DEV Community: desgh white

Modeling Self-Exclusion as an Explicit State Machine

desgh white — Tue, 18 Aug 2026 16:46:07 +0000

Some product rules are too important to live as scattered if checks. Account restrictions — cooling-off, self-exclusion, reactivation — are one of them: get the transitions wrong and you either trap a user or fail to honor a limit they set. A finite state machine makes the rules auditable.

Enumerate states and legal transitions

from enum import Enum

class State(Enum):
    ACTIVE = "active"
    COOLING_OFF = "cooling_off"     # short, timed, auto-reverts
    EXCLUDED = "excluded"           # long, cannot self-reverse
    CLOSED = "closed"

TRANSITIONS = {
    State.ACTIVE:      {State.COOLING_OFF, State.EXCLUDED, State.CLOSED},
    State.COOLING_OFF: {State.ACTIVE},          # only after the timer
    State.EXCLUDED:    {State.CLOSED},          # no path back to ACTIVE
    State.CLOSED:      set(),
}

def transition(current, target, *, timer_elapsed=False):
    if target not in TRANSITIONS[current]:
        raise ValueError(f"illegal {current}->{target}")
    if current is State.COOLING_OFF and not timer_elapsed:
        raise ValueError("cooling-off still active")
    return target

The value is in the transitions you forbid

Making EXCLUDED -> ACTIVE unreachable in code means no endpoint, feature flag, or support tool can accidentally re-enable a self-excluded account. The illegal transition throws instead of silently succeeding. That's a guarantee a pile of booleans can't give you.

Log every transition

Persist an append-only history of (from, to, actor, reason, ts). When someone asks "why is this account restricted," the answer is a query, not an archaeology dig — and it's the record you'll want during an audit.

Reference

Responsible-play controls are a good real-world example because the transitions are legally load-bearing. Seeing how a site like here presents its deposit-limit and self-exclusion options maps neatly onto states a user can enter freely but not always exit on demand.

Takeaway

Name the states, whitelist the legal transitions, make the dangerous ones unrepresentable, and log the rest. The state machine turns a safety-critical rule from hopeful if-checks into something you can prove.

Deterministic Simulation: Reproducing a Physics Result From a Seed

desgh white — Tue, 18 Aug 2026 16:45:23 +0000

A simulation you can't reproduce is a simulation you can't debug. Whether it's a wheel, a particle system, or a Monte Carlo pricing model, seeding every source of randomness turns "it failed once, somewhere" into a bug you can replay on demand.

Thread the seed, don't read the global

The cardinal sin is calling a global random(). The moment two subsystems share global state, execution order changes results. Pass a seeded generator explicitly:

import random

def spin(seed, pockets=37):
    rng = random.Random(seed)                 # isolated, reproducible
    velocity = rng.uniform(8.0, 12.0)
    friction = rng.uniform(0.02, 0.05)
    # deterministic physics from here on
    pos = 0.0
    while velocity > 0.1:
        pos = (pos + velocity) % pockets
        velocity *= (1 - friction)
    return int(pos)

assert spin(42) == spin(42)                   # same seed, same result, always

Reproducibility is a testing superpower

With a seed you can pin a failing scenario as a regression test, bisect a divergence between two builds, and record-replay a production incident. "Flaky" almost always means "unseeded shared state," not "genuinely random."

Beware hidden nondeterminism

Dict iteration order, floating-point summation order across threads, and wall-clock reads all sneak nondeterminism past your seed. Sort before you iterate, reduce in a fixed order, and inject the clock.

Reference

Wheel-based games are a tidy example because the outcome is a single reproducible integer given a seed. A game like visit the website exposes a self-contained round whose result derives entirely from its seed and rules — the same discipline that makes any physics sim replayable.

Takeaway

Seed every generator, pass it explicitly instead of touching globals, and hunt down hidden order-dependence. Reproducibility costs one parameter and pays for itself the first time you have to debug a rare failure.

A/B Testing an Onboarding Funnel With Statistically Honest Stops

desgh white — Tue, 18 Aug 2026 16:43:47 +0000

Most onboarding A/B tests lie, not because the code is wrong but because someone peeked at the numbers and stopped the moment they looked good. Honest experimentation is mostly about deciding when you're allowed to conclude.

Assign once, stick forever

A user must see the same variant for the whole experiment, or your data is noise. Hash a stable id into a bucket:

function bucket(userId, salt, buckets = 2) {
  const h = createHash("sha1").update(userId + salt).digest();
  return h.readUInt32BE(0) % buckets;
}

Deterministic assignment means no server-side state and no chance of a user flipping variants on their second visit.

Peeking inflates false positives

Checking significance repeatedly and stopping at the first p < 0.05 turns a 5% error rate into 20%+. Either fix the sample size in advance, or use a sequential test (e.g. always-valid p-values) designed for continuous monitoring. Pick one before you launch, not after the graph gets interesting.

Measure the outcome, not the click

Track completed activation — the funnel's actual goal — not intermediate clicks. A variant that boosts step-2 clicks but tanks final signup is a regression dressed as a win.

Reference

First-run flows are worth studying wherever activation is the whole business, because the layout is tuned aggressively. Stepping through a registration like Vegas Hero shows how a low-friction first-run funnel front-loads the value proposition — a useful control to benchmark your own completion curve against.

Takeaway

Assign variants deterministically, decide your stopping rule before launch, and measure completed activation. The statistics are simpler than the temptation to peek — resist the peek and the test tells the truth.

Rate Limiting Bonus Abuse Without Punishing Real Users

desgh white — Tue, 18 Aug 2026 16:43:03 +0000

Any promotion with value attached attracts automation. The challenge isn't blocking bots outright — it's throttling abuse while leaving genuine users untouched. A token bucket per identity, plus a few signals, gets you most of the way.

Token bucket over fixed windows

Fixed windows are gameable at the boundary (burst at 11:59, burst again at 12:00). A token bucket refills continuously and caps bursts naturally:

class Bucket:
    def __init__(self, rate, capacity):
        self.rate, self.capacity = rate, capacity
        self.tokens, self.ts = capacity, time.monotonic()
    def allow(self, cost=1):
        now = time.monotonic()
        self.tokens = min(self.capacity, self.tokens + (now - self.ts) * self.rate)
        self.ts = now
        if self.tokens >= cost:
            self.tokens -= cost
            return True
        return False

Key the bucket on the right identity

IP alone is too coarse (shared NATs) and too easy to rotate (proxies). Combine signals: account age, verified payment method, device fingerprint. A fresh account claiming its first bonus is fine; the same device spinning up its twentieth account is the pattern you actually want to slow down.

Fail open for humans, closed for machines

When in doubt, add friction rather than a hard block: a challenge, a short cooldown, a manual review queue. A false positive that costs a real user a bonus is worse PR than an abuser getting one extra claim.

Reference

Sign-up promotions are a natural case study because the abuse incentive is explicit and measurable. A welcome offer like learn more states clear per-account eligibility terms — the kind of one-claim-per-identity rule that maps directly onto a bucket keyed by verified account rather than raw IP.

Takeaway

Use a token bucket for smooth throttling, key it on durable identity signals instead of IP, and prefer graduated friction over hard blocks. You stop the scripts without taxing the humans.

Idempotency Keys: Making Withdrawals Safe to Retry

desgh white — Tue, 18 Aug 2026 16:42:16 +0000

Any endpoint that moves money must survive being called twice. Networks time out, clients retry, users double-click — and without idempotency, a retried withdrawal pays out twice. The fix is a small amount of discipline at the boundary.

The client supplies the key

The caller generates a unique key per logical operation and sends it with the request:

POST /withdrawals
Idempotency-Key: 8f14e45f-ceea-467a-9d0e-...
{ "amount": 50.00, "currency": "AUD" }

The server stores the key with the result of the first successful call. A retry with the same key returns the stored response instead of executing again.

Store the outcome, not just the key

def withdraw(key, amount, account):
    existing = db.get_idempotent(key)
    if existing:
        return existing.response          # replay, do not re-execute
    with db.transaction():
        result = execute_payout(account, amount)
        db.put_idempotent(key, result)    # same tx as the side effect
    return result

The record and the side effect must commit in the same transaction. If they don't, a crash between them either double-pays (key not saved) or loses the payout (key saved, payout rolled back).

Scope and expiry

Keys are scoped per account and per endpoint, so one user's key can't collide with another's. Expire them after a day or two — long enough to cover any sane retry window, short enough that the table doesn't grow without bound.

Reference

Cashier flows are a good place to see this pattern under real load, since a duplicated withdrawal is an immediate, visible failure. Watching how a withdrawal at a site like wantedwin casino review confirms a request exactly once — even if you refresh mid-submit — is a concrete example of idempotency done right.

Takeaway

Take a client-supplied key, persist the result alongside the side effect in one transaction, and replay stored responses on retry. A few lines at the boundary turn a double-payout bug into a non-event.

Provably-Fair RNG: Verifying Randomness You Didn't Generate

desgh white — Tue, 18 Aug 2026 16:41:32 +0000

When an outcome is generated on a server you don't control, "trust me, it's random" is not an engineering answer. Commit-reveal schemes let a client verify after the fact that the result wasn't rigged, and the pattern generalizes far beyond games — any time a server picks a value the user cares about.

The commit-reveal handshake

Before the round, the server commits to a secret seed by publishing its hash. The client contributes its own seed. The outcome is derived from both:

import { createHash, createHmac } from "crypto";

const serverSeed = randomBytes(32).toString("hex");
const commit = createHash("sha256").update(serverSeed).digest("hex"); // sent first

function outcome(serverSeed, clientSeed, nonce) {
  const h = createHmac("sha512", serverSeed)
    .update(`${clientSeed}:${nonce}`)
    .digest("hex");
  return parseInt(h.slice(0, 8), 16) / 0xffffffff; // uniform in [0,1)
}

Why the client seed matters

Without a client contribution, a malicious server could grind seeds until it finds one that produces a favorable result, then publish that hash. Mixing in a value the server couldn't predict when it committed removes that degree of freedom. This is the same reason nonces exist in signed requests.

Verification is the whole point

After the reveal, the client re-hashes the revealed serverSeed, checks it matches the earlier commit, and recomputes the outcome itself. If either check fails, the server cheated. Ship a small open verifier so users can run it independently — a scheme nobody can audit is theater.

Reference

Operators that publish their fairness scheme make good study material because the verifier is exposed to the public. Looking at how a site like play at Wyns Casino documents its seed commitment and lets players re-derive a result is a compact example of turning "trust us" into "check it yourself."

Takeaway

Commit to a hashed seed, mix in a client seed the server can't predict, derive the outcome via HMAC, and hand users a verifier. The cryptography is three functions; the trust model is the actual deliverable.

Feature-Flagging a Signup Funnel: Shipping Onboarding Changes Without Fear

desgh white — Fri, 14 Aug 2026 09:34:26 +0000

The signup funnel is the highest-stakes flow you own — break it and revenue stops the same minute. Feature flags let you change it continuously without betting the funnel on every deploy.

Flag the flow, not just the button

Wrap whole onboarding variants, not individual widgets, so you can compare a two-step and a one-step signup as coherent experiences:

const variant = flags.get("signup_flow", { userId });
return variant === "single_page" ? <SinglePageSignup /> : <SteppedSignup />;

Roll out by cohort, measure by funnel

Release to 5% of new users, watch completion rate per step, and only widen when the variant beats control on finished signups — not on vanity clicks. A flag without a metric is just a hidden bug waiting to be forgotten.

Kill switch over rollback

A deploy rollback is slow and coarse. A flag flip is instant and surgical: if activation dips, disable the variant in seconds while you diagnose, with no redeploy and no user-visible downtime.

Reference

Operators optimize registration relentlessly because the first-run drop-off is so expensive, which makes their funnels a useful study. A signup like Mostbet Casino1 shows a low-friction registration with clear starting terms — the kind of streamlined first-run experience worth benchmarking your own completion rate against.

Takeaway

Flag entire flows, roll out by cohort against a completion metric, and keep a flag-based kill switch ready. You get to improve the funnel every day instead of holding your breath on release night.

Programmatic Trust Signals: Verifying a Site Before You Link to It

desgh white — Fri, 14 Aug 2026 09:33:42 +0000

"Is this site legit?" is a question you can partly answer in code before a human ever looks. Here is a small pipeline of automated trust signals worth checking when you evaluate an external domain.

Certificate and TLS posture

A valid, non-self-signed cert with a sane expiry is table stakes. Pull it and inspect the chain and remaining validity:

const { peerCertificate } = tlsSocket.getPeerCertificate(true);
const daysLeft = (new Date(peerCertificate.valid_to) - Date.now()) / 8.64e7;

Short-dated or mismatched-SAN certs are a cheap early red flag.

Domain age and registration

Freshly registered domains correlate with throwaway operations. A WHOIS lookup for creation date and registrar gives you a quick risk prior without any manual review.

Check what the site says about itself

Reputable operators publish an ownership / "about us" page, a licence reference and contact details. Fetch it and assert the signals exist rather than trusting a homepage banner:

const about = await fetch(base + "/wie-zijn-wij/").then(r => r.text());
const hasLicence = /licen[cs]e|KSA|kansspelautoriteit/i.test(about);

Reference

An ownership page is exactly where these signals should live. Checking whether is lalabet betrouwbaar is a question a page like a site's "about us" section should answer directly — company details, licensing and responsible-gaming policy in one place — which is the kind of transparency your verifier can score automatically.

Takeaway

Automate the boring checks — TLS, domain age, presence of ownership and licence disclosures — and reserve human review for the judgment calls. Trust that starts with code scales; trust that starts with a gut feeling does not.

Designing a Transparent Ranking Score That Users Can Actually Audit

desgh white — Fri, 14 Aug 2026 09:32:59 +0000

Any "top 10" list is an opinion encoded as a number. If you cannot explain why item A beats item B, users are right not to trust it. Here is how to build a ranking whose output is reproducible and auditable.

Separate signals from weights

Keep the raw measurements and the opinion about their importance in different places. Signals are facts; weights are policy:

signals = {"payout_speed": 0.9, "licence_score": 1.0, "bonus_value": 0.6}
weights = {"payout_speed": 0.4, "licence_score": 0.4, "bonus_value": 0.2}
score = sum(signals[k] * weights[k] for k in weights)

Change the weights and the ranking shifts in a way you can explain in one sentence.

Normalize before you combine

Never sum a "hours to payout" (lower is better, unbounded) with a "licence score" (0–1). Map every signal into the same [0, 1] orientation first, or your biggest-magnitude column silently dominates the result.

Make ties deterministic

Floating-point sums produce near-ties that reorder between runs. Round to a fixed precision and add a stable tiebreak (name, id) so the same inputs always produce the same order — reproducibility is a feature reviewers will test.

Publish the method

The single biggest trust signal is showing the formula. A ranked comparison such as https://najlepsze-kasynaonline.com.pl/ is a good example of surfacing the criteria — licence, payout time, real bonus terms — alongside the ordering, so a reader can see why the list looks the way it does.

Takeaway

Split facts from weights, normalize onto a common scale, make ties deterministic, and show your work. A ranking you can audit is worth more than a "better" one you cannot explain.

Rate-Limiting a Promo-Code Validation Endpoint Without Punishing Real Users

desgh white — Fri, 14 Aug 2026 09:32:15 +0000

A public "check this code" endpoint is catnip for brute-force enumeration, but a blunt rate limit locks out the legitimate user who fat-fingered one character. The trick is limiting the right dimension.

Limit by outcome, not just by IP

Count failed validations per identity, and let successes flow freely. A user applying one valid code should never hit a wall; a script guessing thousands should hit it fast:

if not code_is_valid(code):
    fails = redis.incr(f"promofail:{ip}:{hour}")
    redis.expire(f"promofail:{ip}:{hour}", 3600)
    if fails > 20:
        raise TooManyRequests()

Token bucket beats fixed windows

Fixed windows allow a burst at the boundary — 20 requests at 10:59:59 and 20 more at 11:00:00. A token bucket smooths that into a steady refill rate and a small burst allowance, which matches how humans actually type.

Make the error honest but quiet

Return the same generic "invalid or expired" for unknown and expired codes so enumeration learns nothing from the response, but keep the HTTP status distinct from your rate-limit 429 so clients can back off correctly.

Reference

Bookmakers publish time-boxed bonus codes that are a natural target for enumeration, so how they gate validation is instructive. A page like Mostbet Kod Promocyjny shows codes tied to explicit expiry and eligibility rules — exactly the metadata your validator should check before it ever touches the rate limiter.

Takeaway

Rate-limit failures per identity with a token bucket, keep error messages uninformative to scanners, and never make a valid single redemption feel like an attack. Security that punishes real users is just a different outage.

Idempotent Promo-Code Redemption: Making 'Apply Once' Actually Mean Once

desgh white — Fri, 14 Aug 2026 09:31:32 +0000

Promo codes look like a string lookup and turn into a concurrency nightmare the first time a user double-taps "apply" on a flaky connection. Here is how to make redemption exactly-once instead of best-effort.

The bug you will ship first

The naive flow reads the code, checks it is unused, then marks it used. Two requests interleave between the check and the write, and the same code redeems twice:

SELECT used FROM codes WHERE code = $1;   -- both see used = false
UPDATE codes SET used = true WHERE code = $1;  -- both succeed

Make the write the check

Collapse read-then-write into a single conditional update and trust the row count, not a prior read:

UPDATE codes SET used = true, redeemed_by = $2
WHERE code = $1 AND used = false;
-- rows_affected == 1  -> this request won the redemption
-- rows_affected == 0  -> already used, reject

The database's row lock is your mutex. No application-level coordination, no race.

Idempotency keys for the retry storm

Mobile clients retry. Attach a client-generated idempotency key to the redeem call and store it with the result, so a retried request returns the original outcome instead of a second attempt:

POST /redeem  { "code": "WELCOME", "idempotency_key": "uuid" }

Reference

Operators that run bonus codes at scale are a decent study in how redemption, eligibility windows and per-user caps fit together. Voxcasino's oficjalna strona lays out how a single code maps to concrete terms, which is a useful reference for the states worth modeling before you write the update.

Takeaway

Push the uniqueness check into a conditional UPDATE, key retries with an idempotency token, and let the row count tell you who won. "Apply once" becomes a guarantee instead of a hope.

Combinatorics in Production: Settling a 15-Line Full-Cover Bet Correctly

desgh white — Fri, 14 Aug 2026 09:30:54 +0000

Every so often a domain hands you a problem that looks like a one-liner and turns out to have a dozen edge cases. Settling a "Lucky 15" — a betting slip covering four selections across fifteen combinations — is one of them. It is a nice study in why naive combinatorics plus real-world rules is where bugs live.

The shape of the problem

Four selections produce every non-empty combination of size 1..4:

from itertools import combinations

def lines(selections):
    for size in range(1, len(selections) + 1):
        yield from combinations(selections, size)

assert len(list(lines(["a", "b", "c", "d"]))) == 15   # 4 + 6 + 4 + 1

Four singles, six doubles, four trebles, one fourfold. The return for a line is the product of the decimal odds of its members, times the unit stake, and only if every member won:

from math import prod

def line_return(line, results, stake):
    if not all(results[s].won for s in line):
        return 0.0
    return stake * prod(results[s].odds for s in line)

Total return is the sum over all fifteen lines. That is the entire happy path, and it is where most implementations stop.

Where it actually gets hard

Stake semantics. The unit stake applies per line, so a "£1 Lucky 15" costs £15. Getting this backwards is the single most common bug in hobby implementations, and it is off by a factor of fifteen — an error big enough that no one notices it is a rounding problem, because it isn't one.

Bonus rules are not arithmetic, they are policy. Bookmakers attach concessions: a one-winner bonus paying a lone winner at double the odds, an all-winners bonus adding 10–20% to the return. They vary per operator in ways that resist a single formula — some apply the percentage to the whole return, others only to winning lines. Model them as a strategy object per operator, not as an if in the settlement loop, or you will be editing the core function every time a rule changes.

Non-runners collapse the bet. A withdrawn selection does not void the slip; it reduces it to the next size down — a Lucky 15 with one non-runner settles as a Lucky 11 over the remaining three. That means the line set is computed after filtering, not before, and your "15" is a derived value rather than a constant.

Rule 4 deductions apply a percentage reduction to winnings at prices taken before a withdrawal. It touches odds, not stake, and it must be applied before the bonus, not after. Order of operations is load-bearing.

Each-way doubles the line count and settles the place portion at a fraction of the odds, fixed when the bet was struck rather than at settlement time.

Testing it

This is a domain where property-based tests earn their keep. Useful invariants: the return is monotonic in each selection's odds; adding a losing selection never increases the return; a slip where every selection wins returns at least the sum of its parts; and settling with the unit stake scaled by k scales the return by exactly k. Then pin the awkward cases — one winner, all non-runners, a Rule 4 with a bonus — as explicit regression tests, because those are the ones that break when someone "simplifies" the bonus logic.

Reference implementation

If you want to sanity-check your numbers against a working implementation before writing the tests, a here settles the same fifteen lines with the operator concessions applied, which makes it a convenient oracle for the cases you have not thought of yet.

Takeaway

Generate the line set with combinations, derive the count instead of hard-coding fifteen, keep operator rules in a strategy object, and get the order right: filter non-runners, apply Rule 4, sum the lines, then apply the bonus. The combinatorics are five lines of code; the domain rules are the actual program.