Just-Dice.com : now with added CLAMs : Play or Invest

[Lohoris]

I still have a little over 1000 BTC unclaimed in JD accounts, although I noticed last night that the last remaining large investor was attempting to withdraw his ~600 BTC balance.

The hot wallet was empty, so he couldn't. I refilled it this morning, but he's not been back.

Mystery investor: if you're out there, there are ~300 coins in the hot wallet waiting for you. If you withdraw them, I'll put another 300 in so you can take those too.

Isn't this unsafe?
I'd rather just send him directly the sum, without risking it in the hot wallet.

I imagined there was a feature which automated that, such as "pending withdrawal" you had to manually send, but already had a destination address set by the user.

[1714803893]

1714803893

[1714803893]

1714803893

[1714803893]

1714803893

[1714803893]

1714803893

[boumalo]

I still have a little over 1000 BTC unclaimed in JD accounts

Probably people in jail lol

Dead, dt know their password or username, forgot they have a JD account, dust accounts

Jul  1 16:45 - total: 2500
692, 378, 314, 133, 119, 86, 73, 71, 52, 41, 29, 27, 25, 24, 22, 18, 15, 2*13, 3*12, 2*10, 2*9, 3*8, 2*6, 2*5, 3*4, 11*3, 11*2, 53*1, 3784*0

If the 600BTC that dooglus is talking about is the 692, there will only be 300-400BTC left; maybe to be distributed in 6months in a big game with 300 prizes of 1BTC, spread the fun!

[Lohoris]

there will only be 300-400BTC left; maybe to be distributed in 6months in a big game with 300 prizes of 1BTC, spread the fun!

wat

[dooglus]

Isn't this unsafe?
I'd rather just send him directly the sum, without risking it in the hot wallet.

I imagined there was a feature which automated that, such as "pending withdrawal" you had to manually send, but already had a destination address set by the user.

I never got the 'pending withdrawal' feature set up. I can see in the logs what address people have tried to withdraw to, but I can't be sure they still want a withdrawal of that amount to that address.

There were several hundred coins in the JD hot wallet most of the time the site was running, to allow big players to withdraw instantly, and it never proved to be a problem.

The 300 BTC were pulled from the hot wallet last night, so I've put the rest in there now. This time I've split it up into 10 equal pieces, so the withdrawal should go more smoothly this time. (I don't spend unconfirmed chance, so if there's a single large output in the wallet and you try to withdraw your balance in two equal parts, the first withdrawal will leave unconfirmed change in the wallet, and you'll have to wait for it to confirm before your second withdrawal will be allowed. That's what happened last night).

[Stars]

I have a question Dooglus. Lets say you didn't know how to code therefor you had to pay a developer which you didn't 100% trust, what's the worst they can do? Is there anything that can be put in place so the developer doesn't know the seeds and of course can NOT cheat out investors or if it was private funded by my self presumably cheat out me?

[dooglus]

I have a question Dooglus. Lets say you didn't know how to code therefor you had to pay a developer which you didn't 100% trust, what's the worst they can do? Is there anything that can be put in place so the developer doesn't know the seeds and of course can NOT cheat out investors or if it was private funded by my self presumably cheat out me?

The developer writes the code that tells the server what to do. If you can't understand the code he writes, you've no idea what he has told your server to do. It could be doing anything, up to and including sending him all the server seeds and hot wallet contents.

You pretty much have to trust him - or have someone you trust review all of his code (and, of course, don't grant him access to the server, or he can just change it after it has been reviewed).

[espringe]

I have a question Dooglus. Lets say you didn't know how to code therefor you had to pay a developer which you didn't 100% trust, what's the worst they can do? Is there anything that can be put in place so the developer doesn't know the seeds and of course can NOT cheat out investors or if it was private funded by my self presumably cheat out me?

What I'd do in that situation is make them work on openly on github.

SHAMELESS PLUG TIME WITH CASE STUDY:

I open sourced moneypot.com as way of adding a bit extra transparency. So far I've had three different odds-effecting bugs. One I found myself, and patched (playing at 1.01x was -EV for the house). A second which was reported independently by two different people auditing the code (the game instant crashed 1 in 101 games, not 1 in 100 like it should) and the third more subtle (which I won't say more, as it hasn't been patched -- but easy for me to see if anyone is abusing it) which would allow a player to play at +EV.

The more people who read and review the code, the harder it's going to be to slip something past

[zimmah]

You pretty much built a very reputable name for yourself and a lot of people respect you for that including myself.

I had a pretty good name before JD even launched, which I'm sure contributed massively to JD's success.

I still have a little over 1000 BTC unclaimed in JD accounts, although I noticed last night that the last remaining large investor was attempting to withdraw his ~600 BTC balance.

The hot wallet was empty, so he couldn't. I refilled it this morning, but he's not been back.

Mystery investor: if you're out there, there are ~300 coins in the hot wallet waiting for you. If you withdraw them, I'll put another 300 in so you can take those too. Or email me to arrange a manual withdrawal of a single lump sum.

Scammers: don't bother. Random "I had 600 BTC but my dog ate my homework" emails never work.

what about my tortoise? 

[Stars]

I have a question Dooglus. Lets say you didn't know how to code therefor you had to pay a developer which you didn't 100% trust, what's the worst they can do? Is there anything that can be put in place so the developer doesn't know the seeds and of course can NOT cheat out investors or if it was private funded by my self presumably cheat out me?

The developer writes the code that tells the server what to do. If you can't understand the code he writes, you've no idea what he has told your server to do. It could be doing anything, up to and including sending him all the server seeds and hot wallet contents.

You pretty much have to trust him - or have someone you trust review all of his code (and, of course, don't grant him access to the server, or he can just change it after it has been reviewed).

Even if I have someone I trust 100% to review the code, Is it possible to write an undetectable back-door into the server?

Also, even if I were to lock him out the server after it being checked and what not, what if there was problems on the site such as bugs, he would need to have access to the server to fix them right?

[high110]

I have a question Dooglus. Lets say you didn't know how to code therefor you had to pay a developer which you didn't 100% trust, what's the worst they can do? Is there anything that can be put in place so the developer doesn't know the seeds and of course can NOT cheat out investors or if it was private funded by my self presumably cheat out me?

What I'd do in that situation is make them work on openly on github.

SHAMELESS PLUG TIME WITH CASE STUDY:

I open sourced moneypot.com as way of adding a bit extra transparency. So far I've had three different odds-effecting bugs. One I found myself, and patched (playing at 1.01x was -EV for the house). A second which was reported independently by two different people auditing the code (the game instant crashed 1 in 101 games, not 1 in 100 like it should) and the third more subtle (which I won't say more, as it hasn't been patched -- but easy for me to see if anyone is abusing it) which would allow a player to play at +EV.

The more people who read and review the code, the harder it's going to be to slip something past

I am surprized that you would publicize the third bug which is not batched.

Did you write the code and did you have a team of engineers?

[BayAreaCoins]

there will only be 300-400BTC left; maybe to be distributed in 6months in a big game with 300 prizes of 1BTC, spread the fun!

wat

Surely not, I'm sure there is at least one person who did something dumb and will be sure happy to have their JD coins back in 10-20yrs or something!  Some dude probably sitting in the can remembering them like they are there like a fucking ticket to freedom hahahahha!

"Excuse my Guard can I use Bitcoin to buy stamps yet and could I barrow your cell phone really quick if yes?" haha

[dooglus]

Even if I have someone I trust 100% to review the code, Is it possible to write an undetectable back-door into the server?

Also, even if I were to lock him out the server after it being checked and what not, what if there was problems on the site such as bugs, he would need to have access to the server to fix them right?

I don't see how it could be undetectable if you don't give him access to the server. The problem is that if you don't know how to administer the server, you're going to have to get someone to do it for you, and you're going to have to trust them. It's possible to install a back door and hide it well enough that you'll never find it.

Personally I would never want to put myself in that situation.

[Stars]

Even if I have someone I trust 100% to review the code, Is it possible to write an undetectable back-door into the server?

Also, even if I were to lock him out the server after it being checked and what not, what if there was problems on the site such as bugs, he would need to have access to the server to fix them right?

I don't see how it could be undetectable if you don't give him access to the server. The problem is that if you don't know how to administer the server, you're going to have to get someone to do it for you, and you're going to have to trust them. It's possible to install a back door and hide it well enough that you'll never find it.

Personally I would never want to put myself in that situation.

The website developer would need access to the server to build the website though, right? So that's my problem.

It's really annoying because even if I were to deal with a top company that has some of the best developers, they would charge me A LOT which I don't care too much about but the problem is there's no guarantee they wouldn't play with the seeds I just have their word.

So the only options I have is to either learn how to code myself which will most likely take years or somehow find a developer that I can trust 100%. Am I right in saying these are my only options to move forward or is there possibly a way around the "not trusting your developer with the seeds"?

[espringe]

The website developer would need access to the server to build the website though, right? So that's my problem.

No. You could easily do that yourself, it can be made rather painless. Something like a dice site is perfectly suitable to run on heroku (or another platform as a service), and combined with a managed database -- it would be very possible to have the devs never touch the production environment.

Some things are definitely going to be harder without prod access (e.g. load testing) and maybe some weird prod bugs will come in, but in general it's very doable.

The issue you need to worry more about, is the code being backdoored not the production environment.

It's really annoying because even if I were to deal with a top company that has some of the best developers, they would charge me A LOT which I don't care too much about but the problem is there's no guarantee they wouldn't play with the seeds I just have their word.

If they don't have access to prod, they don't have access to the seeds -- and you'd rely on code review to prevent they're not leaked.

So the only options I have is to either learn how to code myself which will most likely take years or somehow find a developer that I can trust 100%. Am I right in saying these are my only options to move forward or is there possibly a way around the "not trusting your developer with the seeds"?

If you have lots of money, and want a gambling site built and want to put no trust in someone -- I can build it for you, seriously. I could use the cash, I just quit my job last Friday to focus full time on moneypot.com and had a few people wanted to leave also and work with me -- but I'm not making close to enough to pay anyone else's salary.  To make it work, I'd need ~12k/USD/month with a promise of a minimum of 6 months -- which would buy you two full time devs (with bitcoin experience) and me managing it.

The way I'd do is is make the core gambling part publicly available (where public could be anywhere from open source, to downloadable to something you send to a 3rd party auditor) -- and I'd teach you how to manage the production environment, where you and you alone would have access and set the appropriate variables.

[Dabs]

dooglus, may I ask some hardware / software questions regarding how JD was set up?

1. What kind of server did you start it with? Did you upgrade? (You mentioned Amazon Cloud something before, micro instance or maybe even bigger)
2. Ram? Hard Drive space? Operating System? Processors? GPUs? (in theory, GPUs could have hardware accelerated the HMAC-SHA functions, maybe.)
3. What software packages? I remember something like Node.js
4. Was bitcoind (the hot wallet) on a different server, or on the same server as the JD site?
5. Did it need an external entropy source? From what I understand, you only need to generate the server seeds once per player, and only when they click Randomize. The rest are all deterministic.
6. How many real players were there? How high was the peak number of active players at one time?

See, 5 and 6 are related because you would be serving each player over SSL, and might deplete the entropy pool, or /dev/random related or something.

7. What would you recommend for me to start my own little dice site (or other game site), in terms of hosting, servers.

Thanks.

[Dabs]

If you have lots of money, and want a gambling site built and want to put no trust in someone -- I can build it for you, seriously.

Hi espringe,

I don't have lots of money. Would you consider some sort of partnership or commission or percentage of net profits for a certain amount of time (which can be 6 months, or 6 years) ?

Past performance of other similar sites (including JD) obviously don't reflect on future possibilities of a new site, by a different operator; but if this becomes successful to any degree approaching what JD has accomplished in a year, I will be content with 10% of the 10% of the site profits. (Lemme see, that was 19,000 profit, 10% is the commission or 1,900. And 10% of that is 19 BTC, per year... hmm, I may want to rethink how we split net profits, but yeah.)

You're asking "salary" is worth about 30 BTC per month.

I've been dreaming of a multi-player card game site (poker), but dice is simpler.

*edit* my math sucks. 10% of 1,900 is 190, per year. I can live with that.

[dhenson]

(Lemme see, that was 19,000 profit, 10% is the commission or 1,900. And 10% of that is 19 BTC, per year... hmm, I may want to rethink how we split net profits, but yeah.)

You may want to also rethink your math.

[Dabs]

You may want to also rethink your math.

I fixed it before you replied (or maybe at the same time). I was actually thinking of 1% at the time, but decided that's too low, and typed the wrong number.

[elm]

If you have lots of money, and want a gambling site built and want to put no trust in someone -- I can build it for you, seriously. I could use the cash, I just quit my job last Friday to focus full time on moneypot.com and had a few people wanted to leave also and work with me -- but I'm not making close to enough to pay anyone else's salary.  To make it work, I'd need ~12k/USD/month with a promise of a minimum of 6 months -- which would buy you two full time devs (with bitcoin experience) and me managing it.

The way I'd do is is make the core gambling part publicly available (where public could be anywhere from open source, to downloadable to something you send to a 3rd party auditor) -- and I'd teach you how to manage the production environment, where you and you alone would have access and set the appropriate variables.

did I understand You right? You need 6 month for coding and 12K USD a month? to be frank that sounds a lot. I have also some different game ideas in mind.

cheers

[boumalo]

If you have lots of money, and want a gambling site built and want to put no trust in someone -- I can build it for you, seriously. I could use the cash, I just quit my job last Friday to focus full time on moneypot.com and had a few people wanted to leave also and work with me -- but I'm not making close to enough to pay anyone else's salary.  To make it work, I'd need ~12k/USD/month with a promise of a minimum of 6 months -- which would buy you two full time devs (with bitcoin experience) and me managing it.

The way I'd do is is make the core gambling part publicly available (where public could be anywhere from open source, to downloadable to something you send to a 3rd party auditor) -- and I'd teach you how to manage the production environment, where you and you alone would have access and set the appropriate variables.

did I understand You right? You need 6 month for coding and 12K USD a month? to be frank that sounds a lot. I have also some different game ideas in mind.

cheers

12k$/month is for 2devs + him

60k$ total for a great job is not that pricey but you can get a good job for less!