3 ms·

> From a USA point of view: it's highly regulated at the state level. State gaming commissions hire third-party labs to audit the mathematics and software to ma

by majos 9y ago

> From a USA point of view: it's highly regulated at the state level. State gaming commissions hire third-party labs to audit the mathematics and software to make sure everything matches what the manufacturer says it does. Can you point me to more info on this "auditing" process? For all the recent coverage of "algorithmic fairness" (an area where I do some research) I'm not aware of any other usecases where mandatory software audits are common, so this is interesting. Who are these labs?

joezydeco 9y ago
One of the most popular labs in this line of work is GLI (Gaming Laboratories International) http://www.gaminglabs.com/ http://www.gaminglabs.com/ Here's a doc from their site about RNG testing: http://www.gaminglabs.com/pdfs/GLI%20Comp%20Sub%20Req%20V1.2.pdf http://www.gaminglabs.com/pdfs/GLI%20Comp%20Sub%20Req%20V1.2...
- majos 9y ago
  Thanks, this is pretty thorough. Do you by chance know how these verification systems arose -- goverment intervention or, somehow, from within the industry? It's remarkable to me that good software verification practices (well, trusting this document and knowing only a little about verification in general) is up and running for casinos, not banks or other important software users.
  - joezydeco 9y ago
    From my experience, which is a very small intersection of a software validation background combined with work in the gaming industry, labs like GLI sprung up from demand. Gaming laws were written to require independent verification from the start which seems smart. That said, labs like GLI don't really comb the entire code for bugs. They're looking for obvious things like backdoors, flaws in random number generation, payout table problems...blatant things that would make a machine fail against the player. Bugs still do happen. Google for "$42 million jackpot denied". You'll find multiple instances over the years, and you'll also quickly see that the actual amount in question is almost always $42,949,762.95. Why is that number special? =)
    - majos 9y ago
      Heh. Overflow? Funny (maybe not to "winners").
      - joezydeco 9y ago
        Technically a 32-bit underflow (2^32-1, or 0xFFFFFFFF), but you've got it. Remember, kids: don't mix error states and return values.

by majos 9y ago

joezydeco 9y ago

One of the most popular labs in this line of work is GLI (Gaming Laboratories International) http://www.gaminglabs.com/ http://www.gaminglabs.com/ Here's a doc from their site about RNG testing: http://www.gaminglabs.com/pdfs/GLI%20Comp%20Sub%20Req%20V1.2.pdf http://www.gaminglabs.com/pdfs/GLI%20Comp%20Sub%20Req%20V1.2...

majos 9y ago
Thanks, this is pretty thorough. Do you by chance know how these verification systems arose -- goverment intervention or, somehow, from within the industry? It's remarkable to me that good software verification practices (well, trusting this document and knowing only a little about verification in general) is up and running for casinos, not banks or other important software users.
- joezydeco 9y ago
  From my experience, which is a very small intersection of a software validation background combined with work in the gaming industry, labs like GLI sprung up from demand. Gaming laws were written to require independent verification from the start which seems smart. That said, labs like GLI don't really comb the entire code for bugs. They're looking for obvious things like backdoors, flaws in random number generation, payout table problems...blatant things that would make a machine fail against the player. Bugs still do happen. Google for "$42 million jackpot denied". You'll find multiple instances over the years, and you'll also quickly see that the actual amount in question is almost always $42,949,762.95. Why is that number special? =)
  - majos 9y ago
    Heh. Overflow? Funny (maybe not to "winners").
    - joezydeco 9y ago
      Technically a 32-bit underflow (2^32-1, or 0xFFFFFFFF), but you've got it. Remember, kids: don't mix error states and return values.