Possible solution for stoping oversized mining rigs

[BiohazardShell]

Hi,
I would like to gather here possible solutions to stop users that are breaking the Duino Coin project by creating oversized mining rigs and help @revoxhere find a durable solution for the project.

I have thinked about a way that may help.
By defining maximums of workers for each category based on efficiency ( currently -4% per arduino so over 25 arduinos efficiency for each new workers is 0 ) pools will be able to reject a certain amount of shares.

ex:
30 arduinos
30/25 = 120%
so 20% of the shares gets rejected.

Please feel free to post. We are here to debate the subject.

Thank you @revoxhere for starting this awesome project.

[LadDS]

How would this curb the use of AVR emulators? Isnt the point of AVR mining to use actual hardware?

[BiohazardShell]

This is a different problem. But in a way by caping the number of workers you will cap the number of emulators.

Then you can use the atmega serial number to check if anyone is using the same.

Of course if someone as already registered an emulator with that serial it will be hard to determine who's lying.
Not perfect but could help.
Maybe there's a way to challenge workers that will reveal if they are real atmegas.

Again not the subject. Here I try to tackle the oversized rigs problem.

[nigeljohnson73]

I like the overworking shares get 'donated' to the project rather than rejected... that way you can go over the limit and contribute at the same time :)

I am a little confused by the limiting stuff and the undocumented changes that have occurred, but my thoughts are:

Have a limit per user, then cap as above. I think the original idea of per user per client IP was also quite good. Per client IP alone seems bad for areas like student groups etc. Per-user limits stop accounts from accumulating significant coins regardless of what it's doing, or where. the current worker limit of 150 seems high, while 25 seems low to me.

Trying to make each miner thread the same regardless of hardware seems to me to be the key. If you run a miner of a GPU, the difficulty is much higher than on an Arduino, so they should produce a solution in the 1.5 second-ish timeframe. If you can uniquely identify a thread (chip id for example) then you can possibly even slow the acknowledgement down - bad on the server though, and if you randomise your chip ID between calls that might attempt a bypass, but a submitted share should match the requested share, so this would be where you would rate limit.

Based on time limiting though, you could also use some factor to limit rewards... aiming at 1.5seconds... if you come in at 1 second, you only get 66% of the reward.

Doing that will mean that regardless of hardware, the mining is the same, then regardless of the number of miners, you cap out at the upper end. Run on a GPU or AVR simulator... all handled.

To reduce the creating of multiple accounts to bypass this, the emails sent out should have an activation link in, and possibly an update every so often - 90 days for example - so that you need to ensure you still use your account. all using the google captcha thing. If your account is not active, you don't get jobs.

Hopefully something useful in my ramblings :)

[BiohazardShell]

I like the idea of "donnating" the overworking shares. It would be a great way to stop greedy people from over-sizing rigs and allow others to donate more to the project.

Having a worker limit at 150 does seems high regarding workers efficiency. I agreed that 25 is low I would rather like to see something closer to 50.

To make each miner thread the same we could use a challenge/response that will allow us to determine what "type" of hardware is used base on response results. We could also use specific algorithms that some hardware can't do.

I'm not a fan of the time limit factor. People with bad or low connections can have high pings/packet loss that may affect the response time.

The email thing works as long as they aren't organize or automate the process. Using python and headless firefox could allow you to connect to a mail server check emails and open links with the headless firefox. With that technic most of the time Google's ReCaptcha won't think your a bot and allow you to just check the box. But I'm getting carried away here.

Feel free to keep rambling :)

[nigeljohnson73]

Yeah, email processing is tough, but a 90 day check to keep an account unlocked for mining would mean humans would have to interact with the account at least that often... doesn't reduce farming out though.

Time limiting would be minimum time... A target of 1.5 seconds computational time, any shorter the difficulty goes up, or a delay processing... any longer and immediate response. no impact to slower hardware or networks.

A combination of things will reduce the likelihood, but very little will reduce the impact of a VERY determined individual being able to leverage the system.

[jonnycn]

I think we can kick out of the system by limiting the daily mining amount of each account! For example, 200 accounts. At the same time, the number of accounts that can be used by each IP is limited. For example, each IP can have up to 6 accounts working at the same time. The accounts that exceed the limit will not get benefits!

[nigeljohnson73]

If you're going to be using IP listings you'd probably want to have a higher limit as there are various places where a shared IP would be expected, and where a possibly large proportion of users might sit demographically - students in school and halls of residence etc. Let hosting firewalls handle spam and DDOS etc. Also, IP management is easy to get around with a VPN so as a security measure it seems like a lot of maintenance for little gain/protection.

[BiohazardShell]

There is no real way to stop account creation. There's many technics that will help but won't stop it. For example: validations email works as long as they don't use things like temporary mail boxs.

[nigeljohnson73]

Very true, a very determined person, or group of people will always be able to bypass things at least temporary. Temporary accounts could still be capped if 90-day keepalive emails were sent out... but that's a little intrusive... but then if you're investing, and active it wouldn't be. Lots to think about.

[nigeljohnson73]

Cap the number of chip ID's per account in any window (say 15 minutes) and use the submit job to get another job so a 'chain' can occur. This would stop anonymous/random chip ID's being spoofed in software to bypass the difficulty algorithm, and allow the backend to better set difficulty based on submission rate.

One possible downside is that cheap cloned chips would all have the same ID though...

[BiohazardShell]

I do use some clones and I can tell you that they all use legit Atmel ATMEGA328P. The price diffrences comes mainly from the usb to serial controller CH341G wich is MUCH cheapper than the arduino (FSI?) mainly because it requires a special driver.

[Izder456]

iirc someone (i forget who) said in the discord server that all arduinos (emulated or not) have chip identifiers or serial numbers. just either reject the known emulator chip IDs or set 100% donation level server-side on these emulation chips

[BiohazardShell]

It's close to what I said. The thing is you can't realy tell apart who's lying. If an emulator already registered the ID then the real arduino will be unusable. That's the problem.

[Izder456]

another possible solution is to encrypt the shares with some encryption method client-side, with a method only possible on real hardware like using real pins on the real arduino needing to have voltage or not, and if that isn't true the encryption isn't unlocked, thus making the share invalid.

[Izder456]

may i add the all the pins will be random from user to user.

[BiohazardShell]

Encryption requires a lot of processing power. Hard to achive on tiny arduinos working on shares already.

the pin technic you describ is a promissing solution yet some emulators could be able to emulate that. The physical interaction may be the key to kill emulators. I'll keep that in mind.

[DerProgrammierer78]

I think there is nothing wrong with rigs and nothing wrong with mining on other CPUs and GPUs. But I see the problem that other CPUs and GPUs are much more powerfull than an Arduino.

I think the current way of sending a photo could be part of the solution. The other part could be additional hardware and the fun and ambition of the people.
People who accept the cost and effort of a rig are very likely willing to register the rig and the corresponding Arduinos at startup. A rig like this usually runs for several weeks or months without interruption.

So maybe it could be a way to limit each user to 3 unregistered Arduinos and a maximum amount of DUCOs per day. Then it doesn't matter which hardware or software they use to mine DUCOs.

Users who wants to use more then 3 arduinos and mine DUCOs beyond the limitations must connect a small cheap I2C Display-Modul to the Arduinos. Then a new version of the software reads out the serial number of the Arduino and sends it to the server. The server uses this number and a secret code to calculate a new secret code. This will be sent to the Arduino and shown on the display. Then the user has to take a photo of this and send it back. A free open source OCR-software could read out the mail and automatically store the text on the photo of the display to a textfile. After this another software reads out this textfile and compares the code with the expexted result in the database. If they match, then the registered Arduino will be stored in the database as registered for this user.

The secret code for the registered Arduino could be sent as ID for this arduino within every communication to the server. So that this Arduino is not taken into account in the limits.

Maybe this sounds difficult to realize, but I know how to realize it and I could help with that. I already build something similar to automatically recognize texts in photos and store them into a database some years ago with free open source software.

[revoxhere]

Really interesting idea. I'll try to forward this to other admins and maybe we will reach out to you.
Also, are you taking part in the bounty program? if so - you can tell me your username.

[DerProgrammierer78]

My username on your Discord server is "Frank Niggemann#6188" and I am registered as "DerProgrammierer78" for mining.

[Weazel486]

Weazel wallet
For bounty rewards and help

Each type and power should get it's own coin currency If u mine esp32 u get a duino esp32 coin if u mine android phone u get duino apk or something like that Then if you mine with under 10x it's a duino apk 1x coin like 10c Mine with 20x it duino apk 20x Something like that So we can exchange values and we aren't detured from investing hardware numbers and computing power.......... I have quite few ideas if someone is interested

@revoxhere

[DerProgrammierer78]

In my humble opinion, Arduino coins should primarily be mined with Arduinos. And to include more and more other hardware and then to introduce separate coins for each type of hardware with an exchange program only makes it unnecessarily complex. I understand if someone wants to at least get their costs back with it. But this is about Arduinos and I think it should be left that way. Or you have to rename "Arduino Coins" to "Anything Coins".

The advantage of the Arduinos is that they require little power. And if you now consider every possible piece of hardware that uses more power, then that is not good for the environment either.

I think it's great that there is a crypto currency that can be mined with very little electricity and if someone wants to mine many many DUCOs, then he has to buy many many Arduinos. In best case Arduino Uno, Nano or Micro, because it just takes an average of around 30 to 40 mA while mining. In my opinion the next best choice could be an Arduino Mega with around 70 tp 80mA while mining. I think ESP32s and ESP8266s will take an average of around 100mA to 180mA while mining depending on the quality of the WiFi connection.

So based on the environmental aspect, it should be Arduinos from the Uno, Nano or Micro series. Or maybe special boards with Atmega 328P chips designed especially for low power consumption.

[Weazel486]

Without teirs and different coins then it's harder to value the coin earned and have a diverse low mhz rigs
Atm u are going to look for the best mcu boards to mine and if you want to go hardcore then u would have to breach rules to setup multiple accounts..........

With different coins or a ad-hoc version of approximating it and different base size for the size of your farm then u can go as hard as you want and everyone can enjoy without higher possibility of people breaking rules

Me personally I'm a electronics nut and if this was more farming based then i would be running lots of rigs of gameboys ps one mcu boards and collecting waste electronics and run a homebrew mechanical like Turing machine computer and transistor valve and relay brew machines along with basic and dos pc...........

But atm its pretty impossible to run it all at once and wouldn't be worth it
And way the system works be hard for it to be worth any $$$

[DerProgrammierer78]

If your primary concern is to earn money, then DUCOs are maybe not the best choice for you ;)

[Weazel486]

@DerProgrammierer78
It isn't my primary concern but it would be a good driving force to have this system gain a big status