Last-minute add-on:
I'll offer to audit this script. If alia wants to send it to me then I will go through it and analyze how it works and post my analysis about it here without revealing its inner workings. I don't plan to bet money with it, instead to analyze the code.
Some of my posts take much time to write, gather links and quotes for, etc. I wrote the below part about auditing before RGBKey posted this.
I myself will vouch for RGBKey’s technical competence for performing such an audit. I don’t know gambling; but I have interacted with RGBKey in the Development & Technology forum, and he knows his stuff. I would trust the results of any gambling script audit performed by RGBKey.
What say you, Alia?
[...]
A super-secret math-defying script for one bet? Totes legit.
Pathetic. This is where I stop even trying to argue, and just break out my popcorn.
Actually, I should have done that awhile ago.
If this is not math to you, then I feel very sorry for you (for being you) and for myself for having to read through your nonsense.
It is math, but it's bad math.
TL;DR on Alia’s script and her arguments in favour of it.
1 - PM stands for 'Personal message' and notice the word 'private' is not within the name
2 - If you want to maintain confidentiality, GPG (or another encryption means should be used), this is primarily how I judge if I will be willing to disclose information received via PM
3 - If GPG is not used, there is the potential for anyone with access to the forum DB to trivially read your PMs, even after they are deleted because the entire DB is backed up every day.
You forgot Cloudflare:
The security implications are that Cloudflare can read everything you send to or receive from the server, including your cleartext password and any PMs you send or look at. They can't access the database arbitrarily, though: they can only see data that passes over the Internet.
Also, you’re preaching to the vicar. Observe that my signature contains my e-mail address, the admonition “Use PGP!”, and the identifiers for
two PGP keys (ECC for GPG 2.1+, Keybase, and some other implementations; RSA for everybody else). And I have been vocal about my dismay at the abysmal state of PGP use amongst users of so-called “cryptos” (!):
This is why I think user education is important. For a forum dealing with what is now colloquially called “crypto”, only an astonishly small proportion of users are crypto-savvy.
One of my first thoughts on seeing anything Bitcoin-related is, “Why isn’t public-key crypto used for all authentication?” Of all places, the Bitcoin Forum should lead with that! If you use Bitcoin, you should also use PGP, at the bare minimum; and the attention brought by Bitcoin makes for an opportunity to introduce more people to what old cypherpunks call “crypto”, resulting in more security all-around.
As a 90s-era cypherpunk, I’ve been pushing PGP use for so long, to so little effect, that at this point I will
do almost anything [NSFW] to raise user awareness of actual “crypto”. (That thread started with general applied cryptography background at a beginner level; I had intended that when it really got going, lessons would move on to PGP/GPG use and also, OTR for chat.)
Anyway...
I would point out that alia threatened to release information about aTriz (
source:
I will be forced to reveal certain things that he has done.
However from what I have seen, alia has not released any negative information about aTriz. One could argue that alia was bluffing when she made that statement, however aTriz would be very much aware that alia didn't have negative information about him and it should have reasonably be known that making that statement would make alia look very bad. To me, it does not make any sense this would be a bluff.
The full extortion threat is here:
I would advise aTriz not to try and "wriggle out" of the contract, because it puts me in a position where I will be forced to reveal certain things that he has done. If he sticks to the terms of the contract, as stipulated, he is my friend, and he will not be my enemy. Being my enemy is not a very favourable position for anyone to be in.
That did strike me as a peculiarly stupid bluff to make, if it was a bluff. But aTriz
did avoid the contract; and rather than dropping some scandalous bombshell, Alia apparently returned his prepayment on it. Moreover, I note, Alia had previously rattled a similar sabre at me (albeit much more weakly):
That ship has long since sailed. I'm afraid nullius has only his soggy pillow left (unless, after someone Skypes me, he publicly apologizes for even beginning to doubt me after all the personal stuff I shared with him). Oh yes, he has shared his fair share of personal things, but I would never betray his trust and even speak of it here. I wonder if he would do the same
Interesting. Testing the waters?
You shared very little of a personal nature with me; and most of that was generic. Brief mention of your college majors, etc. Nothing
very personal (except a few sex bits you also give your clients), and certainly nothing which could be compromising to you. Indeed, the one time I tried to press you for information (because I wanted to help—about your purported privacy breach, for which you got the username change), you firmly kept me at arm’s length; and you barely told me more about that than you stated in public forum postings.
Whereas I gave you a carefully measured amount of low-level private communication which I do desire to be kept confidential. Nothing which could
compromise me if leaked—nothing for which you could blackmail me—because I didn’t trust you
yet. I was trying to build trust with you; and the only way to do that is to give someone something real, bit by bit, and see over time if they can be trusted with it. (Intelligence agencies have some similar methods.)
I cut
that off cold; Alia only has from me a few bits of high-grade sex talk (
PMed with PGP)—disclosure of which could moderately upset me just on principles of privacy, plus
severely titillate the forum. Nothing which could actually hurt me.
Given Alia’s propensity to rattle an extortionate sabre, I presume that what you quoted was a bold but badly-calculated bluff.
A lot of the concerns about aTriz were more or less being ignored in the thread about aTriz, and most of the conversation was surrounding the signature contract.
I think that if the person who
started that thread was satified, then the matter can be considered resolved. scam_detector seems unbiased; remember that he started by making serious accusations against me, too, in the alia scam thread (then dropped his accusations against me when I showed contrary evidence). I will admit that I have a moderate positive bias toward aTriz, of the kind inevitable amongst human beings in social scenarios. (
N.b. that as of a few days ago, I had a
strong positive bias toward Alia; and that did not stop me from changing my opinion based on credible evidence!) Given your post history, you must admit that you have a strong negative bias toward aTriz—really, that you bear a grudge. Whereas scam_detector seems interested only in detecting scams (for which reason, I will now pay close attention to any accusations he makes). He locked the thread—not when Lauda publicly suggested it, but much later, when he decided it was appropriate. I think that settles it.
I don't think alia is exactly putting in a lot of effort into making it appear she is actually running any kind of script,
True. (suchmoon’s post on the same page, excerpted above, is an eye-opener on this point.)
If you operate under the assumption that alia is not using a script in this thread, then the only reasonable explanation as to what the point of this thread is would be to expose aTriz for giving fake vouches.
The only possible point for whom? Such an allegation is obviously
your point; and you’re the only one who has made that allegation here.
As for Alia, I have advanced two different (but not mutually exclusive) hypotheses as to why Alia is doing this: The “kook” theory of a self-described “degen” gambler fixated on the idea of a winning script; and the “long con” theory of a scammer with nothing to lose, who cooks up the ploy of an ill-designed “empirical” experiment she has a large chance of winning by blind luck. Since there is no evidence other than Alia’s uncorroborated word of any script being actually used here (plus other reasons), I now lean
strongly toward the latter theory—exclusively.
As a counterpoint to the above, it is possible that alia is trying to frame aTriz into it looking like he was giving a fake vouch.
Interesting theory. I note that this thread was started
after the (in)validity of the signature contract had been broached, and many people were advocating that it should be voidable.
Means (that foolhardy vouch),
motive (the signature contract),
opportunity (obvious). But that alone does not make a case beyond
reasonable suspicion; any other evidence?
However I don't think this is the case because when their relationship was scrutinized, the vouch did not appear legitimate even when ignoring all of the above. This is a script that was being sold for $10,000, however the basis for aTriz's vouch was that he made bets totaling well under of penny and had winnings of well under a penny (he said he used faucet money to test the script) -- think about that for a minute and let that sink in. think about just how ridiculous that sounds.
The weight of all evidence I have thus far seen is that aTriz got sucked into a situation where he was a bit starstruck, and made some foolhardy mistakes—even, yes, one which looks quite ridiculous. The totality of the situation must be examined: The vouch in question, the unprecedented signature contract, and also my own involvement. (Remember that aTriz was seeking my signature, too, as I disclosed in the other thread. In view of Alia’s close public association with me, I
hope that my reputation for technical credibility did not improperly weigh in his eyes in favour of a script which I myself didn’t even know about until after the scam accusations broke.) All this
was examined, in the aTriz thread where aTriz was the topic.
Remember:
Many people got fooled here. I myself got fooled, badly. Even theymos got fooled—not so badly, but nevertheless. There was a domino effect: I looked to theymos’ neutral reporting of a fact (/r/GirlsGoneBitcoin verification) on Alia’s trust page; arguably, I may have read too much into it. Via private as well as public communications, I am almost 100% certain that aTriz first heard of Alia due to me. So, aTriz got fooled even worse than I did—in some part because I was fooled, and Alia was carrying my afterglow. Of course, aTriz is responsible for his own decisions, just as I am for mine; but still, this is the simplest explanation, and the most likely.
Yeah well, I gave aTriz the script, he ran it, it worked, he vouched. I thereafter deleted the script from the chat. Pretty simple to get, right?
So do you have a problem with aTriz disclosing the script in order to prove the script actually exists?
Do I have a problem with aTriz disclosing a script that I was trying to, at one point, selling for 1 BTC a piece? Absolutely.
Another idea:
Publicly commit a hash of the script: Bit-for-bit, exactly the version which was provided to aTriz. Perhaps even a keyed hash (HMAC). I would be willing to produce and escrow a secret key for that purpose, under appropriate terms as for the purpose of this commitment, and the exact circumstances under which I would agree to disclose the secret.
This would fix the bit-for-bit identity of the script, as a reference point for any future investigation of it (whether publicly, or by a private auditor).
So, Alia, do you have a problem committing a SHA-256 here? I don’t think the keyed hash would be necessary, for any script of nontrivial length. (I would suggest that keyed hashes be used for such purposes as committing evidence of names, e-mail addresses, and other very short texts which could easily be bruteforced from databases of known identifiers.
That is a large mistake of many people who commit identity hashes.)
You do realize that as it stands now, no one will ever buy your script from you, for a number of reasons.
If your script has any level of legitimacy, you should allow others who have the ability to audit the code and methods to do so. This is probably the only realistic way of redeeming your trust.
Another idea:
Private audit.Alia, you yourself made this an issue:Like I said, many, many times... not everything has to be 100% math based. My aim is to make profit for people, and I am doing it. That is my end goal. Not to fit your stupid equations (which are not even relevant since you don't know the intricacies of how my script works)
If your ultimate answer is that your critics lack sufficient knowledge to judge your script because they haven’t seen it, then it is incumbent on you to grant such knowledge.In both open-source and proprietary software, paid professional audits by independent third parties are an industry best practice. Proprietary software is typically audited under NDA terms. In this case, I seriously doubt that any credible expert would make of himself a laughingstock by accepting an ordinary audit job for a mathematically impossible script.
However,
perhaps a credible auditor may be interested in approaching this as a “skeptical investigator”. There do exist eminent scientists who make a hobby (or even a secondary career) out of investigating famous spoon-bending psychics, and the like. Their investigations are not jokes; they are serious and scientifically rigorous.
Why don’t you ask some of your critics here if they’d be interested in taking a paid audit job under NDA?
(Note: I am not offering to do this, for the following reasons: (0) Obvious COI, which would present at best an appearance of impropriety; it needs to be an
independent third party, who was never before involved with you. (1) My lack of technical competence in the specialist subject of games of chance—a deficiency I intend to fix, but have not yet.)
[...good maths vs. bad maths...]
Either maths is applicable to your script (and therefore, as we've shown, your script is a scam) or you've written a script which breaks the fundamental laws of mathematics, in which case you are sitting on Nobel Prize material.
s/Nobel Prize/Fields Medal/. Which is much more exclusive, and would be
almost unprecedented if Alia really be a woman. Oh, don’t complain about my mention of an inconvenient fact; I’ve already been branded “politically incorrect”:
