CBS's Showtime caught mining crypto-coins in viewers' web browsers

Can't wait for this to show up as a plot device for Mr. Robot or something.

https://www.youtube.com/watch?v=CiqioE1zGCw talks about this

Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems enough to fix software that must speak certain protocols?

The answer to these questions is that for many protocols and services currently in use on the Internet, the problem of recognizing and validating their "good", expected inputs from bad ones is either not well-posed or is undecidable (i.e., no algorithm can exist to solve it in the general case), which means that their implementations cannot even be comprehensively tested, let alone automatically checked for weaknesses or correctness. The designers' desire for more functionality has made these protocols effectively unsecurable.

In this talk we'll draw a direct connection between this ubiquitous insecurity and basic computer science concepts of Turing completeness and theory of languages. We will show how well-meant protocol designs are doomed to their implementations becoming clusters of 0day, and will show where to look for these 0day. We will also discuss simple principles of how to avoid designing such protocols.

EDIT: Sandstorm was looking to fix user permissions for individual programs on computers (they went defunct/bankrupt/no-longer-developing last I heard).

What I'm looking for is a user-facing, user-friendly structure that A) Does only what the user wants to do eg. load site B) Explicitly does NOTHING else eg run javascripts for cryptocurrency.

How could this work? Maybe your SecureBrowser*tm would only run Javascripts that have their hashes, and the hash of all the simultaneous Javascripts running on that page, approved by a network. Your client frequently checks this blockchain (why not) to download the latest approved scripts.

Without that, I think people are unlikely to be sympathetic and they'll be snagged by ad blockers rapidly: consent is the cornerstone of products people like.

This is a step in the right direction and does satisfy the 2 basic requirements I listed for more security, thanks for sharing!