Crypto miners are killing free CI

#1

Post by Lyn_layerci » Sun, Apr 25, 2021, 9:39 PM UTC

Crypto miners are killing free CI
layerci.com

Re: Crypto miners are killing free CI

#2

Post by Lyn_layerci » Sun, Apr 25, 2021, 9:42 PM UTC

Sharing some thoughts from our own experience fighting cryptominers and the negative externalities for CI companies and their users. I'd be curious to hear if any other services have been affected.

Re: Crypto miners are killing free CI

#3

Post by miltoncd » Sun, Apr 25, 2021, 10:09 PM UTC

Interesting! Didn't realize it was affecting so many services...

Re: Crypto miners are killing free CI

#4

Post by salawat » Sun, Apr 25, 2021, 10:12 PM UTC

Once you have any way of allowing other people to use cycles... They will do it. And you can't really be surprised when you have these cryptocurrencies that folks in need of cash with few if any other options use it. It's why I object to the activity on principle. It becomes the new default+ activity.

Any computation not explicitly provisioned in a way that guarantees pre-empting a cryptocurrency generating process never has a chance to happen.

Re: Crypto miners are killing free CI

#5

Post by Lyn_layerci » Sun, Apr 25, 2021, 10:18 PM UTC

salawat wrote: post #4

Once you have any way of allowing other people to use cycles... They will do it. And you can't really be surprised when you have these cryptocurrencies that folks in need of cash with few if any other options use it. It's why I object to the activity on principle. It becomes the new default+ activity. Any computation not explicitly provisioned in a way that guarantees pre-empting a cryptocurrency generating process n…

Yes, this needs to be solved at the crypto level - attackers always have the advantage.

Re: Crypto miners are killing free CI

#6

Post by ggghgrrrrr » Sun, Apr 25, 2021, 11:04 PM UTC

How about online compilers: you encode the mining as a C++ template and do the mining at compilation time, or you use their "run" functionality.

Re: Crypto miners are killing free CI

#7

Post by ddevault » Sun, Apr 25, 2021, 11:07 PM UTC

We're moving builds.sr.ht to only support paid users from May forward because of crypto mining abuse. Background here:

https://man.sr.ht/ops/builds.sr.ht-migration.md

I've been in touch with many other people working in the CI industry and this has become a massive problem for all of us over the past few months. Entire industry working groups have been set up for knowledge sharing to combat the crypto mining epidemic.

In hindsight, cryptocurrency is an abject disaster and one of the worst inventions of the tech industry in the last few decades. I am absolutely ashamed to share an ecosystem with such an obscene, exploitative grift. In addition to entirely failing to meet its basic objectives as a useful currency, it has introduced perverse incentives into the entire technology sphere, reduced the integrity of the entire industry, been the subject of hundreds, if not thousands, of scams and ponzi schemes, has created shortages for consumer and server hardware, and is hugely wasteful and harmful to the environment. Fuck cryptocurrency.

Re: Crypto miners are killing free CI

#8

Post by judge2020 » Mon, Apr 26, 2021, 1:48 AM UTC

This is still happening right now on circleci (requires login but is otherwise public https://app.circleci.com/pipelines/github/testronan/MyFirstR...)

Re: Crypto miners are killing free CI

#9

Post by sydd » Mon, Apr 26, 2021, 6:02 AM UTC

ggghgrrrrr wrote: post #6

How about online compilers: you encode the mining as a C++ template and do the mining at compilation time, or you use their "run" functionality.

Sadly they are able to attack anything that allows arbitrary code execution

Re: Crypto miners are killing free CI

#10

Post by Ayesh » Mon, Apr 26, 2021, 6:19 AM UTC

GitHub recently changed its policy to not allow CI runs on first time contributor PRs until approval, and to flag PR maker instead of the repo owner on potential abuse.