Live data from Hacker News

CBS's Showtime caught mining crypto-coins in viewers' web browsers

go.theregister.com

211–220 of 220 posts

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#211

I bet some clever person on the marketing team just went ahead and inserted the tag. My first experience on a large corporate dev team was eye-opening. While the core product code was version controlled and reviewed, the marketing team had the power to insert any kind of scripts onto the page without clearance. In theory, anything new on the page would require many ridiculous meetings. In practice, they could and did…

As a marketer and coder, I appreciate those loopholes to make sh*t work (I used to do it all of the time, and was pretty much the basis I was hired on at my previous job) :) although I would concede giving anyone the option if they don't have tech experience is a nightmare waiting to happen.

You bring up an interesting tangent that I'll speak to. As a marketer who needs to get things done, I feel you. At this organization, this was in the general interest of all of the middle managers as well. This encouraged more and more off the shelf "solutions" to be jammed in, and misorganization of the core team development. I was a contractor here, and the core code base was crammed with bandage quick fixes to the point where it was actually suggested to use Google tag manager to to change code on the fly for other third-party scripts.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#212

Earlier quoted context omitted.

Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems. The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically). Heartbleed was an issue of exactly this "The Heartbleed bug allows anyone on the Internet to read the memory of the systems prot…

No i was only arguing it's not as easy as you think. Just like your solution you suggested can easily be hacked, any technological solution a human being comes up with is vulnerable to hacks. The only thing I was criticizing was you seem to think it's easy to simply create a secure system. It's not. That's why there are tons of smart people in security but hacks still happen.

He's saying we know how to increase the energy needed to compromise a system, while spending less energy than would otherwise happen in the case of compromise. The harder a task is, the less often the task occurs.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#213

Earlier quoted context omitted.

Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems. The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically). Heartbleed was an issue of exactly this "The Heartbleed bug allows anyone on the Internet to read the memory of the systems prot…

No i was only arguing it's not as easy as you think. Just like your solution you suggested can easily be hacked, any technological solution a human being comes up with is vulnerable to hacks. The only thing I was criticizing was you seem to think it's easy to simply create a secure system. It's not. That's why there are tons of smart people in security but hacks still happen.

Yes hacks still happen. See pharrington's response. I don't think it's easy to create a secure system. I'm in favor of making software more difficult to hack. I think the Heartbleed example speaks for itself.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#214

Earlier quoted context omitted.

Wish there was open-source browser that did this, with SecureBrowser*tm concept in my above post to automate this. This is a step in the right direction and does satisfy the 2 basic requirements I listed for more security, thanks for sharing!

> Wish there was open-source browser uBlock works on Firefox too. Can't get more open shots than that.

https://www.ublock.org/ for anyone interested

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#215

The web seriously sucks. One thing I admire, at least in theory, about Xbox 360 games or iOS apps is the limited access a specific program can run. https://www.youtube.com/watch?v=CiqioE1zGCw talks about this Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the cas…

1) The system you’re describing wouldn’t have prevented this. 2) Just use NoScript if you’re that paranoid.

Why would it not have prevented this? If my browser only ran approved Javascripts, it wouldn't be mining coins.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#216
post #195

Earlier quoted context omitted.

Cryptocurrencies in the browser are[0] irrelevant. But they're a part of larger ecosystem of cryptocurrency mining, and that ecosystem is a huge problem. > playing computer games, watching mindless YouTube videos, scrolling Facebook, leaving devices on when not used, lighting places 24/7 where nobody goes at night anyway etc.? We do. But all those examples are the case where energy use gives us something (fun, conven…

"Crypto mining literally pays you for wasting power, so the more electricity you can burn, the more money you get." Well, you (or somebody else) still has to pay for power consumption used for mining, so it just converts money you pay for energy bill to micropayments (though in very unfavorable rate as of yet). Don't get me wrong, I don't advocate such shady behavior in any way, just wanted to point out that this "wa…

You pay less for the wasted power than you get in cryptocoins - otherwise you wouldn't mine at all. The delta is what cryptocurrency system pays you for wasting electricity.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#217

I bet some clever person on the marketing team just went ahead and inserted the tag. My first experience on a large corporate dev team was eye-opening. While the core product code was version controlled and reviewed, the marketing team had the power to insert any kind of scripts onto the page without clearance. In theory, anything new on the page would require many ridiculous meetings. In practice, they could and did…

> they could and did put in whatever through a third-party like New Relic. They didn't put anything through the third-party. It's commented as NewRelic, but anyone even glancing at the link would notice this is completely wrong.

I wasn't suggesting that New Relic is to blame. I was suggesting that New Relic allowed somebody to put arbitrary script tags onto the page. It's more likely that Google Tag Manager allowed this and possible that New Relic doesn't allow this sort of thing.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#218
post #207

Earlier quoted context omitted.

Running ads also dry your battery.

Do ads make your CPU run at 100% load? Most likely not. Yet mining scripts will do just that.

Does that mean a mining script that throttles its resource usage would be acceptable?

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#219
post #84

as if I needed another reason to browse with JS disabled. https://github.com/jakeogh/glide (dont use the recent commits)

The other day someone was ranting about web app technologies. This is actually nice idea. A browser without javascript. For all the fun interaction, browser may add extensions of widgets. Let all richness be supplied by browser.

That would be worse than JS obfuscation of content because now it's browser specific PLUS you gotta execute an arb program (which is the real problem) to (maybe) get the result.

The separation of content from presentation is a fundamental building block of the past and future of the internet. Attempts to mix the two will fail. Flash is dead and it's close relative javascript is next. Outdated players will resist because without JS their data is accessible.

Re: CBS's Showtime caught mining crypto-coins in viewers' web browsers

#220
post #207

Earlier quoted context omitted.

Do ads make your CPU run at 100% load? Most likely not. Yet mining scripts will do just that.

Does that mean a mining script that throttles its resource usage would be acceptable?

No, they're still using your computational resources without your (informed) consent for their own (financial) gain.
Post reply on HN