API tools faq
paste
Advertisement
Guest User

BMR/Sheep bet

a guest
Oct 22nd, 2013
394
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.28 KB | None | 0 0
raw download clone embed print report
  1. > BMR & Sheep have demonstrated their danger, but few black-market-users seem to genuinely appreciate this. I am publicly betting that they will fail in the near-future. If you think I am wrong, just try to take my money and prove me wrong!
  2.  
  3. Hi. I'm Gwern Branwen. You may remember me from such black-market webpages as [Silk Road: Theory & Practice](http://www.gwern.net/Silk%20Road), and [/r/silkroad](http://www.reddit.com/r/SilkRoad/search?q=author%3Agwern&restrict_sr=on). Today I'm here to talk to you about Sheep & BlackMarket Reloaded.
  4.  
  5. (A signed version of this post will be posted as a comment, because I wish to use Markdown formatting; my PGP key is [available](http://www.gwern.net/Links#contact).)
  6.  
  7. # Background
  8.  
  9. With the fall of SR, we're all very sad: it was a good site which performed a useful function. But life goes on, so it's no surprise we're all moving on to new black markets. That said, in general I am very concerned by the accumulating pattern I am seeing around BMR and Sheep, and by the delusional optimism of many of their users.
  10.  
  11. ## BMR
  12.  
  13. BMR, since the fall, has been marked by a pattern of arrogance, technical incompetence, dismissal of problems, tolerance for sellers keep buyer addresses & issuing threats, astounding tolerance for information leaks (all the [implementation information](http://www.reddit.com/r/SheepMarketplace/comments/1nrdwr/bmr_and_sheep_leaking_platform_info_today/), and particularly the VPS incident with the user data leak; mirrors: [1](http://www.sendspace.com/file/ozr19p), [2](https://dl.dropboxusercontent.com/u/182368464/2013-10-17-blackmarketreloaded-userdatabase.sql.xz)), etc. We know his code is shitty and smells like vulnerabilities (programmer in 3 different IRC channels I frequent quoted bits of the leaked code with a mixture of hilarity & horror), yet somehow backopy expects to rewrite it better, despite being the same person who wrote the first version and the basic security principle that new versions have lots of bugs.
  14.  
  15. And then there's the things he's not telling us. Atlantis shut down because they were worried about contacts from LE, and thus far this shut down seems to have saved them; but BMR has been around several times longer than Atlantis - would it not beggar belief if LE had not made contacts, attempted SR-style stings, or infiltrated BMR staff? And remember how we were able to discover all sorts of leaks in DPR's opsec once we had the indictment and knew what to look for? If this is what we see publicly for BMR, what on earth is going on behind the scenes?
  16.  
  17. backopy should have handed on BMR weeks ago, but is still around. He seems to plan to repeat SR/DPR's mistakes exactly: leak information all over the place, never retire, and just keep on until he is busted and takes who-knows-how-many people down to prison with him. He has learned nothing. What exactly is his exit plan? He has been running BMR for more than 2 years now, and has not left. How does this story end: of a man who does not know his limits, does not have ability equal to the task, and refuses to quit while he's ahead? It ends with a party-van, that's how it ends.
  18.  
  19. And hardly anyone seems troubled by this! The BMR subreddit is full of bustle; people are even hailing backopy as a "hero" for allowing withdrawal of bitcoins. (How generous of him.)
  20.  
  21. ## Sheep
  22.  
  23. Is Sheep any better? No. BMR is troubled and probably infiltrated at this point, but Sheep may well be a dead market walking at this point. No one has a good word to say about its coding, so there may well be BMR-style issues in its future. More importantly: the veriest Google search would turn up that clearnet site, and it [has been](http://www.reddit.com/r/SheepMarketplace/comments/1nsmzx/a_friendly_warning_sheepmarketplacecoms_owner/) [pointed out](https://pay.reddit.com/r/SheepMarketplace/comments/1o6wqq/everyones_opinion_on_smp_as_of_yet/ccplp3e) that the clearnet Czech site hosted by HexaGeek was *uncannily* similar to the actual hidden service. It uses almost the same exact technology, and the official explanation is that they had "fans" (fans? who set up, many months ago, before anyone gave a damn about Sheep, an entire functioning mirror while cloning the hardware stack and being in a foreign non-English-speaking country just like the Sheep admins?). Ridiculous! DPR may have set up a WordPress site, but at least 'altoid' didn't run an entire SR mirror and left that to onion.to. Sheep's likely about one subpoena to HexaGeek away from being rolled up.
  24.  
  25. # The Wager
  26.  
  27. I am uninterested in seeing Sheep/BMR busted and lots of newbies caught because they can't appreciate the patterns here. People don't take mere criticism seriously, and even if I lay it all out like here, and I mention that I have an [excellent track record of predictions](http://www.gwern.net/Prediction%20markets), they still won't because anyone can doom-monger and issue warnings, it won't get through to them. I want to get through to them - I want them to understand the risks they're taking, I want them to reflexively use PGP, and I want them to leave balances on sites for as short a time as possible. So! I am putting my money where my mouth is.
  28.  
  29. (TODO What are the exact amounts and wagers here? I'm putting up 1 bitcoin = $200, what else?)
  30.  
  31. ## Bets
  32.  
  33. I and TODO others are publicly wagering ฿TODO ($TODO at today's rate) on the following bets:
  34.  
  35. 1. BMR will not be operating in 6 months:
  36.  
  37. 25%; 1:3 (ie. if you put up ฿1 and BMR is operating, you win ฿0.33, else you lose the ฿1 to us)
  38. 2. BMR will not be operating in 12 months
  39.  
  40. 42%; 1:1.38 (ie. if you bet ฿1 & BMR is operating in a year, you win ฿0.72 else lose ฿1)
  41. 3. Sheep will not be operating in 6 months
  42.  
  43. 50%; 1:1 (our ฿1 against yours)
  44. 4. Sheep will not be operating in 12 months
  45.  
  46. 70%; 1:0.43 (ie. you bet ฿1, win and get ฿2.32)
  47.  
  48. TODO: these are bets at the true odds, but I need a margin to make it worthwhile.
  49. TODO: register each prediction on PB.com
  50.  
  51. chance of losing each bet: 0.75 * 0.58 * 0.50 * 0.3 = >0.07
  52.  
  53. ## Definitions
  54.  
  55. - BMR = `kss62ljxtqiqdfuq.onion`
  56. - Sheep = `sheep5u64fi457aw.onion`
  57. - The exact definition of 'not operating' includes but is not limited to this: on noon of TODO (6-months) or TODO (12-months), if nanotube can visit the relevant black-market, create a buyer account, deposit bitcoins, and order an item, then the site is operating. If deposits or new accounts or purchases are not allowed or not possible, it is not operating.
  58.  
  59. At his own discretion, the arbitrator can take into account other factors, like widespread reports that a market has been raided and turned into a sting operation.
  60.  
  61. ## Escrow
  62.  
  63. Escrow & arbitration is being provided by Nanotube, a long-time [Bitcoin](https://en.bitcoin.it/wiki/User:Nanotube) user & [-otc trader](http://bitcoin-otc.com/viewratingdetail.php?nick=nanotube), who has handled some past bets (most famously, the [฿10,000 bet between the Ponzi schemer pirateat40 & Vandroiy](https://bitcointalk.org/index.php?action=printpage;topic=91661.0 "Putting your money where Pirate's mouth is")) and I believe can be trusted to escrow this one as well; he has agreed to a nominal fee of 1%.
  64.  
  65. (I am not using Bets of Bitcoin because they have a frankly dishonest & exploitative rule-set, and I am not sure [Predictious](https://www.predictious.com/) would allow these bets.)
  66.  
  67. ## HOWTO
  68.  
  69. If you disagree and are man enough to take our bets, post the amount you are betting on which bet, and Nanotube will supply an address for you to transfer your bitcoin to. When it arrives in his wallet, then our bet will operational.
  70.  
  71. # Appendix: Statistical estimation
  72.  
  73. In my past betting & predicting, I have found it useful to start with some simple base rates & statistical calculations as a way of anchoring my subjective considerations. Neither approach is extremely reliable, but they can help us figure out what are reasonable-looking estimates and we can increase or decrease them based on the observed security issues to get a final estimate which will be better than either random guessing based on gut-feel or blind acceptance of numbers spat out by a model.
  74.  
  75. ## Basic data
  76.  
  77. - SR: survived from January 2011 through September 2013; (in months) 12+12+9=33; closed
  78. - BMR: June 2011 through October 2013; 7+12+10=29; open
  79. - Atlantis: 26 March (April) 2013 through September 2013; 6; closed
  80. - Sheep: February 2013 through October 2013; 9=9; open
  81. - Deepbay: June 2013 through October 2013; 5=5; open
  82. - BuyItNow (http://buyitnowquyft7dx.onion), April? 2013 through October 2013; 7=7; open
  83. - Black Flag, 14 October (http://blackiiw5nozs6i5.onion/index.php?topic=29.msg1032#msg1032) 2013, 1=1; open
  84. - Budster, 20 October (http://www.reddit.com/r/Budster/comments/1ove9w/has_anyone_made_a_purchase_yet/ccw8srh) 2013; 1=1; open
  85.  
  86. (Silk Road Reloaded & The Marketplace are excluded because they have not actually started selling. RAMP & Magic Shop are excluded because they're in Russian and I can't get good information about them.)
  87.  
  88. ## Laplace
  89.  
  90. A nifty way of estimating some things come from [Laplace's rule of succession](https://en.wikipedia.org/wiki/Rule_of_succession) ([additional derivations](http://zlkj.in/survival.html)): $s$ failures and $n$ total chances to fail, is $\frac{s+1}{n+2}$. Nsheppard offers a more general formula: the probability that the next site will last for at least 'z' time, given total running of all black markets of 't' months with 'n' shutdowns is $(t / (t+z))^{n+1}$.
  91.  
  92. Pooled, all-markets (SR+BMR+Sheep+Deepbay+BIN+BF+Budster), # of failures vs # number of live months:
  93.  
  94. - by Laplace: (1+1+1)/(33+29+6+9+5+7+1+1) = 3/91 = 0.033 = 3.3% chance of closure per month; generally: (91 / (91+1))^(1+1+1) = 94% = 6% chance of closure in the first month
  95.  
  96. 1. 6 month survival: (91 / (91+6))^(2+1) = 82% chance of survival = 18% closure
  97. 2. 12-month survival: (91 / (91+12))^(2+1) = 68% chance of survival = 32% closure
  98.  
  99. By market:
  100.  
  101. - BMR:
  102.  
  103. 1. 6-month: 33 / (6 + 33) = 0.84 = 84% survival = 16% closure
  104. 2. 12-month: 33 / (12 + 33) = 0.73 = 73% survival = 27% closure
  105. - Sheep:
  106.  
  107. 1. 6-month: 9 / (6 + 9) = 0.60 = 60% survival = 40% closure
  108. 2. 12-month: 9 / (12 + 9) = 0.43 = 43% survival = 57% closure
  109.  
  110. I believe both sets of estimates are lower than the true risk, given what I have discussed about the sites' security & anonymity.
  111.  
  112. ## Survival analysis
  113.  
  114. I have some basic familiarity with [survival analysis](https://en.wikipedia.org/wiki/Survival_analysis) from my lengthy analysis of [how long Google services survive](http://www.gwern.net/Google%20shutdowns), so I thought I'd take a stab at a survival analysis of the black markets:
  115.  
  116. ~~~{.R}
  117. library(survival)
  118. library(rms)
  119. markets <- read.csv(stdin(),header=TRUE, colClasses=c("factor","Date","Date","logical"))
  120. Marketplace,Started,Ended,Dead
  121. SR,2011-01-27,2013-10-02,TRUE
  122. BMR,2011-06-10,2013-10-21,FALSE
  123. Atlantis,2013-03-26,2013-09-21,TRUE
  124. Sheep,2013-02-15,2013-10-21,FALSE
  125. Deepbay,2013-06-05,2013-10-21,FALSE
  126. BuyItNow,2013-04-02,2013-10-21,FALSE
  127. BF,2013-10-14,2013-10-21,FALSE
  128. Budster,2013-10-20,2013-10-21,FALSE
  129.  
  130. markets$Days <- as.integer(markets$Ended - markets$Started)
  131. surv <- survfit(Surv(markets$Days, markets$Dead, type="right") ~ 1)
  132. summary(surv)
  133. time n.risk n.event survival std.err lower 95% CI upper 95% CI
  134. 179 5 1 0.8 0.179 0.516 1
  135. 979 1 1 0.0 NaN NA NA
  136. # Not enough datapoints to reasonably estimate!
  137.  
  138. # 6-month mortality:
  139. 1 - (1-(0.2/179))^(365/2)
  140. [1] 0.1846
  141. # 12-month mortality
  142. 1 - (1-(0.2/179))^365
  143. [1] 0.3351
  144.  
  145. plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI")
  146. ~~~
  147.  
  148. As it happens, I wrote some R code to do another survival analysis as well, this one [of Bitcoin exchanges like MtGox](http://www.gwern.net/Silk%20Road#bitcoin-exchange-risk), checking a published paper's results. A Bitcoin exchange is an online website which trades in Bitcoins, is a target for hackers, and is often of questionable legality - so it's actually quite a bit like a black market in some respects. What if we try to borrow strength by combining the black markets & exchanges into a single dataset, include a dummy variable indicating black market or exchange, estimate a survival curve from that dataset, and predict?
  149.  
  150. ~~~{.R}
  151. library(survival)
  152. library(rms)
  153. market <- read.csv(stdin(),header=TRUE, colClasses=c("factor","Date","Date","logical"))
  154. Marketplace,Started,Ended,Dead
  155. SR,2011-01-27,2013-10-02,TRUE
  156. BMR,2011-06-10,2013-10-21,FALSE
  157. Atlantis,2013-03-26,2013-09-21,TRUE
  158. Sheep,2013-02-15,2013-10-21,FALSE
  159. Deepbay,2013-06-05,2013-10-21,FALSE
  160. BuyItNow,2013-04-02,2013-10-21,FALSE
  161. BF,2013-10-14,2013-10-21,FALSE
  162. Budster,2013-10-20,2013-10-21,FALSE
  163.  
  164. market$Type <- as.factor("black.market")
  165. market$Days <- as.integer(market$Ended - market$Started)
  166.  
  167. exchange <- read.csv("http://www.gwern.net/docs/2013-moorechristin-bitcoinexchanges.csv")
  168. exchange <- with(exchange, data.frame(Marketplace=Exchange, Started=as.Date(Origin), Ended=as.Date(Dates), Dead=as.logical(Closed)))
  169. exchange$Days <- as.integer(as.Date(exchange$Ended) - as.Date(exchange$Started))
  170. exchange$Type <- as.factor("exchange")
  171.  
  172. allSites <- rbind(exchange, market)
  173.  
  174. # plot aggregate survival curve
  175. surv <- survfit(Surv(allSites$Days, allSites$Dead, type="right") ~ 1)
  176. plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI")
  177.  
  178. cpmodel <- cph(Surv(Days, Dead) ~ Type, data = allSites, x=TRUE, y=TRUE, surv=TRUE)
  179.  
  180. conditionalProbability <- function (d, followupUnits) {
  181. chances <- rep(NA, nrow(d)) # stash results
  182.  
  183. for (i in 1:nrow(d)) {
  184.  
  185. # extract chance of particular subject surviving as long as it has:
  186. beginProb <- survest(cpmodel, d[i,], times=(d[i,]$Days))$surv
  187. if (length(beginProb)==0) { beginProb <- 1 } # set to a default
  188.  
  189. tmpFollowup <- followupUnits # reset in each for loop
  190. while (TRUE) {
  191. # extract chance of subject surviving as long as it has + an arbitrary additional time-units
  192. endProb <- survest(cpmodel, d[i,], times=(d[i,]$Days + tmpFollowup))$surv
  193. # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
  194. # so we shrink down 1 day and try again until 'survexp' *does* return a usable answer
  195. if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
  196. }
  197.  
  198. # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
  199. # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
  200. chances[i] <- endProb / beginProb
  201. }
  202. return(chances)
  203. }
  204. allSites$SixMonth <- conditionalProbability(allSites, (365/2))
  205. allSites$OneYear <- conditionalProbability(allSites, 365)
  206.  
  207. allSites[c(1,7,8)][c(42,44:48),]
  208. Marketplace SixMonth OneYear
  209. 42 BMR 1.0000 0.3679
  210. 44 Sheep 0.9442 0.8786
  211. 45 Deepbay 0.9450 0.9000
  212. 46 BuyItNow 0.9494 0.9178
  213. 47 BF 0.9095 0.8635
  214. 48 Budster 0.9185 0.8635
  215. ~~~
  216.  
  217. While it seems reasonable to expect the new markets to survive with high confidence, I am left very quizzical by the estimate that BMR has a 100% chance of surviving for half a year, yet a 36% chance of surviving for a year. I could accept the 36% estimate, but 100% is simply bizarre and suggests that something went very wrong somewhere in this analysis.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!