Earlier quoted context omitted.
Can you not design a PoW that is most efficient in a browser? Don't brute force hashes like Hashcash/Bitcoin, do something similar to RandomX instead but in JS. Browsers ought to run the fastest JS interpreters already so if interpreting JS becomes the bulk of the work, that attack might not work. Maybe even involve the DOM or whatever else makes sense.
> Browsers ought to run the fastest JS interpreters already Well they don't. Users want the website to work sooner, and care little about whether a for-loop of elements take 10ms or 20ms if it only happens once. JS can be AOT compiled if you can wait a few _seconds_ -- which users don't want, so browsers don't bother. Our attacker however, rightly observes they only have to pay that compilation cost once.
Re: An update on residential proxies and the scraper situation
#421If it takes seconds to compile it then the browser wins. The PoW only runs for seconds already.