Introducing Cardwars

[luv2drnkbr]

I'm not sure whether to feel good or bad that we helped fixed the glitches.  I think that next time somebody posts a game with a double payment glitch, I'm going to keep my mouth shut and just play it until they realize the mistake themselves...  Making a few hundred bucks off a casino is something I think I can learn to not feel bad about. 

[1713475281]

1713475281

[1713475281]

1713475281

[1713475281]

1713475281

[1713475281]

1713475281

[tomcollins]

I'm not sure whether to feel good or bad that we helped fixed the glitches.  I think that next time somebody posts a game with a double payment glitch, I'm going to keep my mouth shut and just play it until they realize the mistake themselves...  Making a few hundred bucks off a casino is something I think I can learn to not feel bad about.  

I'm still not convinced that it was working properly for real money.  The edge we had was quite significant, getting down 30 bets is just so hard to pull off with that edge.  

Debugging source code without being to step through it or examine what its actually doing is tough, especially when you don't have all the code.

I'm hoping he has logs of what happened for real money.  I see code that looks like it's logging things, so I'd love to look at those.  There's always a chance the log is wrong, but it should shed some light on it.

I caught a huge bug in an online poker site.  They had a bug where a player could go all in for less than other players.  But if he won, he'd win the same amount everyone else bet.  For example, someone bets $3 (all he has).  The other players raise and stay in for $10 each.  So the total pot is $23.  If the hand plays properly, the low guy wins $9 if he actually wins, and the winner of the other two gets the other $14.  But they would give the low guy $30 out of a $23 pot.  I saw one case where the house actually lose >$1000 on one hand.  It was a crazy bug.  There wasn't a great way to take advantage of it since it didn't always happen.  Might as well report it for good karma.

[BCEmporium]

Gosh! Not my coding weekend as it seams.... woke up and found heavy losses at mbtcasino (luckily it was at mbtc), had to rush to put some coins from my wallet to cover it. 

I'll retract table card games, it attracts a kind of gambler I'm not quite comfortable with. While slots and lottery attracts relaxed players, table games attracts gamblers filled up with "get rich schemes" and all sorts of statistical rigs along. I would need a 24h/day surveillance system to see what's going on.

tom, late I'll put the cardwars test-net online.

[tomcollins]

Gosh! Not my coding weekend as it seams.... woke up and found heavy losses at mbtcasino (luckily it was at mbtc), had to rush to put some coins from my wallet to cover it. 

I'll retract table card games, it attracts a kind of gambler I'm not quite comfortable with. While slots and lottery attracts relaxed players, table games attracts gamblers filled up with "get rich schemes" and all sorts of statistical rigs along. I would need a 24h/day surveillance system to see what's going on.

tom, late I'll put the cardwars test-net online.

If you make a flaw in your payouts, someone will find it and exploit it.  The bug we found potentially saved you a ton of cash.  Even with the slots, if there's a mistake in the code, you can get burned hard.  However, it's more difficult for a user to find a slot that is paying out better than 100% (plus it's also easy to rig it toward the house).

Having a casino opens you up to a lot of losses even if it's done properly.  Hopefully you have it covered in case someone does get lucky.

[BCEmporium]

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

So far it adds to experience, so I can redo things better, log more... The logging system at testnet creates text files, so it's easy to follow, in that server it goes to db and due to a query error it was logging over the same line (means instead of sequential log I found out pretty few data about the last hand played).

[tomcollins]

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

So far it adds to experience, so I can redo things better, log more... The logging system at testnet creates text files, so it's easy to follow, in that server it goes to db and due to a query error it was logging over the same line (means instead of sequential log I found out pretty few data about the last hand played).

Even the big time casinos can be hit by this kind of stuff.  I've seen major sites have flaws in their shuffling algorithm that was exploitable and got hit for a ton of money.  But at the very least, calculate the expected odds on a game, then set up an automated test to play a million hands or so, and make sure you are very close to the expected value.  Doing that in this case should have caught the problem.

These types of games also can be very easily rigged to favor the house as well (not saying you did this, but others might).  So buyer beware on these types of things.  It's not very hard to rig a deck so that the player wins less than he should, but still wins close enough to the right amount that he doesn't notice.

[BCEmporium]

There wouldn't still be enough, playing 1 mil hands, by the theory of large numbers it would resemble a game tendency, however it would take a while until 1 million hands get played and that tendency shows of, meanwhile SD will call the shots and it may be to the house... or not.
Therefore on this kind of table games, I'll work towards online poker where the house takes its rake and players deal with each others. Not much to bother there, just keep an eye if the things go fine and if all-ins are well distributed.

[tomcollins]

There wouldn't still be enough, playing 1 mil hands, by the theory of large numbers it would resemble a game tendency, however it would take a while until 1 million hands get played and that tendency shows of, meanwhile SD will call the shots and it may be to the house... or not.
Therefore on this kind of table games, I'll work towards online poker where the house takes its rake and players deal with each others. Not much to bother there, just keep an eye if the things go fine and if all-ins are well distributed.

For the 1 million hands, you certainly could get a good idea that the game appears to be fair.  It shouldn't take that long to simulate (maybe a few hours at most).  If you are putting your money on the line in the house, it seems worth it.

Even then there are a lot of considerations.  You want to run a fair game.  There have been exploits in the past where you could predict what cards were coming due to an improper RNG.  Players can cheat and collude with each other.  There are potentially a lot of troubles.  There's a reason why the major poker sites all have multi-million dollar software budgets.

Best of luck!

[BCEmporium]

Players will always try to cheat, it's the role of the house to ensure they fail on the attempt.
With poker and low stakes, to not drag in those "cheating sharks", I believe I can put up a pleasant online poker. Players colluding is however a harder issue to deal (specially if they don't use the same IP Address), but that's something for other players in the table to see.

An issue to not need that mils budget is to not run mils tables. If stakes are too low to be "cheating profitable" they should keep their hands off (I believe).

[tomcollins]

Players will always try to cheat, it's the role of the house to ensure they fail on the attempt.
With poker and low stakes, to not drag in those "cheating sharks", I believe I can put up a pleasant online poker. Players colluding is however a harder issue to deal (specially if they don't use the same IP Address), but that's something for other players in the table to see.

An issue to not need that mils budget is to not run mils tables. If stakes are too low to be "cheating profitable" they should keep their hands off (I believe).

Cheaters gonna cheat.  I've played counter-strike for free and people cheat.  As long as you are monitoring things to make sure you aren't paying too much, players will have an interest in making sure they identify anything fishy, that should help out.

With a table game, no one is interested in protecting the house except the house and good Samaritans.  Players must also trust that they are getting a fair game, and with no 3rd party audits or checks, it's a matter of faith that the programmer did everything correctly and is not devious.

If there is anything else you need from me to help, I am willing to give it a look.

[tomcollins]

I want to thank BTEmporium for opening up his test server to me.

Based on what I have currently found, I think there may be a flaw in the shuffling algorithm used by php to shuffle arrays.  I need to investigate further and use a larger sample size, but there's a good chance that there is a flaw in it where certain cards are more likely to be in certain positions.

I'll run some tests tonight and report back.  I believe that BTEmporium is trying to run a fair game and is letting me help find any potential problems.

The payout problem with the current rules left a gigantic player advantage (6.8%), which means losing a lot of money over and over is very unlikely with a fair deck.  If there was anything that was not fair, it likely was not due to anything intentional by BTE, but by a flaw in php.  I'll update this thread with any findings I have.

[luv2drnkbr]

Yeah, with the numbers you PM'd me, it's getting up to just under 5 standard deviations, which is significant.  Also, BCEmporium, regarding collusion for online poker... There are many forms of cheating that you can and should worry about.  Collusion isn't one of them.  It's not possible to stop and therefore you shouldn't try.

[eturnerx]

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

Keep the stakes low on games until they've run long-enough that you're confident that your code is not exploitable. Place cash-out limits and/or cooldown times before winnings can be cashed out to give yourself time to investigate any large wins that look improbable. Even B&M casinos start watching players who seem to be winning too much. As they leave they'll have casino staff delay them while security reviews the table cameras for anything fishy. A common tactic is to make anybody cashing out above a certain amount to come to a private office - make them wait for the duty manager (who's in a meeting / other delay etc...)
Also consider bringing in help. It'll cost, but worth the peaceful sleep to ensure that the shuffle algorithm are good.

[luv2drnkbr]

Even if I'm a "pioneer" and still have some dusty-BTC, I don't have a limitless supply of it.
Being alone also makes things hard, as I've to sleep from time to time leaving the casino on its own.

Keep the stakes low on games until they've run long-enough that you're confident that your code is not exploitable. Place cash-out limits and/or cooldown times before winnings can be cashed out to give yourself time to investigate any large wins that look improbable. Even B&M casinos start watching players who seem to be winning too much. As they leave they'll have casino staff delay them while security reviews the table cameras for anything fishy. A common tactic is to make anybody cashing out above a certain amount to come to a private office - make them wait for the duty manager (who's in a meeting / other delay etc...)
Also consider bringing in help. It'll cost, but worth the peaceful sleep to ensure that the shuffle algorithm are good.

Except in casinos, you can still just walk out with the chips you've won.  Unless they have proof of a crime committed they can't hold you.  Then you can come back later and cash out the chips.  If you're a card counter and being hassled, you simply look the security guard (or suit or whoever is holding you) in the eye and ask them "Are you detaining me against my will?"  They'll let you go immediately.

As a business practice BCEmporium should always pay out player money.  If there's a flaw in his site, it's not the player's fault, not is the player cheating by merely playing a poorly programmed game.  Your idea about only allowing smaller bets on questionable games is a good idea, and I think that should be the way to handle the situation.  But not paying out because the game was flawed is unconscionable.

[tomcollins]

Yeah, with the numbers you PM'd me, it's getting up to just under 5 standard deviations, which is significant.  Also, BCEmporium, regarding collusion for online poker... There are many forms of cheating that you can and should worry about.  Collusion isn't one of them.  It's not possible to stop and therefore you shouldn't try.

I ran the numbers and it was 227,000:1 against what happened for 3 players to lose 15, 15, and 30 bets at that game with the incorrect payouts.  This means beyond any reasonable doubt, the game was rigged (likely unintentionally, but still not a fair game).

I'm hoping that BCE does the right thing and refunds my money for playing on a rigged game.  It would let the entire Bitcoin community know he is committed to running a fair game and if a problem is found, he is willing to come forward and repay players when there is a mistake.  It would speak very positively for his casino that as a pioneer, there will be bugs, but if they harm the player, the player will not be taken advantage of.

[BCEmporium]

You've full access to the source code, we both played with it and we both lost. I see no riggs there and even out of such "unlikeliness" the bugs were in favor of the player, not harming him.

[tomcollins]

You've full access to the source code, we both played with it and we both lost. I see no riggs there and even out of such "unlikeliness" the bugs were in favor of the player, not harming him.

227,000:1, but it's impossible that it's rigged.

The bugs we found *were* in favor of the player.  Quite severely.  Yet the player still lost in most simulations.  Not only lost, but lost a fairly large amount.  This makes it far more likely that an even bigger bug is still present and harming the player.

This is incredibly statistically significant proof that there is something not right in the game.  Just because you don't see it doesn't mean it doesn't exist.  There is a >99% chance of something incorrect going on harming the player, and <1% chance that we were just really unlucky.

Yet you are taking the stance that the <1% chance is much more likely.

I urge you to reconsider.

[BCEmporium]

Next to the .php you've the matching .phps, follow it and ran it over... the simulation I got on log.txt was playing with that code.
If you find something that was rigging the deck let me know, other than the deck rigged, if you were out of luck I don't see a reason to refund. And it's not just being stubborn, but if I start to refund each time a player goes down on luck I rather close all down now, as I'll attract all kinds of crooks to that casino «Cool! A casino where if you find the edge shifted and don't get away with it, you get a refund»... get real!

Also I must noticed that you saw a bug, told about it, and I thank you for that. The guy that found the bug on VP let me know nothing and when noticed I fixed the 4x double bug just cashed out and vanished. For that I may give you some credit still not understanding why you deposited and played while I was re-checking the code. Refund; if the deck ain't rigged: no way!

[tomcollins]

Next to the .php you've the matching .phps, follow it and ran it over... the simulation I got on log.txt was playing with that code.
If you find something that was rigging the deck let me know, other than the deck rigged, if you were out of luck I don't see a reason to refund. And it's not just being stubborn, but if I start to refund each time a player goes down on luck I rather close all down now, as I'll attract all kinds of crooks to that casino «Cool! A casino where if you find the edge shifted and don't get away with it, you get a refund»... get real!

Also I must noticed that you saw a bug, told about it, and I thank you for that. The guy that found the bug on VP let me know nothing and when noticed I fixed the 4x double bug just cashed out and vanished. For that I may give you some credit still not understanding why you deposited and played while I was re-checking the code. Refund; if the deck ain't rigged: no way!

How could I possibly prove that the deck was rigged?  Every piece of proof I've given (php shuffle bug, empirical evidence, etc...), you claim it isn't good enough.

I found a problem that rewarded the player too much, and I LET YOU KNOW IMMEDIATELY!  I am not trying to scam you.  I am not the guy who took advantage of your flawed logic.  Do not take it out on me.

You claim it is bad luck.  But be honest with yourself, it is much much more likely that the deck was unfairly shuffled (http://bugs.php.net/bug.php?id=18401) shows that it was broken.  This exact problem favors the house by giving the player lower cards than the house more often.
If you want to run a buggy casino that might be rigged, might not be, but there is no recourse, you will get very few players.  If someone finds an exploit, rather than telling you, they will play until you have no money left to pay out.  Especially when you treat your honest customers this way.  Your reputation is not worth it.  We are talking about 15BTC.  You offered a bet of 10BTC in the game, so it's less than two of those bets.  Did you even have money to cover a player winning (say I got as lucky as you re describing but was betting 10BTC each time, I would have been up 300 BTC, would you have paid out?)

I noticed that the test server now is running much different results.  Did you update PHP to include that bug fix?  Did something upgrade on there?  It is an impossible situation to prove at this point.  I can only look at likelihood that such a situation could have happened with a fair deck.  The odds are incredibly high (277,000:1).  You'll see on the test server, whatever changed since last night, the player wins almost all the time.  So did you upgrade it to fix the problem and then try to get me to shut up?  Because that's what it seems.  277,000:1 vs. buggy code (and you already have bugs everywhere, php had this bug before, so we know there is a high possibility of it).  Be realistic.

[BCEmporium]

No, I did nothing to test server, it is today what it was yesterday. No updates made, nothing changed there. If the results come different it may only mean your luck has changed on drawing it.
Also I could draw within less than 10 tries, didn't took 200K tries to get it, simulations where the player was down to -15 or less by 50 hands played.
That bug was from a CVS version of PHP back in 2002, PHP5.2 is far younger than that, the other bug was from 2000 and PHP 4.0.1.

Under your logic, folks winning lotto should be returning the money, as the odds against winning such thing is over 50,000,000:1... and still sometimes happens.

And you're applying gambler's fallacy there, you're stating the odds after 500 hands assuming you'll play 500 hands when you can well be down at 50 or 100, each time gamblers' gamble it also counts how much or how longer his chip stack will hold. Otherwise that "lose and double" Blackjack "scheme" would work, as sooner or later you'll win a hand, question is if you have a limitless stack to hold that long.