My official response is here: https://ripple.com/dev-blog/response-china-cert-report/

TL;DR: It looks like they just ran a static analysis tool against a combination of security sensitive and irrelevant code, totaling the number of potential issues detected by automated, static analysis. This is almost completely meaningless because the vast majority of issues reported by such tools are false positives with no actual security implication. But it's doubly meaningless when you use it on code that already uses that exact same methodology because every issue that can be identified by this method has already been found and fixed.

We now have an official response to this report at https://ripple.com/dev-blog/response-china-cert-report/

"Again, Ripple recognizes the importance of security researchers, and we take any reports of security vulnerabilities very seriously. At this time, we do not feel confident in the accuracy of the CERT report and further, and based on the way in which the report was published, we question the legitimacy of the reporting body. We are confident in our processes and our codebase, and expressly state that this report identifies no actionable items and our review, in response to it, found none either."

I've spoken to several people who will not buy BTCD specifically because they are unsure about the mechanics of the swap. Wasn't there supposed to have already been a snapshot? If so, BTCD bought now *won't* be swapable. Or is there going to be no snapshot and you'll have to transfer your BTCD somewhere to get KMD? People are uncertain.

Has anyone we have any reason to trust audited the CLAM client? Otherwise, I think it's a very good idea to steer people away from feeding the Bitcoin private keys into some software that talks to the Internet and that they have no reason to trust.

Martingale working 100% of the time wouldn't bankrupt casinos, it would just result in them having a "spikier" revenue stream with occasional large gains.

It doesn't make the game at all in your favor ever. That's not its purpose. The purpose is to change the odds so that your chance of losing is smaller. Used properly, progressive schemes can give you the smallest house edge possible for the odds of losing you choose, but there will still be a house edge.

That's not Martingale's fault though, that's the fault of the person who choose to use Martingale that way. The whole point of progressive betting systems is to arrange your betting so that your probability of winning is very high. When you choose to use a progressive betting system, you should know three things:

1) How much you will win, if you do win.
2) How much you will lose, if you do lose.
3) What the probability is that you will win.

If you like these three numbers, then play. If you don't, don't play. But if you play without knowing those numbers, or play with numbers you don't like, you're just a fool.

That assumes that you keep betting until that happens. The most important thing about a progressive betting system is deciding ahead of time when you'll stop and understanding what your odds of losing are.

It's not so much about "better" odds but about different odds. For example, consider two games:

First game:
99% chance, win $1
1% chance, lose $100

Second game:
99% chance, lose $1
1% chance, win $100

Neither of these games has "better" odds than the other. But they have very different odds.

That's really pretty silly. The whole point of Martingale is to make the probability of a loss low. You pay dearly for the benefit. By repeating a Martingale operation over and over, you increase the probability of a loss. As a result, you've paid dearly for a benefit that you're not getting. Why would you do that?

If you want to use a progressive betting system properly, you choose two of the following three things:
1) How much you want to win.
2) How much you are willing to lose.
3) What the probability of winning is.
Then you compute the third thing and execute the optimal betting strategy to achieve those objectives.

If you then repeat the process, you've shown that when you picked two of the three things above, you gave the wrong answer. So you designed an optimal betting strategy for a situation other than yours. Why would you do that?

All that will do is increase the total amount that you bet, and the house's edge is proportional to the total amount you bet. So you're basically giving money to the house.

I just thought of a neat solution to block withholding attacks. It does require a hard fork to add support because there's a small tweak to legal coinbase transactions and to how block hashes are checked against the target. The basic mechanism involves a hash blinding factor that is included in the coinbase transaction and must be XORed with the block hash before it is tested against the difficulty target.

The scheme works as follows:

1) When the pool creates work for a miner, it generates a random hash blinding factor. It then masks off all the bits in the blinding factor that contribute to whether the miner has found a share or not. The masked blinding factor is included in the coinbase transaction. With difficulty 1 shares, the blinding factor might be 00000000987E872A234...

2) The pool gives the work to the miner.

3) The miner finds a share normally, and the pool gives the miner credit.

4) The pool, knowing the hash blinding factor (because, of course, it must have saved the coinbase transaction because it needs it to submit the block) checks if the miner found a block. If so, it submits it to the network.

5) The miner does not know the blinding factor and so has no idea whether he found a share or a block. So he can't withhold blocks without withholding shares.

You are trapped in a room, you have two choices:

1) You can keep flipping a coin until it comes up heads.  When it comes up heads, you can leave.

2) You can flip 100 coins at once until they all come up heads. You can leave when all 100 coins come up heads at once or in two weeks.

Which would you prefer? Option 2 can guarantee you will eventually leave. Option 1 cannot. So option 2 must be better, right?

Blockchains can't guarantee that anyone will ever find a block. Is that a problem? No.

What you can guarantee is interesting from a theoretical standpoint. But what really matters for practical purposes is what actually happens.

Note: I edited this post to add the word "No" after "Is that a problem?" for clarity. My point, of course, is that it's not a problem at all.

Actually, it won't make you slowly lose money. It will make you slowly gain money and then suddenly, unpredictably, lose it in one fell swoop.

If you literally mean the original Martingale betting strategy, yeah, it's dangerous because you'll rapidly run into the betting limit. However, more sophisticated progressive betting systems don't have this problem because, among other things, the most important thing they do is tell you when to stop betting.

Well, right. Progressive betting systems aren't magic. They just let you choose what your odds of losing are. No more. No less.

I'm just annoyed at people who keep saying these systems don't work when the problem is that they didn't follow the system. The systems work perfectly, you just have to understand what they do and follow them and you will get the promised results. (Assuming the promises don't come from other people who don't understand the systems.)


The vast majority of people who actually follow a modern, progressive betting system will make money. Now, they will make very little and the few who lose will lose a lot. But that's not because the system doesn't work -- that's what it's supposed to do.

The point would be whatever you want the point to be. With sophisticated progressive betting systems, you can choose precisely how much you're willing to lose, what odds you want, and so on, and you know precisely what your odds are. You can calculate the mathematically optimal strategy to get you precisely the odds that you want. Got a bankroll of $1,000 and don't want a chance of more than 1 in 1,000 of losing money -- you can compute a betting strategy that meets those parameters.

However, the important thing is this -- say you've chosen the mathematically optimal strategy for a 1 in 1,000 chance of losing. You play that strategy and win. And then you play it again. Clearly, your odds of losing are no longer 1 in 1,000. But you played the mathematically optimal strategy for a 1 in 1,000 chance of losing, not for your new, lower odds. Thus you didn't actually play a mathematically optimal strategy and you will ultimately take a higher risk of going broke than you would have had you honestly specified your risk tolerance in the first place.

But don't blame that on the system because you didn't follow it. When you computed your betting strategy, you put in a risk tolerance that was lower than your actual risk tolerance, so of course it produced a sub-optimal strategy.

If you accurately specify your risk tolerance and your bankroll, you can compute a progressive betting system that precisely matches that risk tolerance. But it will only be optimal if you specified your actual risk tolerance -- repeating it will produce suboptimal results and you're always better off specifying your actual risk tolerance in the first place.

You don't really pick a specific strategy. Strategies like d'Alembert and Martingale were popular historically because they're easy for humans to do. But we all have access to computers. So it's not difficult to figure out a near-optimal strategy that maximizes the win amount and reports your odds accurately. You can then decide whether the profile is acceptable to you and, if so, execute it.

No. This is a common misconception. You are only guaranteed to "eventually lose" if you keep playing until you lose. But progressive betting systems specifically prevent you from doing that.

Right, but that wasn't Martingale's fault. Martingale doubled your money and then you went and did something else that caused you to lose.

Progressive betting systems work in the sense that they allow you to reduce your odds of losing to be as low as you want them to be. Want your odds of losing to be 1 in 1,000, done, you can have your odds of losing that low. But you have to follow the system. Obviously, your odds of losing will only be what you chose them to be if you both implement the system correctly and follow its rules.

The *only* good thing they do is reduce your odds of losing. If you keep playing after you've won, you increase your odds of losing. That means you choose to give up the only benefit you got from the system. If you do that, you are a total idiot. Bit don't blame your idiocy on the system you didn't follow.

Easily fixable by using more sophisticated methods like d'Alembert. You can make the probability of a streak long enough to bankrupt you pretty much as low as you want. (Of course, there are tradeoffs. TANSTAAFL.)

Well, yeah, that's the point of having a system. You decide what result you want, and it tells you what to do to get that result. If you don't follow the system, why have one? Progressive betting systems tells you how much to bet and when to stop. If you don't follow them, don't pretend that you are.

That defeats the entire point of Martingale. The entire purpose of a progressive betting system is reduce your odds of losing. By repeating the process, you just increase your odds of losing, giving up the *only* benefit of using such systems in the first place.

It seems Vanilla is doing the same thing as of the end of this month. You will not be able to buy a reload without physically presenting both the card and the cash at the point of purchase.

Definitely the first thing to check is that your cloud mining provider is doing actual mining. I would generally tend to assume that anyone who can't provide strong evidence of actual mining is a scammer.