Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proof-of-Work Defense for Onion Services

blog.torproject.org

Post reply on HN
Print view View original

91–100 of 159 posts

Re: Proof-of-Work Defense for Onion Services

#91

Post by wmf »

synesso wrote: post #74
salawat wrote: post #36

Earlier quoted context omitted.

So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation . Computing is not free . Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect,…

This is an example of the common fallacy of conflating energy consumption with carbon-intensive energy generation.

That's what you get when the powers that be have spent decades promoting guilt-tripping instead of internalizing the externalities.

Re: Proof-of-Work Defense for Onion Services

#92

Post by cool_dude85 »

synesso wrote: post #74
salawat wrote: post #36

Earlier quoted context omitted.

So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation . Computing is not free . Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect,…

This is an example of the common fallacy of conflating energy consumption with carbon-intensive energy generation.

"Conflating" energy consumption with energy generation, which here in the real world is still predominantly carbon intensive? I wouldn't say there's much conflating going on, rather, recognition of the reality we live in.

Re: Proof-of-Work Defense for Onion Services

#93

Post by croshan »

enigmurl wrote: post #89
capableweb wrote: post #76

Earlier quoted context omitted.

From https://github.com/tevador/equix/blob/master/devlog.md > The service would give the request a priority value based on the "difficulty" of the puzzle solution. Seems like single clients could increase the difficulty to higher than what the bot net would do (so it gets priority), and hence get access. Operators of the bot net would probably hard code one value as the difficulty, and it would be lower than what you…

Would it really be lower on the bot net in the majority of cases? I'd imagine that real users probably wouldn't want to have their entire cpu spent on this.

real users have more CPU than a literal toaster (or smart air fryer, or IP camera, or many other common botnet devices)

Re: Proof-of-Work Defense for Onion Services

#94

Post by Zuiii »

IngvarLynn wrote: post #69

It's a shame that Torproject has decided to reinvent its own wheel, lagging 10 years behind the crypto crowd, instead of integrating with existing coin(s). The problem is, such integration would require the chosen coin to be anonymous, which is essentially forbidden: https://www.theverge.com/2023/8/23/23843161/tornado-cash-ind...

I agree with you in principle. Wasting energy like what this and hashcash do is unfortunate but that's what happens when you have an irrational hate towards a technology rather than how it is used.

That said, modeling it after a general cryptocurrency is probably a bad idea since it rising prices may prevent legitimate clients from being able to connect to onion services due to the challenge being too expensive (either in terms of computation or accusation). I think a much practical approach is to have each visitor contribute to a partial solution that can then be combined to derive funds (much like how mining pools work). That way, clients will be completely isolated from cryptocurrency and sites can actually benefit from the work rather than just throwing it away. It's a win-win situation.

I hope the next generation learns from our senseless technology-burnings.

Re: Proof-of-Work Defense for Onion Services

#95

Post by AnthonyMouse »

croshan wrote: post #93
enigmurl wrote: post #89

Earlier quoted context omitted.

Would it really be lower on the bot net in the majority of cases? I'd imagine that real users probably wouldn't want to have their entire cpu spent on this.

real users have more CPU than a literal toaster (or smart air fryer, or IP camera, or many other common botnet devices)

Not only that, real users actually want to use the service, not overload it. A real user might only make one request a second. A botnet device is trying to make a thousand requests per second to overload the server. Even if they each have the same CPU as a normal user, now each node in the botnet can only make as many requests per second as a user or the user can outbid them.

Re: Proof-of-Work Defense for Onion Services

#96

Post by emporas »

hedora wrote: post #26
codetrotter wrote: post #10

Earlier quoted context omitted.

There are PoW algorithms specifically developed to resist GPU and ASIC. Typically they do this by being memory intensive instead of (or in addition to) being compute intensive.

Regardless, you need a device that’s more powerful than whatever the attacker is using. The article says they target 1 minute solve times under load. If that’s 1 minute on a 5GHz, 64 core machine with 512GB ram, an A100 and an FPGA, then it’s going to be at least 5-15 minutes on your phone. Also, the server farm can parallelize work across an arbitrary number of challenges, but legitimate users cannot.

Requiring regular users to compute PoW is a terrible idea. Actually it has the exact opposite effect. It will keep the attackers in, and the regular users out.

The problem is that we don't know how much is a cheap computation without first relying on a marketplace of computation and discovering the price. That marketplace of computation does exist, and it's called blockchain.

Re: Proof-of-Work Defense for Onion Services

#98

Post by AnthonyMouse »

cool_dude85 wrote: post #92
synesso wrote: post #74

Earlier quoted context omitted.

This is an example of the common fallacy of conflating energy consumption with carbon-intensive energy generation.

"Conflating" energy consumption with energy generation, which here in the real world is still predominantly carbon intensive? I wouldn't say there's much conflating going on, rather, recognition of the reality we live in.

It's addressing the problem from the wrong end. If you replace your generating capacity with non-carbon sources then energy consumption is no problem. If you don't, you have a problem even at the current level of consumption, and that problem continues to have the same solution.

It's not even impossible for increased consumption to lower carbon emissions, because to meet the higher peak demand you may need to add more generating capacity. When the new capacity is renewables or nuclear then it adds no carbon emissions during peak usage times and allows for a reduction in carbon emissions whenever the grid is at less than full capacity by assigning the remaining load to the new plants and spinning down the legacy fossil fuel ones that would otherwise have been used.

Re: Proof-of-Work Defense for Onion Services

#99

Post by kragen »

milsorgen wrote: post #86
kragen wrote: post #81

Earlier quoted context omitted.

is it really running hashes, or is it probing your browser to see if your video card drivers look like phantomjs

I was actually quite curious about that and I found this. >With a JS challenge, Cloudflare presents challenge page that requires no interaction from a visitor, but rather JavaScript processing by their browser. >The visitor will have to wait until their browser finishes processing the JavaScript, which should be less than five seconds. https://developers.cloudflare.com/fundamentals/get-started/c...

that permits both possibilities

Re: Proof-of-Work Defense for Onion Services

#100

Post by dotnet00 »

IngvarLynn wrote: post #69

It's a shame that Torproject has decided to reinvent its own wheel, lagging 10 years behind the crypto crowd, instead of integrating with existing coin(s). The problem is, such integration would require the chosen coin to be anonymous, which is essentially forbidden: https://www.theverge.com/2023/8/23/23843161/tornado-cash-ind...

I think it's pretty great that Tor hasn't tied itself to crypto that deeply given how the vast majority of crypto users don't actually give a shit about privacy, only the appearance of it.
Post reply on HN