10 ms·
Salon magazine mines crypto-cash with readers' PCs
- abusoufiyan 9y agoSo...doesn't this mean their website will start getting flagged as malware? Many security companies flag CoinHive as malware...
- DyslexicAtheist 9y agoyes it's likely that these domains end up on some list. E.g.: $ curl -s https://raw.githubusercontent.com/ZeroDot1/CoinBlockerLists/master/hosts|grep salon.com 0.0.0.0 worker.salon.com
- abusoufiyan 9y agoYikes, you'd think a media company would be smarter than to use a software that returns hundreds of articles about malware as the top results of a google search for its name.
- xaerise 9y agoMany media companies doesn't think longer than their nose. Only thinks about money but not the impact the decisions they make.
- NKCSS 9y agoWhy would they care? They make money off of the ads, if you use an ad blocker, you just run up their server costs. Don't think they care.
- abusoufiyan 9y agoBecause your site showing up in other news outlets under a title like "Salon Magazine running cryptojacking malware on users" is terrible publicity. I get that they are using the version which asks for consent, but why even take the risk of associating yourself with such a shady piece of software? If you make money of ads, you'd think you wouldn't want to do things that might scare away your users.
- NKCSS 9y agoThe software (script) itself is not malicious, it's the way it's used in a lot of cases. It's similar to how torrents are usually used for piracy, but has some legitimate uses.
- abusoufiyan 9y agoYes, I know that. But public perception doesn't really see it this way. It's more like torrent == bad && malware == bad
- deleted 9y ago[deleted]
- dmix 9y agoSalon is well known for some poor quality journalism/blogging. Not surprised to see that is reflected in their management/technology descions.
- abusoufiyan 9y agoI had never really read anything from this site before and just searched it in Google News. Wow, you weren't wrong. And I'm probably THE target audience for that site (unabashedly leftist). It's very trashy.
- cardigan 9y agoCoinHive provides two miners: one which runs without asking the user, and one which requires explicit consent from the user. The version requiring explicit consent is being used on the Salon website, and isn't currently being blocked by AdBlockers/malware detectors.
- abusoufiyan 9y agoIt is being blocked as some other commenters showed. I think the company needs to shut down shop and provide their explicit consent miner under a different name because as long as anyone looking up your company's name can only ever find articles about your company providing malware, you won't be very successful.
- sudhirj 9y agoIt did. The new consent based miner is on and served from authedmine.com
- abusoufiyan 9y agoI don't think you understood. The name "CoinHive" is essentially synonymous with cryptojacking. A name change and a refusal to pay out to anyone using the version which does not ask the user are probably good steps for them to take (but obviously they won't do either because $$$)
- grzm 9y agoLarge discussion on HN a week ago (153 comments): https://news.ycombinator.com/item?id=16364919 https://news.ycombinator.com/item?id=16364919
- BigTex420 9y agoI think it’s a good thing. Better than sacrificing journalistic integrity for clickbait that helps drive more ads
- camus2 9y ago> I think it’s a good thing. Better than sacrificing journalistic integrity for clickbait that helps drive more ads err ... they are doing both.
- AnsisMalins 9y agoNow the incentive is to keep the user on the site longer. Excessively long articles?
- draugadrotten 9y agoMore video, unskippable ads. Interactivity, asking for user input. Articles read by video chatbots.
- krylon 9y agoWell, better articles might work...
- grenoire 9y agoI don't see how independence in funding by default is supposed to mean journalistic integrity is present.
- acgh213 9y agoJournalistic integrity doesn't die if your content is worth the price of admission. Excessive ads on a site that serves click bait isn't a site worth a 100% hit against your PC, unless it allows you the profit, the entire amount or a portion depending how you are mining the coins using Moreno. New York Times wants to charge for subscription over 5 articles a month, they put forth the effort to earn it. While not abusing my trust. They aren't forcing a user into a choice that is similar to a loss/loss situation like Salon. I pay for electricity, I pay for internet. I pay for hardware. I don't pay directly to visit a site online. I pay a fee to access the content if it is locked down. But if someone wants to places ads, that doesn't take a hit on a system. Then the content is worth it. If Salon wants to offer a choice of blocking those who AdBlock, or mine a currency for them. The site isn't worth any bit of it's content. I'll waste my processing power and actual power bill on something that benefits my own life and not the Salon Media Group.
- Nursie 9y agoIf this is done without explicit permission from the user, I can see it being some sort of hacking offence. So yes, I run adblockers. I will also run coinblockers. You're not going to be mining on my laptop processor and battery. Not yours. If you don't want me reading your stuff for free (which is perfectly reasonable!) then block me, instruct your server not to send content on those terms. I'm happy with that. But I will not render your ads, nor run your mining script.
- mikekchar 9y agoOut of curiosity... Rather than blocking ads, why not block sites that have ads? This way you comply with their implicit wish not to have you read their content without some sort of monetary return.
- esnard 9y agoBecause people will likely stop using their ad blocker if they can't use the web as they want to.
- Phait 9y agoHonestly, it's a bit of a gray ethical area for me. On one hand, what you say makes perfect sense. On the other hand, I like having my cake and eating it, too. It's like having a buffet dinner where the host tells you: "sure, you can eat this juicy steak, but you also have to eat the surrounding shards of glass that I've put there to feed my thirst for human dignity". If I particularly like the host I might do it, otherwise I'll just take the steak and leave.
- jjjensen90 9y agoI don't love ads but that is a pretty poor and dramatic analogy... It's more like eating a free buffet and the host asks you to listen to his annoying friends while you eat... Some of them write notes about you and share it amongst themselves... I'm not sure this is really an ethical grey area for you or just rationalizing it into grey area. If the website you are reading completely relies on ad revenue to pay its employees then it is pretty black and white that blocking the ads is not "ethical." If you really object to the ad model then you should do as the parent said and block websites which are ad-driven. I've also worked at multiple publishing companies and I can tell you that although their owned and operated websites were run with ad money, none of the people involved had a thirst for human dignity. It is more like, we all wanted to make a living and enough people simultaneously wanted to read the content AND didn't mind the ads enough to click away. Any time I've seen subscription or pay per content tried at publishers I've been with it fails dramatically because the percentage of willing readers is just too small unless you are a very niche and valuable or very large and famous publisher.
- swang 9y agoTheir website was already unreadable on mobile so I guess they're now going to make sure you can't view it on a desktop/laptop by pegging your cpu to 100%
- sudhirj 9y agoThat's config on the miner, can throttle to any CPU usage percentage. No reason for them to be stupid enough to peg at 100%. 50% to 70% seems much more reasonable. Most day to day, non professional applications barely use more than 30%.
- calimac 9y agoFuck Salon they are shit and have always been pretentious shitheads. No surprise
- NKCSS 9y agoThinking about this, how long till ad blockers will also block these crypto mining scripts... it's not that different.
- esnard 9y agoActually they're already blocking them. https://github.com/uBlockOrigin/uAssets/blob/master/filters/resource-abuse.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/...
- apocalyptic0n3 9y agoThere's been blacklists for them since The Pirate Bay started their trial with it, perhaps longer. Here's two: [1]: https://github.com/hoshsadiq/adblock-nocoin-list https://github.com/hoshsadiq/adblock-nocoin-list [2]: https://github.com/ZeroDot1/CoinBlockerLists https://github.com/ZeroDot1/CoinBlockerLists
- VMG 9y agoI imagine the mining code can be transformed so that it will be hard to detect.
- sudhirj 9y agoCoinHive now has the authedmine.com domain, and the scripts served from there only run with explicit and temporary user consent. No reason to block that, although I think some blockers are doing so anyway.
- tzahola 9y agoSo they did seize the means of production after all. The means of Monero production.
- deleted 9y ago[deleted]
- VMG 9y agoBitcoin was inspired by Hashcash in 1992: a Proof-of-Work that protects services from DoS. Now we have come full circle. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
- nukeop 9y agoLuckily, my adblocker (uBlock Origin) blocks mining scripts as well, so the joke's on them.
- TekMol 9y agoIsn't that a good thing? Imagine you have a little widget in your browser that displays something like '50%' which means you constantly use 50% of one core to mine a cryptocurrency for the page you are currently looking at. And in return you get an ad free web. I think that would be way better then the web as we know it.
- ErrantX 9y agoSeems wasteful & fruitless. Better to evolve a micropayments model that works (because at least i can quantify what I pay)
- wklauss 9y ago> because at least i can quantify what I pay And the publishers can quantify how much it gets. With the volatility of crypto assets this is not a viable solution for the publisher, especially because readers who have an ad-blocker installed are likely to block the mining script as well. This is a publicity stunt. Nothing more, nothing less.
- applecrazy 9y agoIf so, this is a stupid publicity stunt, given the largely negative reaction by this community and the media. If anything, more people will install adblockers because of things like this.
- Kiro 9y ago> Better to evolve a micropayments model that works I agree but until that exists this is the best thing we have. It's the only way you can pay cents without doing anything else than click a button.
- darawk 9y agoI'm sure as soon as that micro-payments model evolves Salon will be happy to switch to it. People have been saying that for 20 years, though, and this is the closest we've come.
- 9y ago
- Kiro 9y agoAgain mostly negative comments here. May I ask why? It's 100% opt-in so I don't really see what blocking mining scripts has to do with it. I also block mining scripts but that's for rogue sites doing it without my consent (The Pirate Bay) while this feels like a legitimate use-case. Correct me if I'm wrong. The headline makes it sound like they automatically start it if you're using an adblocker. That is not the case. Check the screenshot in the article.
- abusoufiyan 9y agoIn theory, it's a great idea being 100% opt-in and all. But in practice, we know that CoinHive is being used largely as malware, being injected in third-party sites to enrich hackers. And it's not a nice move to support that ecosystem and the company which clearly doesn't give two damns that their software is enabling so much hacking.
- Kiro 9y agoYou are right. However, CoinHive seems to care about this (at least superficially). Check out their AuthedMiner.
- abusoufiyan 9y agoAccording to this, they don't seem to care at all: https://motherboard.vice.com/en_us/article/vbpbz4/creators-of-in-browser-cryptocurrency-miner-coinhive-say-their-reputation-couldnt-be-much-worse https://motherboard.vice.com/en_us/article/vbpbz4/creators-o... >The team don’t specifically track domains, so if a user’s email address is not, for example, “contact@website.com,” Coinhive often don’t know where or how the service is being used, though. So they don't keep track of who uses the software (perfect for malicious users), and yes they offer an AuthedMiner but why are they still offering payouts to people who use the version which runs without user consent? It's like me selling illegal firearms in the back of my store and people saying "Hey, he is really concerned about the negative effects of illegal arms dealing, that's why he sells legal firearms in the front of the store!"
- grx 9y agoPrime example of failed business models and their desperate attempts to survive. I'm really disappointed about how online publishers handle the decline of ad revenue. Of course my ad-blocker will also block your miner script, what do you think how this works? And better yet, integrating external third-party JavaScript into your website screams for abuse by attackers. Someone could just change the wallet address the scripts mine for and suddenly all your visitors not only do not mine for Salon, but mine for someone else entirely. But yeah, ask me about "well how do we make money?" and I don't really have an answer myself. IMO sources like Patreon are the most appealing for me, though it might hurt websites I have not yet in my list and would not be able to access if I'm not a subscriber.
- koliber 9y agoEvery business is failed unless it figures out a way to survive. Businesses do not survive by default. It takes a lot of work and experimentation to find the right mix of everything to build a viable company.
- O_H_E 9y agoWell Said
- majewsky 9y ago> sources like Patreon are the most appealing for me, though it might hurt websites I have not yet in my list and would not be able to access if I'm not a subscriber. There's also the crowdfunding model. Backers can pay in advance to cover your production costs, and post-funding sales can earn you a profit. I've seen cases where the product became freely available once sales brought in a pre-determined profit. Of course, this works best for individual productions with rather small budgets, such as documentaries or music albums. Not so much for big productions (think Hollywood movies) and not so much for periodic publications like magazines or blogs.
- realitycheck_13 9y agoOne cannot change wallet id just from scraping the JS on a website. #research
- revanx_ 9y agonot using UMatrix or NoScript in 2018, kek.
- CaliforniaKarl 9y agoI am completely fine with this. The entire question of "How does a web site providing content 'for free' make money?" still seems to be in flux. Yes, people might push for some sort of micropayments thing, and The Guardian is making their method work, but I don't know if that's the exception or the rule. At least, not right now. Given the choice, I prefer a background miner over ads. Even on a laptop that's running on battery. For one thing, removing the ads (and all the annoying JS they load) should make the page much better to load & navigate, meaning I can go through the content faster. If I don't want to use up my battery, then I'll add the site to my Read Later list, and read it then.
- abusoufiyan 9y agoI'd be okay with it if choosing to do this on your website wasn't going to obviously incentivize hackers to inject this software maliciously on unsuspecting websites to steal money from unsuspecting users. The more legit websites do this, the more cryptojacking will wreak havoc on the web. And for those who say they ask for consent so it's okay, why do the CoinHive people still pay out for versions of the software that don't ask for consent?
- icebraining 9y agochoosing to do this on your website wasn't going to obviously incentivize hackers How does this work? Why would hackers needs this "incentive"?
- abusoufiyan 9y agoThe less legit it is for a website to mine crypto, the easier it is for adblockers and security to block all such scripts without inconveniencing the user (less tradeoff of usability for security). But when some sites use it and others doesn't, it makes security complicated and hacks are able to slip through easier. Also, the more users get used to sites mining on their browsers, the less likely they will be perturbed by and reporting CPU usage spikes (which are used to determine which sites have been hacked by cryptojackers) because they are used to seeing legitimate such spikes from sites they frequent.
- mnm1 9y agoThey've been doing shady shit with JS for years like auto-reloading their home page and other shady practices. The only solution to sites running bad JS like Salon is to block the JS. uBlock origin, NoScript, etc. The only downside is that none of these tools is user-friendly enough to run without any user input. The idea that other entities should be able to run their code on my computer was a bad one to begin with and still is. I think people are slowly coming to that realization as this default begins to show just how dangerous it is.
- molticrystal 9y agoThe best way to prevent this in firefox: 1. Run Noscript extension 2. Run RequestPolicy extension 3. Keep your adblock/ublock rules updated as they block miners 4. Don't ever visit Salon The first three also work on most other websites that have miners or were hacked and had a miner injected.
- andygates 9y ago"users must do special stuff" doesn't scale, which is why Chrome has had to roll out default blocking for egregious ads. But using user resources to mine fadcoin? That's borderline Computer Misuse Act, in the UK, I reckon.
- krylon 9y agoThe problem with ads is that they are not just ads these days. There is a big industry whose "product" is tracking users across sites, trying to build detailed profiles in order to present people with targeted ads they are more likely to click on. In other words, a massive invasion of privacy that may very well come back to haunt us (think of an oppressive government trying to find potential dissidents, either to bombard them with propaganda or worse). Using my browser as a cryptocurrency miner as I visit a site has obvious problems, especially on mobile devices, but from a privacy perspective it is far less troubling. With the exception of blogs people write in their spare time, most web sites need a way to recover their expenses. Even more so for news sites that employ journalists etc. At that point, the interesting question is how effective running a Javascript miner is. When I visit web sites using a browser that has no ad blocker or tracking protection installed, I notice that ads, tracking scripts, etc. can use quite a bit of CPU, RAM and bandwidth, too. If I could be sure that a site using crypto-miners does not just gobble up my phone's battery like crazy, the idea is not that bad, as long as sites are transparent and up-front about it. Some sites already offer a model where you either have ads or make a donation and get an ad-free page. Something similar with cryptominers could work, too. (All this assumes, of course, that web site owners play fair, which is hopelessly naive all too often.)
- fezerozero 9y agoFor this model to be successful(long term), sites/anyone who does this, must set an early precedent to inform and get consent from users. (this is, of course, antithetical toward modern advertising philosophy) Otherwise, it crosses a line from Adware to Malware, further validates the reclassification of ad blocking/protection from optional to required, and will meet a quick demise
- realitycheck_13 9y agoThe web is open and free because ads made it possible when the internet was first evolving. You only understand the internet as “free” because someone else was footing the bill to begin with. Ads can no longer support an open web as you once knew it. So, the web closes down (publishers gating their content - subscriptions) one by one and what do you end up with? A closed web. Plain and simple. Those who feel the web is “free” are under an illusion becaue they know and knew of nothing different. These people are ignorant and the ignorance is what is actually causing the web to close down faster. The more ignorance the faster it closes. I’m not saying ads and mining are great ways to pay the toll but it’s the only options since I don’t see any user here writing checks to websites out of good will. Salon at least is trying to keep the web “open” by giving options - and by the way, when did an option, in your control, ever offend you. Offended? Fine you don’t have to opt in. That’s like saying your pissed of because the restaurant accepts discover card when you only chose to carry Amex or cash. There are a lot of people here who just don’t know what they are talking about and unfortunately they’ll never know who they are because they are always right. That’s fine because that’s the way the world works unfortunately and it’s human nature but a little honest research would do the greater community as a whole a great deal of good.
- em3rgent0rdr 9y agoThis is a wonderful innovation, allowing visitors access without ads while providing revenue to the site.