5 ms·

Why do we treat advertisements and crypto-mining so differently? They both waste your machines resources, without specific opt in, to generate a profit. Unaut

Why do we treat advertisements and crypto-mining so differently? They both waste your machines resources, without specific opt in, to generate a profit. Unauthorized cryptominers are scripts ... that run energy-sucking operations on your web browser without your knowledge or consent. They literally steal your system’s computing power to make money. We think that’s deeply shady... What then, are advertisements?

jarcane 7y ago
Seriously. And why isn’t the mining blocked on by default? Most users aren’t going to know to even look for it, and I highly doubt any of them would support what’s basically theft of their resources.
- Sendotsh 7y ago
  I just checked and the "Cryptominers" box is ticked under "Privacy & Security > Content Blocking" for me, and I didn't turn it on. I have Firefox auto updating, so not sure if it's the same on a fresh install.
vidyesh 7y ago
Advertisements eat resources while loading and once that is done they do not keep refreshing themselves to eat more resources. Cryptominers have a very different behavior. They reserve a % of system resources to keep running in the background as long as the site is kept open even in a dormant tab. So if your system is at 10% load usually, cryptominers could keep them at 20-30%+ load all the time they are in memory without the user knowing it nor approving it. Unlike advertisements we do not see them running or loaded in front of our eyes either. Don't you think this is very invasive?
- Beldin 7y ago
  Advertisements eat resources while loading and once that is done they do not keep refreshing themselves to eat more resources. That is no longer true - on several sites (eg. Ars Technica), ads are loaded and refreshed after a short period. I haven't yet seen anything close to as resource-intensive as a cryptominer yet... in terms of CPU. In terms of bandwidth, I would not be surprised if most ads consume more than cryptominers.
  - vidyesh 7y ago
    That is no longer true - on several sites (eg. Ars Technica), ads are loaded and refreshed after a short period. Auto-refresh ads still do most of the work on the ad servers and very small amount of resources are eaten on the user side in the browser. This too is done with a predefined logic which are user-action based or event-based. Time-based auto-refresh ads are only seen on bigger sites which usually have very high average session times. So regular news and clickbaity sites won't necessarily have those. Auto-refresh ads are only served by bigger ad networks which server bigger sites, Google Adsense do not allow auto-refresh ads. Google Ad Exchange does but that network is for bigger sites. This weeds out all the potential scammy/spammy sites which go for exploiting user resources like cryptominers do.
derefr 7y ago
The bigcorps that control most of the web wouldn't care if every browser blocked cryptominers. They would care if every browser blocked ads.
- burfog 7y ago
  I don't even really demand that ads be blocked. Ultimately you can't do that, due to paid product placement. It would be like blacking out the Reese's Pieces in the movie ET. I just want stuff throttled. I mean everything, not just ads. Sometimes the non-ad content eats too much memory or CPU time, causing me to lose control of the computer. Web browsers have been really lax about restricting resources. It is not OK to let a web site kick off 12345 threads, suck up 42 gigabytes of RAM, and attempt to download at gigabit speeds. For the CPU, I prefer that all but one tab of one window be suspended. (and I can override) In there, the number of running threads shouldn't exceed the number of my CPUs. For the RAM, there ought to be a per-tab limit that doubles each time I give the OK. Attempts to exceed the limit cause the tab to be suspended until I authorize more RAM.
  - derefr 7y ago
    I mean, asking to throttle a web browser’s tabs by default, is like asking that you throttle the JVM, or Docker, by default. The web browser has become a de facto container-workload hypervisor—and for many consumers (and some systems, e.g. ChromeOS) the primary one they rely on. I say “container workload” because it often makes sense to put CPU/memory quotas on things like VMs, but containerized workloads are rarely designed for it, rather being designed to be able to have dynamic resource allocations—spiking up to huge resource usage before returning to a baseline level. Containers (and browser tabs) are meant to sort of “negotiate” CPU time and memory usage [and IOPS, which you didn’t mention] back and forth over time, especially as both kinds of workloads use way more of all of those resources when booting up before going quiescent. And container hypervisors—like browsers—are running workloads that mostly are designed to work better on an overprovisioned powerful substrate than on a strictly-provisioned less-powerful substrate (because there’s a pool of resources any workload can borrow to boot up, and then release), and so there’s never been real demand to make them manage hard quotas for every resource effectively, the way one can in a VM hypervisor. So, if a sysadmin wants to limit the resource usage of a container workload, they don’t even bother trying to solve this at the level of the container hypervisor; rather, they just wrap the container [and its hypervisor] in its own VM, and then use the resource-quota support inherent in the VM abstraction to manage the resource quotas for the workload. I’d say that what you’re asking for is similar to what people demand when they want quota knobs on container hypervisors. There’s consumer demand for it, but no professional demand, so it’ll never get done to the level of quality of the quota-enforcing solutions that professionals do rely on (and, to not lose performance in the process, would need a lot more “magic” in its allocation logic, to allow for patterns like burst-usage before quiescence, so it wouldn’t really be the thing you’re looking for anyway.) I’d personally suggest—if there is such a thing as a “browser unikernel” (I’m imagining ChromeOS stripped down to have only virtio drivers)—then running several of those in VMs would probably be your best for controlling browser workloads. I believe there are (research) workstation OSes where hardware-virtualized VMs running unikernels are treated as first-class “applications”, in about the same way that Metro apps are treated in Windows 10. https://genode.org/ https://genode.org/, for example. (Genode is technically a microkernel where applications are all capability-isolated kernel servers, but it’s easy to have one such server that’s a VM hypervisor, and you don’t end up even noticing the difference, since the OS is already built to make communication between these isolated workloads easy.) In these OSes, a window has not just window-management window-decorations, but also resource-quota management window-decorations, since each window represents an isolated workload. Maybe that’s close to what you’re looking for—running a browser on such an OS? Or, to rephrase in terms of blame rather than constructive problem-solving: it’s not the browser’s job to make browser tabs not steal all your resources. It’s the OS’s job. The browser has already done its job by distinguishing these workloads from one-another as separate OS processes/threads; after that, it’s up to your OS to fairly quota and schedule those processes/threads such that you, the user, don’t get a bad experience. The consumer-OS approach to running native workloads, is lagging far behind the state-of-the-art here (that state-of-the-art being the way workloads are managed in hypervisor clusters like vSphere or Google’s Borg.) Demand more of your OS!

jarcane 7y ago

Seriously. And why isn’t the mining blocked on by default? Most users aren’t going to know to even look for it, and I highly doubt any of them would support what’s basically theft of their resources.

Sendotsh 7y ago
I just checked and the "Cryptominers" box is ticked under "Privacy & Security > Content Blocking" for me, and I didn't turn it on. I have Firefox auto updating, so not sure if it's the same on a fresh install.

vidyesh 7y ago

Advertisements eat resources while loading and once that is done they do not keep refreshing themselves to eat more resources. Cryptominers have a very different behavior. They reserve a % of system resources to keep running in the background as long as the site is kept open even in a dormant tab. So if your system is at 10% load usually, cryptominers could keep them at 20-30%+ load all the time they are in memory without the user knowing it nor approving it. Unlike advertisements we do not see them running or loaded in front of our eyes either. Don't you think this is very invasive?

Beldin 7y ago
Advertisements eat resources while loading and once that is done they do not keep refreshing themselves to eat more resources. That is no longer true - on several sites (eg. Ars Technica), ads are loaded and refreshed after a short period. I haven't yet seen anything close to as resource-intensive as a cryptominer yet... in terms of CPU. In terms of bandwidth, I would not be surprised if most ads consume more than cryptominers.
- vidyesh 7y ago
  That is no longer true - on several sites (eg. Ars Technica), ads are loaded and refreshed after a short period. Auto-refresh ads still do most of the work on the ad servers and very small amount of resources are eaten on the user side in the browser. This too is done with a predefined logic which are user-action based or event-based. Time-based auto-refresh ads are only seen on bigger sites which usually have very high average session times. So regular news and clickbaity sites won't necessarily have those. Auto-refresh ads are only served by bigger ad networks which server bigger sites, Google Adsense do not allow auto-refresh ads. Google Ad Exchange does but that network is for bigger sites. This weeds out all the potential scammy/spammy sites which go for exploiting user resources like cryptominers do.

derefr 7y ago

The bigcorps that control most of the web wouldn't care if every browser blocked cryptominers. They would care if every browser blocked ads.

burfog 7y ago
I don't even really demand that ads be blocked. Ultimately you can't do that, due to paid product placement. It would be like blacking out the Reese's Pieces in the movie ET. I just want stuff throttled. I mean everything, not just ads. Sometimes the non-ad content eats too much memory or CPU time, causing me to lose control of the computer. Web browsers have been really lax about restricting resources. It is not OK to let a web site kick off 12345 threads, suck up 42 gigabytes of RAM, and attempt to download at gigabit speeds. For the CPU, I prefer that all but one tab of one window be suspended. (and I can override) In there, the number of running threads shouldn't exceed the number of my CPUs. For the RAM, there ought to be a per-tab limit that doubles each time I give the OK. Attempts to exceed the limit cause the tab to be suspended until I authorize more RAM.
- derefr 7y ago
  I mean, asking to throttle a web browser’s tabs by default, is like asking that you throttle the JVM, or Docker, by default. The web browser has become a de facto container-workload hypervisor—and for many consumers (and some systems, e.g. ChromeOS) the primary one they rely on. I say “container workload” because it often makes sense to put CPU/memory quotas on things like VMs, but containerized workloads are rarely designed for it, rather being designed to be able to have dynamic resource allocations—spiking up to huge resource usage before returning to a baseline level. Containers (and browser tabs) are meant to sort of “negotiate” CPU time and memory usage [and IOPS, which you didn’t mention] back and forth over time, especially as both kinds of workloads use way more of all of those resources when booting up before going quiescent. And container hypervisors—like browsers—are running workloads that mostly are designed to work better on an overprovisioned powerful substrate than on a strictly-provisioned less-powerful substrate (because there’s a pool of resources any workload can borrow to boot up, and then release), and so there’s never been real demand to make them manage hard quotas for every resource effectively, the way one can in a VM hypervisor. So, if a sysadmin wants to limit the resource usage of a container workload, they don’t even bother trying to solve this at the level of the container hypervisor; rather, they just wrap the container [and its hypervisor] in its own VM, and then use the resource-quota support inherent in the VM abstraction to manage the resource quotas for the workload. I’d say that what you’re asking for is similar to what people demand when they want quota knobs on container hypervisors. There’s consumer demand for it, but no professional demand, so it’ll never get done to the level of quality of the quota-enforcing solutions that professionals do rely on (and, to not lose performance in the process, would need a lot more “magic” in its allocation logic, to allow for patterns like burst-usage before quiescence, so it wouldn’t really be the thing you’re looking for anyway.) I’d personally suggest—if there is such a thing as a “browser unikernel” (I’m imagining ChromeOS stripped down to have only virtio drivers)—then running several of those in VMs would probably be your best for controlling browser workloads. I believe there are (research) workstation OSes where hardware-virtualized VMs running unikernels are treated as first-class “applications”, in about the same way that Metro apps are treated in Windows 10. https://genode.org/ https://genode.org/, for example. (Genode is technically a microkernel where applications are all capability-isolated kernel servers, but it’s easy to have one such server that’s a VM hypervisor, and you don’t end up even noticing the difference, since the OS is already built to make communication between these isolated workloads easy.) In these OSes, a window has not just window-management window-decorations, but also resource-quota management window-decorations, since each window represents an isolated workload. Maybe that’s close to what you’re looking for—running a browser on such an OS? Or, to rephrase in terms of blame rather than constructive problem-solving: it’s not the browser’s job to make browser tabs not steal all your resources. It’s the OS’s job. The browser has already done its job by distinguishing these workloads from one-another as separate OS processes/threads; after that, it’s up to your OS to fairly quota and schedule those processes/threads such that you, the user, don’t get a bad experience. The consumer-OS approach to running native workloads, is lagging far behind the state-of-the-art here (that state-of-the-art being the way workloads are managed in hypervisor clusters like vSphere or Google’s Borg.) Demand more of your OS!