Monero for DDoS protection
Monero for DDoS protection
Trocador used to be a pleasure to use. No Javascript, it worked over tor, and it had an onion service. Then they got DDoSed. Turns out this is what causes the enshittification of the internet, that sites without javascript are trivial to DDoS. Now, the statement about no JS is gone, the onion service is gone, and if you try to connect over tor, if you can connect at all, you get DDoS Guard demanding you enable javascript so it can try to fingerprint your browser and force you to perform captchas. What if there was a better way?
You use a proof-of-work cryptocurrency that is not only microtransaction capable, but also "micro-mineable", i.e. the difficulty is low enough that you can solo mine multiple blocks per day even on modest hardware. For proof of concept you could use stagenet monero, but in the long term you would use a dedicated fourth Monero blockchain where transactions older than a certain age are pruned, because the idea is that PoWnet coins are something you mine and use rather than using them as a long-term store of value.
You go to website.app/NoBS/, and the site communicates in headers the current cost in PoW tokens of an access token good for X minutes of access and an appropriate amount of server resources for a non-bot user during that time. You have a web browser plugin that reads it, and if you've whitelisted the combination of site + cost it can autopay from a PoWnet wallet so you just go straight through.
No more javascript or reliance on third parties that might be compromised.
To keep people from rolling forward their PoWnet balance forever by making a transaction just before the outputs expire, PoWnet ouputs could have a telomere which is reduced by one every time they're transacted, so they also expire after a set number of sends. It would be a small value, not more than 5 at start, and merging outputs would use the least of the input t-values.
Or you could just pay for website access in minute amounts of mainnet Monero. But I expect people don't want to pay in real money, and I want there to be a way for people who don't have any mainnet Monero to still use the system.
This is precisely what Hashcash is. Hashcash is widely acknowledged as the primary ancestor of Bitcoin.
Also, Tor now has a system like this built-in. It uses PoW. It's quite new (less than a year old) and you have to explicitly enable it, but I'm sure the trocador admins know about this.
But seriously, regarding enshittification, I don't think javascript makes websites any harder to ddos. Rather, you get ddossed until you cry uncle and comply with the demands that you help MITM and fingerprint your customers. Javascript happens to be useful for fingerprinting. It has very little to do with ddos mitigation.
facts
Just take the main website down and use the onion since it has proof of work, DDoS protection, thanks to Tor.
But they did the opposite. The onion is gone. Presumably they have some reason for that?
Also onion sites in general are very slow because of the six hops. I'd like an open source solution that can be used by anyone, including clearnet sites, so that use of captchas and browser probing can be reduced across the entire web.
And Trocador couldn't go onion only because an increasing number of their partner exchanges were no longer willing to be available over .onion or i2p.
It's only three hops if, like Trocador, you don't need to hide the location of the server. They can (and should) enable HiddenServiceSingleHopMode. This hides the location of the client but not the location of the server. Six hops is only for darknet sites that need to hide the server location.
this is targeted by the global powers, to get everyone on the top major cdns like akami, cloudflare, etc, in order to scarf and decrypt all traffic. enshitification is correct af.
why tf do they not have an onion anymore?? have they said anything? it would be perfect to have the onion.
edit. i just checked and the onion is gone but i can connect to the clearnet from tor with no js.
edit again
trocador just made another post on monero.town
go look at it!
I never understood why monero hard forked to using a hashing algorithm that was intentionally difficult to implement in WASM.
Like, we could be implementing anti-DDOS fronts as an alternative to CloudFlare that use PoW to mine monero and also raise funds for the site at the same time.
News sites could use this as an alternative to an authwall ffs (just wait 10 seconds before you read the article).
Its one of my least favorite things about Monero, and something more people should be talking about
Having most people's first and only exposure to your ecosystem be malware level browser miners that really diminish their browsing experience is really really bad pr.
WASM is the millennials getting their turn to learn that "those who do not learn from history are doomed to repeat it".
Letting the bloated web offload more of its bloat to clients will simply result in an even worse web obesity crisis than already exists. The computational burden needs to stay with the side (the content producer) that has the ability to reduce the level of bloat. Anything else is a broken incentive structure.
What I'm saying is implementing it in the front, so instead of spending 2 minutes solving captchas, you spend 10 seconds solving a PoW, then load the site without any background mining.
We shouldn't ban knifes just because some people use them to stab people.
Do you know about Primo? I think it was only a proof-of-concept, never used widely: https://monero.stackexchange.com/questions/11752/what-is-primo-private-monero-payments
Primo is a protocol and associated suite of software allowing a website to request payment for service by mining Monero to an address owned by the website owner.
Use their i2p gateway, works with no JS.
i2p ftw