3

I'm a markdown fan, and there is a very useful tool named Typora (It is free but not open source).

When I went to its official website to download it, there was neither animation nor complicated service. However my cooling-fans on my computer ran in full-speed when I visit this site. And when I open the task manager I saw a whole core are eaten up. What does this website do? Is there a bitcoin miner in JavaScript included in the source code?

In addition, does Typora itself have the same kind of problems?

Are there any useful tools to analyze the behavior of a certain website or a software?

1
  • 2
    Many websites just use really, really crappy code that burns through cycles far more than they should. Bing Images comes to mind. It's not necessarily a miner just because it eats your cycles. Most browsers can do analysis on the performance of various web pages via their developer tools. Try that.
    – forest
    Mar 2, 2018 at 3:34

3 Answers 3

6

I tried to access this site in my VM found the same issue. The Typora website is running the below script:

<script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-54f423356e25706b" async="async"></script>

Typora is also using the below scripts without caching, so that it can avail the latest of resources:

https://m.addthisedge.com/live/boost/ra-54f423356e25706b/_ate.track.config_resp
https://s7.addthis.com/js/300/addthis_widget.js

I blocked addthis.com and addthisedge.com using hosts file in C:\Windows\System32\drivers\etc. It is the file used to map domain name to IP. I pointed these domain to my local random IP. After that, site does not able to find scripts and failed to execute.

What is addthis.com? According to The Guardian it is a social sharing tracker. I found that it tried to read data from other sites which I was using at that time.

After blocking these sites, CPU use is normal.

1
  • Thanks, It help me a lot, however, will addthis.com get information of my account name or password of the other site?
    – Sajoi8
    May 16, 2018 at 14:40
3

Most web browsers come with a build-in development tool called a "Profiler". This tool can be used to identify which javascript functionality from a website consumes how much processing time. Development tools are usually accessed with F12.

Using it on that website confirms the answer by again. Most processing time is used by the script https://s7.addthis.com/js/300/addthis_widget.js (by the function i._handleScroll, to be specific). The script is minified, so I don't really feel like doing more research into what it is actually doing. Either that script is just that awful, or the developer of the website made a mistake when they integrated that script into their website. Anyway, this is not for you to fix. You could block that script using noscript or by blacklisting the whole domain in hosts, but it is possible that the website won't work correctly anymore if you do that.

By the way: Websites using their visitors' processing power to mine Bitcoins or other cryptocurrency is actually a thing. I have seen such websites myself. But they will usually not use the CPU. They will use the visitor's GPU through the WebGL API. That means your GPU fans will start to spin, but the CPU usage in the task manager will stay rather moderate. If you want to check the current load of your GPU, check the website of the vendor. They often offer companion programs for their drivers which show such information.

3
  • How can I block the WebGL API in my browser? Because there is no chance for me to use GPU on browser.(I use HTML5 player to watch video on website).
    – Sajoi8
    May 16, 2018 at 14:51
  • @RoseKent Please ask this as a new question. Remember to state which browser you are using. Not every browser will have this setting in the same place (if at all). And by the way, WebGL doesn't have anything to do with video playback. It's for 3d graphics... and bitcoin mining... but mostly 3d graphics.
    – Philipp
    May 16, 2018 at 15:04
  • I post it there superuser.com/questions/1323271/… . Welcome to pay attention. Thanks!
    – Sajoi8
    May 16, 2018 at 15:52
1

Depends on your browser. On Firefox, you could install NoScript and whitelist JS for that site selectively, perhaps it's a particular JS resource that is not strictly needed to view Typora itself.

Ghostery may also be able to do that on Chrome, though I have a lot less experience with what it does, it's much more automated than Noscript.

Warning: I like NoScript, but it can get a little paranoid about things and you need to do a lot of handholding to whitelist. Best to have a different browser without it available as well.

Update: yes, a major hog it is. Firefox shows a FirefoxCPWebContent at 170% on my macs Activity Monitor. And that's with all the site's JS disabled. Looks like they goofed up the code something fierce - there are a lot of open handles to fonts for that subprocess.

Bottom line: even NoScript can't fix this.

7
  • Noscript can whitelist fonts which may help.
    – forest
    Mar 2, 2018 at 4:43
  • hmmm. maybe. Pre-57/Quantum, NoScript could also lookup info about websites from various web trust registries. The UI still shows that option, but it's not doing it.
    – Italian Philosopher
    Mar 2, 2018 at 4:48
  • 2
    Just fyi: Ghostery had some privacy issues in the past (and possibly still has some).
    – Tom K.
    Mar 2, 2018 at 8:23
  • 2
    @TomK. It still has those issues (unless it changed very recently). It sells user behavior information to advertising companies.
    – forest
    Mar 2, 2018 at 10:21
  • chrome lets you block scripts on a per-site basis, much more convenient than a script-domain basis like no-script. just click the URL badge, choose "site settings" and change Javascript to "Block". it used to be right there in the drop down, now its a new tab, but still effective. kills most ad block blockers too! you can make Block default and reverse the above for mis-click protection/paranoia alleviation.
    – dandavis
    Mar 4, 2018 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .