Declined scrap.tf

It's not about Steamlottery.com being unsafe, it is about Geel using a bypass to trick users into giving him entry tickets so that he can get a free game by abusing a popular site
At least his tickets should get removed

I sent a message to the user who made steamlottery on facepunch.

Good to know that he will get what he deserves

The SteamLottery exploit was to bring attention of the exploit to the owners. I already own Bioshock Infinite and had warned the owners of SteamLottery of the exploit ahead of time.

The security holes in the website were due to the chat system and have been fixed.

The FP Toolkit was a long time ago.

Rather, by ahead of time I mean "as soon as I was aware it worked"

So that means you didn't?

Plus neither of you didn't seem to take any further precautions to protect users.
The session keys I have obtained because of those security holes, most of them still work, which indicates you ( or jesse ) have not even bothered wiping sessions.

What? Of course I did. I informed them of the exploit, and their response was akin to "it's not an issue."

I thought the sessions had been wiped. I'll do that when I'm available.

Not really. Quickswitching is when a user puts up an item, lets say buds, then he switches the buds to mad milk without the other user noticing.
In this case we're talking about a bot that doesn't put up any items to begin with.

Besides, it's a bot that's run by a script. Bugs are bound to happen. I don't think it's doing it intentionally, unlike users who quickswitch.
So I don't see how it's the same thing?

Not to mention that I have traded with the bots nearly 500 times and I've never seen that bug happen, so basically saying "lol nope, you don't deserve it" because such a bug MIGHT happen is kind of dumb.

Strange how other sites seem to not have this problem?
And I can agree that quickswitching is a different type of scam, but it turns in to a scam the second they promise you an item, and then blame it on the bug with the words "We do not give refunds"

So basically I can make a site like scrap.tf and make it actually malfunction every 1000th trade, and blame it on a bug with the policy that I do not give refunds even tho the problem is clearly on my end?

I'm happy to address some issues and concerns here.

Firstly, it's hard to compare a simple malfunction to purposeful deceit such as quick-switching (which in any case is not at all like the malfunctions people have received, seeing as the bots are not swapping items at all). I also don't know where the "no refund" policy that people are referring to is, because there is a topic on the forums that has been there for quite a while allowing users to report that they have had a malfunction and have not received the proper amount in question. We also encourage people to make a topic if they have not received the amount they should have. While the site does hold some responsibility, it is still the responsibility of the end user to check that everything is okay in the trade, just as they should with any trader (bot or not).

Secondly, I agree it was very irresponsible for Geel to abuse his position into farming tickets for a raffle, legitimate or not, and I can't really comment much upon this.

There was a lapse of security in the chat function of the website, however, the site does not store credits of users and there are no I.O.U type facilities. Every trade is a simple item-to-item trade. If an event occurred where items were somehow stolen from the site then the only users affected would be the site developers as the site does not hold items of any other user.

Lastly Regen I feel as if you haven't actually used the site, your postings don't seem relevant and appear more as if they were imagined scenarios... if an error occurs the bots don't quickswitch an item for another they simply just don't put it up, which is very obvious to the end user (why would a user accept a blank trade?).

I'm happy to answer more questions and concerns, however I feel as if most of them are exaggerated.

Cited in my OP, and when you login to scrap.tf now there is a big popup with these terms. You must agree before using the site. http://scrap.tf/rules : " it is your responsibility to check the items in a trade. If a bot isn't giving you the items, don't accept the trade."

"So stop making threads about this.
Just don't accept the trade, and no we won't give refunds as per rule 2"

The site's responsibility doesn't end when the trade is made.

You're being disingenuous. If you bank 100 weapons, you may or may not receive 50 scrap. The discrepancy will not be obvious. Ditto buds for keys, etc.

I'll bet.

It's clear you haven't looked into the issue at all, since the issue you're describing is not the issue at hand.

The bots have no issue providing payment for items. The bots only have rare issues where they do not put up some of the weapons reserved for a trade. This only occurs with weapons.

I don't understand why you would make no refunds a policy, then?
If the bot doesn't give the item, then that is the developer's fault, not the user's. If it's an issue you are aware of and can't fix, then it should be something you take full responsibility for.
While the user should have made sure everything was fine, he shouldn't have to in an automated system. It isn't their responsibility to make sure it goes smoothly. It is yours.

I didn't know scrap.tf was so sketchy. I agree with Ace. If your script messes up, you should refund someone's items.

No. They absolutely do have issues giving metal for weapons. You put up X weapons, bot says "you will receive X/2 scraps", puts less than X/2 scraps in the trade, and will ready if you do. It was this very issue I set out to report to you, when you started banking buds, until I came across your announcement in my first post ("stop making threads").

I immediately stopped dealing with scrap.tf then, so I never got to see if buds trades are vulnerable the same way.

This is the kind of disconnect that can happen when you tell your users you don't care to hear about problems.

Found the screenshot I took of this bug. You can see the bot readying in the trade history, and me removing/adding items to force it to recount (which doesn't work).

Didn't realize the "I've added x weapons. You must put up (x/2) scrap." cause an issue like this. Geel/Jessicar, i have this fixed in mine. If items aren't added, it tells the user it wasn't able to add all the items, and they can pay for the ones it did instead of the total they had reserved. Not 100% sure how you guys do code, but i can tell you how i do mine if you need to.

@ naknak: Wow. Never knew the bots would do this =o

And I can agree that quickswitching is a different type of scam
And I can agree that quickswitching is a different type of scam
And I can agree that quickswitching is a different type of scam
And I can agree that quickswitching is a different type of scam
And I can agree that quickswitching is a different type of scam

With this I withdraw my previous statement that it was like a quickswitch scam. ( Do you get it now?)

There are a few different things that can cause that bug.

Firstly, the steam inventory could have been out of date when the bot fetched it. This is the most likely and there's not much we can do about it.
Secondly, there could have been an error on the steam network side that caused it to believe that it sent an item when it didn't. This appears to not be the case.

In any event, I make it a personal policy to give refunds; Jesse does not. Jesse wrote the rules and I overlooked that rule. I'm going to be changing the rules to reflect that we do give refunds if there is an error on our side.

In our defense, the no refunds policy was put in place because people were occasionally putting in items they did not want to scrapbank and then asking us for a refund. We couldn't give them a refund because the item had already left our system.

I have always given a refund to people who ask if it's our fault.

Yes there is, you can fix the issues or cease to use such a system. While offering a "refund to people who ask" sounds fair, it is probable many people would not bother, thus garnering advantage for a flaw scrap.tf is aware of and should be responsible for.

An automated service with active promotion in the form of a website and all the attendant paraphernalia cannot be equated to a user to user trade, where the buyer has an equal onus of verifying fairness. The presumption must be (just as in the real world) that the party with knowledge, power and control in the transaction bears the lions share of responsibility. Scrap.tf is aware of the potential problems due to coding, users are not. Users come in many flavors, many of them are stupid and no form of blanket waver can place an undue onus upon them to use common sense, especially in light of the fact Scrap.tf is aware of the issues involved.

From the sounds of it you guys are going to implement a clearer policy to make it easier for anyone genuinely affected to find relief and that can only be a good thing, hopefully along the way the root causes of any such issues can be sorted out in code to eliminate any such rare eventualities.