31–39 of 39 posts
Earlier quoted context omitted.
Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.
I would be surprised if a javascript cryptominer was productive enough to even be worth the effort.
Earlier quoted context omitted.
True, but they can compromise the machine that runs VuePress (or at least, run arbitrary userlevel JS code on it).
Wouldn’t this be the case for any node app? Why pick on VuePress specifically?
Earlier quoted context omitted.
They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.
Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.
Earlier quoted context omitted.
But this is a static site generator. They can't take over your server if you're just serving up stuff from S3.
They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.
Earlier quoted context omitted.
They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.
If they can inject something like that in the output, they can also do something funky on your dev machine. Which means I shouldn’t be installing any npm package.
Is this in the same space as Sphinx and Doxygen? The VuePress docs only have a trivial markdown example.
VuePress pulls in nearly a thousand transitive dependencies. In light of recent security incidents[0][1] and the relative ubiquity of poor security practices[2] in the npm ecosystem, that seems like an unacceptably large attack surface. I don't want to have to worry about somebody injecting malicious code or cryptocurrency miners into my website by compromising a little-watched transitive dependency in my static site…
Earlier quoted context omitted.
They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.
Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.
((50 hashes / s * 100000 vistors * 5 minutes)) / average hashes per block[0]) * block reward [1] * 0.7 ≈ 70 USD cents.
[0]: 54272216853
[1]: 4.11 XMR, 1 XMR ≈ 90 USD
Earlier quoted context omitted.
Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.
I noticed that the nazi/terror/nationalistic organisation Nordic Resistance Movement uses https://coinhive.com , since they probably can't use ads. Coinhive apparently takes a 30% cut, and on my 2014 15" MBP I get a hashrate of around 50 / second. Some napkin math: ((50 hashes / s * 100000 vistors * 5 minutes)) / average hashes per block[0]) * block reward [1] * 0.7 ≈ 70 USD cents. [0]: 54272216853 [1]: 4.11 XMR, 1 X…