Embedable Javascript Bitcoin miner for your website

[1bitc0inplz]

Here's what one of my users said (I had it in "forceUIThread: false" mode at the time)

I have a new computer and when I bring cathinfo up, it is very choppy and slow. Keystrokes lag and hesitate when typing. This does not happen on any other website. Is there something I can do about this?

Running the jsMiner in the UI thread does pose a risk of browser slow downs... however, in my experiences the defaults do not seem to cause any noticeable performance degration on my 2007 year Mac mini. I would be curious to know which browser this user is using, IE and Firefox are severely lacking in the Javascript department.

Also, does your website have (perhaps) some onkeypress event handlers for the particular text boxes this user was filling out? When running in the UI thread our Javascript miner and your website Javascript will be fighting for CPU time.

All of these things play a factory, but in either case one thing you could try and do to make the script even friendlier is to adjust "delay". By default the default between every block of 100 hashes is 30ms. You could try setting delay to a value larger than 30 and see if that improves the situation.

Do let me know if that helps any, and also if you can find out more info about this particular case do let me know as well.

[1714933747]

1714933747

[1714933747]

1714933747

[1714933747]

1714933747

[Nick]

Excuse me for being a buzzkill, but this is pure Bullshit.
I really hate the idea of websites forcing me to mine for them without even noticing me. Also, due to the inefficiency of javascript, the hash-rate is ridiculously low, so this is just a criminal waste of electricity.
If you want to monetize your website, use ads or ask for donations, but don't contribute to the already big ecological footprint of bitcoin.
I will block the api.bitp.it-domain now and I urge everyone to do the same!

[1bitc0inplz]

Excuse me for being a buzzkill, but this is pure Bullshit.
I really hate the idea of websites forcing me to mine for them without even noticing me. Also, due to the inefficiency of javascript, the hash-rate is ridiculously low, so this is just a criminal waste of electricity.
If you want to monetize your website, use ads or ask for donations, but don't contribute to the already big ecological footprint of bitcoin.
I will block the bitp.it-domain now and I urge everyone to do the same!

If you block our domain, you're going to miss out on all our fun we have planed for you this weekend 

And, the website's are free to notify the users... in fact, I do think it's a wise idea to fully disclose this type of stuff to your visitors.

[Nythain]

Maybe the websites that host this mining code could AT LEAST notify their users that they will be cpu mining for the website.

Fixed your post for you.

[TheBunk]

I have to agree with Nick here. This idea is pure bullshit. Not only do you waste the energy of YOUR users for YOUR benefit without their consent. You are also draining the batteries of notebooks and smartphones, potentially leading to a shorter battery life. Are you willing to pay for that? And I don't want an Internet where every website has 100% cpu usage and causes my cpu cooler to speed up. We've already got flash for that.

[Natanji]

I agree that this is complete bullshit and a very, very bad idea. This script is now major news on popular German blogger Fefe's page. It is effectively destroying Bitcoin's reputation. Take it down!

Bitcoin is based on the idea that mining is done by users that WANT to mine. *Forcing* other users to mine for you is absolutely awful. Also note that popular browsers like Google Chrome don't even have a JS blocker and once this script is embedded into the other website code, nobody will be able to prevent the miner from running when they want to just normally use the website.
I already see mobile phone companies getting problems because you wasted the user's battery life!

Did anyone figure out the IP adress of the pools used? The only idea I have for preventing this is to prevent the JS miner from connecting with the pool it's mining in. We need a list of pools so that we can block them via an entry in our hosts. This is the only way to stop this effectively, I suppose.

1bitc0inplz, you just made yourself the enemy of the Bitcoin movement.

[Nythain]

1bitc0inplz, you just made yourself the enemy of the Bitcoin movement.

Champion of the bitcoin movement is more like it. Trust me. Speaking out against the development of java cpu and webcl web miners will get met with much more resistance and lrn2noscript n00b than it will support.
Everyone is in it to make money, and there are no rules or ethics to making money.
 

[Natanji]

I'm afraid of that too, yes.

Still, things like these will effectively prevent Bitcoin from gaining real market penetration. The people using these JS miners right now are as a matter of fact going against the interests of their website users for this - they will feel that it's not worth the hastle, sooner or later. I very much hope that they will LOSE users this way. We should make a pillory thread so that we all know which websites to stay away from. Maybe even Google will mark the sites as "Malware"? I really do hope so! And they have very good reason to do that. After all it's in their interest to prevent their Android users from visiting those websites...

Besides that, I hope that if you compare the gains (a few 0.01 BTC every few days) vs. the losses (in users visiting your website), you will notice that this system has no real benefit. JS is clearly not made for Bitcoin mining.

But who am I talking to... too many people here only want to trade Bitcoin for $$$ anyways! Too many people that aren't the least bit interested in Bitcoin's reputation. I think we shouldn't give these people a forum here to speak out about their wicked plans, anyways.

[mennoman]

Malware, short for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior.

Congratulations.
Don't inflate my electricity bill only for your gain, you people. Seriously.

[fetokun]

I'm afraid of that too, yes.

Still, things like these will effectively prevent Bitcoin from gaining real market penetration. The people using these JS miners right now are as a matter of fact going against the interests of their website users for this - they will feel that it's not worth the hastle, sooner or later. I very much hope that they will LOSE users this way. We should make a pillory thread so that we all know which websites to stay away from. Maybe even Google will mark the sites as "Malware"? I really do hope so! And they have very good reason to do that. After all it's in their interest to prevent their Android users from visiting those websites...

Besides that, I hope that if you compare the gains (a few 0.01 BTC every few days) vs. the losses (in users visiting your website), you will notice that this system has no real benefit. JS is clearly not made for Bitcoin mining.

But who am I talking to... too many people here only want to trade Bitcoin for $$$ anyways! Too many people that aren't the least bit interested in Bitcoin's reputation. I think we shouldn't give these people a forum here to speak out about their wicked plans, anyways.

Dude, seriously? The guy developed a brand new miner and now he is a greedy evil motherfucker who steals old laydies purses?

I think this js miner it's an awesome idea and there are lots of good ways to use it.

Instead of a "donate" button you could just have a "donate cpu time" in your website where people could click to willingly start the mining.

Are you proposing we should be against the technology because it can be used in unethical ways?! Seriously? On a BITCOIN forum??!

[Natanji]

Don't get me wrong. I'm not against it if it is used in a proper way. But with all the programmer dudes out here: you should know best that you don't want someone else's software to force something on your computer. That is, yes, Malware.

I think it's fine if you allow your users a choice. So far, I have yet to see a website that does this. That's why I'm criticizing what is happening here.

bitp.it was designed as a background script that the user gets no knowledge of. Otherwise there would be some form of notification. There isn't. So this is bad, mhkay?

EDIT: I created a pillory thread in this topic and it has already taken effect: bitp.it was removed from Detexify! So I guess even website owners see this is a bad idea.

[TheBunk]

Instead of a "donate" button you could just have a "donate cpu time" in your website where people could click to willingly start the mining.

Are you proposing we should be against the technology because it can be used in unethical ways?! Seriously? On a BITCOIN forum??!

If only the people who are using this script would ask their users. But this script was intentionally designed to work in the background without people noticing it. And right now, I see no way of effectively blocking it. Banning the bitp.it domain is not enough, because people can easily copy and modify the script and host it on their website. Turning off JS completely renders most of the websites useless.

This shit isn't even a good idea from a technological standpoint, because 1bitc0inplz just figured out a way to waste even more cpu time (doing calculations with JS instead of native code, seriously?)

[sparomba]

so all the newbies here have read Fefe's blog and blindly believe everything he writes? did you guys even take a look at the site or the source code at all? i don't think so....

bitp.it was designed as a background script that the user gets no knowledge of.

seriously....did you open the site even once? On bitp.it you see a live response of how many hashes per second your machine is calculating(with about 30% CPU usage)....how is this "background"? of course users can get a feedback and see there is a miner running. But this is up to the webmasters and not up to bitp.it. The script clearly allows user interaction.

Not only do you waste the energy of YOUR users for YOUR benefit without their consent.

ah, you mean like all the other scripts that run in background without user notice and their consent? like google analytics? doubleclick? INFOnline? adsense? clicktrack? facebook tracker?
The CPU usage of the JS Miner is adjustable...it is all up to the webmaster who uses it on his site but the author of the script can't be blamed for any of your points.

IMHO the JS Miner is a very good (tho short term) alternative to annoying ads. the "donate cpu time" is a great idea to support a site. Of course the user should know that there is a miner running (little symbol,live response, something like that) but don't listen to the idiots who read about it on some blog and don't even seem to know what they are talking about. i know this is my first post in this forum, but i'm not new to bitcoins....i'm just annoyed by the "malware" screamers.


@1bitc0inplz:
for now the JSMiner is really great idea for news papers,blogs and forums, but i have to admit that i doubt the long term evolution of the idea :-/
since mining will get harder and harder, at some point it will stop being profitable and start being useless...unless the user base on the website where a miner is running is constantly growing and growing

[Natanji]

It's not 30% CPU usage. It wastes one full core because it's currently not using multiple threads. It tries to run as fast as it can, and on single-core machines (yes I'm talking about smartphones here!) this is a pretty common scenario.

I'm also not aware of a way to download the source code. On the bitp.it website there is no button, link etc. to do so. I'm guessing there is a way to download it after you sign up, but nothing anyone could know if there is just a generic "sign up enter email here" field on the site. So it's completely obvious that not everyone reads the code, because it is de facto not open source.

[Sukrim]

so all the newbies here have read Fefe's blog and blindly believe everything he writes? did you guys even take a look at the site or the source code at all? i don't think so....

bitp.it was designed as a background script that the user gets no knowledge of.

seriously....did you open the site even once? On bitp.it you see a live response of how many hashes per second your machine is calculating(with about 30% CPU usage)....how is this "background"? of course users can get a feedback and see there is a miner running. But this is up to the webmasters and not up to bitp.it. The script clearly allows user interaction.

Not only do you waste the energy of YOUR users for YOUR benefit without their consent.

ah, you mean like all the other scripts that run in background without user notice and their consent? like google analytics? doubleclick? INFOnline? adsense? clicktrack? facebook tracker?
The CPU usage of the JS Miner is adjustable...it is all up to the webmaster who uses it on his site but the author of the script can't be blamed for any of your points.

IMHO the JS Miner is a very good (tho short term) alternative to annoying ads. the "donate cpu time" is a great idea to support a site. Of course the user should know that there is a miner running (little symbol,live response, something like that) but don't listen to the idiots who read about it on some blog and don't even seem to know what they are talking about. i know this is my first post in this forum, but i'm not new to bitcoins....i'm just annoyed by the "malware" screamers.


@1bitc0inplz:
for now the JSMiner is really great idea for news papers,blogs and forums, but i have to admit that i doubt the long term evolution of the idea :-/
since mining will get harder and harder, at some point it will stop being profitable and start being useless...unless the user base on the website where a miner is running is constantly growing and growing

It can be easily implemented that there is NO UI shown to the user in any way. If the reference implementation has an UI - fine! The page linked on fefe had none. In fact, It didn't even MENTION Bitcoin! Unless you were actively looking where that huge drain of ressources is coming from, you would have no idea what's going on on that site.

Also JS mining will nearly always be profitable (at least if you think that people won't notice it and thus not be drawn away from your site) as you don't have any costs at all besides a few Bytes of traffic.

Yes, the profit won't cover website costs eventually, but it will still give you some Satoshis for free.

There's another mining script out there that on one hand does far more Hashes per second and also uses all 4 cores on my CPU. This one here just seems to be poorly done, but I expect the worst!

[1bitc0inplz]

I agree that this is complete bullshit and a very, very bad idea.

Natanji no offense, but you're just full of bullshit yourself.

1st. Have you ever been to http://bitp.it ? Right there, on the homepage, it tells you exactly whats going on. It tells you that it's a bitcoin miner, and how many hashes/sec your generating.

Are you proposing that I create some annoying Javascript alert that pops-up on somebody else's website to alert their users of what they are doing? No. I am of a firm believe that each website is the realm of it's owner. I will not interject my ideas of how UIs should work on someone else. I have said it before, and I will say it again.... the website operators are free to alert their users in any which way they feel like. I have seen several websites that tell the people whats going on, they even encourage people to leave their browsers open on this website to donate CPU time to their cause. What is wrong with that?

It's not 30% CPU usage. It wastes one full core because it's currently not using multiple threads. It tries to run as fast as it can, and on single-core machines (yes I'm talking about smartphones here!) this is a pretty common scenario.

No it doesn't. Have you even read this thread?

Our jsMiner uses HTML 5 web workers. NO smartphone supports web workers. Do you know what that means? That means that it cannot "run as fast as it can". Nope, no sir, not at all sir. It uses the UI thread. In fact, each website operator can force all instances to be as friendly as they want. But, you wouldn't know that either since you haven't read this thread.

I'm also not aware of a way to download the source code. On the bitp.it website there is no button, link etc. to do so. I'm guessing there is a way to download it after you sign up, but nothing anyone could know if there is just a generic "sign up enter email here" field on the site. So it's completely obvious that not everyone reads the code, because it is de facto not open source.

How did you find out about bitp.it? Lots of talk on the Internet about it being open source

But, in case you lost the link: https://github.com/jwhitehorn/jsMiner


What I do not understand Natanji is what your problem is? Every "problem" you have mentioned is simply a reflection of your ignorance. Do you have any real feedback to provide?

As mention, bitp.it has some big things coming out this weekend... perhaps that will change your mind. But, perhaps your mind is already made up.

[Natanji]

Natanji no offense, but you're just full of bullshit yourself.

Nice - you start off by openly insulting me. Saying that an idea is bullshit is really not on the same level as a personal insult. But okay, I guess that's just how you are, right?

1st. Have you ever been to http://bitp.it ? Right there, on the homepage, it tells you exactly whats going on. It tells you that it's a bitcoin miner, and how many hashes/sec your generating.

Yes. That's where I found out that although it wastes a full core of my Q6600, its hash rate is very much ridiculous.

Are you proposing that I create some annoying Javascript alert that pops-up on somebody else's website to alert their users of what they are doing? No. I am of a firm believe that each website is the realm of it's owner. I will not interject my ideas of how UIs should work on someone else. I have said it before, and I will say it again.... the website operators are free to alert their users in any which way they feel like. I have seen several websites that tell the people whats going on, they even encourage people to leave their browsers open on this website to donate CPU time to their cause. What is wrong with that?

Please show me these website, I'd gladly see them.
Also, this is not the issue. With the current state of the Bitcoin community, everything here is full of script kiddies. People will take your code and put it on their website and be done with it. It very much makes a difference if the standard implementation/settings has some sort of UI - and may it be a button that links to bitp.it or tells the users that their CPU is used. No need to make this annoying *at all*. But as an inventor of something cool, you also carry responsability. If you release a 0day with a standard implementation into the wild that harms the users, of course you are helping the cause of creating malware. This is not "shoot the messenger".

If the standard implementation has at least some protection, by displaying a graphic or hashes per second or whatever, then I'd say you are correct. You are not to be held responsible if someone takes your software, *removes* the small amount of user information, and then puts it out there. But this went the other way around.

It's not 30% CPU usage. It wastes one full core because it's currently not using multiple threads. It tries to run as fast as it can, and on single-core machines (yes I'm talking about smartphones here!) this is a pretty common scenario.

No it doesn't. Have you even read this thread?

I didn't read the full thing because testing it out myself, on the official bitp.it website, was much much faster. There I could directly see what the CPU usage is. So it was pretty clear.

Our jsMiner uses HTML 5 web workers. NO smartphone supports web workers. Do you know what that means? That means that it cannot "run as fast as it can". Nope, no sir, not at all sir. It uses the UI thread. In fact, each website operator can force all instances to be as friendly as they want. But, you wouldn't know that either since you haven't read this thread.

Correct, and okay, ONE point for you. However: just because current smartphone implementations don't support web workers, this doesn't mean that future generations won't. If this idea is here to stay (and yes, I am in fact afraid so that it will be, otherwise I wouldn't waste my time complaining!), then some people need to think about these obvious consequences like wasted battery life. Plus, laptops are still affected anyways.
So far, I also have to see a website yet that *doesn't* bring one of my CPU cores to 100% when I visit it. And fully uses up both cores when I have two tabs of it open.

I'm also not aware of a way to download the source code. On the bitp.it website there is no button, link etc. to do so. I'm guessing there is a way to download it after you sign up, but nothing anyone could know if there is just a generic "sign up enter email here" field on the site. So it's completely obvious that not everyone reads the code, because it is de facto not open source.

How did you find out about bitp.it? Lots of talk on the Internet about it being open source

But, in case you lost the link: https://github.com/jwhitehorn/jsMiner

Nope, I did not hear about it because it was open sourced. And that link is nowhere to be seen on the bitp.it website, and also not on the first page of this thread, so you are obviously deliperately making it hard for people to find it.
Maybe I'm wrong an it will appear within 24h on the bitp.it website. Let's find out shall we?

What I do not understand Natanji is what your problem is? Every "problem" you have mentioned is simply a reflection of your ignorance. Do you have any real feedback to provide?

As mention, bitp.it has some big things coming out this weekend... perhaps that will change your mind. But, perhaps your mind is already made up.

I'm curious on how you want to get yourself out of this, or in what way these "big things" will change my mind on any of the arguments I've given so far.

[cablepair]

is there a way I can show the users mining speed on my site like you do at bitp.it ?

[anisoptera]

Malware, short for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior.

Congratulations.
Don't inflate my electricity bill only for your gain, you people. Seriously.

I'm not defending this, but it isn't malware. This code:

- is NOT "designed" to disrupt or deny operation in any way. It is designed to mine bitcoins. Mining bitcoins does not disrupt or deny operation. At worst it slows down the site that is actually using the miner.
- does NOT gather information that leads to loss of privacy or exploitation. The information it sends back to the server is the results of calculations performed on data retrieved solely from the server.
- does NOT gain unauthorized access to system resources. You loaded a script into a JS interpreter and told it to run when you loaded my site, implicitly granting access to the JS VM and everything it is reasonably expected to have access to. This doesn't include finding an exploit in the JS interpreter and breaking out of your sandbox, but within the sandbox, you've granted the script permission to do what it wants.

If you go to a site and you have Javascript enabled then you cannot claim that the fact that that site runs JS on your computer is unauthorized access. If you are concerned about power usage then you should have JS disabled (or Noscript turned on) and also probably block flash as well. If JS is disabled in your browser for some reason, then you are not implicitly granting websites permission to run scripts on your machine; if the miner continued to run in THIS case, it would be malware.

The definition of malware is not so broad as to include "using CPU cycles that I expected to be idle".

I'm still going to block the script, but I won't be so disingenuous as to call it "malware", because it isn't. It's just like any other ad. This one just doesn't flash or play annoying sounds or pop up windows on your screen.

[manifold]

First Points:

• Your idea isn't good, it is brilliant.
• If bitcoins will ever get a major payment, your way WILL replace ads
• Your idea, may very well get some sites to use it instead of ads, and therfore will make the bitcoin market bigger

Seconds Points:

• All code has to be open source, if you really want to spread it as wide as possible
• An optional visible hashing rate would be nice
• A choice (I want to use 10, 20,.... 90%) of the end users cpu.

Thanks for your idea and implementation!