Are you scared by a site that would use your computer to crunch data when you visit? You should be
A new open source project promises to harness two of the most hyped technologies out there. Crowd Sourcing meets Cloud Computing for Crowd Computing. The Plan is, a UK based company has released an open source library on GitHub name Really-Cloudy. It is actually a set of javascript files that allow you to “pass processing work to your website visitors.” But while this seems like a neat idea, it is fraught with the potential for malice.
The idea here is that when a visitor comes to your web site using standard javascript functionality you can turn their computer into a web worker doing data crunching for you. According to ThePlanis.com developers, “your users don’t have to install anything to join the processing cloud – it’s all done automatically with JavaScript in the background using the new Web Workers API.
I don’t know about you but that scares me to death. So when you go to a web site using Really-Cloudy, you don’t know it but they are using your computer to “crunch data”. Who knows what data they are crunching or what else they are having your computer do. Part of the library is a script that sends the work package down to the worker. That package could be malicious or worse.
Even if it were not I would be very upset with a web site using my computer to crunch their data for them without my knowledge and consent. Sort of reminds me of StarTrek TNG episode where they wanted to clone Riker and a few others without their permission. Just not cool.
The developers themselves at ThePlanis even acknowledge the potential for abuse when they say:
Ethics: At The Plan Is we don’t use Really Cloudy without an explicit opt in by the user. By design the web workers API allows you to run background tasks without telling the user but that shouldn’t be abused.
But just because they won’t use it that way, doesn’t stop anyone else from using it that way. That to me is just too dangerous.
In a way it is sort of like grid computing which in some ways was a predecessor to Cloud Computing. Harnessing CPUs to crunch data across networks is a great idea. The folks from SETI did it for years. You could download their screensaver and when it kicked in it would perform searches through the collected data looking for patterns that would indicate intelligent life. But in the SETI case you knew what you were signing up for. It couldn’t be done on the sneak without your knowledge and permission.
I would hope that most browsers would stop this js from running. At the very least I am sure NoScript would not let it run without your explicit permission. But how many people will log on with IE or another browser and must become the next victim?
Just goes to show you that not all open source is necessarily goodness. Also a reminder that when you go to a web site to a large degree you are at the mercy of the ethics and intentions of the web site operator. Like some sort of STD, you may not know what you are taking with you when you leave.
