News for hackers. Stuff that matters.
Re:Proof-of-Work Defense for Onion Services by salawat on Thursday August 24, 2023 @07:31PM (#37255918)
So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else.

Plus, PoW is nothing but wasted, needless computation. Computing is not free. Every watt spent doing anything PoW is just that much more intensification of our current climate crisis.

As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect, fuck anyone who proposes PoW is a good idea for anything.

It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.

Re:Proof-of-Work Defense for Onion Services by thechao on Thursday August 24, 2023 @07:36PM (#37255959)
Maybe we can ask the DoSers to stop, nicely? Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running.
Re:Proof-of-Work Defense for Onion Services by maest on Friday August 25, 2023 @06:10PM (#37267625)
> Everything else being equal, I bet the Tor/Onion-folk are pretty smart people, and this is what they felt was necessary to keep the service running.

That's an appeal to authority and an attempt to shut down inquisitive thought and investigation.

Imo, this goes against the spirit of HN.

Re:Proof-of-Work Defense for Onion Services by nullc on Friday August 25, 2023 @07:19PM (#37268240)
It's an unconvincing argument, but not an attempt to shut down anything. By comparison, the grandparent comment was emotional and reactionary beyond the point of being expressly uncivil.

A better response might have been to point out that the level of POW is reactive. If there are no attacks ongoing it will use little to no resources. If it's effective, the attacks will largely stop (no point in attempting an attack that won't work) and so paradoxically this can potentially provide its benefit without actually having much usage.

If it works out that way the benefit vs costs are very good for pretty much any way of evaluating the costs. This is the kind of nuanced thinking that you'd expect from smart people, as the prior poster suggested (and, in fact, is pointed out in the design document).

Re:Proof-of-Work Defense for Onion Services by cinntaile on Thursday August 24, 2023 @07:46PM (#37256022)
> Computing is not free.

That's the whole point.

Re:Proof-of-Work Defense for Onion Services by hunter2_ on Thursday August 24, 2023 @07:59PM (#37256097)
What if instead of spending energy on compute, we just spend money instead? On the one hand, some people may be turned off by the idea of spending money, but on the other hand, the two are usually interchangeable unless you're stealing energy. Someone with a lot of money and no hardware or energy can purchase hardware and energy; someone with a lot of hardware and energy can sell the hardware and sell energy back to the grid to make money.
Re:Proof-of-Work Defense for Onion Services by ssklash on Thursday August 24, 2023 @08:21PM (#37256281)
How do you suggest the people who are using Tor for anonymity pay money to use Tor? That might make sense for cryptocurrencies, but for Tor I think it's unusable.
Re:Proof-of-Work Defense for Onion Services by foota on Thursday August 24, 2023 @08:37PM (#37256385)
I believe this could be done using zero knowledge proofs, ala tornado cash (which I'm not familiar with in practice, but I've read the algorithms behind it). You'd need some service that produces zero knowledge proofs that someone sent some funds to the service, and got their slot in return. Put down your pitchfork, but I think this would essentially be an NFT backed by a ZK-snark.
Re:Proof-of-Work Defense for Onion Services by pseudo0 on Thursday August 24, 2023 @08:26PM (#37256306)
The goal with Tor is to preserve privacy. Payment systems come with significant legal and regulatory overhead, KYC and AML, etc. That introduces significant privacy risk. Meanwhile PoW just requires owning a computing device.
Re:Proof-of-Work Defense for Onion Services by panny on Thursday August 24, 2023 @08:01PM (#37256111)
>So now you have the drawbacks of both as well

Everything has drawbacks. It's always a tradeoff in software. You want a really simple interface? Now you can't do complex things. And so on.

Instead of complaining loudly, why not be the change you want to see? Proof of CPU makes you hot? How about proof of RAM? How about about something else, which you thought of yourself, which is a great idea, which you shared with their team, which they would eagerly accept as a superior solution to proof of work?

Re:Proof-of-Work Defense for Onion Services by spencerchubb on Thursday August 24, 2023 @08:01PM (#37256113)
The proof of work only engages when there is a Denial of Service attack. So if you're going to be mad at anyone for useless consumption, be mad at the attacker.
Re:Proof-of-Work Defense for Onion Services by rlpb on Thursday August 24, 2023 @08:02PM (#37256121)
I think the presence of this PoW system might mean that this form of abuse is discouraged enough that in practice it means that PoW will not be required. Who is going to compete with a huge amount of compute to DoS others? They'd need the same compute as all legitimate access put together to get to just 50% effectiveness.

If this is the case and in practice PoW is never required, then your rant is moot, and instead it is interesting that this effect occurs.

Re:Proof-of-Work Defense for Onion Services by kaveh_h on Thursday August 24, 2023 @10:12PM (#37257081)
My thought exactly. Would be interesting if they shared metric of pre and post level of DDoS attacks so there was some proof this scheme actually has desired effect.
[dead]
Re:Proof-of-Work Defense for Onion Services by jrajav on Thursday August 24, 2023 @08:19PM (#37256266)
This stinks of hollywood accounting, like a lot of "negative carbon" plans for things that would otherwise be nonsensical for.

The premise here is that if Bitcoin mining uses an energy source that inherently captures carbon or methane, then it's "carbon negative?" This ignores the fact that the energy budget is shared. We could just as well use that same energy for something else currently on carbon-based sources. So, energy is still being wasted on crypto speculation - you've just fudged the total energy budget calculations by pretending it doesn't apply here.

Re:Proof-of-Work Defense for Onion Services by kevinak on Thursday August 24, 2023 @08:54PM (#37256524)
I don't think it does at all.

Burning methane has positive effects on global warming since methane is way way waaaaaaay worse than CO2. Taking care of landfills that are largely untouched, just spewing methane is a good thing. If Bitcoin ends up having a net-negative effect on global warming, how is that a bad thing?

You're assuming that all energy sources are well-connected to a grid that can handle the electricity that is generated, that's not the case at all. You can't "use that same energy for something else currently on carbon-based sources" without major infrastructure costs.

Re:Proof-of-Work Defense for Onion Services by foota on Thursday August 24, 2023 @08:23PM (#37256288)
To the sibling, while I largely agree, I think there's some argument that building out additional manufacturing capacity for renewables even if it goes towards crypto mining has beneficial knock on effects for reducing the cost of the equipment provided that the learning curve effect and economies of scale outweigh the competition for resources, which to be fair isn't guaranteed.
Re:Proof-of-Work Defense for Onion Services by kevinak on Thursday August 24, 2023 @09:01PM (#37256569)
It's mainly the fact that Bitcoin mining sets a price floor on electricity prices. It's a buyer of last resort. Without it you'll get negative electricity prices and less investment in renewables.

See for example what Ercot has to say about Bitcoin mining: https://www.youtube.com/watch?v=gKnRfDeFgr0

Re:Proof-of-Work Defense for Onion Services by foota on Thursday August 24, 2023 @09:25PM (#37256732)
Who needs batteries when you have Bitcoin?
Re:Proof-of-Work Defense for Onion Services by kevinak on Friday August 25, 2023 @04:44AM (#37259500)
Until you can solve the climate crisis with batteries alone you need other solutions to step-in in the meantime.

Also, batteries don't help when the electricity is in the middle of nowhere and not connected to the grid.

Re:Proof-of-Work Defense for Onion Services by foota on Thursday August 24, 2023 @08:20PM (#37256272)
Without this proof of work, users can be arbitrarily denied access due to overload.

With the proof of work, I think the assumption is that a legitimate user will be willing to accept a sufficient delay to make botnet DoS attack impossible.

The counter argument might be that the botnet can generate arbitrarily hard proof of work, but this isn't true. Assuming some fixed capacity by the botnet, and that the botnet needs to send some amount of requests per time in order for the attack to be effective (e.g., if they only send one proof of work request per minute, then the "bid" for the rest of the time is quite low), then there's some maximum effective "price" based on the capacity of the botnet past which a user is guaranteed access.

For example say a botnet has access to a million compute nodes, so they have 1 million proof of work seconds per second.

If there's a service which can serve 1000 requests per second, then the average proof of work seconds they have per request is 1000 seconds of proof, so as long as the user is able to provide 17 minutes of proof of work, they can get access. In reality, the user's hardware is likely more capable than the attacker's botnet (which is probably IoT devices etc.,) so the ratio is more favorable.

I find it amusing that this approach is pretty on brand for onion services, as an invisible hand type market solution from what I'd consider to be a fairly libertarian leaning group.

Re:Proof-of-Work Defense for Onion Services by _blk on Thursday August 24, 2023 @08:25PM (#37256301)
Oops, with that message the temp just went up to 110.
Re:Proof-of-Work Defense for Onion Services by synesso on Thursday August 24, 2023 @09:09PM (#37256620)
This is an example of the common fallacy of conflating energy consumption with carbon-intensive energy generation.
Re:Proof-of-Work Defense for Onion Services by wmf on Thursday August 24, 2023 @11:19PM (#37257609)
That's what you get when the powers that be have spent decades promoting guilt-tripping instead of internalizing the externalities.
Re:Proof-of-Work Defense for Onion Services by cool_dude85 on Thursday August 24, 2023 @11:23PM (#37257640)
"Conflating" energy consumption with energy generation, which here in the real world is still predominantly carbon intensive? I wouldn't say there's much conflating going on, rather, recognition of the reality we live in.
Re:Proof-of-Work Defense for Onion Services by AnthonyMouse on Friday August 25, 2023 @12:44AM (#37258179)
It's addressing the problem from the wrong end. If you replace your generating capacity with non-carbon sources then energy consumption is no problem. If you don't, you have a problem even at the current level of consumption, and that problem continues to have the same solution.

It's not even impossible for increased consumption to lower carbon emissions, because to meet the higher peak demand you may need to add more generating capacity. When the new capacity is renewables or nuclear then it adds no carbon emissions during peak usage times and allows for a reduction in carbon emissions whenever the grid is at less than full capacity by assigning the remaining load to the new plants and spinning down the legacy fossil fuel ones that would otherwise have been used.

Re:Proof-of-Work Defense for Onion Services by goodpoint on Friday August 25, 2023 @05:27AM (#37259723)
Wrong. Currently most electricity is generated from sources that release co2. Also, all the energy used in computation is ultimately released as heat anyways!
Re:Proof-of-Work Defense for Onion Services by Uptrenda on Friday August 25, 2023 @02:30AM (#37258748)
IDK, a mechanism that helps Tor continue to run does not seem like a 'wasted', 'needless' computation to me. People literally use Tor to protect themselves in situations that might result in heavy penalties for exposing the truth (maybe even torture or death.) If hidden nodes can be easily DDoSed it just makes it easier to censor the facts (and that can be dangerous.) Tor really does represent the best of us.
Re:Proof-of-Work Defense for Onion Services by dontupvoteme on Friday August 25, 2023 @02:39AM (#37258808)
[delayed]
Re:Proof-of-Work Defense for Onion Services by thephyber on Friday August 25, 2023 @04:17AM (#37259344)
This proposal applies a temporary cost to DoS and DDoS — which itself is already a big waste of power. This proposal has the ability (if it works as planned) to destroy DoS + DDoS as an effective tool against this kind of server. Likely a net positive in terms of power usage.

Remember that this PoW proposal is a market. If the server has unconsumed cycles (eg. Is not saturated), the POW spot price can remain 0. The server only needs to set a PoW price after the server’s resources near saturation. For the same reason auctions end because nobody is willing to pay infinity dollars, clients can forego PoW and can opt to check back in on the server later when costs subside.

Re:Proof-of-Work Defense for Onion Services by mdekkers on Friday August 25, 2023 @08:26AM (#37260915)
> Every watt spent doing anything PoW is just that much more intensification of our current climate crisis.

> It isn't interesting. It's the most egregious example of conspicuous consumption on the planet.

This cannot be overstated. PoW needs to die. It is a lazy implementation that just sounds clever but is nothing of the sort. It kills our habitat. It has to go.

Re:Proof-of-Work Defense for Onion Services by SamPatt on Friday August 25, 2023 @11:22AM (#37262725)
>Every watt spent doing anything PoW is just that much more intensification of our current climate crisis.

Every watt spent doing anything, period, right? Like using your computer to send comments on HN?

Or streaming video? Or any one of a million things that humans do which aren't strictly necessary for survival but we do them anyway?

The tirade against PoW is absurd. It's useful, get over it.