those resources for this kind of extraordinary purposes without prior notice violates that license in just the same kind of way that (eg) triggering a more conventional malware download would. If you buy that theory (and I tentatively do), then there are lots of concrete legal doctrines to hook it to.
- hobofan 9y ago
  One point of reference: World of Warcraft and other games (apparently Windows 10 too) have used P2P (torrent-like) patch systems in the past, where after you downloaded a content update, you also distribute it to other users. AFAIK this was opt-out rather than opt-in. I think that falls under the same category of using the users' computer for an extraordinary purpose.
  - icebraining 9y ago
    Skype and Spotify too.

wrinkl3 9y ago

The Pirate Bay just tested that yesterday, apparently. They bundled a Monero javascript miner with some of their pages. The funny thing is that while the legality of that is questionable enough for the more reputable websites not to go down that road, TPB is already shady enough to pull it off - and their users don't really have anyone to complain to. It's worth noting that this isn't exactly a new idea - some MIT students had a project a couple of years ago that was basically that, except they tried to turn it into a startup. The viability of it was questionable back then as well.

quantumsequoia 9y ago
I'm intrigued. Do you know what the startup was called?
- frankacter 9y ago
  Not OP, but this is probably it: https://en.wikipedia.org/wiki/Tidbit https://en.wikipedia.org/wiki/Tidbit

schoen 9y ago

This was studied a few years ago as "parasitic computing": https://en.wikipedia.org/wiki/Parasitic_computing https://en.wikipedia.org/wiki/Parasitic_computing But it's a bit strange that the same broad concept can include subtle things where the indirect result of an activity is a computation that someone else wanted you to make, along with explicit cases where someone asks your device to run a full-fledged applet and it does so (to someone else's benefit).

6nf 9y ago

Pirate Bay trialed this but otherwise nobody is doing this at scale right now. The problem is that users will notice and the ROI is miniscule. Even if your users keep the miner running 24/7 you're nowhere near just regular old ads.

drusepth 9y ago
Not arguing with you, but I've seen a lot of people say this has very minimal ROI without giving any numbers. Do you happen to have any to share? Are you considering a higher relative investment based on an inconvenience to the user? I'd love to explore this idea in a more reasonable, less-sketchy, opt-in way, but I'm only just getting started with crypto and I'm not sure what factors go into estimating potential costs/returns yet.
- detaro 9y ago
  I calculated 2-5 US cents per 24 hours on an average-ish PC (my laptop was more towards 2, someone else quoted hashrates that would result in 5). (In the thread for the original Show HN for the code behind this: https://news.ycombinator.com/item?id=15246145 https://news.ycombinator.com/item?id=15246145 )

andai 9y ago

In 2015 I had the idea to start a meme aggregator and use it as a distributed JS computer where visitors are the nodes. I just didn't know what to do with it. Until now!

ringaroundthetx 9y ago

hm yes this has been going on for years from anonymous services. remember the WannaCry exploit? another group was already using the same exploit to mine monero, it was more profitable than WannaCry's global clusterf* and fixing WannaCry merely exposed the other group's mining operation, and cut it off when the patches rolled out. the only thing new is known organizations trying to do it for revenues.