In regards to "keepinquiet"'s rants...


Short story:

(Side note added: No money was confiscated from him other than during the double-spending attacks, which was actually returned to him. 100% of his losses were incurred during several million bets made gambling).

(For those paid to write articles but who do not realize they are part of the extortion: If I do not pay him, "We know I have at least 144 [BTC] sitting in the three withdrawal addresses I used today. The other play money I have can buy one hell of a lot of sponsored ads on bitcointalk, reddit, cryptocoinnews, newsbtc, zero block, and lets not forgot twitter.")

I'll be updating the API this week The API has been updated for the conspiracy theorists =P But this is just a more complete picture of what this guy's been doing on my site.


There are more emails, but these are relevant.


Subject: 	Re: Message
Date: 	Tue, 13 Jan 2015 00:26:21 +0000
From: 	99.9% Dice Support
To: 	sklep sklep


Hi,

Username: 22106642
Password: ...

Jake

On 1/12/2015 11:59 PM, sklep sklep wrote:
> Quite reasonable, thank you. I actually found a bunch more which I guess you never noticed because I never did anything with them. Deposit, withdraw. When I did all the math I came up with 10.97 which seems to mesh up with your numbers. The rest looks pretty accurate to me. Thanks for being reasonable, and it won't happen again.
>
>
> On Mon, Jan 12, 2015 at 5:27 PM, 99.9% Dice Support  wrote:
>
>     Hi,
>
>     I did these calculations quickly, it might be off by a bit. I also did not do thorough research to find all your transactions - just the ones that caught my attention.
>
>     I see about 10.9 BTC in transactions from you:
>     0ED65987869F39AB1D569B31C996A66EE4ECDF45DD47AEE8FD59D02BBD6293F4   
>     D393CE256A6BEBB9EA3D8B97290FBA9BD5AEAF50930308CDAEE739A2D7B72659   
>     EF95719F5300ACD668148B2C1C07E5F4B8117059B26607763D116ABAF725B9CF
>     AF94A5DED33E1EBB12D7591CC443337C39286CB04D1C07E1F5B60F117E01BC2F   
>     8EF05219FBF4190CB4DC79F42B9E71250DC7A9CF962AC4D1FC27598258E4FE05   
>     F87E58A9C2129F03654144FA59ADD52B672D0214970F0C9E923271856E20B664
>     41821BE85A4037EA73DA27E48544E3621BED2100772597B6A58884B06D5B4D47   
>     0A07F6DC42DEC4696747EA2A5A05E889176C774F7B4115C988E2CF44E2D1D9E2   
>     A2CB5C7B0D601340BFE01AF31E74551502BFF3FCAC5ECB7E25146DC8C3699A20
>     7450A910A71546DF13251D6E45D7C5D3258716C3ABCA7267844C87F469D63C52   
>     EA10CCFE49C905D8AE1F7EC1F191FEDE9229B471F772BE4B055A8B422D880C46   
>     4BABC137075B5D6F84297281C26CFB0844C91FABAF579C182AA22D316E62ED88
>     34699E03B7F308C7339321B8679172B568E751BF0D64B3C96E7105DCCB5849B4   
>     7BBE2DB03B25F6EA0F3A86AD0F5127B623A124F35642626FA854D19295F20D68
>
>     Only 8.89 BTC were confirmed. (All were attempted as double-spends)
>
>     I see other ones like b093cadc1b3952f8a96e7987bc8d7c6913a9878b068ae395269c8dccb331b4df which you deposited to 22096057 and then withdrew, but they seem irrelevant to this particular discussion, because neither the system nor I took any automatic or manual action to intervene with those.
>
>     All of these transactions were credited to your various accounts. After your attacks stopped, I did some cleanup and removed the following amounts from 3 accounts which still had coin:
>     .02109088 BTC from account 22095165
>     .2 BTC from account 22096075
>     .2 BTC from account 22096113
>     Total = 0.42109088 BTC which I removed.
>
>     One of the accounts successfully withdrew 0.15 BTC. You have 7.49256643 BTC in withdrawals which will never complete (cancelling them now)
>
>     The accounts related to the transaction hashes above are:
>     22095131
>     22096113
>     22094484
>     22095165
>     22094810
>     22094977
>     22094484
>     22095593
>     22095072
>     22095933
>     22096075
>     22094871
>     22096029
>     22095177
>     (These are the only accounts I took any action on)
>
>     10.9 spent - 8.89 confirmed = 2 BTC double-spent because you lost them gambling
>     8.89 confirmed - 0.15 withdrawn = 8.74 BTC in our wallet from you
>     8.74 - 7.49256643 attempted withdrawals - 0.42109088 removed from accounts = 0.82634269 lost gambling with money that actually landed
>     2 lost gambling and double spent + 0.82634269 lost gambling on confirmed deposits = 2.82634269 BTC lost while gambling total
>     8.74 in our wallet - 2.82634269 BTC lost gambling = 5.91365731 BTC seized.
>
>     So, all in all, for the accounts on which we took action to intervene, we seized 5.91365731 BTC during your attempt at theft. These are not being "held hostage", as you say. They were seized during your commission of a crime.
>
>     I don't intend on giving you money back for what you lost gambling. But I'll offer to return 5.91365731 BTC to you, and we'll call it a day and go our separate ways.
>
>     Reasonable?
>
>     Jake
>
>
>
>
>
>
>     On 1/12/2015 10:37 PM, sklep sklep wrote:
>>     Didn't intend to be difficult, just did not notice anything about emailing you until this morning. Truth is I was messing with peter todd's replace by fee tool (I thought it would be an even better way to tumble some coins - add some confusion and anonynmity to the transfers by having some go bad and then others take their spot, and well, seeing if I can break shit is a hobby, so, I messed with the double spend tool) and if my logs are correct, three 1 BTC payments to you were actually double spent. A few others I was playing with the tool and the parameters and were not. Then I was messing with it further, and you can clearly see I never actually sent the second transaction.
>>
>>     So here's the deal. I'm highly involved in crypto. Not saying what or where, just that I know stuff, high up the ladder on a moderately known crypto related site, and I'm not some jackass kid trying to rip you off. Of course, take that with a grain of salt, I WAS sending double spends, but never outrageous amounts (look at the change that was sent, was working with large sums, never intended to try and do massive sends). Also, in my role involved with crypto, I have a lot of respect for someone who's honest when confronted with what they did. Not saying you should be, but the reason I'm writing this is your response is pretty calm and honest, and that caught my attention. Most people online nowadays are lying childish pricks. So, you've got my respect there (if you even care. I mean, hell, I *was* fucking with your site).
>>
>>     Anyway, rambling. I shorted your wallet 3 bitcoin and caused you headache and crap. You have a crapton of my legitimate bitcoin held hostage. No terms and conditions (seriously, write one, I'd have little ground to stand on if a 'dont mess with us' policy was written), and quite a few of the held coins were not successful and didn't cause a loss, and a bunch were not even sent in any way to double spend (without the second transaction sent).
>>
>>     I just tried to add up what was sent and without running it all through a script (since I was also sending myself a ton of tests to see what actually worked and what did not) and looking at what my wallet is short, I think I'm short ~13.6 BTC.
>>
>>     Three are obviously yours. Double spent. Wallet short. Thats 10.6 of my bitcoin you have that while I understand you wanting to say screw you asshole, they are technically mine, and you keeping them would be just as bad as me screwing around with your system. What I propose: Obviously ignore the winnings on the few accounts that won some coin (and again, never sent the second tx to try and double spend), and split the 13.6 (or whatever the number actually is. I counted 20 sent, but without checking each txid I'm not sure which are you and which are my own addresses, I'll do that in a bit to be sure. What's the number you have?). Thats the 3 that were legitimately screwed out of your system, and 3.8 BTC as an apology and for your time and trouble. Send 6.8 back. It seems fair to me. Doesn't even count the winnings left on the site, which I believe was about 1.5-3 BTC.
>>
>>     Obviously you don't have to send squat back, but, hoping we can both be adults here. I screwed with your site, caused a small loss, and am more than willing to repay that, plus another 3.8 for your trouble.
>>
>>     Writing like that did earn my respect and I won't be screwing with your site again. I'm not a total douche. I'm... gray hat... like to learn new crap, screw with stuff, see how things tick, and occasionally break some rules (laws? heh) but have no interest in screwing honest people.
>>
>>     Thoughts? If thats cool with you, an address you can use is: 1FkHEhhk49mFsZk5zPB1781ePqjsWj5QsL
>>
>>     Thanks in advance, regardless.
>>
>>     Tom
>>
>>
>>
>>
>>     On Mon, Jan 12, 2015 at 2:29 PM, 99.9% Dice Support wrote:
>>
>>         Hello,
>>
>>         Thanks for getting in touch.
>>
>>         >From time to time, there are people who attempt double-spending attacks in an effort to steal money. Your initial attempts were successful, which seemed to encourage you to attempt several more. Unfortunately for you, countermeasures were already in place.
>>
>>         Usually, I find a way to get in touch with the attacker. I let them know that their attempts will fail and their money will be seized. And usually I give back money from their first failed attack, which seems to go over well - they give a nod, handshake, and leave. Or whatever the email equivalent of that is.
>>
>>         You were difficult to get ahold of until now, long after you've stopped your attacks.
>>
>>         Suggestions?
>>
>>         Jake
>>
>>
>
>

    
Hello,

Alright, I've had some time and I've read through the rest of your email.

I do have some compassion for you, given the amount you've lost, and because of that, I won't be writing to you what initially went through my mind, hearing this email's threats and accusations.

Hopefully what I say now is rational, and can be taken rationally. And I do say it with respect - because from what you've written, you relied on some information that isn't quite true, but if it were, you'd be justified in your accusations.

First thing's first: Provably fair. I already replied to you in a previous email. The bet ID is not part of the provably fair calculation - just the server seed, the client seed, and if applicable, a bet # (if it's part of a batch). At the time of the bet, all 3 parts can be known (though one only by the hash obviously).

Another concern you had was that the server seed changes with each bet and when you requested the server seed, your request rate slowed down. Well, it would slow down a bit because it does require an extra round-trip to the server, yes. But it's not a delay built into the system, of course. The call to GetServerSeed is not rate limited - it can be called as fast as you're making calls to place bets.

You raised the point about X number of BTC wagered overall times 0.1% should equal the overall profit for this site. That's quite untrue. It's a way thinking that I think you've fallen into yourself - but there's a simple truth about the house edge. It really doesn't matter what the house is in most cases - people will continue to play until they've lost. This site could have been called 100dice, with no house edge whatsoever, and it would be profitable. The user's average profit before they lose would be slightly higher, but they would still continue to play until they've lost. Perhaps one of the secrets of our success is that we provide a simple interface that allows for very quick betting, both single bets, or 200 at a time, or completely automatic through the API - it makes it easy to make lots of bets.

The fact that people tend to play until they've lost is by no means an insult against those players, though it might sound like it. Gambling should be fun! Many people just like to keep having fun as long as they can!

I've seen you several times come to the site and win big. But you come back again and then lose. You've had a lot of ups and downs, but too often you played until you lost, unfortunately. You have over 6 million bets on our site.

Over 6 million.

Even with "the perfect strategy", at 99.9% house edge on each bet, how does one do 6 million bets and profit? Thinking there's such a strategy is just wrong thinking - it's the fallacy of many gamblers. Gambling should be fun! Come and play, and you could win or lose, but have fun! Do you realize that your biggest wins were when you were just dicking around with single bets on the site? When you first came here you made only a few bets and ended up 20 BTC richer right off the bat.

In any case, let's take some time and let the issue cool off. Up until now, our conversations have left me with the impression of an intelligent, respectful and honorable person, and I do not think that will change despite this bump.

One thing does strike me about your email. "like I mentioned before, I'm pretty connected in the crypto world". I don't believe you've ever said that to me. But someone recently did - a thief who attempted to steal bitcoins through some pretty massive double spending attacks. My countermeasures were effective and most of his BTC was seized by me during his crime spree. Despite him attacking me, despite him committing crimes against me, I gave him his money back. A burglar who broke into my home with the intent to take everything I owned dropped his wallet - and I returned it to him. This was you?? [inputs to deposits were also matched up with double spender]

Jake


On 1/28/2015 5:31 AM, Ed Benckert wrote:
> So. As you can probably see, I've been doing a ton of betting using the
> API. And I've been losing an absolute fuckton of bitcoin. I've spent
> days working on programming some betting bot that has even the slightest
> edge. Funny thing math - you can't beat it. I've done all sorts of funky
> things that, in the end, always work out to "You're gonna lose this x%
> of the time" - even if it means the most unlikely things, like rolling
> over 33 (66% chance of 'failure') 47 times in a row. Yep, thats a
> .000000669% chance. 1 in about 1.5 million odds. I've seen it happen, at
> least 4 times. Not all on your site, but in my simulator, testing things.
>
> Anyway, having realized math cannot be beat, and realizing no matter how
> "tricky" I get, the odds are the odds and there is no way around it, I
> decided to take another tack. Lets try and make really big bets,
> minimize losses as much as possible, have huge risk (possibly losing 32
> BTC on a 2.5 btc bet), but it's mitigated by the fact that I'm finding
> ways to make it pretty damn rare, and offset by my winnings.
>
> So I devise a plan. I test it, extensively. The plan: Bet 2.5 btc at
> 49.95% odds, and double it til 10 - if I lose the 10 then some pretty
> complicated stuff happens that tries to get it back while minimizing
> losses. But, end of the day, 87.5% of my bets should pay off at 2.5 btc.
> The other 12.5% - well - thats complicated. About a third of them pay
> off the 2.5 BTC, and some, rarely, if the numbers work out just right,
> 7.5 BTC. The other 2/3rds lose in some fashion, anywhere between 10 and
> 37.5 BTC.
>
> Run it 10,000 times and you either wind up with a few hundred BTC, down
> about double that, or, in a few funny displays of balance, ± 5 BTC of
> breaking even. End of the day - math is working.
>
> I loaded my test program with "100 BTC" and ran it. 5 'batches' of runs
> at a time. I would, about 75% of the time, win 12.5 BTC (2.5 x 5). The
> other 25% of the time, I'd win 0-5 BTC, or lose between 5 and 17.5, and
> on some really bad runs, 70 BTC where it was bad and hit a few of the
> -27.5 BTC losers.
>
> But, at the end of the day, when I sat there, for hours, loading 100 BTC
> in and running it, 5 at a time, though I would have losses, I was able
> to pull back and break even, or profit quite nicely from it. Oh, yes,
> there were a few disasters.... load up 100 BTC, then lose 17.5, lose 10,
> and then wham - lose the rest. Don't think I'm telling you I've found a
> way to beat math. My whole point was to try and make a few bets, not
> thousands like my other attempts, and 'get out' before the inevitable hit.
>
> So, before I go and get stupid, I load up my live betting api, with 3.26
> BTC left in it from yet another unbelievable, massive loss. (My luck at
> losing is ASTOUNDING). I scale everything down so that instead of 2.5,
> I'm betting .025 BTC - 1/100th the scale. 1 BTC = the 100 I planned to try.
>
> And, without fail, over and over, I lost. Over. And. Over. Now when I
> ran my simulator, I would lose, absolutely, but it was always controlled
> - like I designed the system to be. I'd win 3-4 batches of 5 in a row,
> then lose 1-2, then win, then lose 1-3, then start another winning
> streak... 4, 5, 6 in a row. Then I'd stagnate for 30 rolls winning then
> losing, barely moving at all.
>
> Yet when I tried it with your API, I lost. Consistently. The "a few wins
> with a loss every now and then" turned into "mostly losses, with a few
> wins thrown in there." Like, almost every bet was a loss.
>
> In all my testing, I never managed to lose 200 BTC all at once. Never.
> Yet, in the span of 10 minutes on 999dice I lost 2 (scaled to that 200 I
> just mentioned).
>
> So then I think - there is NO fucking way. No way. I've literally spent
> hours the last 2 weeks running the math. I know losses can happen, but
> what my simulator showed NEVER worked out once put to the test. And
> before you call into question my rng, I was using raw data from
> random.org, which is pulled from atmospheric noise, and then hashed in
> various ways to be as random as possible. There was no faulty rng here.
>
> So I want to test your "provably fair" system. I start grabbing the
> server seed for my bets. Which, how interestingly I discover - changes
> with every bet. (I mention that because it is utterly impossible to see
> your seed AFTER the fact unless you think ahead and pull it BEFOREHAND -
> not something always visible, but something you need to specifically
> REQUEST. Ill get to that in a moment).
>
> Beings that I don't have access to be able to run the SQL code, and the
> C++ is a massive pain in the ass, I try working it out in PHP. PHP,
> being not overly easy to use when it comes to binary data, was causing
> me some headaches. Copying and pasting server seeds and client seeds and
> bet ids....
>
> Wait a minute. Bet IDs in the hash? You don't tell me the bet ID until
> AFTER I place the bet. And they sure as hell aren't sequential. It's
> REAL easy to formulate a loss by ticking that bet ID up a number or two
> before "setting" and hashing it. What? He won? Lets move the bet id up
> one and check again. Aah, ok, there's a losing bet.
>
> Nevermind the fact the server seed changes WITH EVERY BET, and you
> actually have to actively request it by clicking a button on a screen
> you are NOT usually on when betting, or submitting a second, slower API
> call before the bet is placed. ANYONE who does not actively,
> intentionally, click that button or hit that API, and record the hash,
> has absolutely no way to verify shit. You can generate any seed you like
> and pass it back, and no one has any way after the fact to verify that.
> And since you force us to PULL the hash, you know we looked for it.
> Which could flag all sorts of things, like "Oh shit, he's looking, make
> sure the next bet is more fair."
>
> I'm a long time gambler. I know odds. I've always been stunned at how
> much it's possible to lose on your site. So when I started using the
> API, and developing my own math and odds based betting rules, and
> TESTING THEM EXTENSIVELY, I knew I wasn't just rolling random shit.
>
> Yet, every time I went to use real BTC, I lost lost lost lost lost over
> and over. Astoundingly so. Like 200+ BTC. Losses I have never
> experienced anywhere. So much so I started win-streak and loss-streak
> trackers. On my simulator they'd be relatively sane. On 999 dice I'd
> see, on 49.95% odds, I'd watch this, ROUTINELY, roll by:
> Lose
> Lose
> Lose
> Win
> Lose
> Win
> Lose
> Win
> Lose
> Lose
> Lose
> Lose
> Lose
> Lose
> Lose
> Lose
> Lose
> Lose
> Win
> Lose
> Lose
> Lose
> Win
> Win
> Lose
> Lose
> Lose
> Lose
>
> It was mind blowing. Now it's pretty clear why. Your site APPEARS to be
> legit, it offers all the goods to validate bets etc, yet there's issues
> like the bet ID being part of the hash (something you can change) and
> maybe even worse - a changing server seed that we need to let you know
> we're looking at. You could make up shit all day long, and there's no
> way to prove a damn thing, until someone starts requesting the hash -
> which you know they are doing - and can play nice until they stop.
>
> Anyone using the site is not going to click and record that hash and bet
> ID for 50 bets. The API makes it easier, but once I turned that on, my
> request time slowed down terribly. Funny, that.
>
> So, since there are two GLARING issues that make it so that its easy as
> hell to cheat people, here's what I'm proposing: Give me back all of my
> lost bitcoin. Obviously, only the actual losses - not counting the
> withdrawn winnings. My web account right now says 108.29988339 BTC and
> my API account reports 109.40501507. Thats over 217 BTC that your site
> stole. You know, I've been shady in my past. The thing that always got
> me caught was being greedy. I'd have NEVER noticed if the losses were
> not so astounding.
>
> You refund me back my 217 BTC and I'll disappear and you'll never hear a
> peep from me again. I rightly don't give a rats ass who you steal from.
> Just don't steal from me. I'm not making some asinine internet threats
> about finding you or hunting you down or any of that shit. Just return
> the BTC, and I disappear and leave you alone to keep making money.
>
> If you DONT return it - like I mentioned before, I'm pretty connected in
> the crypto world. Knowing people can get the word out and have your site
> exposed everywhere... and I mean everywhere... and while you may feel
> like refunding my 217 BTC is a massive cost, it's nothing in comparison
> to what you make by keeping your site open. You are one of the most
> profitable sites out there - I've looked. 552k BTC wagered, times .1%,
> thats a profit of... 552 BTC? Since I assume my 217 isn't profit and is
> in the 'bank' to pay out winnings, thats a drop in the bucket for you.
> Keeping your site open I'd imagine is a lot more valuable.
>
> And given the propensity of assholes on the internet to be blowhards and
> threaten and no one to be taken seriously, keep in mind - I had 217 BTC
> to blow gambling and was ready to deposit 100 MORE. And that's what I
> had as "play money" to gamble. I'm not some script kiddie or 'noob' just
> blowing smoke because they are pissed they lost 217 BTC. I'm someone
> smart enough to know the math to see that the losses I incurred are
> astronomically improbable, then the moment I started to question your
> "provably fair" system, saw the two glaring holes in it.
>
> I don't give a shit who you rip off. You just won't be ripping me off.
> Return the 217 and I'll disappear, and you can go your merry way. Choose
> not to, or choose to bullshit me, and I turn the rest of my play money
> into my new "remove 999dice.com from the internet" project. I've got
> lots of free time and not much to fill it, other than new things I'm
> passionate about. I can see this being one of them.
>
> No need to even reply if you choose to do the sane thing. BTC address:
> 1AaBkT1sCEj12oSEKC6aVjpSpReJoE3o6m. 217.70489846 BTC.
>
>
>



(validation code is provided in several languages)


Hello,

You wrote this email as if you did not read my previous 2 emails to you. Did you not get them?

The input to the formula is the server seed (as a byte array), plus client seed converted to byte array, plus bet # (not ID!)

The client seed is a 4 byte int. The bet # is 0 for single bets ... 4 bytes as well, so 0x00000000

In the SQL sample code, the client seed and bet # are combined into a single parameter called "@clientSeed" - sorry if that was confusing. If you still can't get it working with all this info, let me know - I don't mind working through the problem. Maybe I could create a powershell script =D Everyone has powershell!

Jake


On 1/28/2015 3:48 PM, Ed Benckert wrote:
> In addition to all that I said last night - I've spent hours this
> morning actually trying to get your data to validate.
>
> Server Seed concat'ed with client seed, double sha512 hashed, in ever
> possible way. With and without the bet ID - as your two examples on the
> site contradict each other. The instructions say + bet_id. The SQL code
> does not use it. The C++ code does.
>
> Then I've tried it as strings, as binary, as big endian, as little
> endian, with and without the bet ID, and absolutely NO combination of
> server seed
> e6dcbc65928ac3035e8ea8f5071039218e59b15886297e2ff94663e593f1eb09, client
> seed 839810215, and bet id 15638932668 would ever work out to equal 721889.
>
> So, if you're legit, and I'm just being a huge asshole - clue me in. How
> do I make that validate? I'm not installing a SQL server and I'm not
> installing the MSDN .net c++ compiler. Python, perl, PHP, gcc, g++ - how
> the hell do you concat those strings and make the hash work out.
>
> What makes the MOST sense is convert the hex seed to binary. Concat the
> client seed, converted from integer to 4-byte binary data, then concat
> the 4-byte binary of the bet id. Try with and without the bet ID. Try
> reversing the endianness of all two/three. NONE work out. The bet cannot
> be verified.
>
> Return my stolen bitcoin. I'm not some crusader out to save the world
> from your site. Just want my bitcoin back, since I figured out the
> (quite ingenious if I do say so myself) loopholes you created. I go
> away. I get the bitcoin back, my mouth stays shut, we're both happy.
>
>



    
Ed,

*PLEASE MAKE NO FURTHER DEPOSITS*

I am glad to see that my email got through. My email provider was having troubles all day. I was not sure that it had, because I saw your bets pop back up in the chat room. There's a pending withdrawal of 7.3 BTC or so, which I will release after clicking "Send" on this email.

If I see further deposits, they'll be seized. If they're on new/stealthy accounts that you think I won't know about, they'll still be seized - please don't test what you can get away with - you'll lose your money.

You have no remaining balances on your account - everything that is yours will have been paid out within a couple minutes of this email being sent. I wish you the best of luck earning back what you've lost - but it will have to be elsewhere - not on this website.

Jake




On 2/5/2015 5:17 PM, Ed Benckert wrote:
> Read your other response this morning but I've been busy and havent had
> time to get to email.
>
> As for that - I'm sorry but I don't agree with your assessment that I
> claimed your site COULD be cheating, you reply and say no it's not, and
> I just say ok fine. I said I did some testing and it SEEMS to be ok, but
> thats easily
>
> Three times now I've asked you about it, presented, very clearly, my
> issue about how the hash is hidden until requested, allowing you to
> fudge the numbers. When a user does request the hash, the system can
> stop cheating until the user stops requesting the hash.
>
> Again - I am NOT saying you ARE cheating. I'm saying that it's extremely
> possible, and there's no way to prove otherwise. I find the massive
> losses I had, in direct opposition to true random number rolling, to be
> extremely curious, which is why I started looking in the first place.
>
> My one issue was misunderstanding - you cleared that up. My other issue,
> you absolutely ignored on multiple occasions. I'm sorry - if you were in
> my shoes, and the site admin repeatedly refused to answer, you'd feel
> the same way. Do I think your site cheats? I've no idea. CAN it and
> never be detected? Absolutely. Do I feel it might? Yes - because of the
> way the hash is hidden, and your utter ignoring of the issue when asked
> about it, over and over.
>
> I don't CARE if your site cheats. Like I said - I think it's brilliant.
> Provably fair with credible deniability if it's not. I just don't like
> being the victim of that.
>
> As for being back betting, since we're at a stalemate of me not being
> sure if I can trust you (and apparently, vice-versa) and having lost 200
> some-odd BTC on your site when all the math in the world says I
> shouldn't have, I was attempting to regain some of that. After
> retrofitting my script to ask for the hash on every bet, and having it
> actually validate the hash/secret/roll result on every loss, *I* am
> assured that any possible screwing about on your end is either not
> possible, or at least I'd be able to detect it (which I am sure that
> after requesting the hash, would never actually happen). "Oddly" enough,
> after implementing that, rolls I make on your site are actually matching
> up to the probability I've calculated.
>
> Or maybe it's just a card counting issue. Someone with big pockets who's
> smart enough to know what to bet. Thats my problem in the first place -
> I KNOW what the results should have looked like, and they didn't. At
> all. To the tune of -200 BTC. Big pockets and not looking is great - bet
> all I want. Big pockets and being smart, AND watching the hash - and now
> you'd prefer I didn't bet? Color me shocked. Again, absolutely
> everything thats happened since I emailed about the issue just screams
> "yep, I cheated you out of 200 BTC"
>
> As for the hacking issue, it seems we're at another stalemate. I think
> your site runs dishonestly until someone looks, I ask, present
> verifiable proof that it's possible (and funny enough - impossible to
> truly prove), and you ignore the question. On the other end, you think I
> tried to hack your site. Like you, I'm choosing to ignore that question.
>
> Not sure why I'm even writing any of this. You'd never admit to what I
> said might be true, a denial is expected and impossible to prove
> otherwise, and even if I could somehow prove it, you'd not return the
> BTC. So this entire dialogue is pointless. Hence I attempted to win back
> some of what was lost.
>
> Anyway. Work to do. This whole discussion is a waste of time for us both.
>
>
>
>
> On 2/5/2015 11:02 AM, 99.9% Dice Support wrote:
>> Ed,
>>
>> Please make no further deposits.
>>
>> I saw your account back betting again, while I was watching the chat
>> rooms earlier. Given the events in the short time you've been here,
>> I'm afraid I'm not comfortable with you on the site.
>>
>> I wish you the best of luck where ever you go - perhaps try primedice
>> - they are provably fair as well, and very well established and
>> regarded in the community.
>>
>> Jake
>>
>>
>>
>> On 2/5/2015 4:19 AM, Ed Benckert wrote:
>>> Never heard back from you, which is about the best way to avoid an issue
>>> instead of deal with it.
>>>
>>> So I did a lot of tests, both offline, and online. Without requesting
>>> hashes, running a few million bets to see how it reacts. Much to my
>>> surprise, the percentage was spot on.
>>>
>>> I'm not sure if it was the most absurdly bad luck ever, or if something
>>> changed on your end after I sent the last email you ignored, but
>>> everything seemed ok.
>>>
>>> I hope you understand my problem here. Odds that made no sense were
>>> rolling. Your site is set up in a way that unless you check FIRST, you
>>> can cheat everyone from here to the ends of the earth. I call you out on
>>> it and you ignore me.
>>>
>>> How does that look?
>>>
>>> I'm still not sure, but I'm man enough to admit I might have been wrong.
>>> Truth is I'll never know. You are obviously very smart. I've run your
>>> numbers enough to know that the limits you have in place are not random
>>> chance, and the site is set up extremely well to facilitate massive
>>> amounts of betting. You could be cheating those who don't check the
>>> hash, or you could be completely legit and have your site set up in a
>>> way that makes it look like you're shady as hell. I might have been
>>> robbed and my IP was flagged to play nice so my tests came back "normal"
>>> - or maybe it was just absurdly bad luck. The shit thing is that with
>>> how you're set up, there's no way to know. Ever.
>>>
>>> Just wanted to followup. Thats all.
>>>
>






First - I never said anything even remotely close to "mafia like" 
threats. I never threatened your life, like you felt the need to say in 
the site's chat room. I never even threatened to do anything but expose 
you and do my best to get your site shut down. Sure, I listed some 
grandiose ways to go about doing that, tor servers and media and 
spending money to accomplish that goal. But Mafia? Threats on your life? 
Come on.

What I DID say was I believe, now more than ever, you're running a scam 
website. Worst part is you are, for the most part, fleecing poor saps 
who are either addicted to it, or are literally begging for money to TRY 
and win something so they actually have something worth mentioning. Have 
you read the bullshit that goes on in your chat room? When I first 
showed up there I saw all this talk of "investing". I honestly thought 
they were talking about investing in a website or some shit. Only to 
find out later, people are ACTUALLY "investing" in someone else to bet 
for them! What?! And then they don't even stand a chance because the 
entire system is rigged?

Your "provably fair" system is utter bullshit and you know it. Its why 
you have not yet once, not a single time, in all the back and forth 
emails, even acknowledged the fact I've MENTIONED it. I'm talking 
lawyer-like skill in skipping past it and pretending it was never 
brought up. It's quite graceful actually. Never actually bat an eyelash 
when confronted with it, and you can never be accused of any wrongdoing.

Let's clear things up a bit here, because, as you keep ignoring the 
entire base of my claim, your version of events is not exactly complete.

I very temporarily "won" a bunch of coins. You said in chat it was 40 
BTC. Going over my deposit and withdrawal logs, it was never that high. 
At no point was my hot wallet over an amount it would have been if I 
were +40. And then the losses started. And kept going. So I moved to the 
API. And despite extensive tests with real random numbers, what I bet on 
your site NEVER panned out and the losses kept mounting. So I stopped 
and looked. And when I looked I saw two glaring issues.

So I fired off a nasty, angry, threatening email, and outlined the two 
issues.

You replied politely that I had misunderstood issue 1, and upon 
realizing that, I wrote back and said, you're right, the site is poorly 
worded, and yes it checks out. However, issue two is still a pretty 
massive issue that bears addressing.

Which you ignored for a second time.

In the meantime I did some testing. Which APPEARED to show that your 
site was being legitimate, however, I was reserving judgement, as after 
accusing you of cheating, it's a simple 1 in a database column to make 
sure it gives correct numbers. Or hell, let's be honest... all it takes 
is 2-3 critical losses in the right place to turn a fair session into a 
massively horrible loss. And 2-3 fudged rolls will in no way skew the 
95.003% win rate of a million rolls.

So, knowing that it's impossible to cheat *IF* I pull the server hash 
FIRST, I retrofit my script to do so, and in addition, automate the hash 
verification for every loss. If I have the hash, and if I set the client 
seed, it's absolutely impossible for you to cheat. So, I can get back to 
getting that lost 207 BTC back.

And, what do you know - in less than 24 hours, pulling the hash and 
ensuring legitimate numbers, I get back 61 BTC, something that has NEVER 
happened in the tens of thousands of BTC I've bet there.

And then I'm banned.

What in the hell do you think I would think? What in the hell would 
ANYONE think? Seriously, let do this:
Math doesn't add up.
I find a huge possible way for you to cheat AND deny it.
You ignore my accusation.
I do testing which seems to show it's ok, but theres really no way to 
know for sure.
So I do the one thing I CAN do to ensure I'm not cheated again, my 
"luck" instantly reverses, the simulations I've run actually line up 
with the actual betting, and I'm winning back my lost coins. And as soon 
as this happens, I'm banned.

Please, for the love of all that is holy... PLEASE tell me that even you 
can step back and say "Oh, wow, yeah, I'd be fucking furious too."

So, I'm banned, for apparently figuring you out and getting my coins 
back, and I go back into "You cheated me, fuck you" mode.

You act like my "mood swings" make no sense and I'm flying off the 
handle. All but two of my emails have been civil. The two times I'm 
flippin pissed off is when I discovered I was being cheated, and the 
second was after I was banned for proving it.

My god man - if you were innocent, all it would have taken would have 
been, like I said in my previous email, "Oh, shit, Ed, you're right. I 
can totally see how that would appear that way! I'm totally legit and 
the last thing I want is to give any doubt about that, I'll fix that 
ASAP." But no. You ignored it. Over, and over, and over again. Now don't 
take that to mean I'd wholly believe you, but at the very least it's put 
a stop to it. I said it 100x now. I know math, and simulations. I know 
it's VERY possible to hit 24 50/50 losses in a row even though its a 1 
in 16 million odds. And I also know that my losses were staggeringly 
disproportional to the wins happening on the other side.

As for waiting a week or two - why? That's plenty of time to retrofit 
the site to make any claims I make appear to be bullcrap. Come on Jake, 
or whatever the hell your name is. (Rumor online is that it's Noah or 
someshit, but that person appears to be 19 and you're too well spoken to 
be 19). You're acting like I'm an idiot. I'm not "flipping out" and 
going to extortion and threats because I lost. I went there because I 
was cheated. And the moment I was able to put a stop to it and started 
winning the losses back, I'm banned. Really? And you expect me to 
believe I was banned because you were afraid I'd lose again and cry 
about it?

There's a simple solution. Return my coin. When I started betting there 
a few weeks ago your site profit was about 1400 or so. Tonight it was 
over 2000. Your system has the bitcoin rolling in. You've got more than 
you know what to do with, and you've got someone who knows what you're 
up to. It's not extortion. I'm not threatening you with baseless crap 
and slander. Your provably fair is absurdly abusable, and I'd wager I'm 
likely the first person to notice.

And you're in one hell of a situation. Return my coin and its pretty 
much an admission of guilt. Don't return it and then you have to deal 
with whatever shitstorm I'm capable of whipping up for you. Neither 
option sounds good, I'm sure.

As for the raped me/didnt rape you strawman argument, the difference is 
I have plausible proof. Your system is set up so well that I'd imagine 
most people who read what I'd write wouldn't believe me anyway. But for 
anyone who stops for a moment and really listens, and looks, the 
possibility for cheating is clear as day, and "provably fair" becomes 
utter garbage.

And none of that even touches on the "I'll confiscate your deposits" 
crap from today. So I play, and lose, and whine about it. So I email you 
and threaten all sorts of stupidity. So what? Who cares? You block an 
email. You mute in chat. So who cares if I came back and lost more and 
whined about it?

Unless you NEED me to stop betting, because without the fudged rolls, 
I'd be able to win back what was cheated away. Up 61 BTC in roughly 14 
hours.

Are you still going to sit there and tell me my claims are utterly 
baseless and without merit? On what planet does that math add up?

And this is one of the emails that gets no response, or if it does, it 
ignored the bulk of it and tells me to go away and you're sorry it 
worked out this way and good luck and all that.

Mind boggling.

On 2/6/2015 2:05 AM, 99.9% Dice Support wrote:
> Ed,
>
> Here's my point of view on all the events:
>
> You started off as a double-spending thief who I showed mercy to.
> Then you won a bunch of coins
> Then you lost. When you lost, you immediately turned to extortion and 
> made credible threats against me and this website
>
> A week or two later, you surprised the hell out of me. Why would 
> someone deposit again to a place you think will cheat you?? But you 
> did. So I responded as quickly as I could by asking you to leave the 
> site. First, gently, which either was ignored or wasn't seen in time 
> because of my email provider's difficulties. The second time I was 
> more forceful.
>
> My concern was that if you ever lost money again, you would 
> immediately go back to extortion and threats, so I was happy to give 
> you your winnings and ask you to leave.
>
> Instead, you responded by immediately going back to extortion and 
> threats anyway.
>
> Your claim is somewhat like "Hey Ed, you're a rapist".  "Jake wtf no 
> I'm not".  "Ed, I think you are - prove it if you're not". There can 
> be no response that makes any sense.
>
> If you wish to go the mafia route, well, do what you're going to do, I 
> suppose. I see it as dishonoring yourself. I would hope that I'm 
> wrong, and you're just blowing off steam. Regardless, if I could make 
> a recommendation from one man with a young son to another man with a 
> young son - and please allow me to - it would be to give yourself a 
> cooldown period before making a decision. Wait a week or two. This 
> website isn't going anywhere, and nothing will have changed, but 
> you'll have had time to think through your actions rationally. One 
> day, our sons will read the dirt online - so instead, let us part ways 
> in peace.
>
> Jake
>
>
>
> On 2/6/2015 6:32 AM, Ed Benckert wrote:
>> Ban ban banny ban ban huh?
>>
>> Oh this WILL be fun. Have an appointment with CCN tomorrow, and 
>> apparently
>> the sponsored story rate for ZeroBlock is $1 per click. Sounds like a 
>> deal
>> to me.
>>
>> Who's in the mood to play?
>>
>> You can state half of the story all you like in chat and mute my ability
>> there, but good luck doing that elsewhere.
>>
>> I assume your reaction is a big fat "Fuck off". Okeydoke.
>>
>>
>