(Edit:This became more of a rant picking apart every detail of the argument the further I went into it. Just skip to the "bottom line" statement.)
Also...
It produces a number that can't be predicted.
And, your bolded statement that "PHP doesn't generate the number, the underlying OS does" implies there is a problem with the underlying OS being able to perform that function. What is wrong with
https://docs.microsoft.com/en-us/window ... cng-portal
and
http://man7.org/linux/man-pages/man2/getrandom.2.html ?
(arc4random_buf() and /dev/urandom are no longer used with PHP 7. See https://www.php.net/manual/en/function.random-int.php)
The statement of no real site uses PHP to shuffle the cards, and backed by your linked article of https://www.datamation.com/entdev/artic ... curity.htm doesn't seem to be accurate. The article points out that reseeding based on the system time clock was the largest problem. it goes on to state
Bottom line -- All* games are available to be replayed, by any BGA user. The data is available, but I have never seen anybody who has made the claim that the RNG used by BGA does not create random numbers ever post a statistical analysis that supports that claim. Or, prove the claim by becoming the top rated player on the site by exploiting the flaw.
------notes
*OK, there have been reports of isolated incidents where some replays have been corrupted, and there is an age limit of a couple of years to the replays. But enough games to provide a statistically sound population are available.
SluggerBaloney wrote: ↑20 May 2020, 05:31You can't handwave away his claims. That's being dismissive, and not helpful. I would ask him to start recording roll results and then when he has a significant sample size of actual data, we can look at them.Jest Phulin wrote: ↑20 May 2020, 02:15 SluggerBaloney, please forgive us if we misinterpreted your question.
The vast majority of people who have ever asked about the random number generator on BGA follow it with "because something is obviously buggy/not representing reality/flawed/biased with it." Their "proof" tends to be what Pastor Flapps has been doing.
There was a request. It was ignored.Jest Phulin wrote: ↑14 May 2020, 21:27 You have several anecdotal reports. But no statistical analysis.
Also...
What results were you seeing that led you to believe the randomizer is not properly implemented? I'm sorry I didn't reread your original post before apologizing, because now I see it also fell into 'the vast majority of people who have ever asked about the random number generator on BGA follow it with "because something is obviously buggy/not representing reality/flawed/biased with it."' category.SluggerBaloney wrote: ↑13 May 2020, 01:38 I do not believe the game is coded correctly based on the results I have been seeing. The randomizer does not appear to be properly implemented.
A cryptographically secure RNG is not the same as any other RNG. All CS-RNGs satisfy the requirements of non-CS-RNGs, but the reverse is not true. One of these requirements is that it passes "the next-bit test. That is, given the first k bits of a random sequence, there is no polynomial-time algorithm that can predict the (k+1)th bit with probability of success non-negligibly better than 50%" (Katz, Jonathan; Lindell, Yehuda (2008). Introduction to Modern Cryptography. CRC press. p. 70. ISBN 978-1584885511.)SluggerBaloney wrote: ↑20 May 2020, 05:31 So looking at random_int(), it is used to generate a "cryptographically secure pseudo-random integer". In the case of Can't Stop, that's pretty much pointless. A "cryptographically secure" RNG is the exact same as any other RNG. It just gets it's seed from an "unguessable" source, like hardware interrupt calls or something. But the generation of the random number is not handled any differently.
It produces a number that can't be predicted.
And, your bolded statement that "PHP doesn't generate the number, the underlying OS does" implies there is a problem with the underlying OS being able to perform that function. What is wrong with
https://docs.microsoft.com/en-us/window ... cng-portal
and
http://man7.org/linux/man-pages/man2/getrandom.2.html ?
(arc4random_buf() and /dev/urandom are no longer used with PHP 7. See https://www.php.net/manual/en/function.random-int.php)
The statement of no real site uses PHP to shuffle the cards, and backed by your linked article of https://www.datamation.com/entdev/artic ... curity.htm doesn't seem to be accurate. The article points out that reseeding based on the system time clock was the largest problem. it goes on to state
And this is exactly what a cryptographically secure random number generator like random_int() provides.the article wrote:Key to the success of our algorithm is the choice of a random number generator (RNG). The RNG has a direct impact on whether the algorithm above will successfully produce decks of even distribution as well as whether these decks will be useful for secure online card play. To begin with, the RNG itself must produce an even distribution of random numbers. Pseudo-random number generators (PRNG), such as those based on the Lehmer algorithm, have been shown to possess this mathematical property. It is therefore sufficient to use a good PRNG to produce "random" numbers for card shuffling.
As we have seen, choice of initial seed for the PRNG is a make or break proposition. Everything boils down to the seed. It's absolutely essential that players using a deck of cards generated using a PRNG can't determine the seed used to produce that particular shuffle.
Bottom line -- All* games are available to be replayed, by any BGA user. The data is available, but I have never seen anybody who has made the claim that the RNG used by BGA does not create random numbers ever post a statistical analysis that supports that claim. Or, prove the claim by becoming the top rated player on the site by exploiting the flaw.
------notes
*OK, there have been reports of isolated incidents where some replays have been corrupted, and there is an age limit of a couple of years to the replays. But enough games to provide a statistically sound population are available.
