PRCDice.eu - Largest Dice invest site - Open since 2013! Chat, Play, Invest!

[chaosPT]

On the other hand, the cold wallet / total investor balance is like 550 BTC. There could be easily a big investor that wants to deposit 550 BTC. If the deposit address is part of a hot wallet, the hot wallet could be the same amount as the cold wallet. Therefor to me it makes sense to make the deposit addresses cold? Perhaps with JD this was not the situation as I assume no deposit would cover the total invested amount.

I basically like the idea of "don't have more in the hot wallet than you can afford to lose from your own pockets" as site operator. So I personally think the deposit addresses must be cold then. I agree for instant withdrawals it will create a delay more often, but in theory it seems more safe to me.

That's a very good point. We had people depositing 1000 BTC or more at once to JD, and it would sit on the hot wallet until it had one confirmation. Then it would be moved offsite. That was a risk in that anyone hacking the server would be able to steal it while it had 0 confirmations.

Of course anyone hacking the server could also see their own "server seed" and so could drain the whole bankroll over time by "getting lucky" with their rolls. Perhaps the presence of 1000 BTC sitting in the hot wallet would be too much for them to resist, and so they would make themselves known immediately, costing the site "only" 1000 BTC instead of draining the whole bankroll over time.

It doesn't matter PRC process thier withdraw manually and twice a day .

[1713497053]

1713497053

[1713497053]

1713497053

[1713497053]

1713497053

[dooglus]

Hi Doog, thanks for testing a bit. It seems again you have more problems than most. Maybe browser/OS that I haven't fully tested? What did you use?

I use Chromium on Linux. I guess I'm more fussy than most players. When I see something that could be improved, I comment on it. Most probably let it slide.

There is a min bet of 1 Dogecoin but that should have showed you an error.

It did. Note that the client-side bet counter on the provably fair tab goes up by 1 when you try to make a bet less than 1 doge, but the server-site counter doesn't, so they get out of sync.

Again I think this has something to do with the overall problems you are having, OS/Browser/connection dropping. Was it a bad internet connection you had or was it PRC that was just dropping?

I have a bad Internet connection. Packets often get dropped. Your site doesn't handle it very gracefully. Showing "NaN" in an integer field is wrong no matter how many packets are dropped.

Divesting an amount more than your total investment divests all since it would be annoying if there was like a satoshi difference that it kept warning about.

Are you sure? I tried a few times and it appears that it does nothing.

Also divest isn't instant, it should have said wait a couple minutes for it to go through which is probably why you see more in history.

Oh, that makes sense then. The first divest I tried actually did divest, but my investment had grown a bit in the mean time, leaving 800 DOGE in my investment, so the 2nd divest divested that. They both show up with the exact same second, so I guess you're timestamping them with the time they were processed, not the time they were requested (since my requests were done manually, and will have been over 10 seconds apart I guess).

That is something I am fixing and was an artefact left over from when you can bankroll your own blackjack tables. You wouldn't want to allow an investor to divest as a hand is going on. Again I'll get that sorted for dice.

I'm not clear on that. When I "invest" on the dice site, am I just bankrolling the dice games? Or the whole site? From what I've read in the chat, there's only a single bankroll per currency. Dicers were bitching about losing their investments to lucky sports bet players for example. If that's the case, then don't you want to wait until all current blackjack hands are finished before allowing a divest? You can't change the max stake part-way through a hand.

Thanks again for pointing out these things.

You're welcome.

I'm just pointing out the stuff that bothered me. I expect most of it could be off-putting to some other players too, so figured you would want to hear about it.

[dooglus]

That's a very good point. We had people depositing 1000 BTC or more at once to JD, and it would sit on the hot wallet until it had one confirmation. Then it would be moved offsite. That was a risk in that anyone hacking the server would be able to steal it while it had 0 confirmations.

Of course anyone hacking the server could also see their own "server seed" and so could drain the whole bankroll over time by "getting lucky" with their rolls. Perhaps the presence of 1000 BTC sitting in the hot wallet would be too much for them to resist, and so they would make themselves known immediately, costing the site "only" 1000 BTC instead of draining the whole bankroll over time.

It doesn't matter PRC process thier withdraw manually and twice a day .

I think you entirely missed the point I was making.

How is their withdrawal schedule in any way related to someone gaining unauthorised access to the server?

[FastBluff]

That's a very good point. We had people depositing 1000 BTC or more at once to JD, and it would sit on the hot wallet until it had one confirmation. Then it would be moved offsite. That was a risk in that anyone hacking the server would be able to steal it while it had 0 confirmations.

Of course anyone hacking the server could also see their own "server seed" and so could drain the whole bankroll over time by "getting lucky" with their rolls. Perhaps the presence of 1000 BTC sitting in the hot wallet would be too much for them to resist, and so they would make themselves known immediately, costing the site "only" 1000 BTC instead of draining the whole bankroll over time.

It doesn't matter PRC process thier withdraw manually and twice a day .

I think you entirely missed the point I was making.

How is their withdrawal schedule in any way related to someone gaining unauthorised access to the server?

The point Dooglus is making, is that people can just keep winning and still drain the cold wallet, it doesn't matter if the PRC processes withdraws manually.

[dooglus]

The point Dooglus is making, is that people can just keep winning and still drain the cold wallet, it doesn't matter if the PRC processes withdraws manually.

Exactly. If I can get onto the server to steal the hot wallet, I can also steal the server seeds.

The server seeds are much more valuable, because if I'm care and don't make it too obvious I can drain the whole bankroll slowly over time.

You would be better off leaving 20% of the cold wallet on the server as "bait" for the hacker. Maybe he's dumb and takes the 20% instant payoff rather than slowly bleeding you to death.

[BitBOOM]

The point Dooglus is making, is that people can just keep winning and still drain the cold wallet, it doesn't matter if the PRC processes withdraws manually.

Exactly. If I can get onto the server to steal the hot wallet, I can also steal the server seeds.

The server seeds are much more valuable, because if I'm care and don't make it too obvious I can drain the whole bankroll slowly over time.

You would be better off leaving 20% of the cold wallet on the server as "bait" for the hacker. Maybe he's dumb and takes the 20% instant payoff rather than slowly bleeding you to death.

The point Dooglus is making, is that people can just keep winning and still drain the cold wallet, it doesn't matter if the PRC processes withdraws manually.

Exactly. If I can get onto the server to steal the hot wallet, I can also steal the server seeds.

The server seeds are much more valuable, because if I'm care and don't make it too obvious I can drain the whole bankroll slowly over time.

You would be better off leaving 20% of the cold wallet on the server as "bait" for the hacker. Maybe he's dumb and takes the 20% instant payoff rather than slowly bleeding you to death.

Doog, I'm curious how big of a concern this should be in your opinion. (people gaining access to the server seed, etc.) Do you see any security issues with PRC? Or is it just a risk for any site of this nature? How secure did you feel just-dice was? I do recall reading some of your posts where it seemed you felt there was always a risk even on just-dice.

I think most hackers would take an instant 10-20% so that as bait might be a good idea.

What are your thoughts on this Dean?

[NLNico]

The point Dooglus is making, is that people can just keep winning and still drain the cold wallet, it doesn't matter if the PRC processes withdraws manually.

Exactly. If I can get onto the server to steal the hot wallet, I can also steal the server seeds.

The server seeds are much more valuable, because if I'm care and don't make it too obvious I can drain the whole bankroll slowly over time.

You would be better off leaving 20% of the cold wallet on the server as "bait" for the hacker. Maybe he's dumb and takes the 20% instant payoff rather than slowly bleeding you to death.

Yeh I agree in theory that would be the "best" way to exploit if the attacker can have unnoticed access to the server.

Anyway, Dean is planning to make instant withdrawals this weekend (so obviously with hot wallet.) The original discussion however was that I still think it's ok to manually fill that hot wallet and use cold wallet for deposit addresses, especially with a relative smaller site because 1 deposit can be 50% of whole cold wallet. There can be many ways to exploit if you have access to the server, but still I think it's best to limit each method which would include trying to limit the hot wallet amount.

Also I do think most attackers will go for instant steal simply because they will (and should) be worried that their unauthorized access will be noticed. This however does depend on the method or vulnerability that's used (and the "experience" of the attacker.) (edit: in theory he could "instant steal" the hot wallet also with the server seed of course, only needs 1 deposit, would depend on the attacker I guess)



Of course in the end I hope the site will never be (successfully) attacked but should definitely think of all the possibilities.

[dooglus]

Doog, I'm curious how big of a concern this should be in your opinion. (people gaining access to the server seed, etc.) Do you see any security issues with PRC? Or is it just a risk for any site of this nature? How secure did you feel just-dice was? I do recall reading some of your posts where it seemed you felt there was always a risk even on just-dice.

I think most hackers would take an instant 10-20% so that as bait might be a good idea.

I don't think it's ever possible to be 100% secure. It's really hard to say how lucky JD was not to get compromised during the year it ran. Running the site I got nervous every time anyone got lucky. There's always that nagging doubt "are they somehow cheating?"

Imagine running the site while nakowa was playing. He was up over 12k BTC at one point I think, and you just have to wonder what's going on.

I've not seen the code of PRC, and don't know anything about where it's hosted so it's impossible to have any idea how secure it is.

I think there's always going to be all kinds of risks associated with this kind of site, and you need to bear them in mind when deciding whether and how many coins to trust them with.

Personally I don't think I would have had many if any coins with JD if I wasn't running it myself. I've had too many bad experiences trusting people with my coins in the past.

As for leaving coins in an unencrypted wallet as bait, I think that's a good idea in general. Don't use your regular computer for your main Bitcoin wallet, but do leave a wallet with a small amount of BTC in it. If the wallet gets emptied, it's an early warning sign that you've been hacked.

[PocketRocketsCasino]

Note that the client-side bet counter on the provably fair tab goes up by 1 when you try to make a bet less than 1 doge, but the server-site counter doesn't, so they get out of sync.

Yeah NLNico pointed that one out too. I'll get that fixed asap.

I have a bad Internet connection. Packets often get dropped. Your site doesn't handle it very gracefully.

Yeah I was in middle of actually redoing the whole site before the new wave of players. For now I think I will clean up/refactor all of the client side scripts instead before moving on to V2. 

I'm not clear on that. When I "invest" on the dice site, am I just bankrolling the dice games? Or the whole site? From what I've read in the chat, there's only a single bankroll per currency. Dicers were bitching about losing their investments to lucky sports bet players for example. If that's the case, then don't you want to wait until all current blackjack hands are finished before allowing a divest? You can't change the max stake part-way through a hand.

Yes the existing bankrolls (btc and doge) are for whole site which includes dice, sports and casino games (which currently is only blackjack).
It currently can take up to 1 minute to divest because of that reason. Another solution is to have an option to state what you want to invest in: sports/casino/dice/all.

I'm just pointing out the stuff that bothered me. I expect most of it could be off-putting to some other players too, so figured you would want to hear about it.

Yeah totally. It's best everyone does. Thanks.

[PocketRocketsCasino]

...
What are your thoughts on this Dean?

As doog says, no system can be 100% secure and there is always a risk, Just look at the recent Heartbleed incident. Saying that there are various techniques and tools we can use to minimise this risk a lot.

I wouldn't want to detail every method and technique in here that I use or have implemented for obvious reasons.
Also as doog says when people do keep winning you sometimes question what is happening. This is a good thing I guess because it keeps you double checking and making sure things are OK.

Although doog prefers the method of having deposits fund the withdrawals of the hot wallet I think at this point that I prefer the deposit addresses be to a cold wallet and I will top up the new hot wallet as needed. 
That at least prevents any situation where someone may deposit a large amount of Bitcoin and it being instantly stolen from hot wallet before I can do anything about it.

[LtPaxIV]

thx for the leaderboard for doges dice.got me 5th place

[sherbyspark]

I am surprised that they pause betting today because some guy had a lucky streak and causes a loss of 10BTC to the casino.

[dooglus]

I am surprised that they pause betting today because some guy had a lucky streak and causes a loss of 10BTC to the casino.

I hadn't heard about that, but it's interesting given our recent discussion about cheating:

Doog, I'm curious how big of a concern this should be in your opinion. (people gaining access to the server seed, etc.) Do you see any security issues with PRC? Or is it just a risk for any site of this nature? How secure did you feel just-dice was? I do recall reading some of your posts where it seemed you felt there was always a risk even on just-dice.

I don't think it's ever possible to be 100% secure. It's really hard to say how lucky JD was not to get compromised during the year it ran. Running the site I got nervous every time anyone got lucky. There's always that nagging doubt "are they somehow cheating?"

As doog says, no system can be 100% secure and there is always a risk, Just look at the recent Heartbleed incident. Saying that there are various techniques and tools we can use to minimise this risk a lot.

[pureelite]

thumbs up for this site

hoping that this site will have many new things!

[sherbyspark]

Irrespective of any Down swings, looks like Dean is handling the site well enough. Would be great to see it grow.

[dooglus]

For those who care about the details of the "issue" at PRCdice:

https://prcdice.eu/home/provablyfair says:

How does it work?

5. Sometimes the first 5 characters will not result in a number we can use and so we loop through characters 2-6, 3-7 etc until we find one

So it looks at the first 5 hex characters. That gives a number between 0 and 16^5-1 = 1048575

If that number is less than 1 million, it is used as the rolled number. But if it isn't, they use characters 2 through 6.

Since the first 5 characters are 1 million or more, the new number will be at least:

>>> (1e6 - 0xF0000) * 16
271360

so (1000000/1048575) = 95.4% of the time, the rolled number will be randomly distributed between 0 and 100, but the remaining 4.6% of the time it will be guaranteed to be over 27.136.

So playing "over 27.14%" is a winning strategy.


The question is, what to do about this...


If you read the description of how provably fair numbers are generated, noticed that numbers over 27.4% come up a little more than they would if picked at random, and decided to bet on >27.4, is that cheating?

There's no bug in the coding - it does exactly what it says it does in the description on the site.

If it is cheating, which bets do you roll back? Maybe some guy figured it out, but decided to bet ">49.5" to avoid detection. Betting ">27.4" kind of suggests you know exactly what you're doing. But even then maybe some of the people doing it were just copying the big winner's strategy because it was "lucky" for him. And maybe the big winner was just copying someone else.


Wow, I'm glad I don't run a dice site!

[sherbyspark]

If the flaw was with the coding/or wasnt looked at. Then I guess sjess should be paid.
If it is decided that bets will be rolled back. Then people who lost money should be paid back.
As if they were betting under 50. then odds were less from what was promised.

[dooglus]

If the flaw was with the coding/or wasnt looked at. Then I guess sjess should be paid.
If it is decided that bets will be rolled back. Then people who lost money should be paid back.
As if they were betting under 50. then odds were less from what was promised.

The coding was doing exactly what the text description said it would do.

I looked through it myself when I first heard about PRCdice and noticed that they were doing it differently than JD.

I wondered why, and thought it wasn't necessary, because even taking the hash 5 characters at a time there's an incredibly tiny chance that you will ever run out of the 128 character sha-512 hash.

But it didn't occur to me to go further and consider what re-using known "too high" characters would do to the distribution. And I'm kind of kicking myself for that. It was pretty obvious, but I missed it.

Anyone betting "low" was getting worse odds than advertised, whether they were betting "less than 50" or any other chance.

It could be argued that the ones whose number was determined by just the first 5 characters of the sha-512 hash got a fair roll, and the rest (which will be around 4.6% of all "lo" bets) weren't fair.

>>> 100*(1 - 1e6/16**5)
4.632568359375

[dooglus]

So not only someone like sjess who has his/her winnings locked up, investors who have lost money with this but anyone who has ever bet LO was being cheated ~5% of the time when they where betting slow.

So pretty much anyone how has played here or invested here should see partial refund from Dean's personal assets, and sjess should be paid from Dean's personal assets.

I'm not sure it's accurate to say they were cheated ~5% of the time they bet lo. Because maybe they still won some of those bets. But they will have lost more bets than they should have if they played much, yes.

I played a bit, both for BTC and for DOGE, and always roll 'hi'. I ended up with a small profit both times.

That could look suspicious - I know how to read code, I admit to having read the code before I played, and then I only ever bet 'hi'.

How is Dean meant to decide which players were taking unfair advantage of the system deliberately, and which were doing it unwittingly?

[NBward6]

It scares me that apparently Dean didn't even verify that his rolls were evenly distributed.  Generating rolls with the flawed algorithm and just binning by integer should reveal the flawed distribution pretty quickly wouldn't it?