Login

Recent searches

No recent searches

Search options

Only available when logged in.
mstdn.io is one of the many independent Mastodon servers you can use to participate in the fediverse.

Administered by:

Server stats:

372
active users

mstdn.io: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

Public
makeasnek

My open source "proof of useful work" captcha alternative (python)

lemmy.ml/post/16896583

lemmy.mlMy open source "proof of useful work" captcha alternative (python) - LemmySituation: You run a website and want users to have to do some amount of work in order to activate a function in your code. The “function” can be anything: creating an account, receiving some kind of in-game token/reward, dispensing coins from a faucet, whatever. Captchas are becoming increasingly both increasingly complex and increasingly useless against spam attacks. Various “proof of personhood” options are available (SMS verification etc) but come with downsides as well. An obvious alternative to captchas is some kind of “proof work” scheme where the user has to run a certain number of hash calculations. This is cheap for individual users but expensive for spammers to spam, and could even net you a little crypto if you wanted it to. This, for example, is the approach used by Tor’s anonymity network [https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/] help prevent DDoS attacks. This is fine, but it serves no other purpose and uses lots of of energy. Though in Tor’s implementation, it is only occasionally used as opposed to being used for every request. My script [https://github.com/makeasnek/ScienceStatsFaucet] is a “proof of useful work” captcha. The user must download and process a chosen amount of workunits from a chosen !boinc@sopuli.xyz [/c/boinc@sopuli.xyz] [https://lemmy.ml/c/boinc@sopuli.xyz] project(s). This work is “useful” because it contributes to scientific research. BOINC is a software for distributed/volunteer computing and its used by scientists all over the world including the Large Hadron Collider [https://lhcathome.web.cern.ch/] (CERN) to offload expensive computation to the machines of volunteers. My script downloads stats from the BOINC projects. The default setup for this software is as a “crypto faucet”, but you can plug-in any function you want: anti-spam, user registration, whatever. It calculates a cost for the “work” and makes sure it dispenses less than the cost, making sure no user has incentive to use the faucet more than a few times since it would cheaper for the user to just do the work on their own without the faucet acting as a middleman. Downside of this tool is that the user may take some time to accumulate the credit and the BOINC projects only report updated credit once every 24 hours (though if you ran your own BOINC project for this purpose, you could get this time down much lower). So while this can be good for longer-term tasks, it is not quick. They also have to download and run BOINC, which is a big step compared to a captcha. In an ideal world, the BOINC work could be completed in the browser instead of by downloading BOINC, I believe folding at home had a client that could do this at one point. Anyways, I think it’s an interesting idea. Maybe you do too and can use it to your advantage somehow.
#opensource
chebra

@makeasnek Does BOINC have any verification or protection from malicious actors finishing the work incorrectly just to get through the captcha? If not, this might actually poison the BOINC network, because bad people will have a motivation to get credits without performing the work.

Jun 15, 2024, 08:39 AM·Public
0boosts·1favorite
Public *
makeasnek

Yes, most projects implement validation of some sort as even well-intentioned BOINC users will occasionally submit invalid workunits due to computation errors, random memory bits flipping, etc. Validation schemes range from simple to complex but suffice to say yes they nearly universally have some sort of validation mechanism. People have attempted to cheat BOINC before simply in pursuit of a “high score” compared to other users, so the BOINC ecosystem is well acquainted with proper defenses for such behavior. There are even cross-project competitions people can participate in, people join teams etc, so the competition can be quite fierce.

Public
gibson

There is already gridcoin which is a cryptocurrency that awards boinc work, so I’d say this concern has already been addressed because of that.

Explore
About