EDIT: No one has offered to accept any of the bets, so I am declaring this offer withdrawn.
BMR & Sheep have demonstrated their danger, but few black-market-users seem to
genuinely appreciate this. I am publicly betting that they will fail in the
near-future. If you think I am wrong, just try to take my money and prove me
wrong! Otherwise, spare us your cheap talk.
Hi! I'm Gwern Branwen. You may remember me from
such black-market webpages as
Silk Road: Theory & Practice, and
/r/silkroad.
Today I'm here to talk to you about BlackMarket Reloaded &
Sheep Marketplace.
(A signed version of this 30 October 2013 post will be posted as a comment,
because I wish to use Markdown formatting; my PGP key is
available.)
Background
With the fall of SR, we're all very sad: it was a good site which performed a
useful function. But life goes on, so it's no surprise we're all moving on to
new black markets. That said, I am concerned by the accumulating pattern I am
seeing around BMR and Sheep, and by the delusional optimism of many of the
users.
BMR
BlackMarket Reloaded, since the fall, has been marked by a pattern of arrogance,
technical incompetence, dismissal of problems, tolerance for sellers keep buyer
addresses & issuing threats, astounding tolerance for information leaks (all the
implementation information,
and particularly the VPS incident with the user data leak; mirrors:
1,
2),
etc. We know his code is shitty and smells like vulnerabilities (programmer in 3
different IRC channels I frequent quoted bits of the leaked code with a mixture
of hilarity & horror), yet somehow backopy expects to rewrite it better, despite
being the same person who wrote the first version and the basic security
principle that new versions have lots of bugs. (I'm not actually bothered by the
DoS attacks; they're issues for any site, much less hidden services.)
And then there's the things he's not telling us. Atlantis shut down because they
were worried about contacts from LE, and thus far this shut down seems to have
saved them; but BMR has been around several times longer than Atlantis - would
it not beggar belief if LE had not made contacts, attempted SR-style stings, or
infiltrated BMR staff? And remember how we were able to discover all sorts of
leaks in DPR's opsec once we had the indictment and knew what to look for? Or
consider the claims being made about the Project Black Flag Leaks, where someone
claims to have
accessed laundry list of information
from its internals - only after Metta DPR decided to rip-and-run. If this is
what we see publicly for BMR, what on earth is going on behind the scenes?
backopy should have handed on BMR weeks ago, but is still around. He seems to
plan to repeat SR/DPR's mistakes exactly: leak information all over the place,
never retire, and just keep on until he is busted and takes who-knows-how-many
people down to prison with him. He has learned nothing. What, exactly, is his
exit strategy? What goals does he have and when will they ever be satisfied? He
has been running BMR for more than 2 years now, and has not left. How does this
story end: of a man who does not know his limits, does not have ability equal to
the task, and refuses to quit while he's ahead? It ends with a party-van, that's
how it ends.
And hardly anyone seems troubled by this! The BMR subreddit is full of bustle;
people are even hailing backopy as a "hero" for allowing withdrawal of bitcoins.
(How generous of him.)
Sheep
Is Sheep any better? No. BMR is troubled and probably infiltrated at this point,
but Sheep may well be a dead market walking at this point. No one has a good
word to say about its coding, so there may well be BMR-style issues in its
future. More importantly: the veriest Google search would turn up that clearnet
site, and it
has been
pointed out
that the clearnet Czech site hosted by HexaGeek was uncannily similar to the
actual hidden service. It uses almost the same exact technology, and the
official explanation is that they had "fans" (fans? who set up, many months ago,
before anyone gave a damn about Sheep, an entire functioning mirror while
cloning the software stack and being in a foreign non-English-speaking country
just like the Sheep admins?). Ridiculous! DPR may have set up a WordPress site,
but at least 'altoid' didn't run an entire SR mirror! (He left that to
onion.to & tor2web.org.). Sheep's likely about one subpoena of HexaGeek away
from fun party times in the party-van.
The Wager
I am uninterested in seeing Sheep/BMR busted and lots of newbies caught because
they can't appreciate the patterns here. People don't take mere criticism
seriously, and even if I lay it all out like here, and I mention that I have an
excellent track record of predictions,
they still won't because anyone can doom-monger and issue warnings, it won't get
through to them. I want to get through to them - I want them to understand the
risks they're taking, I want them to reflexively use PGP, and I want them to
leave balances on sites for as short a time as possible. So! I am putting my
money where my mouth is.
Bets
I and 3 others are publicly wagering ฿4 ($816 at today's rate), ฿1 each, on the
following 4 bets:
BMR will not be operating in 6 months:
25%; 1:3 (you risk ฿3 and if BMR is still operating, you win our ฿1, else
you lose the ฿3 to us)
BMR will not be operating in 12 months
40%; 1:1.5 (you risk ฿1.5 & BMR is operating in a year, you win our ฿1, else
lose ฿1.5)
Sheep will not be operating in 6 months
30%; 1:2.3 (your ฿2.3 against our ฿1)
Sheep will not be operating in 12 months
60%; 1:0.66 (you risk ฿0.66 against our ฿1)
The ฿4 are currently stored in
1AZvaBEJMiK8AJ5GvfvLWgHjWgL59TRPGy
(proof of control:
IOqEiWYWtYWFmJaKa29sOUqfMLrSWAWhHxqqB3bcVHuDpcn8rA0FkEqvRYmdgQO4yeXeNHtwr9NSqI9J79G+yPA=
is the signature by 1Az of the string "This address contains bitcoins for the
BMR/Sheep bet run by gwern.").
Definitions
- BMR =
kss62ljxtqiqdfuq.onion
- Sheep =
sheep5u64fi457aw.onion
The exact definition of 'not operating' includes but is not limited to this:
on noon EST of 30 April 2013 (6-months) or 30 October 2014 (12-months), if
Nanotube can visit the relevant black-market, create a buyer account, deposit
bitcoins, and order an item, then the site is operating. If deposits or new
accounts or purchases are not allowed or not possible, it is not operating.
At his own discretion, the arbitrator can take into account other factors,
like widespread reports that a market has been raided and turned into a
sting operation.
Escrow
Arbitration & escrow are being provided by Nanotube, a long-time
Bitcoin user &
-otc trader, who
has handled some past bets (most famously, the
฿10,000 bet between the Ponzi schemer pirateat40 & Vandroiy) and I believe can be trusted to
escrow this one as well; he has agreed to a nominal fee of 1%.
(I am not using Bets of Bitcoin because they have a dishonest &
exploitative rule-set, and I am not sure
Predictious would allow these bets.)
HOWTO
If you disagree and are man enough to take our bets, post the amount you are
betting on which bet, and Nanotube will supply an address for you to transfer
your bitcoin to. When it arrives in his wallet, then our bet will be in effect.
May the most accurate beliefs win.
Want to add to the discussion?
Post a comment!