Yes, he made a few thousand dollars net profit over 7 to 9 months. He also had a poker bot running for a while (on sites that didn't mention bots in their ToS)

Yes, he made a few thousand dollars net profit over 7 to 9 months. He also had a poker bot running for a while (on sites that didn't mention bots in their ToS) and kept complete logs of cards seen and player actions. There were plenty of players who could beat his bot, but his bot would refuse to sit down at tables with players with too good records against it. With three credit cards running three accounts, that poker bot was paying his rent for the first year or two after he moved out of the fraternity house. He told me a couple of times that he'd give me FTP access to his logs, but never got around to it. When I heard that RC4 had a bias in its key schedule, I thought a bit about how to make an unbiased shuffle, and figured that a lot of people would use a naive biased shuffle. I was curious if my friends poker hands would show such a bias. I also wanted to check against the Perl, GNU C, MS C, and Visual Basic built-in rand() implementations, checking for srand(time()) and srand(time()^getpid()). (Perl still ruled the web in those days.) Later, an academic paper came out explaining that the most common poker site software was written in Pascal, and had both flaws I wanted to look for (plus another flaw due to an off-by-one error in the author's understanding of the Pascal Random() API.) I didn't think to look at popular Pascal implementations' pseudorandom number generator implementations, so I doubt I would have found the predictable prng seeding flaw via my friend's logs, but there's a chance I would have. I'm not sure how much an edge in poker the shuffle bias flaw gives, but I imagine it's tiny.