|
Hi, sorry for the inconvenience, the maintenance is still on-going. This current maintenance is for the full move of all the servers of Moneypot which includes the database. And due to the huge size of the database, it is taking some time. This move will pave way for the new design of moneypot as well as v2 of the api some time this coming weeks.
There will be another long maintenance tomorrow, which will be intended solely for the rubies integration.
Thank you.
|
|
|
|
|
Scheduled Maintenance: Tue, 12 Jul 2016 07:00:00 GMT - Server Time up to Tue, 12 Jul 2016 13:00:00 GMT - Server Time. Thank you
|
|
|
|
In my own understanding and opinion, Moneypot is not an Affiliate Program but rather a Partnership. I must admit that there is a thin line between the two. So here is why I think MP is not an Affiliate Program: > In an Affiliate program or also called Referral program, the affiliate/referrer does not control how much payment they get per referred user. > In an affiliate program, you are referring someone out of your own marketing strategy and the merchant does not care if u refer a user or not. > In an affiliate program, you are prohibited to refer your self, and most of the time it is base on ip address or per user per household. > In an affiliate program, usually there are 4 basic parties, the merchant, the product, the affiliate and the customer. While you might consider MP as the merchant, it is not, as MP does not sell anything, the use of MP's services are free of charge. Why I consider it as a Partnership Program: > App owners are treated as partners(most of the time  ) and earns commission from the wagers they send to MP, whether it be a losing or a winning bet. > Unlike in an Affiliate program, MP relies most of its income/loses from Apps making the App and the App's owners a vital part of MP. > An app can control how much 'edge' they can put on their app, therefor giving them some kind of control over how much commission they get. > An app owner is not prohibited from playing from their own app, as this does not changes or affects anything, the outcome of each bets cannot be controlled to favor the app owner. App owner can only control how much house edge they put on their app, and the lower the house edge, the lower the commission they get. MP does not accept bets that are -ev for the bankroll or in favor of the player. > Apps are in some way also marketed by MP it self, by showing apps on MP site, allowing advertising of promos on MP thread etc..(i know some ppl will bring up preferential treatment issue, that's a story for some other day). > MP currently does not sell any product nor requires any payment to use our service. Tho MP do take commissions per bet per edge, but that falls on the Investment side of MP. People may say that the statements i just said are either arguable or debatable in its sense, but for me, MP is way more than an affiliate program, and offers a lot more opportunities than an affiliate program. Again, this is just my own opinion on MP, and I'm only stating this in behalf of my self and no one else. -uni |
|
|
|
Is there an updated ETA on the Rubies integration?
I would like to personally apologize for the delay. I my self is a stakeholder of rubies and it is also in my interest to have rubies integrated asap... But as people may not know, its not a switch that i could just turn on. There are alot of things to consider and fully test. During the attacks last week, i was already testing rubies on a new higher capacity server. The plan is to test rubies and v2 on the new higher capacity server, then when its ready, point our dns to this new servers, making the transition smooth and lesser down time. Then the attack came, The old server of MP is very small compared to the attack, and i was caught off-guard by it. So i decided to halt v2,rbies, and transfer our service to this new higher server, instead of just staring at the cloudflare page. So because this new server is now in used, its making it harder for me to test on. A tentative date i can give is this week up to first week of july. again this is just tentative -uni |
|
|
|
Which one? It is supposed to list every site that has at least 10 BTC wagered - which is basically nothing.
Just curious on how this one was added on the list.  |
|
|
|
UPDATE:
All Moneypot services are up and running. In the past few days, we had some random short-lived DDoS burst attacks, and the servers are set to auto-reload in case it hits a certain threshold. Anyway, as always, funds are in no way affected by this, most of the funds are stored on a off-line remote multi-sig wallet, while our hot wallet is also hosted on a separate remote server.
INCIDENT REPORT:
The DDoS attacks that was made on Moneypot front-end servers was huge that it crashes our servers, there was also a time when our providers had to disable our server's network because the attack was so damaging. During those times, players were having a hard time to login to our website.
I have been in contact with CloudFlare in regards to this attacks, and some adjustments were made to mitigate this. IP addresses of suspected attacks where banned, and this included some legitimate users. I have made all effort to unblock all legitimate ips and have already fixed this since.
We have not received any Emails from the attacker, except one message from a newbie account here on BCT which is named 'icanhelpyou'. I did not and will not entertain any kind of extortion message or email.
Due to this incident, development of alt-coin integration and the version 2 of Moneypot was put to a halt to give more time scaling and upgrading our security. Rest assured the development of the said new features will resume as soon as possible.
There are alot of reasons why the attack was made on Moneypot, one of those reasons is that we have one of the largest investor-funded bankroll, and as day passes by, more and more people trusts us with their bitcoins which makes us a perfect target for such unethical attack.
Thank you,
-uni
any update on the list of all apps in moneypot and not only those who are verified? it is hard to get players on own app if no one can see it in the dashboard Hi there, i have removed the all-apps page for the mean time, and i will put it back asap. Due to the nature of the apps, we can not show apps that are 'unverified' this is because most unverified apps are used for development and is not open to public. if an app wishes to be recognized by moneypot they must request their app/domain to be verified. |
|
|
|
|
UPDATE:
All Moneypot services are up and running. In the past few days, we had some random short-lived DDoS burst attacks, and the servers are set to auto-reload in case it hits a certain threshold. Anyway, as always, funds are in no way affected by this, most of the funds are stored on a off-line remote multi-sig wallet, while our hot wallet is also hosted on a separate remote server.
INCIDENT REPORT:
The DDoS attacks that was made on Moneypot front-end servers was huge that it crashes our servers, there was also a time when our providers had to disable our server's network because the attack was so damaging. During those times, players were having a hard time to login to our website.
I have been in contact with CloudFlare in regards to this attacks, and some adjustments were made to mitigate this. IP addresses of suspected attacks where banned, and this included some legitimate users. I have made all effort to unblock all legitimate ips and have already fixed this since.
We have not received any Emails from the attacker, except one message from a newbie account here on BCT which is named 'icanhelpyou'. I did not and will not entertain any kind of extortion message or email.
Due to this incident, development of alt-coin integration and the version 2 of Moneypot was put to a halt to give more time scaling and upgrading our security. Rest assured the development of the said new features will resume as soon as possible.
There are alot of reasons why the attack was made on Moneypot, one of those reasons is that we have one of the largest investor-funded bankroll, and as day passes by, more and more people trusts us with their bitcoins which makes us a perfect target for such unethical attack.
Thank you,
-uni
|
|
|
|
Good to see the DDoS attacks have stopped. Sucks not being able to access moneypot at times. Good to see that things have stayed the same (no large bankroll drop). Speaking of faucets, you guys need to reject the google recaptcha test keys, otherwise people will be able to abuse the faucet easier (only a clicking/refreshing bot is needed). I tried it out on my moneypot site, and it worked. Hi there, I am pretty sure i have fixed this months ago. The captcha thing does show up, but If someone claims using a google recaptcha test key, it will respond with an error. Thanks -uni EDIT: i tested on your site, and it did not work, it will sure show the captcha and lets you complete the captcha, which is basically the only purpose of it, but if you submit it, you wont get anything. |
|
|
|
what happened to the faucet? and really how many dice games do you need? way to many!!!
Im not sure what you are asking here, Faucet is there and is working fine. And Moneypot is a gambling api and wallet service, each Moneypot app is owned by their own respective owners, which means anyone can create their own gambling site(dice,plinko etc..) using moneypot. But if your asking it literally, then my answer is as many as people want. |
|
|
|
UPDATE: All Moneypot services are up and running. All users that where blocked by cloudflare are now cleared, so everyone should be able to access all of moneypot's services. If you think you are still blocked, please send me an email at support@moneypot.com with the Error message that you had. The attack has subsided, tho we are still getting some random short-lived attacks from time to time. Hopefully it stays that way as i've wasted alot of sleep-time because of this.  -uni |
|
|
|
You really need to consider firing Acoin. He only makes your site look childish with the way he attends to problems. And while you do handle yourself much better you're also trying to put the blame on others and trying to tell me that FB or google gets DDos and goes down for days at a time?
I have NEVER once tried to log into FB or search on google and was unable to. NEVER
The forum yes. But they always fixed it right away and down time was minimal. If you cant get back up then this DDos can turn into a fatal flaw. You don't think Bittreex and poloniex get's attacked? They do. But they very rarely go down because of it.
Please fix your site and make the investors proud by firing Acoin. He is only holding you guys back. Trust me!
You must have misunderstood me, I'm not blaming others for this sad event, and i apologize if that is what you understood. All im saying is that, DDoS attack is not a flaw in a way that any site can get DDoSed, no site is exempted from it. Moneypot has not gone down for days at a time. The longest time Moneypot was down is during the the ownership transfer last December and last May 26th which was a scheduled maintenance for 12hrs. During the attack,the servers of moneypot is set to auto restart when it fails,and this has happened many times. Also during this attack, there where times when i had to put down the server to update and add security measures, but this down time was only for a few minutes and not even hours. I would assume that the 'down' term you are referring at was because you where not able to open/access the website and you get some cloudflare errors, this does not literally mean that servers are down or offline, it just meant that there was a huge number requests on the server, that your request was not processed therefor giving you an error. As ive updated on my other previous posts, the attack has subsided, and anyone can freely withdraw their funds if they feel to do so. And just a precaution, https://blog.moneypot.com is still up and can also be used to withdraw your funds. If anyone would like to contact me for technical concerns, im available at uni@moneypot.com, or at the discord channel https://discord.gg/011aeZCV0eln38t7vThanks -uni |
|
|
|
A small glitch? Getting annihilated by a DDos attack is not a small glitch. Its a fatal flaw.
I'm not going to join in on this useless arguments,trash talks,fud or w.e people call it. So this is just an FYI for everyone. The reason why moneypot has been goin down was from a sophisticated DDoS attack, and this is NOT a 'fatal flaw' of moneypot or any other site, this is a flaw of the internet and how the internet works. There is literally no 100% way to stop a sophisticated DDoS attack. Even this forum had a share of its DDoS attack issues in the past. Even largest sites such as Google or Facebook gets DDosed from time to time. If anyone has a way to fully stop 100% a DDoS attack, he'd be rich. -uni UPDATE: Looks like the attack has subsided. Both https://www.moneypot.com/ and https://blog.moneypot.com/ are loading fine. But please be informed that the attack may come back any time. |
|
|
|
2. The attack is able to bypass cloudflare which makes me think this are botnets.
3. The attack uses multiple ip ranges, which make it hard to ban all of it.
If the attack isn't showing in cloudflare, it means they have your ip address. If they have your ip address, there is no way you will be able to stop the attack, even firewalls will be completely useless (what they did to BaB was DDoS using spoofed syn packets with cloudflare ip addresses, which allow it to bypass the firewalls) and once it hits a single machine, it will overload it in sheer volume. The only defense that is going to work is obscurity. You need to change your ip address, and then completely hide it, make sure there's no way for the attacker to know what it is. Make sure that you don't have any DNS entries pointing to the real server etc. If the attacker doesn't know your real ip address, then they'll be forced to go a) Go through CF b) by a layer 7 attack. (Also, ignore the idiots who tell you about "CloudFlare resolvers" and what not, if you configure the service right no one can find your ip address. I for a long time had a 1 BTC open bounty on anyone who could name a bustabit ip address, and it was never claimed) The attack is showing on cloudflare. And the attacker does not have our server's ip, ive set the server to 'only' accept request from cloudflare ips found at http://cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6I've been in contact with cloudflare guys, and they have acknowledge that the attack is targeted on www and blog servers. So having that said, im assuming, that the attack does go tru them. Also as far as i can understand from the logs, the attack is specifically either a HTTP GET or HTTP POST requests that is targeted at https://www.moneypot.com and https://blog.moneypot.com and not their real ip addresses. Last week MP IP address was revealed due to a * A record present on our DNS records, and this has been removed and our IP are now changed. If there's any other recommendation you can think of, do let me know. Thanks uni |
|
|
|
Just a little update for everyone. The attack is still on going on both servers www.moneypot.com and blog.moneypot.com. BUT there are additional measures added( yes i know you are reading this), and both sites will now usually LOAD but will be slow (at least this time it loads). If one of them doesnt load or shows cloudflare page, use the other one. For players that had their ip banned by cloudflare, please send an email to uni@moneypot.com with this format: Subject: MP-IP unban request Email body: MP-username Your IP: you can get your ip at https://www.whatismyip.com/Your country And state if you are using any kind of proxy or vpn. |
|
|
|
Well that was a really cool breakdown of whats going on and I appreciate your efforts to get our money accessible, but the blog site doesnt work either  Yes i can confirm that. As I've said above, soon as i announced the new link, this link came under attack aswell, this link was up privately since last night and went fine, but after announcing it to the public, it made it 'known' to the attacker/s. If there are some things that you guys can recommend, im open for suggestions. But for now, ill do my best to find a solution for this. Thanks -uni |
|
|
|
Hello everyone, I've been up for more than 48 hours yesterday, and before i went to sleep the attacks where still ongoing. And for fyi, MP is on a paid plan on CloudFlare, and ive already set to to automatically ban the ips of the attacker, but as Ryan have experienced, i have also reached the limit of banning ips. Here's a bit of an explanation regarding the attack(i know the attacker might be reading this) What i know about the attack: 1. The attack is a HTTP GET/POST attack, which basically sends a flood of request. 2. The attack is able to bypass cloudflare which makes me think this are botnets. 3. The attack uses multiple ip ranges, which make it hard to ban all of it. 4. The attack is probably manually monitored, because as soon as i add some securities on GET requests, it changes its attack to a POST request etc.. 5. The attack is not continues, it sometimes stop for a few minutes(to recharge lol), then resume again. What we can do: 1. Ive set the server app to auto restart on failure, So whenever it goes down, itll go back up. 2. As ive mentioned above, cloudflare did not help much. 3. We can just wait it out, i know it is frustrating to not be able to get your funds. 4. A separate clone server is setup for you guys to use incase u the main site goes down or is very slow, I know after i post this, this clone server will be the next one to be attacked. - https://blog.moneypot.com - Again this is a separate server, but uses the same records/database/accounts as the main one. - You can use this to get your funds out. PS: soon as i put this post up, https://blog.moneypot.com got hit.. which makes me think the attacker is reading this post.  I'm doing all in my power to stop and mitigate this attack, but i can only do so much. Thanks, uni I login with the https://blog.moneypot.com one and I am having balance issues.I asked for 10000 satoshis promo om Dust Lottery and Jackpot Racer said he had credited it but my balance is still showing me 0. Is it because i logined with the blog link one? |
|
|
|
Hello everyone, I've been up for more than 48 hours yesterday, and before i went to sleep the attacks where still ongoing. And for fyi, MP is on a paid plan on CloudFlare, and ive already set to to automatically ban the ips of the attacker, but as Ryan have experienced, i have also reached the limit of banning ips. Here's a bit of an explanation regarding the attack(i know the attacker might be reading this) What i know about the attack: 1. The attack is a HTTP GET/POST attack, which basically sends a flood of request. 2. The attack is able to bypass cloudflare which makes me think this are botnets. 3. The attack uses multiple ip ranges, which make it hard to ban all of it. 4. The attack is probably manually monitored, because as soon as i add some securities on GET requests, it changes its attack to a POST request etc.. 5. The attack is not continues, it sometimes stop for a few minutes(to recharge lol), then resume again. What we can do: 1. Ive set the server app to auto restart on failure, So whenever it goes down, itll go back up. 2. As ive mentioned above, cloudflare did not help much. 3. We can just wait it out, i know it is frustrating to not be able to get your funds. 4. A separate clone server is setup for you guys to use incase u the main site goes down or is very slow, I know after i post this, this clone server will be the next one to be attacked. - https://blog.moneypot.com - Again this is a separate server, but uses the same records/database/accounts as the main one. - You can use this to get your funds out. PS: soon as i put this post up, https://blog.moneypot.com got hit.. which makes me think the attacker is reading this post. I'm doing all in my power to stop and mitigate this attack, but i can only do so much. Thanks, uni |
|
|
|
That is why (as stated in the part you quoted) we will be fixing it shortly, either through the launch of v2.0 (which is coming soon) or a patch for it if v2.0 runs into any issues during final testing.
Understood. I just meant that it seems like a sufficiently serious bug that it's worth patching immediately even at the expense of performance. For all intents and purposes while the bug exists, the casino isn't provably fair. As no one can distinguish "invalid hash" from a legitimate db issue to you not wanting to honor the bet (.e.g. a winning bet at the end of a martingale sequence). From the sound of the description of the bug it just sounds like the code is (psuedo code): var hash = getNewHash();
db.queryPromise('INSERT INTO hashes VALUES($1)', [hash]);
this.body = hash;
and needs only needs a 1 line change to: var hash = getNewHash();
yield db.queryPromise('INSERT INTO hashes VALUES($1)', [hash]);
this.body = hash;
(or something?) Or perhaps more likely, I completely misunderstood the problem and I apologize Hi there, Sorry i was only able to check the forum just now, was so busy lately with bunch of DDoS attacks. Anyway, thanks for your input, but ive made sure that the generation of new hash(next_hash)are yielded properly. **ive omitted/changed some of the codes below for privacy concerns** function* query (sql, params) {
const [client, done] = yield pg.connectPromise(dburl);
try {
return yield client.queryPromise(sql, params);
} finally {
done();
}
}
function* inserthash(){
var hash = make_hash();
var r = yield query('INSERT INTO hashes (newhash) VALUES($1)', [hash]);
if (r.rowCount === 0) // 1st check
throw new Error('Could not insert into bet hashes');
assert(r.rows.length === 1); // 2nd check
var new_hash = r.rows[0].newhash; //3rd check
assert(typeof new_hash === 'string'); //4th check
return new_hash;
}
I've doubled checked,tripled check, the generation of hash and the deletion of used hash,and they are yielded properly.. Ive also setup a cron job to just manually vacuum/analyze the db in case it hits a certain threshold of dead rows which tends to be fast.. As you may have read on previous pages(not sure if i told it here), limits have been removed for all and any kinds of bets/wagers, this was also voted by the mp owners, its why the volume of incoming bets is huge specially on peak hours. I also cannot just generate a new hash if the bet encounters a invalid hash error as that would defeat the very sense of provably fair. So there two immediate solutions i can think of: 1. Would need the participation of the app owners/dev, that is on every response of a bet, get the next_hash value, and call GET /v1/hashes to check if the hash is valid or not. https://www.moneypot.com/api-docs#v1-auth-check-if-hash-has-been-used and if the hash is invalid, generate a new hash, if valid, continue with the bet. I know this is an extra call that some may think the bet will be slow, but this is the only 100% sure way that you won't get invalid_hash. 2. Is more simpler, raise the min wager a bit, bring back the delays on small wagered bets. Thanks, -uni FYI for all: MP has and is under DDoS attack thru out the day/night, So you might see Cloudflare challenge/captcha sometimes when visiting the site. Withdrawals are still instant as always, but we do advise to contact us in case you are trying to withdraw big amounts such as 10+ or 20+ btc |
|
|
|
I just want people to know the message i posted was in no way an attack on the MP team or Uni. It is and has been a problem for a longtime.
I agree it hurts both bettors and businesses JPR. I personally have never had a problem with the team and think theyre doing a good job in the short amount of time theyve been the owners. I just want to see the invalid hash problem solved so i brought this complaint to the public.
Hi Yahoo, This is to just explain to you and also to the public on how the bets are being processed, and if this post offends anyone, then i apologize. So in short explanation, here is how it works, as every MP app owner or even players know, that when you make a bet, you include a hash for that bet, and the api will respond with the result of the bet and the next hash to be used for the next bet. Now to the longer explanation, when you send a bet, the server checks the bet is valid and then checks the hash that you have given and deletes this hash from the database to avoid being used again, and then it calculates the result of the bet, then before replying with a result, it generates a new hash for you to use on your next bet. After that it replies all the needed values and the next hash. INVALID_HASH issue, this error occurs when the server checks the hash that you have given and tries to delete it. If the hash is not found, it will return the error INVALID_HASH. You can try this by sending a bet with random hash that you just made up, and it will return this error. So why has it been happening very often lately? When our database deletes a hash from a table, it really doesn't delete it, it just removes the 'link' to that row and this is called 'dead tuples' or dead rows (this is how it works), and when the number of dead rows are high, it causes the database to slow down, to avoid this there is a set value of dead rows that when it hit that value it will do a clean up or called vacuum, that will clean up the dead rows. But due to high traffic volume of bets, the database tends slow down even after the dead row limit is met, making the generation and saving of the next hash is slower than the speed of your next bet. So in short the second bet was sent before the next_hash has been properly saved to the database thus giving you the INVALID_HASH error as it cannot find the hash. V2 should resolve this issue, but since then, ill try to find time (very busy with v2) to look into finding a fix for this for the mean time. Thanks, uni |
|
|
|
|
Show Posts
