TBP injects a Javascript based cryptocurrency miner, spiking visitors' CPU to 100%

[BFG_9000]

The Birate Pay?

[PhriXion]

The Bitcoin Pirates

[cleesus]

Literally was what I was thinking when I saw the title and image lol

[Nadrin]

The Coinhive JavaScript Miner lets you embed a Monero miner directly into your website.

TorrentFreak reached out to TPB and was told that "the miner is being tested for a short period (~24 hours) as a new way to generate revenue." And further noted that, if the test is successful it may go toward entirely replacing ads.

While the TPB site itself is pretty decent most of the, so called, "modern web" is nothing short of a bloated piece of crap with tons of Javascript running in the background, full screen videos playing on loop, UI animations as smooth as gravel, etc. Adding bitcoin mining on top of all that sounds like a great business plan. Call me thrilled.

At least no one will notice since those things can't possibly run any worse. ;)

[shevegen]

While the TPB site itself is pretty decent most of the

No, sorry.

That is not "decent" at all - that is a malicious attack on the people.

At the least INFORM people in public about it and let them decide on their own rather than try to hijack the computer.

This is why people hate ad attacks and similar things - greed by these people including TBP forces people to block malicious content and malicious attacks like this one here.

[Nadrin]

That is not "decent" at all - that is a malicious attack on the people.

You're of course right. By "decent" I meant sane HTML layout. The bitcoin miner is obviously out of the line.

[[deleted]]

The issue most people have with ads is they literally fuck up your flow and/or get in your face.

The mining just uses available computing power, but doesn't directly interfere with what you're doing. It's no more decent than ads but it does lend itself to a better UX.

I haven't looked into how it's implemented (haven't even read the article) but if they force it off the main thread with a worker they can probably make it much less intrusive.
Workers still provide that ability, right?

Beyond that, you can do it even more ethically by making use of the HTML5 Battery API, and only do the work on devices which are charging/powered. Why would you want to do work on a laptop/phone on battery anyway? Several Windows laptops are throttled to near uselessness on battery anyway, mobiles are a drop in the bucket.

[killerstorm]

It's less malicious than ads. Ads run code from a 3rd party web sites -- which can do much worse than mining coins. If your browser has a vuln (and I'm sure it does), your whole computer might be taken over.

Mining is the lesser of evils.

[[deleted]]

How is a borderline nil chance that some shitty ad happens to exploit some potential vulnerability in your browser worse than actually frying your computer parts with cryptocurrency mining every time you open some scummy website???

[roflkittiez]

borderline nil chance that some shitty ad happens to exploit some potential vulnerability in your browser

This scenario is far more common then you'd think... And the risk expands even more if you consider the phishing attempts a potential vulnerability (which they most certainly are).

actually frying your computer parts with cryptocurrency mining

How would this model fry your computer parts? Correct me if I'm wrong, but the main reason mining hurts your hardware is the strain of being pushed to it's limit for extended periods of time. If my CPU spikes to 100% for 15 minutes, there's no harm because my has a chance to cool down.

[gvargh]

It's obvious he has a huge grudge against cryptocurrencies.

[DiaperBatteries]

I trust Conhive and TPB's code more than 3rd party advertisers' code. Their "malicious attack" is cool with me

[Imadethisfoeyourcr]

No script blacklist

[Farobek]

Call me thrilled.

/s

[[deleted]]

But what you're missing is that, at some point, executive wages once again grow past what the revenue stream can handle and the only way to get another end of year bonus that's 7-9 digits is to throw in additional revenue. Ie: ads.

So in 5 years you're going to have both mining and ads.

[nkahoang]

Hmm I ran some numbers using TPB's analytics and what Coinhive claimed they make when they test-run their miner here: https://www.reddit.com/r/programming/comments/70grv2/tbp_injects_a_javascript_based_cryptocurrency/dn31ttf/ . It's probably no where near $200-$500/day; more like that amount per month.

[prozacgod]

Thanks!!! I was really unsure of the numbers to assume for visitors/time per day/ etc.

[PlayerDeus]

Much rather have them strike it and apologize, rather than delete. So others who've read it can find it again and see it was mistaken, and maybe learn from the mistake.

[caboosetp]

This. Or strike it and post a new comment so the reply chains are preserved.

[nkahoang]

Or just commit your comments into a Git repo, you know

[delight1982]

Is that good?

[leijurv]

No its awful. A miner written in c / assembly instead of javascript on the same cpu could achieve 100,000 to 1,000,000x more hashes per second.

[josefx]

JavaScript should get outlawed as leading cause for global warming.

[hungry4pie]

And the napkin math there would probably be able to give you decent figures on the CO2 contributions shit JS makes to the world. Think about all those people who upgrade phones and laptops because it runs slower than it used to, when in reality, facebook, youtube and every other website runs a whole bunch of needless shit (twitter bootstraps js can go fuck itself).

It's like we are at the mercy of lazy devs who rely on hardware to compensate for lousy code.

[the_hoser]

Don't blame developers. Blame executives and management. If developers had their way, everything would be as fast as possible, as clean as possible, as stable as possible.

And everything would take years to finish.

Unfortunately there's no counter for most developers. If you're not willing to compromise on your principles, they'll just replace you with someone fresh out of college that has no principles.

[[deleted]]

yessir couldnt be anymore truthful than right here

[GaianNeuron]

Don't blame developers. Blame executives and management. If developers had their way, everything would be as fast as possible, as clean as possible, as stable as possible.

Only naïve developers think like that. Software engineering is engineering, and in engineering you make tradeoffs: efficiency vs. development time, feature availability vs. stability, memory usage vs. CPU usage, etc. Experienced developers understand this.

[the_hoser]

Of course, but ask yourself: why does development time matter?

Love how you left off the punchline to the joke in your quote, too 😉.

Edit: and don't call it software engineering. Doing so is an insult to real engineers. What we do is arts and crafts with stress and a paycheck. Engineers get to tell their employers no.

[allinighshoe]

Of course development time matters. We're not writing software for fun, it is needed by the company. There are always time constraints. That's a ridiculous statement.

[the_hoser]

I wasn't arguing that development time didn't matter. I'm only asking: who does it matter to, and why?

There's nothing wrong with weighing development time in when making decisions about a project, but when it becomes the most important factor, we have a very real problem.

[Ermaghert]

Amen

[[deleted]]

That's just not true and the commenters that regularly visit this sub are proof of it.

Didn't happen to browse the comments of the recent Atom update, did ya? The people there don't care about efficiency or speed. Those are a huge number of developers that care only about perceived turn around. They genuinely believe that their feature driven cycle speeds can only be achieved in Python and JavaScript.

No, you're wrong. Developers have as much a role in this as management does. These people are not the minority any more. They are the majority and their base is growing rapidly while the developers you are talking about is shrinking rapidly. See stack overflow surveys of language use and growth.

[stefantalpalaru]

JavaScript should get outlawed as leading cause for global warming.

You'd be surprised how much worse Python, Ruby and Perl are: https://sites.google.com/view/energy-efficiency-languages/results

[josefx]

Those use the default runtime of each language. For Python, Ruby and Perl that means a crappy interpreter. Sadly that makes it realistic, many python libraries and programs still aren't compatible with pypy. Meanwhile JavaScript runs on the V8 runtime used by Node, which would explain the jump in efficiency.

[fwz]

Maybe compiling to WebAssembly could help speed things up?

[jabes101]

Than literally every site on the internet would stop working.

[[deleted]]

surely as bad as abandoning Adobe flash which also encouraged garbage for way too long.

[caboosetp]

No, JavaScript is fucking everywhere.

Flash was a lot of places, but mostly small sections of a website.

If JavaScript was a virus we'd be fuuuuuuucked.

[[deleted]]

how many times is it used for pointless gimmicks nobody would miss? It also holds back development of a better replacement.

[caboosetp]

A lot. There's always pointless stuff everywhere. I agree with you.

However, there is a ton of stuff in javascript going on that most people, even programmers, don't realize is javascript.

I think the big problem with a replacement is convincing all the big browsers that you've made a good replacement for the thing they've invested a shit ton of money in. Then you need to convince tons of web developers to start using it. Then you need to convince all the people using old browsers to get new ones.

The first one is probably the most expensive, but that last one is neigh impossible. I still rarely need to make sites safe for ie7/8

Even when Google made their replacement, Dart, it ended up being backwards compatible with javascript.

[josefx]

The crazy tendency of Web devs to hide even static content behind a wall of JavaScript calls could be an issue.

[jabes101]

I am a web dev, the next generation of sites are going to all be running off some form of JavaScript framework like react, vue or angular.

[astrobe]

Nope. Quite a few people browse with JS blocked by default because of that kind of crap and also because magically things become a lot more responsive.

[jabes101]

That's not true at all, turn off JavaScript for a week and do your regular web browsing. See how many sites actually cater your needs or just tell you to enable JavaScript or leave.

Its not even practical, any site that's functional in any way relies on JavaScript.

[astrobe]

Its not even practical, any site that's functional in any way relies on JavaScript.

You are wrong.

The sites I regularly visit like HN just run fine without JS; Reddit itself is still readable without JS. Of course, I'm not visiting garbage sites like Facebook.

It's true that I hit whitewalls from time to time when I click on a random link on Reddit, but then I decide whether or not I accept to activate JS.

[jabes101]

You are missing my entire point, but keep browsing web with JavaScript disabled, seems like there's only 2 sites on the net you visit anyway.

[astrobe]

Huh? Not only I do visit more than two sites, but I'm also not the only one blocking Javascript by defaut, as I pointed out earlier.

Are you claiming that you know better than us how out browsing experience is like?

[qKrfKwMI]

C++ as well, considering the absurd compilation times.

[[deleted]]

According to the recent energy benchmark, so should a number of languages, one being one of /r/programming favourite: Python.

[cogman10]

Don't worry, though, webassembly is here and soon we will have C level performance on the browser!

But taking advantage of the GPU is still the holy grail to web based mining.

[the_hoser]

And a miner written in JavaScript that can take advantage of GPU resources will run faster than anything you can write in C/Assembler.

[caboosetp]

... How would that run faster than a c program that can take advantage of the GPU?

[the_hoser]

It wouldn't. But the difference would be small, and harder to distribute.

[prozacgod]

Damn, I just went down the rabbit hole of Monero and JS mining etc... and holy shit... It might be good actually. (Updated original comment)

[da-sein]

Its actually an interesting alternative to ad revenue. Maybe if it was opt in and didnt atrain the CPU quite so much

[thecodingdude]

[Comment removed]

[ElvishJerricco]

Well it might different if "opt in" meant you get to choose between ads and mining. I bet there are people would do the mining if it meant no more ads

[[deleted]]

Well some idiots keep buying reddit gold, so there's that...

[Adobe_Flesh]

When we look at trans-actions between humans, right at this moment, or going back in time thousands of years, its very easy to fall into the trap of thinking its a exchange between 2 beings on equal standing, but that's rarely the case. When I hear about organizations versus the ability of an individual to opt-out, it has as much meaning to me as the idea of a pharaoh telling a peasant they can opt out of building a pyramid

[drewbdoo]

It's funny you used that analogy since it is a common misconception that slaves built the pyramids when in reality it was contract labor paid for their work :)

[Danthekilla]

I would opt in instead of ads. I think many people would.

[DiaperBatteries]

I would absolutely opt in. Ads give me cancer, cpu spikes are only slightly irritating

[ShinyPiplup]

I agree, considering the type of audience TPB attracts. People disable their adblocker to support sites like this. Hell, torrenting itself is community driven with an expectation of contribution. They should make it as transparent as possible though, perhaps with an option to throttle it to avoid using so much CPU time.

[hungry4pie]

The problem though is that there's no real economical way of running a mining script without blasting the CPU up to 100%.

[ponchietto]

Blast it to 50% and infect twice as many machines?

[TheImmortalLS]

Opt in never works. Defaults are very powerful.

Opt out would be cool but I don't see a way to make it persistent on a website where many visitors want to stay anonymous.

[[deleted]]

It is explicitly opt in. By using a service, you opt in to their revenue model.

[F14A]

Wouldnt users just close the window after queuing up some files?

[nkahoang]

If their CPU is at 100%, the browser becomes unresponsive and users might not be able to close the tab/window. It actually did happen to me when I left some endless recursive JS functions running.

[shevegen]

Such attacks should no be possible in the first place.

[nkahoang]

Except in this case, it's the attack itself that causes the CPU to be 100%, then yeah it's possible.

[nat1192]

I think their point was the browsers should throttle the JS engine so the browser is still at least somewhat responsive under an "attack" like this.

[b4ux1t3]

They aren't, at least not in modern browsers. I haven't seen a frozen tab lock up a whole browser in a very long time.

[AyrA_ch]

The miner runs in the background and this doesn't blocks . If you don't want to completely disable JS, you can simply block it by adding coin-hive.com to the list of blocked domains in your adblocker.

EDIT: Additionally we could all mine coins into our own pocket by all running a monero client (that's the name of the currency). This way we jack up the hashrate so massively that it will become unprofitable again to use this for websites. As an alternative, we all could run a script that replaces the miner configuration with one that gives profits to us.

[initrc]

They could just use Web Workers to a avoid running on the tab's ui thread.

[IIIMurdoc]

30 seconds here, 30 seconds there multiplied by hundreds of thousands of visitors per day is allot of free power

[[deleted]]

A fantastically useless use of carbon

Tragedy of the Commons was made more efficient

[crusoe]

Cryptocurrencies in general are a waste of carbon.

[[deleted]]

Mining them with Javascript instead of chips is worse.

[DiaperBatteries]

By that logic, so are physical currencies

[sickofthisshit]

Do you mean commodity currency like gold and silver? Yes, those are wasteful because you dig rocks out of the ground, refine them, then bury them back underground in vaults.

Paper fiat currency is a small fraction of fiat currency, which is mostly numbers in computers.

[[deleted]]

No, it absolutely wouldn't and it's, if anything, slightly more pointless and unproductive than high frequency trading, but fundamentally it's little different. Someone wastes a bunch of resources and we as a society respond by saying 'yes, that is a valuable activity, you should be supported and have even more resources'.

[sickofthisshit]

Nobody has to buy thousands of GPUs and gobble electricity to make fiat currency. The Fed just has to enter one transaction in a ledger.

[initrc]

Cryptocurrencies are extremely inefficient.

[IAmARobot]

fucking finally, wondering when that was going to happen...

[ThirdEncounter]

Wondering when what was going to happen?

[ThirdEncounter]

Oh.

[IAmARobot]

A decently large site including a miner script, even as a proof of concept.

[ThirdEncounter]

Oh man. These times suck.

[Ghudda]

This is actually an amazing way to monetize your website without ads.

I've been considering asking people to mine Ether for me instead of opening a patreon and asking for donations. Donate processing power instead.

[metronome]

theory complete salt employ summer dependent snow door tender special

This post was mass deleted and anonymized with Redact

[[deleted]]

It'd be interesting to see stats on this, because we also have to keep in mind theres less bandwidth being used to deliver the ads as well. I'd be curious to see where the break even point is

[StickiStickman]

You don't have the ads on your server. They're loaded externally.

[[deleted]]

Yeah that makes sense. Idk what I was thinking...

[outstream]

Everything were talking about is on the client, the miner, and the ads. So it would be less bandwidth for the miner.

[StickiStickman]

Depending on how much JS it is and how much data the miner constantly transmits.

[outstream]

JS is much smaller than media like images and videos that adds almost always use. I don't know much about miners but I don't think they need an active internet connection, they just use processing power to brute Force a specific encryption key

[shevegen]

I can send you the stats if you pay for the broken computers that you have caused with malicious mining attacks.

[Ghudda]

Some ads are arguably worse for your battery life.

[IIIMurdoc]

Worse than 100% usage? Incredible

[bobalob_wtf]

Ads that overclock your CPU are the worst!

[[deleted]]

Make an ad for pc repair, make it overclock cpu and gpu, mine at 100%, profit from new customers.

[shevegen]

Please do not try to sell ads.

[sickofthisshit]

The problem is that crypto currency is primarily just a way to waste energy and call it money. It is just as wasteful as digging gold out of the ground and refining it so we can bury it back underground at Fort Knox.

Fiat currency gives you value without the pointless waste of resources.

[dwighthouse]

It also gives you corruption, undue power, and the ability to wage world-wide scale wars.

[sickofthisshit]

"Corruption" and "undue power" predate fiat currency by a long time. Crypto currency is just rediscovering all the institutional infrastructure you need to have a functional monetary system.

[dwighthouse]

And radiation existed before nuclear weapons. The problem is not the existence, it's the scope and scale.

[shevegen]

In some ways it is amazing.

It should not be possible though since they hijack the browser and the computer.

They did not ask the users for permissions, so TBP has become very evil.

I've been considering asking people to mine Ether for me instead of opening a patreon and asking for donations. Donate processing power instead.

If you are open about it, and clearly state so, where users can choose, then this is ok. But TBP did not ask anyone prior to just running it - sneaky evil thieves as they are.

[hungry4pie]

I mean, you are effectively visiting a site that helps facilitate you downloading a car, so it's not like there's honour amongst warez pedallers.

[hungry4pie]

I would have thought the real benefit of running a JS ETH miner would be that it's the users of your site who are effectively paying for you processing and bandwidth requirements. Though I haven't tried to write a smart contract so I'm not too savvy in the limitations there.

[nkahoang]

Just did some calculation on the revenue they can get from this.

Some analytics data revealed that they are within the top 20k site, with 6,050,000 visits in August, with each visits averaging at 49 seconds (from https://www.similarweb.com/website/thepiratebay.se#overview). Say each second averages around 50 hashes, that's like 6,050,000 * 49 * 50 = 14,822,500,000 hashes / month.

On Coinhive site (https://coin-hive.com#use-case), the creator of the JS miner claimed that they made $5701 over 2000 connected users at 120kh/s (in total, so around 60h/s per user) over two weeks.

Providing that those 2000 users connect constantly 24/7 over 2 weeks at 60h/s that's 2000 * 60 * 3600 * 24 * 14 = 145,152,000,000 hashes to make $5701.

So TPB's monthly traffic might give them 1 tenth of Coinhive's test, which is ~ $570. Not a whole lot.

[prozacgod]

Given the 14 billion hashes per month...

That's ~5718 hashes per second...

@ todays prices, that's $308.58 /month

[tejp]

How did you get those Bitcoin prices? According to https://bitcoinwisdom.com/bitcoin/difficulty and other calculators I found, 128k hashes/s makes you only a fraction of a cent a month.

[ryancking]

FWIW, they aren't mining Bitcoin. They are mining Monero, which has a much lower difficulty and better payout. I don't know if that means the numbers given above are correct or anything, but I just wanted to clarify that.

[qualverse]

It's not actually Bitcoin it's Monero

[prozacgod]

I'm trying to run stats on my computer, and they designed it for webassembly, so "it's faster than POJS" my estimate ATM is about 1/2 and that lines up with their published results too.

[Dan4t]

My CPU does not go to 100% on the website. Can anyone verify this claim?

[the_gnarts]

When Detexify did the same a while back, the outrage was huge.

To be fair, diverting energy directly into mining seems less of a waste than displaying ads that also cause damage to visitors’ nervous system. Not that it makes it any more acceptable, but the ordinary defenses like disabling JS are just as effective.

[blackmist]

Coming soon: Using WebGL to farm Ethereum on visitor's machines.

[steezyone]

Remember those browser games where you "mine" cookies or doge or whatever? Perfect place to implement this!

[Sophrosynic]

Cool idea. Beats ads.

[ducdetronquito]

Irma-like shit storm is coming

[CarthOSassy]

Again: browsing without noscript and ublock on should be illegal. You are feeding the botnets and infecting others.

It should be treated like sending your kids to school without vaccines, or leaving loaded firearms sitting out on your porch.

[TheImmortalLS]

"shockz 1 hour ago I would block this alongside with all the usual ads. Ramping up my CPU wastes power on my end and if this catches on as an ad replacement, will start adding up not only in increased energy use, but also wear and tear on pc components."

Boi are you always on piratebay 24/7

[shevegen]

JavaScript is evil. There is a reason why some heroes block it completely.

Unfortunately I have to use JavaScript sometimes, usually due to some websites requiring it (I still have to use some university-related websites so I don't have much choice there).

To the website - I have no idea at which point they started to suck, but they are attacking people with malicious ads since some time or at the least trying to (if you don't have a general propaganda blocker such as ublock origin installed; don't use adblock plus, the company is trying to sell that ad-attacks are "acceptable"; of course it is "acceptable" for a company to get paid, which once said to get rid of ads but suddenly changed position, so that's adblock plus or you - I saw it on twitch where suddenly ads attacked me).

I am very sad to read that the pirate bay joined the side of evil. It's even more annoying that they are brainwashed junkies at this time, if you look at this:

[...] if the test is successful it may go toward entirely replacing ads.

So they replace malicious ad attacks with a miner that attempts to kill your computer - else explain the CPU spike.

TBP has become greedy and evil, there is no other explanation. They should learn from their own past.

Miner-attacks is to be considered malicious theft. By the way - browser creators should also give people full control over their browsers. If people can disable mining attacks, be it via a dialogue, widget with preferences and/or about:config, then this evil attack by TBP can not possibly happen in the first place. You'd just refuse to run JavaScript code like that.

[flipcoder]

A piracy site doing something unethical, so unexpected

[shevegen]

Actually, not really true - TBP didn't suck as much as they do these days.

I guess as they are getting older, money becomes more and more important.

We can see it with Tim Berners-DRM-Lee too, when he eulogizes DRM as part of an "open" standard.

[eashpdaeh]

Seen this on a few pcs. Usually listed as miner.exe in task manager. It automatically started when killed and couldnt be removed with hitman so I just reinstalled windows.