this post was submitted on 15 Jun 2024
69 points (91.6% liked)

Open Source

29009 readers
183 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 4 years ago
MODERATORS
 

Situation: You run a website and want users to have to do some amount of work in order to activate a function in your code. The "function" can be anything: creating an account, receiving some kind of in-game token/reward, dispensing coins from a faucet, whatever. Captchas are becoming increasingly both increasingly complex and increasingly useless against spam attacks. Various "proof of personhood" options are available (SMS verification etc) but come with downsides as well.

An obvious alternative to captchas is some kind of "proof work" scheme where the user has to run a certain number of hash calculations. This is cheap for individual users but expensive for spammers to spam, and could even net you a little crypto if you wanted it to. This, for example, is the approach used by Tor's anonymity network help prevent DDoS attacks. This is fine, but it serves no other purpose and uses lots of of energy. Though in Tor's implementation, it is only occasionally used as opposed to being used for every request.

My script is a "proof of useful work" captcha alternative. The user must download and process a chosen amount of workunits from a chosen BOINC project(s). This work is "useful" because it contributes to scientific research. BOINC is a software for distributed/volunteer computing and its used by scientists all over the world including the Large Hadron Collider (CERN) to offload expensive computation to the machines of volunteers. My script downloads stats from the BOINC projects and verifies the user has completed the work. If the user is a pre-existing BOINC user, they will already have sufficient credit to instantly activate the function on the site.

The default setup for this software is as a "crypto faucet", but you can plug-in any function you want: anti-spam, user registration, whatever. It calculates a cost for the "work" and makes sure it dispenses less than the cost, making sure no user has incentive to use the faucet more than a few times since it would cheaper for the user to just do the work on their own without the faucet acting as a middleman.

Downside of this tool is that the user may take some time to accumulate the credit (unless they are an existing BOINC user with credit) and the BOINC projects only report updated credit once every 24 hours (though if you ran your own BOINC project for this purpose, you could get this time down much lower). So while this can be good for longer-term tasks (such as giving an in-game reward to users who contribute to science), it is not quick. They also have to download and run BOINC (and change their username at a BOINC project), which is a big step compared to a captcha. In an ideal world, the BOINC work could be completed in the browser instead of by downloading BOINC, I believe folding at home had a client that could do this at one point.

Anyways, I think it's an interesting idea. Maybe you do too and can use it to your advantage somehow.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] [email protected] 20 points 3 weeks ago (2 children)

@makeasnek Does BOINC have any verification or protection from malicious actors finishing the work incorrectly just to get through the captcha? If not, this might actually poison the BOINC network, because bad people will have a motivation to get credits without performing the work.

[โ€“] [email protected] 4 points 3 weeks ago

There is already gridcoin which is a cryptocurrency that awards boinc work, so I'd say this concern has already been addressed because of that.

load more comments (1 replies)