To be honest, I'm not very familiar with ethereum and its scripting. I just went through the contracts on etherscan.io and took educated guesses and googled for things. After spending a bit more time, I actually /think/ cloudflare might not be able to cheat, because the results appear to be signed from random.org (but I have trouble finding/checking  the code which verifies the signature, does it even exist?). My reading of the logic is that the TLS signature from cloudflare is checked, not the random.org signature, which if so, would allow cloudflare to cheat. But I very well might be wrong, as I said I'm not that familiar with this sort of thing

I don't really mean to accuse them of anything, they're just some concerns i have by reading their code. It'd be nice if they address the issue instead of side stepping it calling it "fully decentralized" which it obviously isn't. If you use a centralized service (oraclized), to call a centralized service (random.org) through a centralized service (cloudflare) done with a decentralized service (ethereum) it doesn't magically become fully decentralized.

Sorry to be an ass and repost this from another thread, but considering you are asking for a considerable amount of investor money, I think it's prudent to not dodge my technical concerns:



wth? If this is your serious reply, I'm starting to suspect another ICO scam coin. My concerns are laid out pretty straight forward:

* random.org  can cheat (by picking any number they want)
* cloudflare can cheat (by signing any number they want)
* oraclize can cheat, by calling random.org as many times as they want and picking the result they most like (or reusing results?)


And not only can they cheat, they can undetectable do so.  And you dodge the question with "You're saying you trust centralized more than decentralized   "

which is beside the point, and I believe nonsense as you're calling centralized services. It's like call "untitled dice" decentralized, as it's a serverless gambling app -- but the reality is it uses a centralized service (moneypot). Same with yours, you might not need to run a server, but random.org, cloudflare and oraclize all need to.

Sorry to be an ass and repost this from another thread, but considering you are asking for a considerable amount of investor money, I think it's prudent to not dodge my technical concerns:



wth? If this is your serious reply, I'm starting to suspect another ICO scam coin. My concerns are laid out pretty straight forward:

* random.org  can cheat (by picking any number they want)
* cloudflare can cheat (by signing any number they want)
* oraclize can cheat, by calling random.org as many times as they want and picking the result they most like (or reusing results?)


And not only can they cheat, they can undetectable do so.  And you dodge the question with "You're saying you trust centralized more than decentralized   "

which is beside the point, and I believe nonsense as you're calling centralized services. It's like call "untitled dice" decentralized, as it's a serverless gambling app -- but the reality is it uses a centralized service (moneypot). Same with yours, you might not need to run a server, but random.org, cloudflare and oraclize all need to.

wth? If this is your serious reply, I'm starting to suspect another ICO scam coin. My concerns are laid out pretty straight forward:

* random.org  can cheat (by picking any number they want)
* cloudflare can cheat (by signing any number they want)
* oraclize can cheat, by calling random.org as many times as they want and picking the result they most like (or reusing results?)


And not only can they cheat, they can undetectable do so.  And you dodge the question with "You're saying you trust centralized more than decentralized   "

which is beside the point, and I believe nonsense as you're calling centralized services. It's like call "untitled dice" decentralized, as it's a serverless gambling app -- but the reality is it uses a centralized service (moneypot). Same with yours, you might not need to run a server, but random.org, cloudflare and oraclize all need to.

Hey, really cool to see a new unique site!   Your design looks good and original, however I suspect the game might not be able to work as is.

The expected profit for the house is going to be crazy, as ndnh said: a 0 to 90% take. While this might seem appealing at first as a casino owner, it's actually counter-productive because players are going to hemorrhage their money, and not want to stick around. A big part of the gambling experience is variance and winning, which is achieved by returning almost all the money to players (e.g. 99% of it)


Also another problem I think you'll find, is getting 10 players to all bet the same. If players can't have arbitrary size bets, you're going to have a lot of problem match-making. And more importantly, you won't be able to get the business of whales (because you won't have 10 whales on at once) One thing you could do, is copy the scheme from: bustabit.com/faq#last  and use a variance of that (it's fair to players, regardless of how big or small they bet) and return say almost all to players (say keep a 1% take of the difference between the pot size and largest bet).

So looking a bit deeper into this, it seems even more concerning. My understanding is that the player will need to trust

* random.org
* cloudflare
* oraclize

As the code doesn't appear to be using random.org's sequences (?), so there's no way to check how many times random.org was asked for random numbers. It just checks that random.org gave a result. It can give any result it wants, and there's no guarantees (unlike a provably fair scheme). But worse, is this means oraclize can ask it as many times as it wants. But the TLS layer is done by cloudflare, so you also need to trust them (they can change the result if they want). There's probably no problem trusting all 3 (?!) parties, but the problem I see is if one of them cheats, it's 100% undetectable.

Now contrast this to going to a bitcoin gambling site, say PrimeDice:

* I deposit money
* I play using a proper dedicated interface, and have instant bets
* I check my results
* I withdraw


So in the vdice case, I'm trusting 3 parties who can cheat me (?) but if they do, I'll never know. And they know I'll never know.  Now contrast to PrimeDice, which you do need to trust with the amount you deposit, however it's impossible for them to undetectable cheat you. This provides extra incentive for them to be honest.


Anyway, I'm sure i'm missing something as AFAICT it's strictly a step down from current bitcoin gambling?   (Disclaimer: I'm very unfamiliar with ethereum and greatly dislike it, so my reading of the contract is likely totally mistaken)

Is it really? In your contact code, I see references to api.random.org

At that point, is it really FULLY decentralized? And is there any mechanism to stop random.org cheating your investors, or is the assumption that they should trust random.org ? And what about gamblers? Do they need to trust random.org?


Anyway, you should also create a "technical description" that explain in high level how it exactly works, and the trust model. As it almost seems incongruent to call it "fully decentralized" and "only trust the blockchain" and have API calls to that are hitting a centralized and non-provably fair server, random.org

I'm not really sure, I don't really understand what he means. With knowledge of the server seed, it probably only takes a few hundred CPU cycles to figure out the required client seed to win. (let x be a random number in the winning range. Then use a client seed of:  (x -serverseed) % 2^32.  Or if you're lazy and want to brute force a client seed -- there's only 4 billion possibilities, and it's a simple range check, so you can scan the entire range in under a second. But you don't even need to scan the entire range, as there's probably at least 50 possible client seeds (if you're randomly searching) so it's an extremely fast operation.


Or let's forget all that, and let's assume that it takes 6 minutes to find a client seed and the player was betting every 3 seconds ...  that means the player has a ~1.6% of finding the seed in between their normal bet. But if they win, they get like a million times their money. Auto-betting with a 1.6% chance of making a million times my bet .... in a few minutes of betting, you're almost guaranteed to hit the jackpot

Is this a joke or an allusion I'm missing?

It's worth noting, the seed is designed to stop the *server* (MP) cheating. A client can never cheat by improperly picking a client seed [1], it just opens the possibility that the server could cheat. However in this case, a player won a lot of money -- so it's not really a consideration. (However, the app should be fixed ASAP, as it's not provably fair)



[1] Assuming the server is generating a proper random number

Very interesting.  I wonder what causes this? Just eyeballing it, it seems most of his client seeds are oddly low, definitely doesn't look evenly distributed. However, this wouldn't allow him to cheat unless MP was trying to cheat him, and he was exploiting that? (I saw that very thing happen on a shitty site a couple months back, you can find it in my post history).

My guess however is just that what ever app he was playing on was not properly coded, and inconsequential to his wins or loses. (But should be fixed ASAP, as it would make the site not provably fair). Generating client seeds is very easy: https://gist.github.com/RHavar/a6511dea4d4c41aeb1eb

Inside, and ranges follow the convention of being [inclusive, exclusive)

I share your concerns about them being a centralized man-in-the-middle, however I don't think the other stuff is too accurate.

I'm not aware of any attack that has ever been too big for cloudflare, or customer they've dropped because of large attacks. I know they've certainly stood in front of my site for some attacks that other providers couldn't close to handle.

Also they've done a *lot* of work on the tor problem, and even allow you to special access rules for tor users if you want them (and the deluge of abuse that comes with it). It's honestly not cloudflare's fault that the vast majority of tor traffic is malicious (they blogged that it's 94%), they simply wouldn't be doing their jobs if they gave it a free pass because it was tor. And they're doing some pretty cool stuff like working on blinded captcha tokens so tor users won't need to re-enter the captcha at each site, while preserving privacy etc.


(FWIW, I'm no cloudflare shill and think it's great that bitcointalk doesn't use them. I really worry about them being the biggest intelligence honeypot in existence, with all this encrypted traffic neatly decrypted for them. But you have to give them credit, they're a damn good service)

If you're going to shill, at least take pride in your work. All four posts of your account have been related to bitizy. I especially like your first post, posted on a competitor thread:


Which is actually before this very thread was created.


But to address the contents of your post. On other gambling sites the operator can scam, but players have the ability to detect it. If it's not possible for the operator to undetectably scam his customers, it's provably fair. If it isn't, it's not. There is simply no way to know if when you lost at bitizy you lost due to bad luck, or were ripped off. Hence bitizy is not provably fair.

As it's been made clear, your site is not provably fair. There's nothing inherently wrong with having a non-provably fair game, it just requires people to trust you. But then you continue to mislead people into thinking the game is provably fair, which seems self-sabotaging. Also the actual page "provably fair" scheme doesn't really offer players any tangible assurances that the game was actually fair, except perhaps in the case they personally know all raffle participants; but even that is diminished by the use of md5 (which has been advised against using for the last 20 years)

I think your behavior is rather inappropriate. Yes, you were undoubtedly ripped off, and I'm sorry that it happened to you. However, you were paid out in full with a generous gesture by betking. At this point, you're no longer out of pocket and continually campaigning to have them pay you doesn't sit right with me.

If you want to campaign that they reimburse betking, or pay out all the other people who were in your exact position (which they damn well should!) but were not so lucky as to have someone donate them the money; then I'd fully support you. But demanding they pay you to close the thread, is just being opportunistic.

Ok. So you unknowingly broke a rule that they've punished other people for doing so, but you fortunately got a free pass (probably because they calculated the life time value of having you as a customer is greater than the amount of your withdrawal). But I'm just going to project here a little, and I suspect if had been like one of the other guys who lost 3.45 (like the OP) and 20 (?) bitcoin due to the very same mistake you wouldn't be so happy.


Anyway, obviously they don't screw over /all/ their players, that just wouldn't make business sense. It's probably pretty safe to assume for every 1 customer they royally screw, there's another 10,000 they don't. But that doesn't make it ok. You don't get brownie points for doing the right thing.


--

(And for everyone, I apologize for keep beating this horse, as they've already said they're finally going to fix the problem, which is fantastic. I just find it mind blowing that anyone could defend what is obviously highly predatory behavior and selective enforcement)

Not a problem that it keeps changing, but you might want to update:

https://www.moneypot.com/proof-of-assets.txt

Along with the signed message, so people have a place to go to, to check you really do control the address and the balances.

Yeah, you're completely right. The pvp aspect of bustabit isn't provably fair, as you point out:

a) I know what the game outcome is going to be  and
b) I know how other players have bet, before it's revealed.


I've never however played against player, or provided information to anyone that would allow anyone to. There's no way I can prove that, but most of the bonus hunters are pretty scientific about it (as they tend to not be gamblers, but advantage players) so I suspect they would notice pretty quickly if bonus hunting became impossible (because I was skimming). I guess they'd have no way of knowing if that's because they've been outsmarted by a better bot(s), or if I'm cheating.

Maybe I should start publishing weekly figures of who are the biggest bonus collectors (both in % terms, and absolute terms) so people can get a feel for who are the bonus hunters and if they think that is or isn't me

Well bustabit is pretty similiar to poker in the sense there is both a skill and aspect. (And both games it's possible to play +EV in certain situations)