“An on-page advert was mining bitcoin in my browser”
twitter.com
twitter.com
I keep telling my other friend it would be really great if we could get a botnet going to mine Ethereum via GPU since ASIC mining isn't a thing in Ethereum because of it's resistance to it. Although, if they ever roll out the proof of stake concept then all mining seems to just evaporate then. Of course I don't plan on risking felony charges to mine Ethereum, but it is fun to think about.
For what you are saying, I think it would be necessary for the original request to come from the site owner to pass through to the end-user, which I don't believe is the case. If that were the case, ad-blockers would have a much harder time determining the source of the content.
> Mining bitcoin won't need 40MB of download.
Are you sure? I would think something like cgminer compiled to wasm/asm.js could be a 40MB payload.
For more context, OP states:
> "checked sources and discovered it was a Bitcoin add in iframe, looked at JS it used"
> "It was also an ad for a btc exchange/wallet thing, so maybe the mining was just to recoup some cost?"
The nebulous "sources" referred to might be something credible. I imagine bitcointalk.org may have a thread on malicious ads like this.
If it's more profitable to mine $ARBITRARY_ALT_COIN than Bitcoin, then people would mine $ARBITRARY_ALT_COIN until the profitability equalized.
> Are you sure? I would think something like cgminer compiled to wasm/asm.js could be a 40MB payload.
There's no need for that: https://github.com/jwhitehorn/jsMiner
That's a reasonable theory but I don't think it holds. Given that (1) $ARBITRARY_ALT_COIN aren't typically well-known, (2) setting up mining may require different hardware/software to enable computing this PoW, that pool, etc, (3) coins and pools have interesting reward & difficulty adjustment algorithms, some better designed to deter coin-hopping. On some coarse-enough scale the general claim of equalization is reasonable -- the differences will be minimized over time. But I have seen times when you could make 5-10% more by mining $ARBITRARY_ALT_COIN (and perhaps taking the altcoin to exchange for bitcoin).
> There's no need for that: https://github.com/jwhitehorn/jsMiner
shrug, seems like we're on a tangent. This thread was speculating about whether the claim of an ad-served-miner exists. The fact that a small JS miner exists for one PoW doesn't seem to rule out the original claim, nor does it rule out the possibility that a wasm/asm.js cgminer might exist.
Right - maybe you could even make 100% more with an alt, for a limited period. My point is that you'd need to be able to make 20000x as much as you could make with Bitcoin before you reach parity with using traditional ads.
> shrug, seems like we're on a tangent. This thread was speculating about whether the claim of an ad-served-miner exists. The fact that a small JS miner exists for one PoW doesn't seem to rule out the original claim, nor does it rule out the possibility that a wasm/asm.js cgminer might exist.
Gotchya. I was just trying to show that giving access to computing resources instead of viewing ads is not currently anywhere close viable.
Thats.... what people do.
Market inefficiencies come up predictably because coins have different block reward and emission schedules. They have different algorithms which give advantages to different processors. The market efficiency time sometimes requires a completely new fabrication line created in china, this gives significant times till mining arbitrage goes away.
Similarly, multipool miners have software which automatically switches to different blockchain networks when the yield is favorable.
It is a mistake to think there is no opportunity just because someone told you there are always smarter more observant people profiting off the opportunity.
I agree - I'm not denying that there are ever opportunities for arbitrage, I'm merely asserting that there isn't going to be an alt out that there is "significantly" more profitable to mine than Bitcoin itself.
I would still disagree, my first thought was defining significantly. When 300% more profitable are the typical differences in yield, how is that insignificant? So then I decided the logical rebuttal would be "over time", where the assertion would be that it isn't significantly more profitable over time.
The rebuttal to that is that baskets of alt coins outperform bitcoin significantly, again by at least 300% barring the worst luck.
And even in a bad year for alts, it is possible to find a difficulty algorithm that you can game giving you an advantage that nobody else notices.
Really the ROI is vs a 40MB download and a few days of R&D.
But this isn't exactly an argument that it can't be happening. They might have failed to understand just how futile it would be.
The mining is just an added bonus.
I guess I'll help:
The costs in this case would be the time and cost of programming and bundling the ad, as well as the ad spend of getting the ad shown. The earnings would be in cryptocurrency. Any non-zero amount of cryptocurrency earned would mean you have a return .... on investment, and any cryptocurrency amount now or in the future that is valued at more than your costs means you have an ROI greater than zero.
Mining pools count shares of work toward the pool itself finding a block, based on processing power contributed to a pool. So it doesn't matter if users uncovered and uninstalled your mining-ware after 5 minutes in the most technical savvy outlier case, the shares of their processing power was already submitted to the pool and that account got paid.
So wouldn't it be hard or almost impossible to say they have an ROI of zero? They are probably making a good amount of money.
In reality, jsMiner is the only JavaScript Bitcoin mining utility of which I'm aware, and it only uses CPU. A modern machine's CPU is only going to yield a hashrate of 5 MH/s or so, which means you'd have to mine for them for 20,000 hours to equal the revenue generated by your eyes being exposed to a traditional ad.
In short, your PC is too slow by several orders of magnitude to make this a viable replacement for traditional ads.
Something like https://www.nicehash.com/ but delivered in a manner that they layman can agree to by just clicking "go ahead"?
Or, as is far more likely because people tend to do first and ask later, in small print at the bottom of the page "by opening this page you agree to let us use your CPU and GPU resources for what-ever we want, if you want us to stop using your CPU and GPU resources you can opt out by closing this tab/window"...
While I doubt mining bitcoin is going to be worth the hassle currently, other currencies might be, other tasks might be (generating rainbow tables for hash attacks?), and if it is bitcoin maybe that algorithm was just picked as a test for the delivery mechanism.
As JS JiT compilers get better and other tech that might help number-crunching becomes commonly available (webassembly? does webGL allow useful access to GPU processing power?) this sort of thing might become common too.
For people doubting the idea for ROI reasons: if the time to code the mechanism isn't time you would have otherwise paid for, and the delivery network isn't one you run but one you've managed to secret your code into by surreptitious means, then the investment is practically zero and any return is a profit. Heck, for some he intellectual challenge and/or willy-waving potential might be profit enough!
Of course, without seeing the code in question I would say it is far more likely that this is just a really badly coded animated advert or advert cycling code, chewing CPU with unneeded DOM changes & redraws and eating 40Mb of bandwidth constantly reloading content for animation frames that could be cached in a better design. The link to crypto-currencies just because the user had a bitcoin related advert on-screen at the time is, while possible, quite a distant conclusion to jump to IMO.
There was an entire mining botnet operating for weeks using the same CIA exploit that the Wannacry attackers used. It made a lot more than Wannacry did.
Wannacry's ameteurish and public ways led to patches that both exposed the existence of and killed the botnet.
An advantage for all of us that actually get this market. Perpetuated market inefficiencies due to ignorance
https://github.com/howardchung/jsminer/blob/master/README.md
The major difference is that the bitcoin ad might actually be profitable at some point.