ToorCamp8 2024 - SHADYBUCKS – Karl Koscher & pinguino kolb

[Music] [Applause] all right so who here has used Shady bucks awesome uh let's see who he's from bureaucracy yeah who hears from Shady uh Shady tail yay they I think they're busy installing all your phone networks right now yeah yeah uh so what what is bureaucracy so bureaucracy is how it's the DMV of uh tour Camp it's you stand in line uh you fill out forms and you get beer and it's very gamified very fun and we're located right behind Shady T yeah awesome some people L being the phone company we l being the DM yeah so uh speaking of laring the the phone company uh so the uh Shady tell if you don't know provides uh the phone service here at Camp uh kind of the origins started uh as like a ship posting parody Twitter account um but and you know we had some funny posters uh but then tour Camp 2012 happened in Nia Bay and there was no cell phone service there so we were asked to provide uh some phone service there so uh we uh actually got into providing real service and not just sh posting on the internet uh so we made the SIM cards uh and you know had Shenanigans uh this is the shitty tell uh that someone made um yeah so that's a brief history of shady to uh and so after the 2016 we realized that we had a shared kind of cabin space we were on one side shitty was on the other side somebody microwaved some food and it knocked down the phone network so we had to go over and introduce ourselves and say hi and apologize a bunch um after that year we decided we were going to collaborate when or actually the year after that we started bureaucracy doing all the and stuff and then we realized we were kind of two utilities and we should work together yes uh combine our monopolies um so we were we were discussing last night and and trying to re-remember how we actually came up with the idea of shady bucks and uh um I think the the idea uh came from uh ASD who really wanted one of these kerchunk machines yeah I I like woke up to text messages and just links to the this machine and so we designed the game around having a reason to buy this machine which involved making like physical little credit cards yeah th this is the actual uh chinesium instructions that came with the machine uh you can get this off of Amazon it's great you should exp yeah and so we we were having uh we were talking uh with asteroid last night and she said you know I was surprised how easy it was to get fake credit cards made um and uh she was talking with a a card manufacturer and they weren't quite sure what uh what we were trying to do and then they're like oh so you're like giving out you know trade show swag and she's like yep that's it great show swag and so this was our first prototype uh yeah um but then uh so then uh I got a design template and made an actual real card that looks pretty legit so this is the kerchunk machine and action you have to uh rotate it to the right digit or letter that you want and then K chunk it um it's a very satisfying noise you want to say anything more about that um yeah we huh you get chunce you can get b oh bold Tex yeah yeah okay maybe that's how it broke yeah so that's delicate be careful when you C chunk this year we're not entirely sure the machine still works but we we did bring it y so the way it worked last year was you would go to Shady tail and activate your card and then come back over to bureaucracy and do the K chunking part so this year we'll probably do something similar if the machine's up yeah we we actually had you K chunk at uh at bureaucracy first because you put that's how we knew your name you had to put the name on it and then we could encode it on the max stripe we'll talk about what's on the Mac stripe um in a bit but let's see here um so yeah uh two weeks after the conversation came up with the logo uh we were doing all the night market like deer Punk stuff um the deer Punk theme just digging through these messages that came from Scotland originally but we designed Night Market as a cyber Night Market where you can spend your shady bucks buy s and trade um you can use real money there too if you want but Shady bucks is way more fun and if you see uh if you haven't been to Tor Camp before and you saw the all the Easy Ups kind of in a row near Shady tail with the big other Dome that's where Night Market it's going to be uh uh tonight and tomorrow night um from like 10: to 2:00 a.m. all kinds of stuff there's food there's somebody's making ice cream somebody's making uh cookies um lots of of just like electronics and stuff yeah it's very cool uh so shortly after we released this um there uh so there's a con contest here uh titanium chef and uh an entrepreneur decided who's right here in the audience decided to set up a beding pool um among other things uh and then a casino popped up and grilled cheese grilled cheese too grilled cheese yeah uh so that was awesome and bought poker I I remember yes they they did uh buy all the poker chips available on the island um and this you know this makes us kind of nervous because now we're getting into like are we like a quasi currency and like do do we have to like register with the state and all these governments and all that and the answer um that I am going with is no we are a loyalty program now there is a precedent for this how many of you are familiar with Canadian Tire money all right there's a few of you so as it turns out Ebay actually in their terms of service I'll blow it up uh in a minute this is an archive of their terms uh one of the accepted payments on Canadian eBay was Canadian Tire money um and apparently it is the um what most successful loyalty program uh retail loyalty program in the world so um it is a Rewards program uh the plan was we would give you um one Shady Buck per minute that you use the phone or we would charge you one Shady Buck per minute to use the payphones uh so the economy um there are like three thing there are we basically didn't want to make it a pay forplay experience um we didn't want yeah um we recognize that uh the most precious resource at tour Camp is your time um and so the official unit of shady bucks is a minute uh because we're the phone company and that's how we bill um in sixc increments uh which is on10th of a minute uh so a lot of people have asked like where do the numbers come from and there's this International standard uh ISO 7812 uh which is a numbering system for the identification of the card isues blah blah blah um so the format of the number is broken down like this so we have 89 which is the Telecom prefix country code 979 which is international premium rate then we have 8667 which spells out tour um on the phone pad then the year and then uh the account number and the check digit so this numbering scheme actually uh is what real credit card use it's what SIM cards use it's what airline tickets use uh it's it's pretty Universal and um as far as I know no one is using the international premium rate um code so we're just squatting on that uh so what's on the ma stripe uh there's typically uh so this is what uh credit cards normally use so uh there's usually two tracks this is track two so you have the primary count number uh which is that number I just mentioned uh then there's you know the expiration date um then there's what's known as discretionary data and this is basically used to prove that um you had read the magstripe um so this is what prevents you from just picking a random account number and um and making your own magstripe now there was a little bit of confusion last time because we wanted to have a CTF um where you had to read the magstripe and so a lot of the mag Stripes uh actually had duplicate discretionary data and so part of the reason for Activation was so that we could rewrite that and make that unique per card so you couldn't just like Forge anyone's uh card um track two is more of the same except it also has uh your name it's alpha numeric it has uh discretionary data too um so uh credit card transactions in the real world um you have uh an authorization process um let me I didn't realize this was animated um so basically when you go to use a card um your card is authorized for a certain amount and that guarantees to the merchant that you are good for at least that amount um and there's there's some reasons why it's done like this but where will commonly pop up is like with gas stations that will authorize your card for like $75 or if you're at a restaurant uh it will authorize your card for an additional tip as well um hotels do this as well normally you don't notice this and you unless you use a debit card um and then that explains the difference between your available balance and your actual balance uh so we actually mirror this as well with Shady Buck you can do a pre-authorization uh so for example with the vending machine it will pre-authorize for some certain amount you can spend up to that amount then when you're done it will actually charge your card uh for the actual amount that you uh spent so we mirrored uh how this works um basically with the web API uh we do have a nice um uh uh front end on top of this um so basically the uh the structure is we have um postgress which we chose for um being able to do transactions so doing things at automically either everything uh succeeds or fails so you don't uh get discrepancies in the account um uh unfortunately uh we could not express the constraint that uh the accounts must balance uh the debits uh and credits Must ALL sum up that's what we were hoping to do uh didn't work out uh talk about that in a bit um we have a Rus cache we have some web apis um so it turns out it was kind of performant um in like couple of days we did 4.4 million transactions I don't know uh what our Peak transactions per second was but um it might be competitive how many did we do oh okay all right doesn't seem with huh number of arms available yeah yeah so so something something went something Shady happened here so so here here's the code that actually does uh does the capture process so we have this um uh with a transaction here so if any of these um uh this is python so if any of these lines fail or throw an exception uh everything in here will throw back uh will uh roll back uh so we make sure that there's an authorization uh we say that the authorization has posted we subtract the amount from one account we add it to another account and then we insert a transaction record and if this block uh completes it will complete automically and everything should uh balance except there's a problem so if you spec so the account the uh the data type of the amount is a decimal number with two decimal digits and if you have a fractional scent um these two uh lines here will behave differently um depending on whether you subtract half a cent or add half a Cent and that's when things uh suddenly no longer uh balancing out uh so yeah the uh God uh the one minute per Shady Buck thing is kind of out um we are announcing new for this year that inflation has hit the Shady economy but we have a stimulus plan don't we yeah we do 500 free shiy books for everybody at tour Camp so last time we gave out a a $50 uh or 50 Shady Buck uh welcome bonus for everyone this year we're 10 Xing it so uh that officially uh we're kind of 10 Xing everything uh in the economy this year um both to uh I don't know inject more activity into it and make it fun and also to balance out some of the shenanigans that happened uh last time uh so also new this year are these wristbands uh that we gave everyone um and these serve a couple of purposes one uh we uh tour Camp needed um wristbands too yeah they identify staff for attendee do not lose your wristband like absolutely that's how you get identified that you're belong here that you paid to be here do not lose your rest band but it's also your wallet because your shady bucks are on your hand yeah so uh we're we're adding Shady bucks to um to these wristbands actually the these were like I don't know 30 cents each or something they were surprisingly cheap uh to get made um they are NFC they are myair ultral light uh C tags which can do Mutual triple desk authentication uh so you can't easily clone it um I Heard a story the other day about someone being able to clone the RFID tags on Disney World Cups so they can get like free refills for life or something um it's a bit harder to to clone these um uh so once we authenticate that we're talking to the actual tag the the uid is used uh to link it to your shady box account it's also you can format it as an in-depth record uh you could write arbitrary things and uh Boop each other's wristbands for for fun uh the mutual authentication scheme goes like this I'm not going to read from the data sheet um you can look it up uh but basically the way that we keep this secure is that all the keys are kept on uh our server uh and then to make this happen we have this app the app asks the tag for a challenge the tag re sends that challenge over to the server the server computes the response based on the triple desk Keys it sends that back to the app it it does a whole bunch of relays back forth and once this succeeds uh the server gives you an NFC token which is valid for uh a single transaction uh so in short uh try to hack us don't hack them not the venue uh please not the venue uh yeah so um the the uh tags themselves are blank right now um because we didn't want to go through and and pre-write all of these uh risk bands um so we will be doing that and linking them with your existing Shady bucks account or giving you a new Shady bucks card uh an account um starting later today I think around 4 pm after 4 pm go to the Shady Shady t uh bo yeah um one other thing that uh I forgot to put in here um yeah so uh we got integration uh with the payones working um so big shout out to kit for that he um actually wrote there he is uh he actually wrote the software to to activate the wristbands uh do he has a vending machine that will accept uh cards and wristbands um and if we get the the phone network up um you will be able to use uh uh Shady bucks in in the payones and it will do uh authorizations against your actual Shady bucks account if you have artwork you want to put in his vending machine the vending machine lives at night market go talk to kit uh I think we have like one minute for questions uh so so it was it was uh it was an integer in in sense uh and the SQL type was uh a decimal type huh want you want to use strings oh okay also wanted to mention come to bureaucracy for loans but like later Parker are there any um are there any legal like traps that you fall into if we do anything as a loyalty program that pushes us into like broker deal territory I am not a lawyer uh yeah you got to go to lawyer camp for that yeah do we have any lawyers in the audience just asking what's illegal it's it's all fake actually this this goes back to to one potential issue that we had uh so um turns out Google is is a lot more aggressive and approving apps these days uh and so I was concerned about whether we would actually they would actually flag it as a money transmitt app uh so that's the reason that you have to sideload it also they take forever to approve things these days um so that's our time more yeah sure huh yeah so I got my first iPhone yesterday uh to try to do this uh everything is open source on GitHub right now both the Shady Bank um and uh the apps uh and uh go to github.com Shady Tel um so if you want to write the IOS app I can tell you what apis you need to use I just don't have the time nor do I have the iOS experience too yes uh how do you get Shady bucks yeah so there's a a a variety of ways that you can get Shady buck so uh we have authorized villages to hand out Shady bucks for doing various activities uh RF Palace does it you can get a loan from bureaucracy um Al everybody gets 500 Shady books when you go turn your card on yeah you can also sell stuff at the night market you can trade it for other people you can um I don't know be be creative just ask people yeah okay one last question are account numbers sequential yes um yeah so uh that that xxxx is is a sequential number um and it it that is sequential and then it's just the tech check digit so there you go all right thanks thank you [Applause] [Music] he [Music]