I agree it sounds harsh, but I think for NOW it's the correct choice. Like any browser API that can be abused, the small number of valid sites are so overwhelmingly dwarfed by the dodgy ones. When I first heard about the "notifications" API I thought it was a great idea - so many valid use case! Now I want it to burn in a fire. Something with so few use cases as cryptomining should not be something that users blindly click yes to.

Could we make Javascript optional as well while we're at it?

"This site tries to run Javascript. Normal news sites shouldn't need this.

[Allow this session] [Allow 5 seconds] [Deny]"

I'd be particularily interested in the second option since it would allow us to use sites that depend on JS for content while they roll back the craziness that is depending on scripting to show static content.

While I'm at it:

I want badges!

- Certified Javascript free page (Platinum)

- Certified progressive site, no dependence on Javascript, no long running background scripts (Gold)

- etc

Obviously I'm exaggerating the implementations here but I'm serious about the idea.

(And yes, I earn good money on frontend work, I just think it often makes solutions worse.)

Ha ha, "certification" is a cool idea, but it would be hard to get anyone to care about it. "Allow 5 seconds" is a feature I really want now - I might dig into the Firefox code (or No-Script) and see if I can figure it out!

I have no-script on by default, and these days I need be convinced there's a REALLY good reason to temporarily whitelist a site.

Sure, a lot of the web is now either a blank page (or "you need to enable js to run this app") but on the positive side, I'm a lot more productive as I just close those sites and move on!

I've wanted the "allow 5 seconds" thing for a long time too.

You can manually pause and resume js by opening up the debugger and hitting pause. The code exists it just needs to be exposed to the UI.

How would this interact with onclick handlers on buttons and the like?

Would it be that after 5s the user couldn't interact with elements on the page like that (e.g. if they open an image, and wait a few seconds, they then couldn't close it because the 'x' onclick handler wouldn't run), or would each handler run by a user action (like an onclick) have 5 seconds to run?

Either, you could even have both as options.

The simplest way to do it would just be to pause js 5 (or maybe 15) seconds after page load, and have a button beside the url to resume/repause js.

The devtools keep working with js paused though, so it should be possible to do something like have a onclick handler that resumes and starts a timer to repause the js.

Ideally I think I'd like click's to resume js for a few seconds unless they are clicking on a link (with a href that leads to another page). I'm not certain that would be technically easy but it seems likely it would be.

This. The internet desperately needs to progress beyond an advertisement driven business model. Disallowing these scripts seems a little heavy handed. Perhaps the addition of a "requestComputeResources" method to the browser's api would give a way to throttle them instead of outright banning them.

They make it optional.

To be real, though, somewhere close to 0% (rounded to the third decimal place) of users would agree to grossly inefficient cryptomining in the browser. As a web funding model it is terrible and is almost always akin to malware. It certainly costs the user much more in electricity costs than it will ever benefit web publishers.

And as a global ecological cost, it's pretty huge.

>They make it optional.

Mozilla? Optional protection? Don't trigger my memories.

They also made it optional to block unsigned extensions, which you could turn off if you wanted to tweak one to fix a bug because it wasn't being maintained fast enough.

Like, if you believed in the whole Open Source/tinkering philosophy, or something, which Mozilla may or may not care about.

Then, they started disallowing it in 2016.

And they turned off key remapping too.

I wholeheartedly agree that we need to progress beyond the ad-driven business model but is in-browser mining really a plausible replacement?

For one thing it's probably not a good idea on battery-powered devices, so it's only useful for monetizing desktop browsing. It also means that the money you make out of it depends on the average power your "customer" has available to mine.

Beyond that since mining is a zero-sum game it means that the more people opt for this model, the less money they individually make. Maybe today you make on average 0.001cent per minute and per user and a year from now you make a tenth of that. You have absolutely zero control on it since it's merely a factor of the total hashrate and the cryptocurrency's value.

I have a hard time imagining how this could become mainstream. Tipping using cryptocurrency microtransaction seems more promising but even that is far from a solved problem. I'd rather directly send $.002 to the website rather than waste $.01 of electricity for the website to make $.001 out of it.

The thing is that with ad networks you're at their mercy, if they don't want to sell ads on your site, you have no other option. While it would be nice to have a micropayment system built into browsers themselves, cryptomining is kind-of the best option.

Nobody would use that API if they can just do it anyway without the users consent

There's not really a way to detect that someone is cryptomining, they can just do it with regular JS or webgl (which has a compute focused API in the works). I don't think either of those features could ever be opt-in. Detecting mining in WebAssembly would be even harder.