[PHP] BitLuck Lottery Script - Released under MIT License

[lulzplzkthx]

Trust is an essential point of Bitcoin, yes. Or really any lottery script.

~lulz

[bitlotto]

Trust is an essential point of Bitcoin, yes. Or really any lottery script.

~lulz

Yes, BUT the script makes it WAY too easy for scammers to rig the results. All they have to do is make a new Bitcoin address for each "win". Every so often let "real" people win to avoid suspicion.
I'm just worried about people using this script to scam people. It's too easy to rip people off.
I'm not saying people are doing this now but with this script but it will happen.

The main problems is:
-all players need to be itemized before the draw somehow with a random way of picking the winner BEYOND the control of the operator

[lulzplzkthx]

Trust is an essential point of Bitcoin, yes. Or really any lottery script.

~lulz

Yes, BUT the script makes it WAY too easy for scammers to rig the results. All they have to do is make a new Bitcoin address for each "win". Every so often let "real" people win to avoid suspicion.
I'm just worried about people using this script to scam people. It's too easy to rip people off.
I'm not saying people are doing this now but with this script but it will happen.

The main problems is:
-all players need to be itemized before the draw somehow with a random way of picking the winner BEYOND the control of the operator

No, the script is a script. It does what it's supposed to, and anybody can modify it as they would like. That's what the GPL and LGPL licenses are designed for. I have created and script, released it, and hope it will be used for good. Yes, it could be used for nefarious purposes, just as Tor or Bitcoin could.

That's why the web-of-trust and similar concepts exist.

And a MySQL RAND() is beyond the control of the operator. If they choose to change the script, that's not my fault. I don't control that. You can feel free to implement another method, and post that if you would like. In fact, you might notice the script is divided into two parts: a front-end (paying), and a back-end (drawing). It makes it very easy to change how tickets are drawn to a more transparent way if whoever uses it would like.

[bitlotto]

No, the script is a script. It does what it's supposed to, and anybody can modify it as they would like. That's what the GPL and LGPL licenses are designed for. I have created and script, released it, and hope it will be used for good. Yes, it could be used for nefarious purposes, just as Tor or Bitcoin could.

That's why the web-of-trust and similar concepts exist.

And a MySQL RAND() is beyond the control of the operator. If they choose to change the script, that's not my fault. I don't control that. You can feel free to implement another method, and post that if you would like.

Don't get me wrong, you did a pretty cool job making a lottery script.    I was merely pointing out the flaws/stuff more for other people reading to be *VERY* careful playing a lottery using this script. That's all.

[BitLex]

how would people know, if a lottery is using this script, or any other?
people should be careful about where to send their coins, or give their money each and every time they do,
no matter what for.

doesnt have anything todo with this script.

[lulzplzkthx]

how would people know, if a lottery is using this script, or any other?
people should be careful about where to send their coins, or give their money each and every time they do,
no matter what for.

doesnt have anything todo with this script.

This was the point I was trying to get across. You have to trust the website, not the script BitLotto.

~lulzplzkthx

[bitlotto]

This was the point I was trying to get across. You have to trust the website, not the script BitLotto.

~lulzplzkthx

Agreed. I was merely trying to say that more trust is needed when using this script. Trust is always needed no matter what. Some systems are just easier/harder to rig than others. I just want people to be careful. That's all.

[lulzplzkthx]

This was the point I was trying to get across. You have to trust the website, not the script BitLotto.

~lulzplzkthx

Agreed. I was merely trying to say that more trust is needed when using this script. Trust is always needed no matter what. Some systems are just easier/harder to rig than others. I just want people to be careful. That's all.

I really don't get what you're trying to say. Any script can be rigged just as easily. Why? Because the script is server-side. There is no validation of it the client can do client-side. Watch where you're spending your money. It's the same way I might trust MyBitcoin, etc.

[FreeMoney]

We already had a lottery (taabl) where you didn't have to trust the operator not to pick the winner. He did it by using the last digits of the hash of a predetermined block as a ticket. Still had to trust him to pay out of course, but we'd know right away if he didn't.

[lulzplzkthx]

We already had a lottery (taabl) where you didn't have to trust the operator not to pick the winner. He did it by using the last digits of the hash of a predetermined block as a ticket. Still had to trust him to pay out of course, but we'd know right away if he didn't.

Yes, I was looking at BitLotto's which is similar. I could have done it that way, but I didn't. So yes, while it is transparently being picked, that doesn't mean the *script* could be as easily rigged. See, if TAABL released their script, I could mess with it just as easily.

[bitlotto]

I really don't get what you're trying to say. Any script can be rigged just as easily. Why? Because the script is server-side. There is no validation of it the client can do client-side. Watch where you're spending your money. It's the same way I might trust MyBitcoin, etc.

Agreed, I was trying to say that's why any lottery that depends on stuff done server-side is easy to fake results. The biggest difference is that with a manipulated script the lottery can run for a while before anyone catches on that it is a scam. The operator can cheat and keep taking the pot. A lottery done such that the operator CAN'T manipulate it, is more ideal because it boils down to if they paid the legitimate winner or not. If done correctly everyone can know who the winner is WITHOUT the operator saying. If they don't pay the proper person it's game over for the lottery. If the lottery has no transparency, the operator can take multiple jackpots before people catch on.

[BitLex]

if an operator wants to cheat, he can easily cheat.
doesnt matter if it's a lottery-script, or a bubble-script, or my randomizer-script, even a mining-pool,
could all be cheating, i don't get it.

why not move this "be careful who and where to send your coins to" discussion to a new thread, if you want to warn people?

[bitlotto]

if an operator wants to cheat, he can easily cheat.
doesnt matter if it's a lottery-script, or a bubble-script, or my randomizer-script, even a mining-pool,
could all be cheating, i don't get it.

why not move this "be careful who and where to send your coins to" discussion to a new thread, if you want to warn people?

Ok I'm done. If you can cheat it, perhaps more work needs to be done on it before it's used! I'm saying that if you want to use this for a lottery perhaps a feature where it lists all the entries is needed with a method for picking the winner separate from the operator after the list is made. That's all. I like the script and think it has potential.

[lulzplzkthx]

if an operator wants to cheat, he can easily cheat.
doesnt matter if it's a lottery-script, or a bubble-script, or my randomizer-script, even a mining-pool,
could all be cheating, i don't get it.

why not move this "be careful who and where to send your coins to" discussion to a new thread, if you want to warn people?

Ok I'm done. If you can cheat it, perhaps more work needs to be done on it before it's used! I'm saying that if you want to use this for a lottery perhaps a feature where it lists all the entries is needed with a method for picking the winner separate from the operator after the list is made. That's all. I like the script and think it has potential.

The point is, I don't plan on using this script. I've released it for educational purposes. I don't plan on editing it or changing it because it does not benefit me at all. You can cheat anything. Hell, you could cheat your own system, bitlotto.

[bitlotto]

The point is, I don't plan on using this script. I've released it for educational purposes. I don't plan on editing it or changing it because it does not benefit me at all.

Ok, it was more directed to those who are thinking of using it as is.

You can cheat anything. Hell, you could cheat your own system, bitlotto.

I don't think so. At least I haven't figured out a way yet. I could not pay the winner or pay the wrong winner (Everyone would know right away) but I can't fake the results giving it to myself. I'd have to either rig Canada's national lottery or figure out a way to alter already existing blocks in the in Bitcoin network. It would be pretty tough.

[leepfrog]

Thanks for your script. I've noticed two minor issues though:
1. When bitcoind cannot be reached (not running/timeout) the php error displays the request (including username, password and IP adress). It would make sense to suppress this details and throw a generic error.
2. The page which shows the deposit address and waits for confirmation is not fully compatible to the new setting to allow inputs other than 1:

Please send 1 BTC or more to the following address:

mjCQzqjNdLratrY6MsdS7fhtiYp8yieibi

This page should change when the address above receives at least 0.1 BTC with 1 confirmation.

WARNING: Non-refundable! Please only use multiples of 1 BTC (anything else is rounded down.)

[lulzplzkthx]

Thanks for your script. I've noticed two minor issues though:
1. When bitcoind cannot be reached (not running/timeout) the php error displays the request (including username, password and IP adress). It would make sense to suppress this details and throw a generic error.
2. The page which shows the deposit address and waits for confirmation is not fully compatible to the new setting to allow inputs other than 1:

Please send 1 BTC or more to the following address:

mjCQzqjNdLratrY6MsdS7fhtiYp8yieibi

This page should change when the address above receives at least 0.1 BTC with 1 confirmation.

WARNING: Non-refundable! Please only use multiples of 1 BTC (anything else is rounded down.)

Didn't notice this but I have just pushed new updates to the Git repository with fixes to these and a few other minor issues.

[BiTCoinRC]

I have installed this script but when I try entering a wallet address to play the lottery I always get "ERROR: You entered an invalid address. Please try again." but the address is valid??? Any ideas?

[BiTCoinRC]

BUMP

http://s13.postimg.org/k5j2cxeh3/Capture.png

I have tried this on two different hosting accounts/servers now and still get the same result. Would really like to get this functioning.

[marssystems]

BUMP

http://s13.postimg.org/k5j2cxeh3/Capture.png

I have tried this on two different hosting accounts/servers now and still get the same result. Would really like to get this functioning.

Have a look at my 'fully working' Weekly Bitcoin Lottery website, based on this code.

http://bitcoin.bigmoney.biz