4 ms·

Running arbitrary code on a distributed network of end user PCs with network access is a recipe for a bot net. Yes it’s doable but it’s not a magic wand to clai

by koolba 6y ago

Running arbitrary code on a distributed network of end user PCs with network access is a recipe for a bot net. Yes it’s doable but it’s not a magic wand to claim that an open platform will solve it. The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.

znpy 6y ago
> Running arbitrary code on a distributed network of end user PCs It's a bit more complicated than that. I run gitlab and gitlab runners for a living, I can tell. First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy). Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).
- nl 6y ago
  > First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". This isn't what "arbitrary code" means.
eins1234 6y ago
> My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“. Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...
- floatboth 6y ago
  What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?
- jrochkind1 6y ago
  Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".
josteink 6y ago
> The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. With GitHub Actions it's even simpler, and no OAuth required at all. I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).

by koolba 6y ago

znpy 6y ago

> Running arbitrary code on a distributed network of end user PCs It's a bit more complicated than that. I run gitlab and gitlab runners for a living, I can tell. First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy). Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).

nl 6y ago
> First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". This isn't what "arbitrary code" means.

eins1234 6y ago

> My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“. Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...

floatboth 6y ago
What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?
jrochkind1 6y ago
Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".

josteink 6y ago

> The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. With GitHub Actions it's even simpler, and no OAuth required at all. I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).