Hacker News Reader

Comment by emporas | Hacker News Reader

Requiring every user to compute it's own PoW is a terrible idea. It defeats the whole purpose. One's person expensive computation is another person's almost free computation.

I commented in the past about it:

"At first glance, yes, we can create intentionally expensive computations without relying on a blockchain, that would serve the same purpose. In reality we cannot. Special computer hardware (ASICs) could generate much cheaper PoW annotations than general purpose computers, and sell it to spammers. Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost."

https://news.ycombinator.com/item?id=33533389

View on HN

Looking cross-comment I think you're advocating for micro-payments or micro-proof-of-burn. This is better than having every user compute their own PoW as they'd purchase a small amount of cryptocurrency from an ASIC farm, which should be cheaper/faster/more efficient than using their local hardware. I mostly agree with the concept, but I don't think any such API exists yet with enough adoption to consider this a real option any time soon.

Right now, if I was to ask my users to do a proof of burn for $0.0001 of BTC most of them would just close my site as they don't have any BTC. The process of setting up an account on an exchange, waiting several hours/days for KYC checks to clear, adding a credit card, buying BTC, sending it to a browser extension, and then trying the signup again is a *significant* initial hurdle. If we were in a world where I could assume all my users already owned BTC, that's a different story, but we haven't seen adoption of cryptocurrency anywhere near that level. I don't expect PoW schemes to drive that adoption either, so this seems like a poor solution today.

Do you happen to know if a hCaptcha/mCaptcha-like micro-proof-of-burn tool exists already? I'd be happy to be proven wrong.

That brings us back to options that exist today, which includes every user computing their own PoW. Looking at mCaptcha some more, it uses a SHA256 derivative so it's compute-hard and vulnerable to GPUs/ASICs. The author mentions some of those concerns in an earlier thread [1]. I wonder if a different proof-of-work algorithm would be better, like a memory-hard PoW, proof-of-space, and/or proof-of-wait. I'm skeptical of those too, unfortunately.

[1] https://news.ycombinator.com/item?id=32341446

You are right in most of your points. Today it doesn't exist an API for micro_proof_of_burn. Economic incentives however require a little patience because they need to work their way through the system. 0.0001 BTC is hugely expensive. A blockchain with millionth of a cent transaction, is certainly possible, and it will exist in 2-3 years approximately.

In my calculations, with millionth of a cent per transaction, even paying for torrent blocks (64 KB), not torrent pieces (16KB) will soon become profitable.

Micropayment are 'profitable' save for anti-money-laundering laws (not to speak of anti-terrorism laws) which make any such payment have significant compliance costs. The only way to bypass that would be with centralized verification agencies to take liability (and demonetize anyone deemed controversial). Since they're centralized, they'll have zero use for blockchain (good riddance). Does anyone want that future?

Security is not all or nothing. There are many applications where adding a small bit of friction in the form of compute will stop 99.9% of abusive traffic. Visual captchas are a plague on the internet, but so is Blockchain mania.

I added FriendlyCaptcha to some of my sites, and stopped 100% of abusive traffic. Open source, user friendly, accessible to people with disabilities.

https://friendlycaptcha.com/

Most of us are not running amazon.com here.

Friendlycaptcha isn't open source, only the widget/client is. The sever seems to be closed source.

What about this? https://github.com/FriendlyCaptcha/friendly-lite-server

>This distribution is licensed under a non-commercial source available license

Thanks for the clarification. Indeed it is not open source in the truest sense, but I don't consider source-available to be closed-source. Especially when the main limitation seems to be a no reselling clause. This would not prevent most people from deploying to their SaaS for example. Even having the code available to audit is a plus. Again, perfection is the enemy of good.

I've found that black and white thinking in security is very dangerous, as you often end up with very "secure" controls that have terrible UX, which users bypass completely via byob etc... And pwnage ensues. UX is a primary pillar of security.

Nice solution, if that works for your site, perfect.

If i may add, in case someone desires a little bit of revenue from a website, one very popular solution is to put advertisements in some places. Well some people consider that a security hole, including me. So i guess the definition of security varies, but the security mania goes on for many decades. I am one of those security maniacs, and any tool to enhance security is important, blockchain is one of them.

Ethereum was pretty successfully ASIC-resistant. Other PoW algorithms are GPU-resistant. Even so, I doubt most spammers are sophisticated enough to create ASICs just to make cheaper requests to this guy's service.

Right - the argument here seems totally silly. The cost barrier to entry would be incredibly high.

Unlike blockchain systems, the implementation details of mcaptcha are also totally hidden, and you don't have to maintain compatibility at all.

Someone creates an asic? Great, you can make it not work anymore without affecting any of your users for real.

10+ million down the drain.

Specialized ASICs are not easy to come up with, what's more if it's in a tug of war you can expect those to suddenly become obsolete, rendering this approach too costly for a scrapper. Also you may have missed the part in the original link where they were using AWS to do the scrapping, so no ASICs there, and you pay by the minute, two things that would make PoW a valid countermeasure, no "free computation" in that setup.

You wouldn't need to host the ASICs (or even GPUs) in AWS, anything there can easily call back to a self hosted compute farm with the challenge.

As far as i know, btc and ethereum actively fight the ASICs, because they will diminish the profits of amateur miners, and will bring great centralization to the network. Which is true, and it is no problem.

The difference between this use case and bitcoin is algorithm mobility. All bitcoin miners must use the same algorithm and get the same result for it to work. This makes it very hard (read slow) to change the algorithm, so there's time and incentive to design, fabricate and deploy ASICs. For client-server PoW the server can choose a new algorithm whenever the old algorithm becomes ineffective.

> Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost.

So instead, what, you want people to buy BTC and send small amounts of it to websites?

Problem is, given varying income levels across society and across the world, one person's expensive micropayment is another person's almost free micropayment.

In a comment down below, i made it clear i was not referring to BTC. In the internet there is no centralized registry of naming projects. There are currently three projects in which the communities call themselves bitcoin. Any one of the other two bitcoins support much smaller microtransactions than BTC.

Very true, that micropayments could vary on their relative cheapness across the global population. Let's put a number, is 0.01 cent affordable by most people on the planet, for every http request?

So maybe you should link to the one you are referring to, if there are three projects with the same name.

I am talking about Bitcoin BSV. If the purpose of blockchain was solely to provide PoW, then there could exist a lot of blockchains, a thousand maybe. Economic incentives ensure that the most inefficient of blockchains will be put out of the market. So some of them, like btc will soon be put out of the market, because speed and microtransactions is the two factors every blockchain competes on.

https://www.binance.com/en/price/bitcoin-sv

> This coin is not listed on Binance for trade and service.

An obscure coin my users cannot purchase through major exchanges is a really poor solution. Sorry, that makes no sense.

I answered on the other comment, but at that point, in case there is a blockchain, which supports a millionth of a cent transaction, then exchanges (Binance, Coinbase etc) are not so useful. If every person just needs one cent for a million http requests, then one guy in your neighbourhood or your town, or your city might have some of it, you message him and he will send you a cent for free. You buy him a coffee, and he will give you in return, billions of http requests.

But again, economic incentives need to work their way into the system.

Yikes, that sounds terrible. The current best alternative is a visual captcha. I'm not driving around town to buy coffee for some random person just to be able to use the internet. That's not the sort of internet I want.

I am not suggesting that you should do that. As soon as we reach the sweet spot of transaction fees, between a thousandth of a cent, and a millionth of a cent, then every person will have a wallet with one dollar inside it, and send it to a site he visits and desires to not be considered a spammer.

In case you run out of proof_of_burn a friend of yours might send you just a cent, and you are good to go, for one hundred thousand http requests more. There is no need for a normal person, to hold more than a handful of dollars for every year's internet use.

That renders exchanges almost useless. Not totally useless, but much less relevant than they are today.

I personally wouldn't care less, if there is one bitcoin/blockchain which reaches that sweet spot, or if they are a hundred, including litecoin, ripple etc. PoW is meant to be used for practical reasons. Blockchain however constitutes an economic system, of suppliers-miners and consumers-users, it is more than just a software program. It will evolve in the future, and it requires some crucial time.

For the moment there no API which provides the kind of PoW service to be very useful, and some hacks might be required to mitigate side effects of relentless scraping. These are just hacks, useful today, but the real solution is coming soon. Web3 some people call it, or Cryptocosm is another name of it.

This doesn't make any sense.

ASIC's take tons of time and money to design.

Unlike blockchain, where the PoW algorithm is part of basic compatibility, it's not at all in mcaptcha - the users see a checkbox. The rest is implementation details.

If someone creates an ASIC, you can break it very easily by changing the PoW algorithm a bit, and no users are affected.

Even if someone has the money to keep up with you, which is remarkably expensive, they will be too slow right now.

That would be hard to change

>One's person expensive computation is another person's almost free computation

We have pretty good guides to what's an expensive computation to everyone. That's how password-hashing algorithms work, much better than BitCoin does. Besides, the existence of specialized methods of compute is hardly determinative. We're not trying to stop TLAs. It just needs to be expensive enough to stop 99%, and at most we'll later update again.

Reply on news.ycombinator.com