News for hackers. Stuff that matters.
Re:“An on-page advert was mining bitcoin in my browser” by the_stc on Tuesday August 29, 2017 @09:54AM (#15124261)
I highly doubt this. He cites 40MB of downloads plus high CPU usage. Mining bitcoin won't need 40MB of download. Plus it has an ROI of 0. Even with free adspace this would not be worthwhile. More likely is someone just fucked up their ad.
Re:“An on-page advert was mining bitcoin in my browser” by wyldfire on Tuesday August 29, 2017 @10:08AM (#15124347)
The ROI is likely nonzero for some coins out there. Bitcoin's difficulty would be too high to make much money even if the ad were served to a very large number of computers. But other non-SHA coins (CryptoNight-based PoW, e.g.) or low-difficulty coins might be worthwhile.

> Mining bitcoin won't need 40MB of download.

Are you sure? I would think something like cgminer compiled to wasm/asm.js could be a 40MB payload.

For more context, OP states:

> "checked sources and discovered it was a Bitcoin add in iframe, looked at JS it used"

> "It was also an ad for a btc exchange/wallet thing, so maybe the mining was just to recoup some cost?"

The nebulous "sources" referred to might be something credible. I imagine bitcointalk.org may have a thread on malicious ads like this.

Re:“An on-page advert was mining bitcoin in my browser” by LyndsySimon on Tuesday August 29, 2017 @11:03AM (#15124752)
> The ROI is likely nonzero for some coins out there.

If it's more profitable to mine $ARBITRARY_ALT_COIN than Bitcoin, then people would mine $ARBITRARY_ALT_COIN until the profitability equalized.

> Are you sure? I would think something like cgminer compiled to wasm/asm.js could be a 40MB payload.

There's no need for that: https://github.com/jwhitehorn/jsMiner

Re:“An on-page advert was mining bitcoin in my browser” by ringaroundthetx on Tuesday August 29, 2017 @12:51PM (#15125641)
> If it's more profitable to mine $ARBITRARY_ALT_COIN than Bitcoin, then people would mine $ARBITRARY_ALT_COIN until the profitability equalized.

Thats.... what people do.

Market inefficiencies come up predictably because coins have different block reward and emission schedules. They have different algorithms which give advantages to different processors. The market efficiency time sometimes requires a completely new fabrication line created in china, this gives significant times till mining arbitrage goes away.

Similarly, multipool miners have software which automatically switches to different blockchain networks when the yield is favorable.

It is a mistake to think there is no opportunity just because someone told you there are always smarter more observant people profiting off the opportunity.

Re:“An on-page advert was mining bitcoin in my browser” by LyndsySimon on Tuesday August 29, 2017 @01:24PM (#15125939)
> It is a mistake to think there is no opportunity just because someone told you there are always smarter more observant people profiting off the opportunity.

I agree - I'm not denying that there are ever opportunities for arbitrage, I'm merely asserting that there isn't going to be an alt out that there is "significantly" more profitable to mine than Bitcoin itself.

Re:“An on-page advert was mining bitcoin in my browser” by ringaroundthetx on Tuesday August 29, 2017 @02:25PM (#15126473)
Okay

I would still disagree, my first thought was defining significantly. When 300% more profitable are the typical differences in yield, how is that insignificant? So then I decided the logical rebuttal would be "over time", where the assertion would be that it isn't significantly more profitable over time.

The rebuttal to that is that baskets of alt coins outperform bitcoin significantly, again by at least 300% barring the worst luck.

And even in a bad year for alts, it is possible to find a difficulty algorithm that you can game giving you an advantage that nobody else notices.

Re:“An on-page advert was mining bitcoin in my browser” by wyldfire on Tuesday August 29, 2017 @12:22PM (#15125373)
> If it's more profitable to mine $ARBITRARY_ALT_COIN than Bitcoin, then people would mine $ARBITRARY_ALT_COIN until the profitability equalized.

That's a reasonable theory but I don't think it holds. Given that (1) $ARBITRARY_ALT_COIN aren't typically well-known, (2) setting up mining may require different hardware/software to enable computing this PoW, that pool, etc, (3) coins and pools have interesting reward & difficulty adjustment algorithms, some better designed to deter coin-hopping. On some coarse-enough scale the general claim of equalization is reasonable -- the differences will be minimized over time. But I have seen times when you could make 5-10% more by mining $ARBITRARY_ALT_COIN (and perhaps taking the altcoin to exchange for bitcoin).

> There's no need for that: https://github.com/jwhitehorn/jsMiner

shrug, seems like we're on a tangent. This thread was speculating about whether the claim of an ad-served-miner exists. The fact that a small JS miner exists for one PoW doesn't seem to rule out the original claim, nor does it rule out the possibility that a wasm/asm.js cgminer might exist.

Re:“An on-page advert was mining bitcoin in my browser” by LyndsySimon on Tuesday August 29, 2017 @01:28PM (#15125968)
> But I have seen times when you could make 5-10% more by mining $ARBITRARY_ALT_COIN (and perhaps taking the altcoin to exchange for bitcoin).

Right - maybe you could even make 100% more with an alt, for a limited period. My point is that you'd need to be able to make 20000x as much as you could make with Bitcoin before you reach parity with using traditional ads.

> shrug, seems like we're on a tangent. This thread was speculating about whether the claim of an ad-served-miner exists. The fact that a small JS miner exists for one PoW doesn't seem to rule out the original claim, nor does it rule out the possibility that a wasm/asm.js cgminer might exist.

Gotchya. I was just trying to show that giving access to computing resources instead of viewing ads is not currently anywhere close viable.

Re:“An on-page advert was mining bitcoin in my browser” by SparkyMcUnicorn on Tuesday August 29, 2017 @10:12AM (#15124378)
Also, he says "It may have been another currency, I can't be certain. Should have generalised"

https://twitter.com/adamjogrady/status/902533084767072258

Re:“An on-page advert was mining bitcoin in my browser” by Rjevski on Tuesday August 29, 2017 @10:08AM (#15124352)
Well given that mining bitcoin in a browser isn't even remotely profitable, someone crazy enough to do it anyway would also be crazy enough to not give a fuck about their code's efficiency and download 40MB's worth of data.
Re:“An on-page advert was mining bitcoin in my browser” by Retric on Tuesday August 29, 2017 @10:33AM (#15124537)
Mining on GPU's is generally not profitable, but if you don't pay for the GPU or electricity then numbers look different. Especially if you get some people that keep active tabs open for days.

Really the ROI is vs a 40MB download and a few days of R&D.

Re:“An on-page advert was mining bitcoin in my browser” by Rjevski on Tuesday August 29, 2017 @10:34AM (#15124546)
I doubt browser-based mining is even using the GPU at all.
Re:“An on-page advert was mining bitcoin in my browser” by Retric on Tuesday August 29, 2017 @11:15AM (#15124832)
Re:“An on-page advert was mining bitcoin in my browser” by rtkwe on Tuesday August 29, 2017 @11:04AM (#15124763)
Depends on how much each ad cost them. The main reason that ASICs are the only profitable way to mine is because of electricity costs and by running this ad they're shunting that cost onto the user of the site. In place of that is the cost to serve an ad which can be really cheap. I could see the math working out buying a lot of really long tail terms super cheap.
Re:“An on-page advert was mining bitcoin in my browser” by the_stc on Tuesday August 29, 2017 @11:16AM (#15124838)
CPU mining is not profitable even for free. Assume they get 5 minutes of computation per ad at 100H/s. They need billions of ads a day just to get 1GH/s, which is around 48 cents a year.
Re:“An on-page advert was mining bitcoin in my browser” by kardos on Tuesday August 29, 2017 @10:13AM (#15124381)
I only somewhat doubt this. Someone was thinking "1e-8 bitcoins per pageload, times 100000 people per day, ...". If they sort out how to leverage the GPU via javascript then they might make a little profit.
Re:“An on-page advert was mining bitcoin in my browser” by mikeash on Tuesday August 29, 2017 @10:42AM (#15124607)
I don't think it's even that high. It looks like most GPUs are well under 1GH/s. If we assume 1GH/s, then at the current difficulty and exchange rate, if a page load gives you one minute of computation on average (wild guess, but seems reasonable), you're looking at about $5e-7 dollars per pageload. That's 5 cents/day if you get 100,000 people per day.

But this isn't exactly an argument that it can't be happening. They might have failed to understand just how futile it would be.

Re:“An on-page advert was mining bitcoin in my browser” by delinka on Tuesday August 29, 2017 @10:16AM (#15124406)
WebGL shaders, right?
Re:“An on-page advert was mining bitcoin in my browser” by hdra on Tuesday August 29, 2017 @10:24AM (#15124462)
They don't need any ROI from the mining though, they're paying for the ads to their exchange. They only need the ROI on the visitors to their website.

The mining is just an added bonus.

Re:“An on-page advert was mining bitcoin in my browser” by ringaroundthetx on Tuesday August 29, 2017 @10:28AM (#15124501)
It has an infinite ROI if you are using other people's processing and electricity.
Re:“An on-page advert was mining bitcoin in my browser” by paulpauper on Tuesday August 29, 2017 @10:43AM (#15124612)
if the code hurts performance to such a degree that it is uncovered and uninstalled, then no
Re:“An on-page advert was mining bitcoin in my browser” by ringaroundthetx on Tuesday August 29, 2017 @10:56AM (#15124691)
To say and defend that you would have to either not know how ROI works, or how mining pools work, or both....

I guess I'll help:

The costs in this case would be the time and cost of programming and bundling the ad, as well as the ad spend of getting the ad shown. The earnings would be in cryptocurrency. Any non-zero amount of cryptocurrency earned would mean you have a return .... on investment, and any cryptocurrency amount now or in the future that is valued at more than your costs means you have an ROI greater than zero.

Mining pools count shares of work toward the pool itself finding a block, based on processing power contributed to a pool. So it doesn't matter if users uncovered and uninstalled your mining-ware after 5 minutes in the most technical savvy outlier case, the shares of their processing power was already submitted to the pool and that account got paid.

So wouldn't it be hard or almost impossible to say they have an ROI of zero? They are probably making a good amount of money.