79 ms·

Discord seems to me like it has a very polished user experience, and it's no surprise that users are trashing programs like Skype in favor of Discord when it is

by ve55 10y ago

Discord seems to me like it has a very polished user experience, and it's no surprise that users are trashing programs like Skype in favor of Discord when it is better in every area. Discord seems to take security seriously, as they should, but I'm curious about their stance on privacy and openness. For example, I wonder if they would consider: - Allowing end-to-end encryption to be used between users for private communications - Allowing users to connect to Discord servers using IRC or other clients (or, at least having an API that easily allows this)[1] - Allow users to have better control over their own data, such as providing local/downloadable logs so that they can search or otherwise use logs themselves Discord is definitely succeeding within the gaming market, but I'm curious what other markets they would like to take a stab at. [1] I'm aware Discord has an API, but if I understand it correctly, normal users cannot easily use Discord from anything other the official Discord apps, as this API is specifically for Discord 'bots'. I see there's a discord-irc bridge, but not much more than that. I may be incorrect on this.

b1naryth1ef 10y ago
- E2E/OTR encryption is something some of us are interested in, but due to the nature of our platform probably isn't going to happen anytime soon (we'd want to do it right, which requires time and effort). - Some libraries support connecting through user accounts, and there are various third-party tools for "linking" chat rooms, incl. some client plugins for irssi and such. We don't officially support it, but it's definitely possible. - Search is currently live on our alpha-testing client, and should be rolling out globally soon. It's also possible to save or log channels through the API fairly easily.
- ve55 10y ago
  thanks for the informative response. I will look into how difficult it is to connect to a server using a user account from an IRC client, as that would make the experience much nicer for users like me. I'm curious about the logging API permissions - it seems kind of weird that I could potentially join someone's Discord server and then download logs of their conversations for the past year instantly after joining, but I suppose this is already possible by viewing history in the client? EDIT: looking at the API on https://discordpy.readthedocs.io/en/latest/api.html https://discordpy.readthedocs.io/en/latest/api.html, it seems you need permission for the channel logs, but that can't prevent someone from writing code to collect them manually, regardless of permissions?
  - ehsankia 10y ago
    Discord has a pretty indepth permission system that allows per-channel/per-user setup. If a server allows a user to view the message history (which basically mean, when you enter the channel, you can see previous messages and scroll up), then yes, that user can write a bot to save all the messages. I don't really see what the issue is here. That to me really is one of the main reasons I prefer Discord to IRC. It's the fact that you can join a channel from any device and see past conversation. But of course, if for security reasons you don't want that, you can very easily disable message history and have it act like IRC does.
  - Gaelan 10y ago
    The channel log permission only applies to logs before you joined. You can always scroll up to the point you joined the server.
- Twisell 10y ago
  So technically that mean that sysadmins at discord can freely browse the billions of message that are stored on your DB? And if you are ever hacked all this chat database can be sucked up for free due to lack of encryption? I must be wrong seriously what did I miss this can't be?
  - Crespyl 10y ago
    There's a difference between end-to-end/client-side encryption and secure/encrypted backend storage. I don't think anyone's commented on the backend security situation (I'd hope they'd have messages encrypted at rest, but it doesn't seem that encryption has been a priority), just that they don't do E2E.
    - Twisell 10y ago
      But with a chat app the "classic" behaviour is as far as i know, to guarantee that each participant got all the message they ought to. Thus what are those billions of messages they store in the database? Is it only a very detailed cache data for current conversation or is it hardwired to PRISM or a commercial database? Why on earth should they store so much chat log? Or maybe i'm not just not award of the popularity of discord, but Billions of messages volumes make me wonder because as a comparison it's roughly iMessage worldwide per day payload. So messages are probably stored longer than needed : how and why?
      - b1naryth1ef 10y ago
        The point of our service is that chat is persistent. You can scroll back through time and read all the messages you sent. Users are free to delete whatever they sent whenever if they wish, but for almost everyone persistent chat history is a huge feature. Also important to note that as of the numbers we released last July we receive around 40 million messages a day. The public stats released about iMessage suggest that 2 billion messages are sent per day.
        Twisell 10y ago
doctorpangloss 10y ago
> Discord seems to take security seriously Any app that has voice turned on whenever it detects sound by default, without prompting the user on installation, doesn't take security seriously. I mean, unless you expect a communications app, running in the background, to share the conversation you're having in your room, without telling you, with everyone in every channel, until you discover it in your user preferences. (I'm going to assume you're going to misunderstand what the issue here is. It listens by default, like when you install, and you're not prompted that it's the default. Contrary to every other communications or microphone app in existence, save for ones that are designed to spy on people).
- ve55 10y ago
  I would consider this more of a privacy issue than a security issue - but something that should nonetheless be communicated clearly to user. Maybe these terms don't seem worth differentiating, but I see privacy as "what info do they collect" and security as "how safe do they keep my info, after they collect it".
- jack9 10y ago
  > Any app that has voice turned on whenever it detects sound by default, without prompting the user on installation, doesn't take security seriously. That's an an opinion.
- hug 10y ago
  I don't think this is a "security" issue as much as it's a usability or privacy issue, and I don't think it's an example of Discord being evil. For a start, it's not quite "on install", but after joining your first voice channel. The issue comes from the interaction of a series of reasonable steps that on the whole result in an unfortunate experience for some people. The problematic series: * By default, Discord uses voice detection to determine when you're speaking, as opposed to push-to-talk. This feature makes perfect sense. * By default, Discord configures itself to start up on login. This feature makes sense. (I personally immediately turn that option off, but I don't resent its inclusion.) * When started, Discord rejoins any voice channel you were in when Discord was last exited. This feature also makes perfect sense. [Edit: Apparently this is no longer true, and Discord will only rejoin the channel if you were active within the past 5 minutes.] Essentially the result of these design decisions in series is [edit: was] that if you install & use Discord, and fail to manually disconnect from your voice channel, next time you start your computer Discord will automatically join your last channel and broadcast any loud enough audio in the same room as your computer to the voice channel. There are a few mitigating factors, too: Discord is pretty obviously open and on the screen when this happens, and it does show your active voice channel, and it does show an activity indicator when you're broadcasting.
cthalupa 10y ago
It's pretty easy to setup the discord-irc bridge, assuming you're referring to bitlbee. I already use it to have an IRC interface for facebook, google hangouts, etc, so discord was just adding a plugin and configuring the account, which took about 10 minutes total.

by ve55 10y ago

b1naryth1ef 10y ago

- E2E/OTR encryption is something some of us are interested in, but due to the nature of our platform probably isn't going to happen anytime soon (we'd want to do it right, which requires time and effort). - Some libraries support connecting through user accounts, and there are various third-party tools for "linking" chat rooms, incl. some client plugins for irssi and such. We don't officially support it, but it's definitely possible. - Search is currently live on our alpha-testing client, and should be rolling out globally soon. It's also possible to save or log channels through the API fairly easily.

ve55 10y ago
thanks for the informative response. I will look into how difficult it is to connect to a server using a user account from an IRC client, as that would make the experience much nicer for users like me. I'm curious about the logging API permissions - it seems kind of weird that I could potentially join someone's Discord server and then download logs of their conversations for the past year instantly after joining, but I suppose this is already possible by viewing history in the client? EDIT: looking at the API on https://discordpy.readthedocs.io/en/latest/api.html https://discordpy.readthedocs.io/en/latest/api.html, it seems you need permission for the channel logs, but that can't prevent someone from writing code to collect them manually, regardless of permissions?
- ehsankia 10y ago
  Discord has a pretty indepth permission system that allows per-channel/per-user setup. If a server allows a user to view the message history (which basically mean, when you enter the channel, you can see previous messages and scroll up), then yes, that user can write a bot to save all the messages. I don't really see what the issue is here. That to me really is one of the main reasons I prefer Discord to IRC. It's the fact that you can join a channel from any device and see past conversation. But of course, if for security reasons you don't want that, you can very easily disable message history and have it act like IRC does.
- Gaelan 10y ago
  The channel log permission only applies to logs before you joined. You can always scroll up to the point you joined the server.
Twisell 10y ago
So technically that mean that sysadmins at discord can freely browse the billions of message that are stored on your DB? And if you are ever hacked all this chat database can be sucked up for free due to lack of encryption? I must be wrong seriously what did I miss this can't be?
- Crespyl 10y ago
  There's a difference between end-to-end/client-side encryption and secure/encrypted backend storage. I don't think anyone's commented on the backend security situation (I'd hope they'd have messages encrypted at rest, but it doesn't seem that encryption has been a priority), just that they don't do E2E.
  - Twisell 10y ago
    But with a chat app the "classic" behaviour is as far as i know, to guarantee that each participant got all the message they ought to. Thus what are those billions of messages they store in the database? Is it only a very detailed cache data for current conversation or is it hardwired to PRISM or a commercial database? Why on earth should they store so much chat log? Or maybe i'm not just not award of the popularity of discord, but Billions of messages volumes make me wonder because as a comparison it's roughly iMessage worldwide per day payload. So messages are probably stored longer than needed : how and why?
    - b1naryth1ef 10y ago
      The point of our service is that chat is persistent. You can scroll back through time and read all the messages you sent. Users are free to delete whatever they sent whenever if they wish, but for almost everyone persistent chat history is a huge feature. Also important to note that as of the numbers we released last July we receive around 40 million messages a day. The public stats released about iMessage suggest that 2 billion messages are sent per day.
      - Twisell 10y ago

doctorpangloss 10y ago

> Discord seems to take security seriously Any app that has voice turned on whenever it detects sound by default, without prompting the user on installation, doesn't take security seriously. I mean, unless you expect a communications app, running in the background, to share the conversation you're having in your room, without telling you, with everyone in every channel, until you discover it in your user preferences. (I'm going to assume you're going to misunderstand what the issue here is. It listens by default, like when you install, and you're not prompted that it's the default. Contrary to every other communications or microphone app in existence, save for ones that are designed to spy on people).

ve55 10y ago
I would consider this more of a privacy issue than a security issue - but something that should nonetheless be communicated clearly to user. Maybe these terms don't seem worth differentiating, but I see privacy as "what info do they collect" and security as "how safe do they keep my info, after they collect it".
jack9 10y ago
> Any app that has voice turned on whenever it detects sound by default, without prompting the user on installation, doesn't take security seriously. That's an an opinion.
hug 10y ago
I don't think this is a "security" issue as much as it's a usability or privacy issue, and I don't think it's an example of Discord being evil. For a start, it's not quite "on install", but after joining your first voice channel. The issue comes from the interaction of a series of reasonable steps that on the whole result in an unfortunate experience for some people. The problematic series: * By default, Discord uses voice detection to determine when you're speaking, as opposed to push-to-talk. This feature makes perfect sense. * By default, Discord configures itself to start up on login. This feature makes sense. (I personally immediately turn that option off, but I don't resent its inclusion.) * When started, Discord rejoins any voice channel you were in when Discord was last exited. This feature also makes perfect sense. [Edit: Apparently this is no longer true, and Discord will only rejoin the channel if you were active within the past 5 minutes.] Essentially the result of these design decisions in series is [edit: was] that if you install & use Discord, and fail to manually disconnect from your voice channel, next time you start your computer Discord will automatically join your last channel and broadcast any loud enough audio in the same room as your computer to the voice channel. There are a few mitigating factors, too: Discord is pretty obviously open and on the screen when this happens, and it does show your active voice channel, and it does show an activity indicator when you're broadcasting.

cthalupa 10y ago

It's pretty easy to setup the discord-irc bridge, assuming you're referring to bitlbee. I already use it to have an IRC interface for facebook, google hangouts, etc, so discord was just adding a plugin and configuring the account, which took about 10 minutes total.