So would be 1 confirmation enough?
That will depend on a number of factors. For an online gambling site in which the player's identity isn't known, then there is a potential to profit from double spending. If there could be thousands of dollars to gain from double spending a payment that already had one confirmation against you then know eventually someone will succeed when attempting that.
The reason retail merchants can today accept a bitcoin with no confirmations or just one confirmation is because there is little or no profit potential in attempting to double spend, and the customer isn't anonymous if making a purchase in-person. For instance, you won't double spend your dinner tab without the restaurant being able to remember who you are. And since double spends attempts frequently fail if you have to make ten attempts before attempt eleven is successful then the restaurant still makes a profit when averaging the one free meal among eleven visits in total.
SatoshiDICE protects against this by including in the payout funds from the wager transaction itself. Thus if the wager never reaches six confirmations neither will the payout transaction.
The challenge though is to not let the game player know if the wager was a winner or not until after at least one confirmation. SatoshiDICE holds off on this for some wagers until there is a confirmation so that a player isn't trying to double spend the losing wagers.
