I used node.js for Just-Dice and had good experiences with it.


This is a worrying question. Security isn't something you add to a site, it's the absence of insecurity. Just don't mess anything up and you have security.


Another worrying question. I would suggest that you're probably not ready to do this right. Play about with Bitcoin and web application development in general to get a feel for it. Work your way up.

A hot wallet is simply a wallet that the server can interact with, and a cold wallet is a wallet that's not online. You create them both in the normal way. You shouldn't be creating a new wallet for each user. I found that 3 wallets was enough for Just-Dice - one for the server to use, one offline cold wallet, and one which I keep online locally as a buffer between the two so I don't have to keep manually transferring coins from the cold wallet (which is a pain due to its offline nature).


There are as many ways to do this as there are existing dice sites. The basics are:

make all rolls depend on the seeds: one that you pick, and one that the player picks
make sure you pick your seed first, and commit to it (by publishing its hash) before making the player pick
make sure the rolls are completely determined by the seeds

These 3 things together prove to the player that you can't be manipulating his rolls, since he picked a vital part of the input to the roll, and he picked his part last.


If your site is successful, it's going to take over your life. Be ready for that, or don't even start it.

It's almost 6 days since we announced we were suspending betting, and our coin liability has fallen from over 53k BTC to a little under 6k BTC. I have been emailing the accounts that have email addresses associated with them, and trying to use other means to track down the owners of large balances which don't have email addresses. One guy for instance had no email address, but his username came up on google as being the same as a very active poster on a big poker forum - so I PM'ed the account on the poker forum. I will continue trying to reach people until withdrawals slow right down. I just woke up and see that they're still happening relatively quickly - logs from the last 2 hours show 5 smallish withdrawals:


A lot of the remaining balances have emergency withdrawal addresses associated with them. I'll use those as a last resort. And quite a few of the remaining balances are for users who set up 2FA to prevent fraudulent withdrawal, and then lost both their 2FA device and the paper backup they were instructed to make. I'm having those accounts wait for a period of time before disabling 2FA to give the real account owner a chance to withdraw.

The top 10 biggest account balances still on site are:

2247, 736, 692, 378, 314, 186, 143, 142, 133, 119, 73 BTC

The biggest one is accounted for - I reached him via forum PM and he'll be withdrawing soon.

There will inevitably be some accounts that still won't have been claimed after any given amount of time. I'm unclear on what I need to do with those. I don't want to still be "dealing with virtual currency" once regulations are being enforced that require me to collect private information on customers, so I'd like to get it all cleared up before those regulations are written. But I also don't want to be in the situation that someone remembers their JD account in a year's time, asks me for their coins and I have to say "sorry, I gave them away". Any suggestions? Is it reasonable to give a cut-off date after which remaining balances are forfeit?


On JD I went through the accounts and divested everyone. It turned out there were 30 accounts with less than half a satoshi invested, which I couldn't divest. Those 30 sub-satoshi amounts summed to 5 satoshis. I changed the site code to allow me to divest those too so the bankroll went to zero, at which point an obscure bug was triggered which made the site forget everyone's "base" and "principal" figures, meaning that if/when the site comes back up, all investors would be due for commission from the start, even the ones who have already overpaid, and also everyone's investment profit was showing zero.

I pulled the lost data from a recent backup. I can highly recommend Tarsnap for your server backup needs:


I pay about 50 US cents per day (in Bitcoin) to maintain up-to-date encrypted backups of all server data and wallets.

So I recovered the data, put it back on the server, and now everything's fine again, but I didn't want to repeat the mistake on DD.

I don't encourage it because I don't want to support bots or hear from players who have lost their bankroll due to a malfunctioning bot.

But I don't discourage it either, so long as players run bots at their own risk.

This makes no sense.

If you're "always winning" at blackjack, where they shuffle the shoe before every hand, then you're either not keeping track accurately, or you're not playing enough hands for your result to be statistically significant.

You can't win at blackjack on Bitzino in the long run - it's a -EV game.

Yes you'll have winning and losing sessions, and your pattern-seeking brain will try to spot correlations between your strategies and your results, both I doubt your conclusion that changing your client seed helps you win has any validity.

I gave you negative trust because you're running a scam.

You don't judge a scam by whether it starts off paying out. They all start off paying out. You judge a scam by whether it has a feasible way of making the amount of coins it promises to pay out, and you don't.

Just-Dice has paid out over 40,000 BTC to its customers in the last 7 days. I don't know what makes you think that "members cant withdraw" but you're entirely incorrect.  See here to see how the 53k BTC we were holding have been dispersed.

So your favourite Ponzi scheme is listed on a site that makes its money advertizing Ponzi schemes and you think that's somehow proof that it's not a Ponzi scheme?

Of course it's not good. It will pay current investors from future investor deposits for a while, and then it will stop, and lots of people will be out of pocket.

"But it has been paying out for over a year"?

Of course it has. They all pay out until they stop paying out.

Calling people "trolls" for pointing out the obvious fact that this is a scam is pretty weak. Do you have a better argument than "you guys are trolls" or "look, it's advertised on a Ponzi board so it must be good"?

The main difference is that this guy is joking. He's exaggerating the kind of scam that cryptory runs to make it look as stupid as it actually is. Whereas cryptory pretends they have a real business model that can pay exponential returns.

"CRYPTORY is a scalable system of distributed computing that allows you to earn a guaranteed stable yield on your investment. [...] Get an exponentially increasing income [...] In the first month total profit will grow 7-10% on the deposit. With the passage of time monthly profit will increase up to 15%."

So it's an investment which GUARANTEES and EXPONENTIALLY increasing income?

You know there's only one kind of business that guarantees exponentially increasing income over 100% per annum - and that's Ponzi schemes.

How about if you make up a server seed for the user, then sha256 it iteratively a million times. Like you sha256 it, then sha256 the hash, then sha256 that hash, over and over again. Then you work backwards through them, so each roll's server seed is the hash of the next roll's seed. That way you get to change the server seed every roll in a way the user can't predict, but in a way that you can't manipulate. When the user is done playing, he can verify that each server seed was indeed the hash of the next one. Then to achieve provable fairness he doesn't need to change his client seed except at the start, but can if he wants to.

That satisfies your request to be able to change the server seed while keeping verification lightweight. But I'm not sure I understand where that requirement comes from. Why do you want to be able to change the server seed every roll? What do you have against using a fixed seed plus a nonce?


The problem is that it is impossible to prove anything to a user who doesn't understand proofs. You may as well just put a shiny badge or checkmark on the page. Provable fairness is only worth anything to the people who understand it, and the people who trust the people who understand it.

The scheme I just presented is a little better than JD's in that it's instantly verifiable without the player having to hit "randomize" (and thereby change their future rolls).

I've taken Just-Dice.com down for maintenance.

It will be back in an hour or two.

I'm done emptying the cold wallet - here's a signed transaction that sends out the last 500 BTC.

Does someone want to broadcast it for me?


Edit: (3 minutes later) that was quick!

The query finished:

mysql> select * from bets where nonce < 0;
Empty set (48 min 7.76 sec)

So I'm not sure what's going on. Are you thinking of a different site maybe?

Edit: there's code that sets the nonce to 0, and code that increments it atomically; there's nothing that sets it to any other value, so I can't see how it could ever go negative.

That sounds dangerous.

Couldn't you set it back to 1 and re-roll the same numbers you've already seen?

It's going to take a long time to query the DB since there's no index on the nonce column.  I'll let you know the results.

What's that? This is news to me.

Do you mean by making 0 BTC bets to increment the nonce?

Or something cleverer I don't know about?

We used to allow players to 'randomize' any time they wanted to, but we had one player who did it after every roll. This was causing us to have to store huge numbers of pairs of seeds in the database.

I thought it was an attempt at some kind of denial of service, and so just put a limit on it - "you can only randomize after you've used a seed-pair 10 times".

But now it has dawned on me - it was you, with an automated roll verifier!

Am I right?

After a while of fighting against DDoS attacks, everything starts to look like an attack, even innocent things.

Is that meant to be a joke?

We've gone over the "1300 coins" story plenty of times already I think. No coins were lost, they never existed. They don't "go" anywhere.

I blocked you from the site's chat after you spammed the poker freeroll we put on as a thank-you to our regular players. I asked you several times to stop posting your donation address over and over but you refused. You shouldn't be surprised if people treat you badly when you act like a dick to them.


I care about all customers of my sites. That's why I had to suspend betting and return their coins. I don't want to be in a position where government agents steal player funds and sell them off to the highest bidder.


Yes, be careful out there. I've no idea how to judge which sites are trustworthy. Hopefully some kind of multi-sig solution will emerge which removes the need to trust strangers with your coins.

Does anyone know how to get in touch with this guy?

He hasn't withdrawn his Just-Dice balance yet.

I agree that the "provable fairness" offered by services which change the server seed for every bet is very hard to take advantage of as a player.

If I play at PrimeDice, Bitzino, prcdice, and probably many more, for every roll I make I have to:

1) make a note of the server seed hash for this roll
2) pick a client seed in an unpredictable fashion
3) make the bet, noting the number they rolled
4) verify that the hash of the published server seed matches the one in step 1
5) verify that the published server seed combined with my chosen client seed gives the roll I saw in step 3

That's a LOT of work. Almost nobody is going to bother doing it, and so for all practical intents and purposes the site isn't provably fair for the majority of people.

Compare the above 5 steps *per roll* to what a player at Just-Dice or CoinRoll would have to do per roll:

3) make the bet, noting the number they rolled

That's right - they can just spam their bets, keeping a record of the rolled numbers.

That is because the bulk of the work required to verify PrimeDice rolls has been moved to the very start and very end of play, not per roll.

At Just-Dice, steps 1 and 2 are done before you start play, and steps 4 and 5 are done after you finish a session. You verify all your rolled numbers in bulk, using a single pair of seeds.

At CoinRoll, step 1 is the same for every player (the site has a global server seed per day), step 2 uses your most recent deposit's txid (obviously out of the site's control (unless they use transaction maleability, I guess?)), and steps 4 and 5 can only happen at the end of the 24 hour period.

I think JD's system is better than CoinRoll's, since it puts control entirely in the hands of the player. He gets to reveal his server seed whenever he wants to and doesn't have to wait until midnight. But both systems are vastly better for the player than having to do all that tedious work for every bet you want to make.

The way the new law looks to me is that in order to continue "dealing with Bitcoins" Just-Dice would have to start collecting private information from its customers, reporting anyone transferring "suspicious" amounts, and other such invasions of privacy.

That kind of behaviour is not something I would want to be involved in, and so I am asking that you withdraw your coins before they start enforcing the new law.