Comment by geocar
2 months ago
> but PoW scales
Not if the honest party is doing it in a browser: The same computer can so any POW so much faster in C than any amount jf JS and WASM that it will never ever ever be a contest.
> becoming much more obvious and easy to block, or they have to use massive amounts of compute.
If you believe this, please contact me: I think compute is free[1] and can probably help you out.
Can you not design a PoW that is most efficient in a browser? Don't brute force hashes like Hashcash/Bitcoin, do something similar to RandomX instead but in JS. Browsers ought to run the fastest JS interpreters already so if interpreting JS becomes the bulk of the work, that attack might not work. Maybe even involve the DOM or whatever else makes sense.
> Browsers ought to run the fastest JS interpreters already
Well they don't.
Users want the website to work sooner, and care little about whether a for-loop of elements take 10ms or 20ms if it only happens once.
JS can be AOT compiled if you can wait a few _seconds_ -- which users don't want, so browsers don't bother.
Our attacker however, rightly observes they only have to pay that compilation cost once.
If it takes seconds to compile it then the browser wins. The PoW only runs for seconds already.
1 reply →
[flagged]