So it wasn't really as fair as you marketed it after all? Your post seems legit and you reacted quick.
In 2016 I built a Loto website for STEEM (I think it was the first gambling app), and even Dan Larimer asked me to use the block hashes for 'provably fair' verification (see https://steempeak.com/steemloto/@heimindanger/introducing-the-first-steem-dollars-lottery-only-usd0-01-sbd-per-ticket) so I guess people cannot blame you so much for doing this. But obviously Dan Larimer was trying to cheat too, he knew these hashes are manipulable (PoW was fast and easy in Steem back then)
My main question is how do you feel about lying to your customers about having a 'provably exploitable' instead of 'provably fair' pseudo random number generation algorithm? And how bad do you think this would have been if your userbase was 100x bigger than what it is today?
Finally, who was the witnesses who controlled the hashes of the blocks where the attack happened, you should blame him and try to get him unvoted out of top 20?
They used transaction hashes. Those are different, as they can be pre-computed by anyone before sending the transaction. There's no one else to blame but them, for using a mechanism they didn't understand in a critical part of their system.
Block hashes are way harder to manipulate, it would need to be done by the witness producing that block, which is not really trivial to do (calculate hash with the tx included, if win publish the block with, if not publish it without the tx) and as you correctly said should absolutely result in downvoting him.
If you use the hash of a later block than the one the transaction is included in there's no way to cheat it, and Dan's suggestion would've been totally valid.
//edit: well, I guess witness collusion would be theoretically possible, if the witness following the one including the bet publishes a block with a fitting hash. That won't always work though, as it requires quite some calculation to find a fitting block, and during that time you may miss the time window to publish. It would also require at least one of the two to be a top-20 witness)
Not sure if you get the full context of the post. There is zero lying from the first day of conducting business. Everything is exploitable, as long as you try hard enough.
This attack has nothing to do with the witness status, it just that the attacker happens to be a witness. Anyone possess of the Steem coding structure and logic can perform the exact same knowledge.
disagree on so many points