The clientseed is generated randomly in the browser - not on the server.
I think it's currently being generated by server. When the user makes a bet, it does a POST request to: /ep/ajax/?func=placeBetDice which returns a field: which is then used as the next client seed. Although I'm really not sure why they're not using the gist I provided in the thread (generating client seeds on the server actually seems like more work, tbh). But I'm assuming it's on the TODO list in the next update. |
|
|
|
Since your server is making the generation of the random it makes it no different than a static seed. You should offer the ability for both.
Hmm, actually I don't believe there's any reason the server should ever be generating the client seeds, but I'm assuming they're going to fix that. Also supporting a static client seed seems kind of pointless, and I personally wouldn't bother; but I guess gamblers are a superstitious bunch and if there's enough demand for that it makes sense. However, as you say the client seed should definitely be user-editable, so if users don't trust the client-seed generation they can do it themselves. Anyway in the previous thread, BetterBetsDev said he's working on the fixes, so you're kind of beating a dead horse here. It's pretty clear that they're not trying to cheat anyone, and people do have other real life commitments -- so I think it's fair to give them another week or so to finish it up =) |
|
|
|
What exactly were the accusations? They have so many players that there's absolutely no reason to cheat. People are silly.
Basically not paying out people who won a lot of money, and shadow muting anyone who discusses it. I don't play there myself, or have any inside information -- so I really have no way of knowing if the accusations are true, so I feel bad for repeating rumors. But I have heard this from a few different independent people, and I would feel bad for saying nothing if this is actually true. They also disappeared for a few weeks without a trace or any communication, where everyone presumed they exit-scammed and then came back online, as they realized that was a bit short-sighted. So they're probably not the most reliable of people. |
|
|
|
|
I've heard from a few different people that csgocrash.com (who I regretfully sold a copy of the source code of bustabit, for 2 btc) has started scamming from its users. I have no way of verifying the accusations, but would strongly advise staying clear of that site until it's resolved.
|
|
|
|
and the players would have no idea what would others bet (In Nash equilibrium, the other player must know the strategy of the other).
The high level premise of your AI, is that it's going to try make players lose X% of the amount they bet. That itself is leaks a sufficient amount of information that it would make most forms of gambling, impractical (e.g. I know if have been unlucky, I will now be unnaturally lucky. If I have been lucky, I will now be unnaturally unlucky etc.) It's possible to constrain the gambling game in such a way it won't be exploited, I guess (i.e. only fixed size bets, no hi/lo choice). And this is already somewhat implemented on bustabit. Where the program itself will decide to maintain a profit for the website.
Hm. Not to be crass, but you should look at how existing stuff works before trying to design a different system. Bustabit and, in fact every single provably fair casino I'm aware of does *not* work like this, on the contrary, the next 10M games have been defined and set in stone, and regardless of how much players have won or lost the exact set of games will continue to play in order. If the casino loses 200 BTC on night, it will *not* alter the game in any shape or form to "recover" the loss etc. |
|
|
|
I am currently researching learning artificial intelligence and I want to ask if is there anyone interested on a dice site powered by an AI instead of pure luck? The AI will decide what bet will win and what bet will lose while maintaining a 1% profit from the wagered money and having the largest amount of wagered money? Please give me some good suggestions for this. Thanks.
For example:
The AI would decide what bet to lose, from a whale betting 1 BTC or from 100 users betting 0.01 BTC or something like that.
It's an interesting idea, but I don't see how it could work. Your first issue is going to be that if it's not predetermined, it's not going to be provably fair. But if it is predetermined, it's going to be vulnerable to players exploiting it (see the Nash equilibrium). As a casino operator, my goal is for players have a great time ... but ultimately (over a long time frame) end up losing. Often I see a new player come to the site, and hit some really bad luck, get destroyed. It's bad for the player (who enjoys that) which makes it bad for me. So there's some merit in the idea of having some "AI" that boosts unlucky players with some "good luck", so they don't get absolutely destroyed. But in order for that to really be feasible, the site would have to do the opposite to lucky players. But now if you have a casino that boosts the luck of unlucky players and decreases the luck of lucky players, which lowers variance and stops being an exciting casino and something more akin to an inhumane abattoir. Not really particularly appealing for players. I have however read studies on some slot machine players, where they're actually not really looking for a high-variance thrilling experience but actually looking for stability and time-burning and predictable and hypnotic with the chance of a giant jackpot. Perhaps your "AI" idea could work there, creating a more controlled experience. |
|
|
|
|
bitstars.net: Serious question. Why don't you enforce all the conditions of your ToS on the server? Most of them are absolutely trivial to do so (e.g. max bets) or "Sorry, you can only claim the deposit bonus 4 times in a row! Next deposit doesn't allow you to claim it").
The fact that you have:
a) Terms that are easy to enforce from your side, but rely on the player to be careful to not do so
b) If the terms are violated (which can be completely accidental), it works out hugely in your favor.
leads to the inescapable conclusion that you want people to break them (otherwise you would spend half an hour coding) so in the off-chance they win some real money, you don't need to pay
|
|
|
|
Yeah. And the house always win. But even if it is computerized. I think their is still the presence of real person monitoring to limit the amount of their losses in the game. And i believed in every gambling site ,they are always mark high roller person and carefully observing their game. Because gambling script can be trick by a pro hackers.
I can assure you that's not the case and in fact, how games are generated is very transparent and verifiable. I'd encourage you to look over it, or ask someone who understand the crypto to help review it for you. For what it's worth, some people just won ~30 btc on bustabit last night, and I was fast asleep. Zero monitoring involved. I think https://www.bustabit.com/user/Susanbee took half that, and the other half I'm not sure. And to be honest, I'd rather sleep through a whale attack then be awake, it's not like I can change the result without (detectably!) cheating. The odds are slightly in my favor, so even though many people will win, many will also lose and the house will live on  |
|
|
|
Do bustabit run their own bots or they are real people?
They are all real players, bustabit (or rather me) has zero house bots or players who wins/loses aren't real (i.e. shills) |
|
|
|
Nice digging up there NLNico  Yeah, although I think step b) and c) are also very important. It's good for BB, as they can be sure their customers aren't getting cheated, and it's good for MP because it removes the ability for them to cheat so there's no doubt in anyone's mind. And I doubt it'd take more than 10 minutes, so it's pretty good bang-for-buck. One of the features I was planning on adding on MP but never got around to, was a "cheating" mode, where the server would attempt to cheat (e.g. give results that were not provably fair, try predict, use "bet stalling" ) and then I could test sites with server-cheating-mode enabled, and if the server was able to cheat without the site giving a warning (e.g. alert("We got a bet result that wasn't provably fair?!") ) the site wouldn't be "certified" as provably fair. |
|
|
|
|
I'm guessing the stats you have on the page are fake? There seems to be 121 bets made on your site, all of which seem to be of dust and add up to less than 0.01 btc. But on your front page, it says "16.00012256 wagered Last 24 Hours" and a minute ago said "20.00xxx btc" and a minute before that said like "0.000xxxxxx".
I know it's hard getting started, and it looks like you've done a solid job -- but faking stats is a way to permanently damage your sites trust, I wouldn't advise it.
|
|
|
|
Don't play bustabit I just lost over $60. So today I was won around 45k bits betting 500 bits at 2x cashout and I was still negative around 35k everything was going smooth so I've deposited around $10 from my wallet to get more funds and survive red streak. As soon as I've invested and started playing red streak started continuously and then after I've lost all bits it goes to 4. So beware they controls reds when you deposit. I'm not going there again.
There exists a rather robust proof that the games were indeed fair, and a nice side-effect of our provably fair system is that it's never too late to actually verify the games. You can find the technical information here: https://bitcointalk.org/index.php?topic=922898.0 and if you don't understand it, feel free to ask me or someone else who understands the primitives involved =) It's not going to change your loss, but it might make you feel better knowing it was legitimate =) |
|
|
|
Hi there,
In terms of casinos with a max bet rule.
Here are some:
There's nothing wrong about a max-bet rule, the problem is not enforcing it on your server and then using it against players when they want to withdraw. As TwitchySeal aptly described it, it's a predatory rule that's designed to be broken. You've unfairly taken thousands upon thousands of dollars of players money because of it. If it's really so hard for you to enforce a max-bet on your server, there's a simple fix. Every night do a db query, search for everyone who violated the rule and refund that bet (be it a winning or losing bet). Now it's no longer predatory, as you're not raping people who make a mistake or otherwise didn't closely read the ToS. |
|
|
|
so , do you believe the data of dice site？why?
Yeah, because a while ago there was the investor dice site called just-dice.com which had pretty incredible volumes (Anyone got a link to them? I couldn't find on archive.org), but we know for sure the site wasn't a ponzi because it actually returned all investor money. And unless Dooglus took a giant personal loss, this means that the profits were actually genuine. So from that we can infer there's actually a huge market that like to playing a game that makes excel seem like fun. I think the real question should be, why aren't dice sites even more popular? By far the most popular/reputable dice site is PrimeDice, which has only done ~31612 BTC of volume in the last month -- which is actually a bit less than my own ugly-ass non-dice site has managed. My guess is probably: a) for legal reasons block many key markets b) their max-payout is too low for some mega-whales c) They don't take investors, and thus don't attract the gambling-investor circle-jerk that JD had |
|
|
|
This was resolved, I'm sorry for any confusion it may have caused some players. To our competitors, our team has never in over a year tried to find flaws in your sites nor detract from your business or hurt your image. I hope to see similar respect in the future.
Classy. Your site wasn't provably fair (due to an oversight), and thanks to the OPs discovery now is. But instead you are blaming "competitors" and not offering the OP at least a little bounty. this issue just limited a user to 2 billion seed combinations versus 4 billion seed combinations
Actually, this would've allowed the casino to completely control with 100% certainty if the bet was going to be high or low. I don't believe this was ever used to cheat players and was a simple oversight (which does happen), but let's also not understate it. It was a very serious flaw. |
|
|
|
Well this was a positive outcome  Kudos to betterbets for fixing the problem in minutes, and to allinbox for being one of the very few people who actually verify stuff! |
|
|
|
I'll implement your gist tomorrow; thank for pointing it out; I was not aware of it's existence (thanks for making it available).
Hopefully this resolves it once and for all.
No problems. Also while stepping through the validation of the manual client seeds, I think there's a couple of minor bugs: function(_0x2a5dx7f) {
var _0x2a5dx90 = parseInt($(_0x58ef[187])[_0x58ef[14]]());
if (isNaN(_0x2a5dx90)) {
_0x2a5dx90 = 0
} else {
if (_0x2a5dx90 > 4294967296) {
_0x2a5dx90 = 2147483647
} else {
if (_0x2a5dx90 < 0) {
_0x2a5dx90 = 0
}
}
}
;$(_0x58ef[187])[_0x58ef[14]](_0x2a5dx90)
});
I believe the line "if (_0x2a5dx90 > 4294967296) {" should be >= not >. And if it's over, it should probably be set to 4294967295 not 2147483647, I guess. (i might be wrong, stepping through obsfucated code is a annoying  ) |
|
|
|
Their manual client-seed stuff seems correct: https://dl.dropboxusercontent.com/spa/rmczv2tqcr196vz/0wk_we9v.pngBut looking at how they actually generate it, I found the obfuscated function: function() {
var _0x2a5dx16d = parseInt(Math[_0x58ef[589]]() * 2147483647);
$(_0x58ef[187])[_0x58ef[14]](_0x2a5dx16d)
}
which we can easily deobfsucate as _0x58ef is just a global variable with some constants, and we get this: function regenerateClientSeed() {
var x = parseInt(Math.random() * 2147483647);
$("#account_client_seed").val(x);
}
Which has the problem you pointed out, that it doesn't use the full range and it's also using Math.random() which is also a bad idea. They should be better using the gist I have. |
|
|
|
Good post, although a bit sensationalist. But BetterBets is limiting the User to a chose a number between 0 and 2,147,483,648.
Assuming that is true (I didn't check) you are correct, it would make betterbets not provably fair. This is almost certainly an oversight on their part, as for them to cheat would require a collaboration between them and moneypot. If they use the same system for rubies (I didn't check) then cheating is a lot more possible. Actually if what you're saying is true, BB needs to fix this ASAP because it means a) they're not provably fair, b) It would allow MP to cheat their customers. I strongly, strongly doubt BB has used this to cheat. But you would be correct, they are not provably fair if you can only pick a seed of half the range. I wrote this a while ago: https://gist.github.com/RHavar/a6511dea4d4c41aeb1eb which is what MP casinos really should be using (client side) for picking client seeds. I'm not sure why anyone would use anything different. |
|
|
|
|
Show Posts
