Iowa man convicted of lottery rigging scheme granted parole

I'm guessing because the lottery system needed to generate a large number of random numbers (given that they are running lots of lottery systems), and this gives a fairly verifiable way of doing that from one initial chunk of randomness.

That said, I don't work in this area, so you should give my comment very little weight. :)

A geiger counter counts from 0-9 repeatedly and stops when a muon is detected. I guess you could count longer but I think the 10 digit modulus is sufficient.. not sure. This is the random initialization.

I'm curious at how you would actually successfully hide the control flow. The only think I can think of would be some factorization, maybe a couple of mods, but that would be detectable. You don't want to explicitly modify the control flow per se. I mean you'd have to be able to hide it from code review... and then mathematical review.

Besides the point about a need to generate a large number of random numbers, there's another thing: you don't know the distribution of the true random generator exactly. You know it's random, but in addition to that, the distribution needs to be flat. That's why you use a PRNG with a known-to-be flat distribution to further process the entropy. As an interesting sidenote, though, Mersenne Twister doesn't have a particularly good distribution by modern standards. For this, I would use a cryptographically secure PRNG.

The amount of entropy is usually limited. For the lottery, it doesn't seem like it would be a problem, but in general, you don't want your function calls to block while gathering "random data"

My understanding is that for this type of gaming, e.g. gambling, there are regulations governing the randomness and repeatability of the randomness for computer/electronic run games. Part of it due to necessities of verification of sufficient randomness from the perspective of the gamer but also that of the gaming establishment. The game needs to be provably sufficiently random to the advertised odds for fairness to both the gamer and the gaming establishment.

For all intents and purposes, using a true source of randomness as the seed for something like a one-time use of Mersenne Twister as a pseudorandom number generator (PNG) is indistinguishable to an end user of true randomness. What it does do, though, is allow for reproducible testing to ensure you don't have an xkcd PNG [0].

Source: bar chat with a couple of friends & former coworkers who had spent time in that area of gaming (e.g. working on video poker machines destined for casinos), so take it with a grain of salt.

[0] https://xkcd.com/221/

Am241 source coupled to a detector sounds sophisticated, but it matches description of now-outdated type of ceiling smoke detectors. It's probably not that mechanically elaborate.

Typically true random stuff like geiger counters do not have enough entropy in a single reading to be a true secret. They are statistically predictable and produce a curve of data.

By using it to seed a pseudo random number generator you are making the values come out in a completely flat distribution. The geiger counter adds non-deterministic results while the pseudo random number generator adds entropy.

If I ever commit a massive felony I'm going to come to HN to get you guys to check my work first

You would want to cheat only the one time, and have your program copy the original program into place, change the timestamps, and delete itself.

More obvious is don't collect it with a person who is legally not allowed to collect it. This person should also not be seen buying the ticket on camera. I would probably have someone play the same numbers every week for months before it hits.

Employees could really game the system. On average there's 1 "big" prize (outside the GLEP prizes) every 4 packs. Any time you see a pack go from start to ~5 remaining without a big prize, buy every remaining ticket.

There's also guaranteed restrictions on the maximum number of losers in a row. So if you see ~6+ (depends on ticket) losers in a row, then buy the next few until you win. I've run simulations on those distributions and it's profitable. But it's a situation that only an employee could take advantage of. And it probably comes up rarely.

If you do something cool with it, let me know at support@scratchoff-odds.com.

What is with the fractional numbers in `game.num_tx_initial` for some of the rows? I am assuming this is number of tickets sold. Parsing error?

Edit: The site is pretty cool. I get strong vibes of the Winfall lottery story[0]

[0] https://highline.huffingtonpost.com/articles/en/lotto-winner...

I see one game in Missouri has a score of 146. Is there anything stopping someone from buying all the remaining tickets (other than time and money obviously) and pocketing the $4 million difference?

Also, is it possible someone has grand prize winner but incorrectly throws it in the trash (because they overlooked the fact that it was a winner/didn’t scratch it all the way off)? Would the website pick up on that?

> serving a 25-year prison sentence for rigging computers to win lottery jackpots for himself, friends and family

This is outrageously absurd a human has been put in prison, let alone for 25 years, for such a bullshit reason. Many murderers and rapists in many countries get less.

I mean, all they have to do is "if europe, remove trackers" and they're golden.

The problem a lot of websites have is that they have no control or insight in which trackers there are, and whether they conform to GDPR rules. Which is IMO exactly why we need these rules.

If I ran the (presumably cash-strapped) website for Northeastern and Central Pennsylvania I wouldn't want my software engineers spending $1 to support Europeans that would never subscribe anyways.

That said, the message is clearly a lie.

Sounds more like he was able to install software on the same computer to use the same RNG as the lottery. In essence not doing anything to the original code, but using known information about it to get similar enough results.

This article goes into a lot more detail. It looks like it was just two lines of code. But apparently the codebase actually had backdoors already present. His employer, MSLA doesn't come out looking good. After winning a few lotteries Eddie actually reported the security hole and suggested a fix. It was ignored.

https://www.desmoinesregister.com/story/news/investigations/...

Hey dang, I see that this guideline is not currently duplicated on the submit page. Is there a reason for that? It seems like it would be useful as a reminder to submitters.

This is an interesting thought experiment.

Harm is relative right.

Steal 10 million dollars from a family owned small business that leads to their bankruptcy and the family homes being lost? Life In Prison.

Steal 10 million dollars from Bezos? Fine. This actually seems somewhat reasonable to me, I have a feeling you are more likely to get punished stealing from Bezos than the family business though.

No. Guilt is based on intent, not harm. And there are many victimless crimes (like buying controlled substances) where the harm is zero and the penalty far from zero.

wow a real life Oceans 11 story—and it's hard to believe she's innocent here

I rather enjoy the format and suspect other people do too, so I won't be the one to give away any spoilers

The security hack part of it isn't that sophisticated--it's literally just someone changing values in a database to make certain tickets a winner.

The interesting part of the story is the sleuthing the investigator did while trying to conceal his investigation so the guilty parties did not get tipped off.

I think that's my point.

The lottery itself is not going to have the manpower to check if every winner was or was not childhood best friends with workers at the lottery. Being in the public would be more likely to bring that to light + would scare people off.