back
65 comments
A friend of mine has written a very popular open-source JavaScript library and has been hosting a copy on his website. Turns out that a few high-volume news sites have started using the library, but instead of downloading a copy and serving it themselves, they've been hotlinking the one on his website.

As a result he is getting several million hits a day on his library's js file, directly from these website's pages.

We've been tempted to include a JavaScript miner in the library he is hosting, but we're unsure of the legal implications, i.e. would the fact that he's hosting the file on his website and that the other websites have simply hotlinked it, be a valid defense?

I did an experiment like this in 2011 on one of my websites. The sites was free to use for the end users but had a few ads (between 0 and up to 3 depending on the pages and sections).

I wanted to see if I could replace the ads with a bitcoins miner and get enough revenues to continue operating the service. FYI I was making about 900€ per month at the moment.

So I installed a JavaScript miner, removed the ads and waited. The result I got was unexpected: Avast Antivirus (very popular among my visitors) flagged the site and blocked it's access. I immediatly lost about hald of the traffic. I tried with a few other opensource miners and the sentence was the same every times: users locked out by zealous anti-virus and traffic cut off by (at least) half.

Zealous antivirus? More like good antivirus...
Why do you think that? Compared to ads that are heavy on the user's network and CPU, track them, get them tons of unwated spams and other shaddy stuffs; why do you think giving some CPU power for a background miner is any worst?

When I did the experiment I thought it was a good deal for users.

This is the likely end for any miner which run without user's consent. Most likely coin-hive the provider is soon going to find themselves on the list too.
>This is the likely end for any miner which run without user's consent.

Please, see my comment above.

It's your server. Change the terms ahead of time with like a two week notice.
There's a lot more interesting things you could do
Okay, I'm going to play devil's advocate here.

What if this was legal? It could be an alternative way to pay for website costs. We get rid of ads and replace it with a client side miner.

The idea to use bitcoin mining in place of ad revenue has been tried before (unfortunately the state of New Jersey didn't like it): https://venturebeat.com/2014/02/12/new-jersey-slaps-mit-bitc...
Actually New Jersey changed their mind. They didn't follow up with their investigation and concluded "we do not believe Tidbit was created for the purpose of invading privacy." https://www.eff.org/cases/rubin-v-new-jersey-tidbit
This discussion comes up every once in awhile. It's horribly inefficient.

Six years ago:

https://news.ycombinator.com/item?id=2566365

Additionally, does this automatically hook in to slush's pool or something? Bitcoin mining is practically useless on CPU; even the fastest CPUs out get way, way less than 10mhash. The average length of time to find a block at 9999khash and current difficulty is 1200+ days, so even that estimate is over-optimistic, so this isn't worth anything if your users don't sit on your site for 5 years+, unless it's hooked into a pool or some other contraption to pay on shares instead of blocks.

It hasn't gotten better.

This isn't bitcoin. The mining is completely different.
You're right.

Monero is different. To mine Monero, you have to calculate hashes with an algorithm called Cryptonight. This algorithm is very compute heavy and – while overall pretty slow – was designed to run well on consumer CPUs.

There are solutions to run the Cryptonight algorithm on a GPU instead, but the benefit is about 2x, not 10000x like for other algorithms used by Bitcoin or Ethereum. This makes Cryptonight a nice target for JavaScript and the Browser.

Would it be more efficient using Web Assembly ?
Just saw it, coin-hive use Web Assembly already :

Our miner uses WebAssembly and runs with about 65% of the performance of a native Miner.

IDK man, YouTube tries to force people into their inefficient video format, burning way more power because they refuse to pay for x264 licensing.
What makes you think it's illegal?
Some MIT students were harassed by the government when they built the idea at a hackathon a few years back.
Yeah, I wonder if I can run this on some apps. Just tell people up front - this app mines crypto, pay $1 to shut it off.
What if google or facebook would have this on their embed code?!
Seeing as how slow Facebook app is, they are probably mining both Bitcoin and Ethereum
They'd mine a few tons more by using native miners on their own servers instead of javascript on all the clients.
They probably don't, but how can you be sure without auditing each and every js embed that you download?
If this included they kind of code in a big % of websites, wouldn't this make the difficulty of getting new blocks so high that it would become an inefficient way of mining?
Use uMatrix from gorhill: https://github.com/gorhill/uMatrix

to block all third party connections unless required. It will stop the coin-hive mining script.

Lol, now that is a cranky maintainer.
I found the Proof of Work Captcha on Coinhive's signup page to be quite interesting:

https://coin-hive.com/account/signup

https://coin-hive.com/info/captcha-help

I'm not super familiar with the inner workings of the world of spam protection, but I'm curious if people think increasing the cost of spamming through extra workload for the machine as opposed to the human in this manner would be helpful to deter spammers in general? Seems like the lack of a human intervention requirement means that the spamming workflow can still be automated, but maybe the extra workload could cut into profits/throughput enough to make the site an unattractive target?

The other aspect of a solution like this where you can potentially recoup part of the damage done by spamming through their contribution to your mining operation, so you say hire a human moderator, is super interesting as well.

I know people will say this is inefficient, but based on the current climate I think this may have potential if:

1. The service provider (Coinhive) used not just BTC but all kinds of cryptocurrency

2. they make sure they switch over to the most lucrative cryptocurrency at the moment in realtime

3. makes sure the user (In this case thepiratebay) can cash out immediately, as in every day.

In this case, mining as a business model may make sense. I think it's impressive that they built something like this to begin with.

BTC isn't made to be mined on consumer machines and it hasn't been profitable for like 6-7 years. You are basically heating the planet for nothing.

Unless the person has a decent GPU and the currency supports that, it's still worthless, but it's a lot of trouble (and disrespectful to unaware users). But you're talking about a business plan that relies on new, worthless, speculative currencies to come and go for the next decade. Does anyone benefit from that? Does that sound stable?

That's why i said there should be a way to cash out immediately.

Of course if you were actually to do something like this, it will require a lot of thought, and I personally won't touch anything like this because I don't believe in junk currencies and would rather spend my time working on something meaningful.

But I think the idea itself is interesting and worth thinking about instead of just discounting it as "not efficient".

> BTC isn't made to be mined on consumer machines

That's exactly what it was made for. But the creators had the foresight to adjust the difficulty factor automatically as the hashrate - inevitably - would increase and this means that even though the speed with which GPU, FPGA and later ASIC based mining probably wasn't foreseen it still managed to remain relevant.

This was my first thought, even just speaking economically there's no way the revenue generated for tpb is greater than the electricity it's costing the victim.

Sure with GPUs this might change but JS is not ideal for this at the moment.

They're mining Monero, not bitcoin.
They way TPB seems to currently work is that there are thousands of clone sites operated by individuals, who find whatever way to earn money while hosting on something like Cloudflare.

They are connect to some sort of centralised server or perhaps just scrap the DHT themselves. For such operators, having alternative source of income is quite awesome. The problem is that they do not interact long with website, someone like Facebook would be much more useful.

Interesting, i honestly had no idea. Do you have a source for this? Would love to learn more about how these people operate in a distributed manner
It appears that it is Monero, not BTC.
Mining monero would make much more sense than BTC. (Apparently monero mining uses alot of memory and so can't easily be ASIC-ed.)
Reminder that if anyone's too lazy (or too paranoid) to download an extension that disables Javascript, you can do so manually via about:config in Firefox by toggling the "javascript.enabled" preference.
Of course you can block coinhive.min.js with your ad blocker to avoid this. Or just use NoScript.
I have been doing some back envelope calculation on this. Using the formula on the coin hive website and the current difficulty. At an average of 60 h/s per user you need 2k users to run the miner for 24hrs straight * 30 days to get any where near the 60 XMR promised in the example.

That is not to say the example is incorrect. Rather the difficulty in Monero has doubled in last month alone. In that case those 2k users needed to run this miner for 12 hours.

Tthe average increase in the difficulty on Monero is also surprising. Chart here: https://www.coinwarz.com/difficulty-charts/monero-difficulty...

It seems the spike in last month has been huge. All thanks to this miner?

This would make a good selling point for freelance website developer. "Make people come to website, to pay bills"
I won't begin to pretend that I'm a lawyer, but ESEA was fined $1MM for this not too long ago: https://www.theregister.co.uk/2013/11/20/esea_gaming_bitcoin...
Something tells me TPB won't be deterred by fines.
I don't think Pirate Bay cares about operating above the law.
This must be some incompetent developer who didn't even added the script tag.
> DO "THEY" REALLY SAY: "TECHNOLOGICAL PROGRESS IS SLOWING DOWN"?

Why is computer memory getting more expensive? DDR4 is now almost twice more expensive compared to 2016...

Because supply availability has decreased as it always does when there are major purchase orders made by everyone from Samsung to Apple.