• API
• FAQ
• Tools
• Archive
SHARE
TWEET

# BMR/Sheep bet

a guest Oct 22nd, 2013 220 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
1. > BMR & Sheep have demonstrated their danger, but few black-market-users seem to genuinely appreciate this. I am publicly betting that they will fail in the near-future. If you think I am wrong, just try to take my money and prove me wrong!
2.
4.
5. (A signed version of this post will be posted as a comment, because I wish to use Markdown formatting; my PGP key is [available](http://www.gwern.net/Links#contact).)
6.
7. # Background
8.
9. With the fall of SR, we're all very sad: it was a good site which performed a useful function. But life goes on, so it's no surprise we're all moving on to new black markets. That said, in general I am very concerned by the accumulating pattern I am seeing around BMR and Sheep, and by the delusional optimism of many of their users.
10.
11. ## BMR
12.
13. BMR, since the fall, has been marked by a pattern of arrogance, technical incompetence, dismissal of problems, tolerance for sellers keep buyer addresses & issuing threats, astounding tolerance for information leaks (all the [implementation information](http://www.reddit.com/r/SheepMarketplace/comments/1nrdwr/bmr_and_sheep_leaking_platform_info_today/), and particularly the VPS incident with the user data leak; mirrors: [1](http://www.sendspace.com/file/ozr19p), [2](https://dl.dropboxusercontent.com/u/182368464/2013-10-17-blackmarketreloaded-userdatabase.sql.xz)), etc. We know his code is shitty and smells like vulnerabilities (programmer in 3 different IRC channels I frequent quoted bits of the leaked code with a mixture of hilarity & horror), yet somehow backopy expects to rewrite it better, despite being the same person who wrote the first version and the basic security principle that new versions have lots of bugs.
14.
15. And then there's the things he's not telling us. Atlantis shut down because they were worried about contacts from LE, and thus far this shut down seems to have saved them; but BMR has been around several times longer than Atlantis - would it not beggar belief if LE had not made contacts, attempted SR-style stings, or infiltrated BMR staff? And remember how we were able to discover all sorts of leaks in DPR's opsec once we had the indictment and knew what to look for? If this is what we see publicly for BMR, what on earth is going on behind the scenes?
16.
17. backopy should have handed on BMR weeks ago, but is still around. He seems to plan to repeat SR/DPR's mistakes exactly: leak information all over the place, never retire, and just keep on until he is busted and takes who-knows-how-many people down to prison with him. He has learned nothing. What exactly is his exit plan? He has been running BMR for more than 2 years now, and has not left. How does this story end: of a man who does not know his limits, does not have ability equal to the task, and refuses to quit while he's ahead? It ends with a party-van, that's how it ends.
18.
19. And hardly anyone seems troubled by this! The BMR subreddit is full of bustle; people are even hailing backopy as a "hero" for allowing withdrawal of bitcoins. (How generous of him.)
20.
21. ## Sheep
22.
23. Is Sheep any better? No. BMR is troubled and probably infiltrated at this point, but Sheep may well be a dead market walking at this point. No one has a good word to say about its coding, so there may well be BMR-style issues in its future. More importantly: the veriest Google search would turn up that clearnet site, and it [has been](http://www.reddit.com/r/SheepMarketplace/comments/1nsmzx/a_friendly_warning_sheepmarketplacecoms_owner/) [pointed out](https://pay.reddit.com/r/SheepMarketplace/comments/1o6wqq/everyones_opinion_on_smp_as_of_yet/ccplp3e) that the clearnet Czech site hosted by HexaGeek was *uncannily* similar to the actual hidden service. It uses almost the same exact technology, and the official explanation is that they had "fans" (fans? who set up, many months ago, before anyone gave a damn about Sheep, an entire functioning mirror while cloning the hardware stack and being in a foreign non-English-speaking country just like the Sheep admins?). Ridiculous! DPR may have set up a WordPress site, but at least 'altoid' didn't run an entire SR mirror and left that to onion.to. Sheep's likely about one subpoena to HexaGeek away from being rolled up.
24.
25. # The Wager
26.
27. I am uninterested in seeing Sheep/BMR busted and lots of newbies caught because they can't appreciate the patterns here. People don't take mere criticism seriously, and even if I lay it all out like here, and I mention that I have an [excellent track record of predictions](http://www.gwern.net/Prediction%20markets), they still won't because anyone can doom-monger and issue warnings, it won't get through to them. I want to get through to them - I want them to understand the risks they're taking, I want them to reflexively use PGP, and I want them to leave balances on sites for as short a time as possible. So! I am putting my money where my mouth is.
28.
29. (TODO What are the exact amounts and wagers here? I'm putting up 1 bitcoin = $200, what else?) 30. 31. ## Bets 32. 33. I and TODO others are publicly wagering ฿TODO ($TODO at today's rate) on the following bets:
34.
35. 1. BMR will not be operating in 6 months:
36.
37.     25%; 1:3 (ie. if you put up ฿1 and BMR is operating, you win ฿0.33, else you lose the ฿1 to us)
38. 2. BMR will not be operating in 12 months
39.
40.     42%; 1:1.38 (ie. if you bet ฿1 & BMR is operating in a year, you win ฿0.72 else lose ฿1)
41. 3. Sheep will not be operating in 6 months
42.
43.     50%; 1:1 (our ฿1 against yours)
44. 4. Sheep will not be operating in 12 months
45.
46.     70%; 1:0.43 (ie. you bet ฿1, win and get ฿2.32)
47.
48. TODO: these are bets at the true odds, but I need a margin to make it worthwhile.
49. TODO: register each prediction on PB.com
50.
51. chance of losing each bet: 0.75 * 0.58 * 0.50 * 0.3 = >0.07
52.
53. ## Definitions
54.
55. - BMR = kss62ljxtqiqdfuq.onion
56. - Sheep = sheep5u64fi457aw.onion
57. - The exact definition of 'not operating' includes but is not limited to this: on noon of TODO (6-months) or TODO (12-months), if nanotube can visit the relevant black-market, create a buyer account, deposit bitcoins, and order an item, then the site is operating. If deposits or new accounts or purchases are not allowed or not possible, it is not operating.
58.
59.     At his own discretion, the arbitrator can take into account other factors, like widespread reports that a market has been raided and turned into a sting operation.
60.
61. ## Escrow
62.
63. Escrow & arbitration is being provided by Nanotube, a long-time [Bitcoin](https://en.bitcoin.it/wiki/User:Nanotube) user & [-otc trader](http://bitcoin-otc.com/viewratingdetail.php?nick=nanotube), who has handled some past bets (most famously, the [฿10,000 bet between the Ponzi schemer pirateat40 & Vandroiy](https://bitcointalk.org/index.php?action=printpage;topic=91661.0 "Putting your money where Pirate's mouth is")) and I believe can be trusted to escrow this one as well; he has agreed to a nominal fee of 1%.
64.
65. (I am not using Bets of Bitcoin because they have a frankly dishonest & exploitative rule-set, and I am not sure [Predictious](https://www.predictious.com/) would allow these bets.)
66.
67. ## HOWTO
68.
69. If you disagree and are man enough to take our bets, post the amount you are betting on which bet, and Nanotube will supply an address for you to transfer your bitcoin to. When it arrives in his wallet, then our bet will operational.
70.
71. # Appendix: Statistical estimation
72.
73. In my past betting & predicting, I have found it useful to start with some simple base rates & statistical calculations as a way of anchoring my subjective considerations. Neither approach is extremely reliable, but they can help us figure out what are reasonable-looking estimates and we can increase or decrease them based on the observed security issues to get a final estimate which will be better than either random guessing based on gut-feel or blind acceptance of numbers spat out by a model.
74.
75. ## Basic data
76.
77. - SR: survived from January 2011 through September 2013; (in months) 12+12+9=33; closed
78. - BMR: June 2011 through October 2013; 7+12+10=29; open
79. - Atlantis: 26 March (April) 2013 through September 2013; 6; closed
80. - Sheep: February 2013 through October 2013; 9=9; open
81. - Deepbay: June 2013 through October 2013; 5=5; open
83. - Black Flag, 14 October (http://blackiiw5nozs6i5.onion/index.php?topic=29.msg1032#msg1032) 2013, 1=1; open
85.
86. (Silk Road Reloaded & The Marketplace are excluded because they have not actually started selling. RAMP & Magic Shop are excluded because they're in Russian and I can't get good information about them.)
87.
88. ## Laplace
89.
90. A nifty way of estimating some things come from [Laplace's rule of succession](https://en.wikipedia.org/wiki/Rule_of_succession) ([additional derivations](http://zlkj.in/survival.html)): $s$ failures and $n$ total chances to fail, is $\frac{s+1}{n+2}$. Nsheppard offers a more general formula: the probability that the next site will last for at least 'z' time, given total running of all black markets of 't' months with 'n' shutdowns is $(t / (t+z))^{n+1}$.
91.
92. Pooled, all-markets (SR+BMR+Sheep+Deepbay+BIN+BF+Budster), # of failures vs # number of live months:
93.
94. - by Laplace: (1+1+1)/(33+29+6+9+5+7+1+1) = 3/91 = 0.033 = 3.3% chance of closure per month; generally: (91 / (91+1))^(1+1+1) = 94% = 6% chance of closure in the first month
95.
96.     1. 6 month survival: (91 / (91+6))^(2+1) = 82% chance of survival = 18% closure
97.     2. 12-month survival: (91 / (91+12))^(2+1) = 68% chance of survival = 32% closure
98.
99. By market:
100.
101. - BMR:
102.
103.     1. 6-month: 33 / (6 + 33) = 0.84 = 84% survival = 16% closure
104.     2. 12-month: 33 / (12 + 33) = 0.73 = 73% survival = 27% closure
105. - Sheep:
106.
107.     1. 6-month: 9 / (6 + 9) = 0.60 = 60% survival = 40% closure
108.     2. 12-month: 9 / (12 + 9) = 0.43 = 43% survival = 57% closure
109.
110. I believe both sets of estimates are lower than the true risk, given what I have discussed about the sites' security & anonymity.
111.
112. ## Survival analysis
113.
114. I have some basic familiarity with [survival analysis](https://en.wikipedia.org/wiki/Survival_analysis) from my lengthy analysis of [how long Google services survive](http://www.gwern.net/Google%20shutdowns), so I thought I'd take a stab at a survival analysis of the black markets:
115.
116. ~~~{.R}
117. library(survival)
118. library(rms)
121. SR,2011-01-27,2013-10-02,TRUE
122. BMR,2011-06-10,2013-10-21,FALSE
123. Atlantis,2013-03-26,2013-09-21,TRUE
124. Sheep,2013-02-15,2013-10-21,FALSE
125. Deepbay,2013-06-05,2013-10-21,FALSE
127. BF,2013-10-14,2013-10-21,FALSE
128. Budster,2013-10-20,2013-10-21,FALSE
129.
130. markets$Days <- as.integer(markets$Ended - markets$Started) 131. surv <- survfit(Surv(markets$Days, markets$Dead, type="right") ~ 1) 132. summary(surv) 133. time n.risk n.event survival std.err lower 95% CI upper 95% CI 134. 179 5 1 0.8 0.179 0.516 1 135. 979 1 1 0.0 NaN NA NA 136. # Not enough datapoints to reasonably estimate! 137. 138. # 6-month mortality: 139. 1 - (1-(0.2/179))^(365/2) 140. [1] 0.1846 141. # 12-month mortality 142. 1 - (1-(0.2/179))^365 143. [1] 0.3351 144. 145. plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI") 146. ~~~ 147. 148. As it happens, I wrote some R code to do another survival analysis as well, this one [of Bitcoin exchanges like MtGox](http://www.gwern.net/Silk%20Road#bitcoin-exchange-risk), checking a published paper's results. A Bitcoin exchange is an online website which trades in Bitcoins, is a target for hackers, and is often of questionable legality - so it's actually quite a bit like a black market in some respects. What if we try to borrow strength by combining the black markets & exchanges into a single dataset, include a dummy variable indicating black market or exchange, estimate a survival curve from that dataset, and predict? 149. 150. ~~~{.R} 151. library(survival) 152. library(rms) 153. market <- read.csv(stdin(),header=TRUE, colClasses=c("factor","Date","Date","logical")) 154. Marketplace,Started,Ended,Dead 155. SR,2011-01-27,2013-10-02,TRUE 156. BMR,2011-06-10,2013-10-21,FALSE 157. Atlantis,2013-03-26,2013-09-21,TRUE 158. Sheep,2013-02-15,2013-10-21,FALSE 159. Deepbay,2013-06-05,2013-10-21,FALSE 160. BuyItNow,2013-04-02,2013-10-21,FALSE 161. BF,2013-10-14,2013-10-21,FALSE 162. Budster,2013-10-20,2013-10-21,FALSE 163. 164. market$Type  <- as.factor("black.market")
165. market$Days <- as.integer(market$Ended - market$Started) 166. 167. exchange <- read.csv("http://www.gwern.net/docs/2013-moorechristin-bitcoinexchanges.csv") 168. exchange <- with(exchange, data.frame(Marketplace=Exchange, Started=as.Date(Origin), Ended=as.Date(Dates), Dead=as.logical(Closed))) 169. exchange$Days <- as.integer(as.Date(exchange$Ended) - as.Date(exchange$Started))
170. exchange$Type <- as.factor("exchange") 171. 172. allSites <- rbind(exchange, market) 173. 174. # plot aggregate survival curve 175. surv <- survfit(Surv(allSites$Days, allSites$Dead, type="right") ~ 1) 176. plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI") 177. 178. cpmodel <- cph(Surv(Days, Dead) ~ Type, data = allSites, x=TRUE, y=TRUE, surv=TRUE) 179. 180. conditionalProbability <- function (d, followupUnits) { 181. chances <- rep(NA, nrow(d)) # stash results 182. 183. for (i in 1:nrow(d)) { 184. 185. # extract chance of particular subject surviving as long as it has: 186. beginProb <- survest(cpmodel, d[i,], times=(d[i,]$Days))$surv 187. if (length(beginProb)==0) { beginProb <- 1 } # set to a default 188. 189. tmpFollowup <- followupUnits # reset in each for loop 190. while (TRUE) { 191. # extract chance of subject surviving as long as it has + an arbitrary additional time-units 192. endProb <- survest(cpmodel, d[i,], times=(d[i,]$Days + tmpFollowup))$surv 193. # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't; 194. # so we shrink down 1 day and try again until 'survexp' *does* return a usable answer 195. if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break } 196. } 197. 198. # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance 199. # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40 200. chances[i] <- endProb / beginProb 201. } 202. return(chances) 203. } 204. allSites$SixMonth <- conditionalProbability(allSites, (365/2))
205. allSites\$OneYear <- conditionalProbability(allSites, 365)
206.
207. allSites[c(1,7,8)][c(42,44:48),]
208.    Marketplace SixMonth OneYear
209. 42         BMR   1.0000  0.3679
210. 44       Sheep   0.9442  0.8786
211. 45     Deepbay   0.9450  0.9000