Topic: Decentralised Gambling Game vDice Announces Crowdsale - page 2. (Read 4730 times)

Decentralized app which rely on centralized services, this way it is not safe for players nor investor.
You should postpone your ICO 'till you solve those issues which RHvar pointed out.

Participants in the vdice smart contract bear a small amount of risk from the
‘house’ being a bad actor, and from a bad actor internal to Oraclize.

I believe that my summary is quite accurate:

which is confirmed by vdice where he explains the reasoning behind the limitations, and says that some will hopefully be improved -- and some of the tooling will be improved as well.


The real "problem" right now in current provably fair gambling is that:
a) You need to trust an operator with your money (until you withdraw)
b) If they do cheat you, and you detect it, it'll be your word against theirs

So there's absolutely a lot of potential to improve the current status-quo. But unfortunately vdice is (currently) a step backwards, because it's not even provably fair at the moment.

And even though I strongly dislike ethereum, it's actually probably a good platform for making trustless gambling practical. (It's possible in bitcoin too, but the UX would be horrible because you'd need a very complex custom wallet)

Since I'm not a developer, could you please tell me whether or not the player is exposed to any risk of the 'house' being a bad actor.

I've read your response, and I think you're just explaining why you're doing what you are.  Not changing it.

I don't mean to take anything out of context, I'm just trying to keep my question as direct and simple as possible.

Nice of you to cherry-pick. I note also you are not a developer.
So you are just taking things out of context to try and make us look bad.

Anyway, I think we already answered to all the major points. But again.

----
1- "Replay Risk"
the very reason why the authenticated JSON-RPC APIs of random.org are used, is because of the "requestsLeft" field which is returned by each API call response ( https://api.random.org/json-rpc/1/signing ). This field content is tied to the API credentials specified in the query and is there to indicate how many requests are left in a given day.
If we check all the TLSNotary proofs published on the blockchain (which contain the whole API response!), an independent auditor can verify whether any subsequent number in the "requestsLeft" fields is missing - when that happens, the auditor has a good indicator that something wrong happened (either on the Oraclize side - which sent more requests than expected - or by any external party knowing that specific API key (vDice itself & random.org)). Of course this doesn't say much about the intent in itself (can just be some failure in the HTTP request, which had to be sent again), but in general it provides some level of security against replay attacks.  
----
2- "setConfig"
Oraclize are updating on-chain contracts in the coming days to support this. It's here for forward-compatibility and enables arbitrary Oraclize flags to be enabled/disabled. The very reason why the vDice contract needs it is to enable the "zero-confirmation query precomputation" feature.
----

Is this true:

Participants in the vdice smart contract bear a small amount of risk from the
‘house’ being a bad actor, and from a bad actor internal to Oraclize.

I understand also that you run a competitor service.
So everything makes a little more sense now.

I suppose everyone here knows you're a competitor.
So they will keep that in mind when reading your negative opinions.

22:49 TheBoyzzz: What other gambling sites are there?
22:49 Ryan: There's lots, I'd recommend checking out the bitcointalk gambling section
22:50 Ryan: and having a look, and seeing what people think of them etc
22:50 Ryan: The biggest by far is primedice.com
22:50 Ryan: the one with the highest max-profit is betking.io
22:50 TheBoyzzz: Thank you I will have to check them out
22:50 Ryan: but checkout bitcointalk, it's the best place to start

So the tldr is:

The site has an extremely weak trust model, significantly weaker than existing bitcoin gambling sites:

* random.org  can undetectably cheat (by picking any number they want)
* cloudflare can cheat, but if they do random.org will be able to detect it (and it'll be CFs word against random.org)
* oraclize can cheat, but it's semi-detectable (there's no tooling offered to detect it, but it's checkable, and oraclize has plausible deniability)


It is centralized by every meaningful definition. It uses a decentralized contract, to communicate with a centralized oraclize server, which sends a message through a centralized CDN (cloudflare) to communicate with a centralized random number generator (api.random.org).


AFAICT this isn't even a serious project, some low-hanging fruit like checking api.random.org's signature is not checked (which would remove the possibility of cloudflare being able to cheat). They also are buying reddit upvotes for 0.006 BTC each, and a bunch of "press releases" to promote the ICO.

Good luck, I guess.

Here is our formal response as to technology decentralisation, fairness, trust etc...

The game works and the code is well tested. You can review it. It's all public.
There is no need to be aggressive and start making wild, unfounded accusations. Let’s keep it civil please!

We have some of the finest developers in Ethereum on our team.
Our coders and game are live, working and can be verified. We are obviously legitimate.

Now, I have no idea why you are posting the same questions, over and over, in EVERY forum.  Huh

Requesting to kindly keep this just one forum.
It's really annoying to have to go and paste the same answer over and over again.

Anyway, these concerns are addressed in our 3rd Party Audit by Peter Vessenes.
You can read that here: https://blog.vdice.io/wp-content/uploads/2016/10/vdice_game_code_audit_october_2016.pdf

It's no doubt that you have the right to make a comment but it looks like you're enjoying making caustic remarks about other people and finding some fault . If you don't like this project or doubt that you could make one yourself. Just my opinion.

Decentralised Gambling Game vDice Announces Crowdsale

NewsBTC recently got the opportunity to interview Jason Colby, the lead developer of vDice, the world’s first fully decentralised gambling game. As we dwelled into the conversation, Colby introduced us with many aspects of their new platform...

Link

Really the issue is what RHavar wrote it's not truly decentralized if using centralized sites. I wish I could offer a way to actually help solve this dilemma but it's above my pay grade. Good luck

I have =)



Sure, I'm merely asking some questions which you aren't giving a straight answer to =)


This I have no doubt


Because you have been ignoring my questions for days, which make me believe you are hiding something I would think "blockchain nerds" like yourselves, would be happy to discuss things on a technical level



Sure, I'd be happy to keep it here if you reply to me here.


However, AFAICT your contract never actually checks the "requestsLeft" field or the ids. Am I wrong? You also provide no tooling to check if any are skipped. Furthermore, this does not provide protection against oraclize making 2 or more requests at the same time, and re-arranging them. I would assume a properly designed contract would have an explicit checks for the id that it expects, and only accept a result that matches the one it expects?

Furthermore, using a service like random.org seems backwards, because there is absolutely no guarantee they're giving you a fair result. Contrast this provably fair bitcoin gambling services, where a cryptographic proof exists that the number was fair.


Why do you verify the TLS, when api.random.org actually provides its *own* signature. Checking the api.random.org signature seems to be the correct thing to do, not the TLS one. By verifying the TLS signature instead of the api.random.org one, it just introduces more opportunities for a party to cheat (notably: cloudflare, which the requests are going though).


Well, then it's not really provably fair as a player/investor has no way to distinguish being cheated with "http request failure"


Again this is nonsense. You have 1 decentralized part (ethereum contract) and 3 centralized single-points-of-failure (orclize, cloudflare, random.org). Players have significant less protections than playing at a current bitcoin gambling site, with a better user experience. I fail to see a single*advantage that your site offers a player, other than affording you the possibility of getting rich with an ICO