If only there was a way how to anonymously charge something like $0.1 for each action/api call.... I don't know... I heard maybe something like cryptocurrencies can do it?
Crypto miners are killing free CI
31–37 of 37 posts
Re: Crypto miners are killing free CI
#32Noob question: why not make a big delay to start processing build jobs (something like 1 hour). By then, whatever input they wanted to hash will be useless as a new block will be already minted. As for build scripts that require a network connection, just make the connection painfully slow.
They're not starting a CI job per hash (that would be too slow). I'm not sure exactly how each of these cryptocurrencies works, but presumably what they're doing is starting a miner which attempts hashes for a while and then stops. And the only reason the jobs stop at all is that it would be too obvious if they ran continuously.
Re: Crypto miners are killing free CI
#33Silly question. But couldn't CI say in TOS, that any crypto currency mined using their CI/CD resources belongs to the host?
They could, but that wouldn't mean much for a few reasons: * Cryptocurrency can't really be confiscated * These malicious miners likely live in a country with a dubiously competent legal system. * Lastly, it's not worth the money to try to collect.
Expanding on that last point, one of the examples in the article is someone making ~$70 per month in cryptocurrency. The CI people -could- send a lawyer to Vietnam to try to collect that $70 but even if they succeed it's very not worth it.
Re: Crypto miners are killing free CI
#34Sharing some thoughts from our own experience fighting cryptominers and the negative externalities for CI companies and their users. I'd be curious to hear if any other services have been affected.
We have the same problem in Okteto. We've been investing a lot on building tech to prevent this (I gave a talk on this during the last eBPF community days -> https://www.youtube.com/watch?v=tplv3Hjjv2Q ), but it's tough. We spend a LOT of resources fighting it.
Do you see yourself able to fully automate that process? The Falco -> slack notification -> manual ban doesn't sound like it will scale very well (but a nicer workaround than outright removing the free tier!).
Re: Crypto miners are killing free CI
#35Re: Crypto miners are killing free CI
#36Contrarian point of view: why do we “need” free CI? Open source can run CI locally on docker etc. The free CI is marketing for the CI companies. Don’t offer free compute. We need to train the industry in general to pay for trials. Some companies eg those in the SEO vertical manage to do this. Ahrefs for example.
Running something locally is not necessarily free either. Even if maybe the "host" is for free (which I can not imagine, unless someone throw something at you), it will still require your time to setup and ensure its running. For private/small open source projects I would highly welcome such a pricing tier from travis-ci but 69USD is just not in my pocket (not saying its unjustified though!). For larger open-source p…
I use a bunch of different CI at work and they are great but if they are offline you are stuffed as they are not portable and running local while possible is a nightmare.
Containers are a solution for this right? If I was open source I’d run CI in docker or similar so you can easily run it locally or on a server.
The assumption is people doing FOSS can’t afford maybe $20 a year to spend on some kind of elastic compute to run this or don’t have a computer powerful enough to run it. I doubt this is the case and if it is just do without CI - just run your tests from IDE before pushing to master.
Re: Crypto miners are killing free CI
#37Earlier quoted context omitted.
We have the same problem in Okteto. We've been investing a lot on building tech to prevent this (I gave a talk on this during the last eBPF community days -> https://www.youtube.com/watch?v=tplv3Hjjv2Q ), but it's tough. We spend a LOT of resources fighting it.
Do you see yourself able to fully automate that process? The Falco -> slack notification -> manual ban doesn't sound like it will scale very well (but a nicer workaround than outright removing the free tier!).
Not yet. We are trying different approaches to curb this since we do want to keep our free tier.