6 ms·

Am I Mining to Somebody?

71 points by kinduff 5y ago

frogger8 5y ago
tl/dr Yes
awinter-py 5y ago
I mean it's the minecraft docker image, at least the scammer has a developed sense of irony
- thih9 5y ago
  I don't understand, could you explain? Edit: Ah, you mean because of mining; true, makes sense.
  - hawthornio 5y ago
    And the image publisher is one crafty son of a bitch
vonadz 5y ago
I wonder if this could be turned into a legitimate way of supporting open source developers? Run their docker images that have an option to configure running a miner during your down time.
- artemonster 5y ago
  Keyword here: consent! I cant imagine that someone would give any. So, no.
  - vonadz 5y ago
    Obviously this would be consensual, keyword legitimate. I don't know why you can't imagine someone agreeing to support someone else with some CPU/GPU in off time.
    - Graffur 5y ago
      Seems like a good idea to me.
  - gavinray 5y ago
    I would do this, why wouldn't you? If you aren't using your computer, who cares. Not like you'll notice. Tipping someone forces me to pay money I've already earned. I can't be assed to set up a crypto miner on my laptop and manage the wallet and all that, it's not worth the few bucks to me. But if it means making a livelihood to an open source developer, who collectively has hundreds of people doing this, yeah I would absolutely do that. It also lets me support a larger number of devs. I realistically don't want to pay out $5/mo to dozens of devs. (Currently sponsor 4) But if there's mining software that distributes profits against a pool of devs of my choosing, then sweet -- free money for them!
    - VRay 5y ago
      > If you aren't using your computer, who cares. Not like you'll notice. If you aren't using your computer, you aren't pissing away 500+ watts every hour either. On top of that, in most of the developed world, you get less money's worth of cryptocurrency out than the cost of the electricity to generate it. So if you really wanted to donate money, you'd donate more by just paying them directly than wasting power, money, and computer hardware life on generating cryptocurrency
      - vonadz 5y ago
        > On top of that, in most of the developed world, you get less money's worth of cryptocurrency out than the cost of the electricity to generate it. This isn't really true. It depends on your hardware. My friend has a 3080 and was making $30-$50 a day mining eth. 3080 has a max usage at 750W, and let's say your computer in total is at 1.5KW. Average rate in US is 13 cents/KWh. Don't think Europe is much higher than. Other countries probably less. Also life expectancy decline of mining is highly over exaggerated by GPU companies so people don't buy them second hand.
        sofixa 5y ago
        https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Electricity_price_statistics https://ec.europa.eu/eurostat/statistics-explained/index.php... In Germany it's 30 eurocents/kWh. That's a decent electricity bill.
- falcolas 5y ago
  As someone with an admittedly very minor open source presence, NO. I'd rather get tips than have someone waste electricity (not to mention hosting costs) on my behalf.
- delusional 5y ago
  Why would I spend CPU time doing useless work in order to give them strange coins that aren't money when i could just save the money and give it to them directly?
  - paulcole 5y ago
    1. They might want strange coins and not money. 2. Most people won’t give them money directly. 3. It’s their choice how to monetize their project. It’s your choice to use or not use their project.
  - awinter-py 5y ago
    I tend to agree with you, but there's an edge case-y argument here that idle CPU is a resource that a corporation might be happy to donate to a small developer in practice though I think it is not
    - delusional 5y ago
      An idle CPU consumes (relatively) little power. I get that you're "wasting" potential computation power, but we've spent years making auto-scaling CPUs to conserve electricity. On clouds, that CPU is probably even oversubscribed, so the idle time is already incorporated into the price. I don't even think it makes any sense in theory. In practice it's even worse. There's not a sane company in the world that would let some random bitcoin miner run on the same host as their mission critical system anyway.
  - vonadz 5y ago
    Well firstly those strange coins are pretty much money at this point. They might not be as universal as fiat, but you can 100% live a comfortable life using only crypto, albeit it might be a bit more work. Secondly I think clicking "yes" to a message saying "you want to support the developer when your computer isn't doing work for you?" Is easier than sending fiat in most cases. I do concede though that it only really makes sense if you live somewhere with cheap eletricity.
    - 5y ago
- Applejinx 5y ago
  Am open source developer. Nope. Please for the love of God don't be sitting around thinking of how to 'help' me in this way…
jiripospisil 5y ago
They are not even trying to be sneaky about it. If you look at layers #42 and #43 at [0], you can see they are cloning and building xmrig/xmrig [1]. [0] https://hub.docker.com/layers/minecraft101/minecraft-server/latest/images/sha256-e161086893ee92271ab83668503dc4d71c6c2b1f7201a4efecc2856c167b07ed?context=explore https://hub.docker.com/layers/minecraft101/minecraft-server/... [1] https://github.com/xmrig/xmrig https://github.com/xmrig/xmrig
- patrakov 5y ago
  And their file is even detected by ClamAV as "Multios.Coinminer.Miner-6781728-2". Too bad that Docker Hub doesn't scan its files. Reported this non-scanning as an issue: https://github.com/docker/hub-feedback/issues/2154 https://github.com/docker/hub-feedback/issues/2154
- jareklupinski 5y ago
  using that page on a desktop environment makes me feel like docker actively wants to hide the steps their hosted docker containers take i had to scroll up and down every time after clicking a line just to see what was obscured by the 80-character limit imposed on my 21:9 screen
input_sh 5y ago
Your best bet is to report it here... and then wait a year for someone to actually remove it: https://github.com/docker/hub-feedback/issues/1121 https://github.com/docker/hub-feedback/issues/1121
- amelius 5y ago
  Report them and send them the energy bill.
bserge 5y ago
On a related note, I found how to get rid of my Reddit addiction! After getting banned on 3 accounts for talking about suicide, they IP banned me. I logged on 2 more accounts (yeah, it's a serious addiction, though I planned to use them for marketing), they got banned. Opened a new account (no unwanted content, only puppies and rainbows), got banned within 3 days. Can still visit, but can't talk, which is a major part of why it's so addictive to me. This should reduce my time spent there at least by half. No comments = no replies = no point. Can't believe I never thought of it before. Actually, I didn't know it was possible. Next up, HN? The last digital heroin right now... What would it take to get permabanned? Asking for a friend.
- WJW 5y ago
  Go into your hosts file, redirect HN to localhost.
  - bserge 5y ago
    Oh, yeah that shit doesn't work on me. If it takes less than 5 minutes to undo, I'll undo the block. Probably should've mentioned that. At one point, I had a dedicated router protected by a password I did not know (I could only recreate it out of several cypher phrases) blocking everything including an exhaustive list of VPNs and proxies using DNSMasq and intercepting DNS, with reset protection. Bypassed with 4G or using a longer LAN cable from the main router to my computer. Like I said, serious addiction and a fucked up brain.
  - Zababa 5y ago
    His idea is actually pretty good. At least in France, you can ask to be put on a list to be forbidden from casinos. If you want to get banned from HN, you could probably make a mail explaining your situation.
    - capableweb 5y ago
      Seems the people building HN already thought of this, just activate noprocrast in your profile settings. > In my profile, what is noprocrast? > It's a way to help you prevent yourself from spending too much time on HN. If you turn it on you'll only be allowed to visit the site for maxvisit minutes at a time, with gaps of minaway minutes in between. The defaults are 20 and 180, which would let you view the site for 20 minutes at a time, and then not allow you back in for 3 hours.
Cpoll 5y ago
> chazragg: I'm not sure why docker is showing this as the most popular when itzg's images have over 100m downloads with 1.3k stars. > gamb1t9: i think cuz my man uses the username 'minecraft101', it's a better match than itzg.. rather crap search design by DockerHub This really does seem to be the case. Searching for "minecraft", itzg/minecraft-server (100M+ download, 1.3k stars) is under two minecraft101 uploads (10K+ downloads, 0 stars) and minecraftly/proxy (2.9K dls, 1 star). Interestingly, itgz beats out minecraftlinux/ci-xenial by minecraftlinux (1.1k downloads). I have no idea what the heuristic is here... I think "Official Images" go at the top of the search, and I can't think of any other popular containers where the name of the container doesn't match the name of the uploader, but there's probably something here...
paxys 5y ago
Don't run random untrusted code from the internet on your computer folks.
- edoceo 5y ago
  What else is docker for?
- michaelcampbell 5y ago
  I guess you reverse engineer all the installation .deb's, install.exe's, and .pkg's.
  - kzrdude 5y ago
    I wish I could get by with just Ubuntu repos, but.. increasingly less so.
  - paxys 5y ago
    No but I verify that they are signed and coming from a provider I trust.
- Ekaros 5y ago
  Hmm... Now where to get trusted code from... And how do I get that on my modern computer again...
  - jrockway 5y ago
    Obviously you use your vendor's "app store".
  - paxys 5y ago
    You can choose who to trust. Docker Hub itself has official images from project owners.
    - mattrick 5y ago
      There's no official Minecraft server images.
umvi 5y ago
Cryptocurrency is one of the worst techs to be developed in recent years. It essentially monetized the practice of wasting CPU/GPU cycles. This in turn gave new incentives to malware writers, scammers, and generally just greedy opportunistic people to waste CPU/GPU whenever possible and as sneakily as possible...
- someonewhocar3s 5y ago
  It's only because you never did that "useful mining" project.
- capableweb 5y ago
  > $NewThing is one of the worst techs to be developed in recent years. It essentially monetized the practice of $DoingBadStuff. This in turn gave new incentives to malware writers, scammers, and generally just greedy opportunistic people to $DoBadStuff whenever possible and as sneakily as possible... I'm sure people said the same thing about the Internet when it became popular. In fact, I know people still say this about the Internet to this day. But enough off-topic, what does this have to do with this particular Docker image?

71 points by kinduff 5y ago

frogger8 5y ago

tl/dr Yes

awinter-py 5y ago

I mean it's the minecraft docker image, at least the scammer has a developed sense of irony

thih9 5y ago
I don't understand, could you explain? Edit: Ah, you mean because of mining; true, makes sense.
- hawthornio 5y ago
  And the image publisher is one crafty son of a bitch

vonadz 5y ago

I wonder if this could be turned into a legitimate way of supporting open source developers? Run their docker images that have an option to configure running a miner during your down time.

artemonster 5y ago
Keyword here: consent! I cant imagine that someone would give any. So, no.
- vonadz 5y ago
  Obviously this would be consensual, keyword legitimate. I don't know why you can't imagine someone agreeing to support someone else with some CPU/GPU in off time.
  - Graffur 5y ago
    Seems like a good idea to me.
- gavinray 5y ago
  I would do this, why wouldn't you? If you aren't using your computer, who cares. Not like you'll notice. Tipping someone forces me to pay money I've already earned. I can't be assed to set up a crypto miner on my laptop and manage the wallet and all that, it's not worth the few bucks to me. But if it means making a livelihood to an open source developer, who collectively has hundreds of people doing this, yeah I would absolutely do that. It also lets me support a larger number of devs. I realistically don't want to pay out $5/mo to dozens of devs. (Currently sponsor 4) But if there's mining software that distributes profits against a pool of devs of my choosing, then sweet -- free money for them!
  - VRay 5y ago
    > If you aren't using your computer, who cares. Not like you'll notice. If you aren't using your computer, you aren't pissing away 500+ watts every hour either. On top of that, in most of the developed world, you get less money's worth of cryptocurrency out than the cost of the electricity to generate it. So if you really wanted to donate money, you'd donate more by just paying them directly than wasting power, money, and computer hardware life on generating cryptocurrency
    - vonadz 5y ago
      > On top of that, in most of the developed world, you get less money's worth of cryptocurrency out than the cost of the electricity to generate it. This isn't really true. It depends on your hardware. My friend has a 3080 and was making $30-$50 a day mining eth. 3080 has a max usage at 750W, and let's say your computer in total is at 1.5KW. Average rate in US is 13 cents/KWh. Don't think Europe is much higher than. Other countries probably less. Also life expectancy decline of mining is highly over exaggerated by GPU companies so people don't buy them second hand.
      - sofixa 5y ago
        https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Electricity_price_statistics https://ec.europa.eu/eurostat/statistics-explained/index.php... In Germany it's 30 eurocents/kWh. That's a decent electricity bill.
falcolas 5y ago
As someone with an admittedly very minor open source presence, NO. I'd rather get tips than have someone waste electricity (not to mention hosting costs) on my behalf.
delusional 5y ago
Why would I spend CPU time doing useless work in order to give them strange coins that aren't money when i could just save the money and give it to them directly?
- paulcole 5y ago
  1. They might want strange coins and not money. 2. Most people won’t give them money directly. 3. It’s their choice how to monetize their project. It’s your choice to use or not use their project.
- awinter-py 5y ago
  I tend to agree with you, but there's an edge case-y argument here that idle CPU is a resource that a corporation might be happy to donate to a small developer in practice though I think it is not
  - delusional 5y ago
    An idle CPU consumes (relatively) little power. I get that you're "wasting" potential computation power, but we've spent years making auto-scaling CPUs to conserve electricity. On clouds, that CPU is probably even oversubscribed, so the idle time is already incorporated into the price. I don't even think it makes any sense in theory. In practice it's even worse. There's not a sane company in the world that would let some random bitcoin miner run on the same host as their mission critical system anyway.
- vonadz 5y ago
  Well firstly those strange coins are pretty much money at this point. They might not be as universal as fiat, but you can 100% live a comfortable life using only crypto, albeit it might be a bit more work. Secondly I think clicking "yes" to a message saying "you want to support the developer when your computer isn't doing work for you?" Is easier than sending fiat in most cases. I do concede though that it only really makes sense if you live somewhere with cheap eletricity.
  - 5y ago
Applejinx 5y ago
Am open source developer. Nope. Please for the love of God don't be sitting around thinking of how to 'help' me in this way…

jiripospisil 5y ago

They are not even trying to be sneaky about it. If you look at layers #42 and #43 at [0], you can see they are cloning and building xmrig/xmrig [1]. [0] https://hub.docker.com/layers/minecraft101/minecraft-server/latest/images/sha256-e161086893ee92271ab83668503dc4d71c6c2b1f7201a4efecc2856c167b07ed?context=explore https://hub.docker.com/layers/minecraft101/minecraft-server/... [1] https://github.com/xmrig/xmrig https://github.com/xmrig/xmrig

patrakov 5y ago
And their file is even detected by ClamAV as "Multios.Coinminer.Miner-6781728-2". Too bad that Docker Hub doesn't scan its files. Reported this non-scanning as an issue: https://github.com/docker/hub-feedback/issues/2154 https://github.com/docker/hub-feedback/issues/2154
jareklupinski 5y ago
using that page on a desktop environment makes me feel like docker actively wants to hide the steps their hosted docker containers take i had to scroll up and down every time after clicking a line just to see what was obscured by the 80-character limit imposed on my 21:9 screen

input_sh 5y ago

Your best bet is to report it here... and then wait a year for someone to actually remove it: https://github.com/docker/hub-feedback/issues/1121 https://github.com/docker/hub-feedback/issues/1121

amelius 5y ago
Report them and send them the energy bill.

bserge 5y ago

On a related note, I found how to get rid of my Reddit addiction! After getting banned on 3 accounts for talking about suicide, they IP banned me. I logged on 2 more accounts (yeah, it's a serious addiction, though I planned to use them for marketing), they got banned. Opened a new account (no unwanted content, only puppies and rainbows), got banned within 3 days. Can still visit, but can't talk, which is a major part of why it's so addictive to me. This should reduce my time spent there at least by half. No comments = no replies = no point. Can't believe I never thought of it before. Actually, I didn't know it was possible. Next up, HN? The last digital heroin right now... What would it take to get permabanned? Asking for a friend.

WJW 5y ago
Go into your hosts file, redirect HN to localhost.
- bserge 5y ago
  Oh, yeah that shit doesn't work on me. If it takes less than 5 minutes to undo, I'll undo the block. Probably should've mentioned that. At one point, I had a dedicated router protected by a password I did not know (I could only recreate it out of several cypher phrases) blocking everything including an exhaustive list of VPNs and proxies using DNSMasq and intercepting DNS, with reset protection. Bypassed with 4G or using a longer LAN cable from the main router to my computer. Like I said, serious addiction and a fucked up brain.
- Zababa 5y ago
  His idea is actually pretty good. At least in France, you can ask to be put on a list to be forbidden from casinos. If you want to get banned from HN, you could probably make a mail explaining your situation.
  - capableweb 5y ago
    Seems the people building HN already thought of this, just activate noprocrast in your profile settings. > In my profile, what is noprocrast? > It's a way to help you prevent yourself from spending too much time on HN. If you turn it on you'll only be allowed to visit the site for maxvisit minutes at a time, with gaps of minaway minutes in between. The defaults are 20 and 180, which would let you view the site for 20 minutes at a time, and then not allow you back in for 3 hours.

Cpoll 5y ago

> chazragg: I'm not sure why docker is showing this as the most popular when itzg's images have over 100m downloads with 1.3k stars. > gamb1t9: i think cuz my man uses the username 'minecraft101', it's a better match than itzg.. rather crap search design by DockerHub This really does seem to be the case. Searching for "minecraft", itzg/minecraft-server (100M+ download, 1.3k stars) is under two minecraft101 uploads (10K+ downloads, 0 stars) and minecraftly/proxy (2.9K dls, 1 star). Interestingly, itgz beats out minecraftlinux/ci-xenial by minecraftlinux (1.1k downloads). I have no idea what the heuristic is here... I think "Official Images" go at the top of the search, and I can't think of any other popular containers where the name of the container doesn't match the name of the uploader, but there's probably something here...

paxys 5y ago

Don't run random untrusted code from the internet on your computer folks.

edoceo 5y ago
What else is docker for?
michaelcampbell 5y ago
I guess you reverse engineer all the installation .deb's, install.exe's, and .pkg's.
- kzrdude 5y ago
  I wish I could get by with just Ubuntu repos, but.. increasingly less so.
- paxys 5y ago
  No but I verify that they are signed and coming from a provider I trust.
Ekaros 5y ago
Hmm... Now where to get trusted code from... And how do I get that on my modern computer again...
- jrockway 5y ago
  Obviously you use your vendor's "app store".
- paxys 5y ago
  You can choose who to trust. Docker Hub itself has official images from project owners.
  - mattrick 5y ago
    There's no official Minecraft server images.

umvi 5y ago

Cryptocurrency is one of the worst techs to be developed in recent years. It essentially monetized the practice of wasting CPU/GPU cycles. This in turn gave new incentives to malware writers, scammers, and generally just greedy opportunistic people to waste CPU/GPU whenever possible and as sneakily as possible...

someonewhocar3s 5y ago
It's only because you never did that "useful mining" project.
capableweb 5y ago
> $NewThing is one of the worst techs to be developed in recent years. It essentially monetized the practice of $DoingBadStuff. This in turn gave new incentives to malware writers, scammers, and generally just greedy opportunistic people to $DoBadStuff whenever possible and as sneakily as possible... I'm sure people said the same thing about the Internet when it became popular. In fact, I know people still say this about the Internet to this day. But enough off-topic, what does this have to do with this particular Docker image?