7 ms·

Discord is a bad decision for security reasons, for privacy reasons, reliability, and for ethical reasons. it's not just illegal things that are kicked off. If

Discord is a bad decision for security reasons, for privacy reasons, reliability, and for ethical reasons. it's not just illegal things that are kicked off. If you violate a third party company's terms of service, say making bots for Team Fortress 2 (a valve video game) then you'll be banned suddenly as well. And Discord is no stranger to banning things that are not illegal but just controversial like, https://www.reddit.com/r/guns/comments/cvv5da/meta_rguns_discord_banned/ https://www.reddit.com/r/guns/comments/cvv5da/meta_rguns_dis... In terms of privacy: they send a tracking request for every single thing you do in their client. Clicked on someone's profile, clicked on a channel, clicked on a server, etc. The URL was named /track before but they renamed it to "/events" recently (but it's still a POST with no response). Their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).

crgwbr 7y ago
> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() And that is why you encrypt your SSH keys with a passphrase, use a Keychain, etc. Discord isn’t unique in its ability to read file on the FS. Pretty much anything can do that.
- ubercow13 7y ago
  Does that really help much? It still has access to .bash_profile
  - crgwbr 7y ago
    What secrets are you putting in your bash profile? I used to be guilty of putting AWS keys in there, I guess, but nowadays we have aws-vault.
    - ubercow13 7y ago
      For example it could register a fake ssh-agent that just grabs your password first time you type it
- clarry 7y ago
  > Pretty much anything can do that. Nah, pretty much anything except proprietary software has a higher chance of being written by people I trust and packaged by people I trust and probably audited by me and other people, and is not capable of loading executable code from any server after installation.
drngdds 7y ago
Most programs can download new code and open whatever files they want as long as their process has the permissions. You can certainly argue that that shouldn't be the case, but calling Discord a RAT because of it is pretty silly. (Not defending it on the other counts, though. If I wanted a platform for anything controversial or privacy-sensitive, I wouldn't trust Discord or any other centralized, unencrypted service.)
- dependenttypes 7y ago
  > Most programs can download new code and open whatever files they want as long as their process has the permissions We should avoid and shame the programs that do that. This is literally a backdoor.
  - tomatotomato37 7y ago
    You would have to add every program with an auto-updater onto that list, because that's what they literally do; take files streamed online and slap them into its install directory Like shit, I have 3rd party mod managers for video games that are exclusively built to do such that
    - smichel17 7y ago
      Most programs I use (on Linux) do not come with an auto updater. Instead, I get updates through my distro's package manager. I have Discord installed, because unfortunately that's where my friends are. However, it cannot access arbitrary parts of the file system because it is installed via flatpak; it only has access to ~/Downloads and ~/Pictures.
      - m4rtink 7y ago
        This is one benefit of Linux distro package managementany people forget - apps can't just update themeselves (possibly after their updater being compromised) but go via package maintainers and are built from source on trusted distro infrastructure.
shkkmo 7y ago
Which is why discord gets run in a browser tab for me.
judge2020 7y ago
> before but they renamed it to "/events" recently Pretty sure it has been /science for at least 2 years.
devwastaken 7y ago
I don't care if discord knows my friends list or who I've clicked on. There are no alternatives. Bandwidth costs money, and P2P is deadly. That's why discord exists in the first place.
OJFord 7y ago
Other software could do that too without you having any idea, surely that's an argument for being careful with permissions and how your software runs rather than against Discord in particular?

crgwbr 7y ago

> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() And that is why you encrypt your SSH keys with a passphrase, use a Keychain, etc. Discord isn’t unique in its ability to read file on the FS. Pretty much anything can do that.

ubercow13 7y ago
Does that really help much? It still has access to .bash_profile
- crgwbr 7y ago
  What secrets are you putting in your bash profile? I used to be guilty of putting AWS keys in there, I guess, but nowadays we have aws-vault.
  - ubercow13 7y ago
    For example it could register a fake ssh-agent that just grabs your password first time you type it
clarry 7y ago
> Pretty much anything can do that. Nah, pretty much anything except proprietary software has a higher chance of being written by people I trust and packaged by people I trust and probably audited by me and other people, and is not capable of loading executable code from any server after installation.

drngdds 7y ago

Most programs can download new code and open whatever files they want as long as their process has the permissions. You can certainly argue that that shouldn't be the case, but calling Discord a RAT because of it is pretty silly. (Not defending it on the other counts, though. If I wanted a platform for anything controversial or privacy-sensitive, I wouldn't trust Discord or any other centralized, unencrypted service.)

dependenttypes 7y ago
> Most programs can download new code and open whatever files they want as long as their process has the permissions We should avoid and shame the programs that do that. This is literally a backdoor.
- tomatotomato37 7y ago
  You would have to add every program with an auto-updater onto that list, because that's what they literally do; take files streamed online and slap them into its install directory Like shit, I have 3rd party mod managers for video games that are exclusively built to do such that
  - smichel17 7y ago
    Most programs I use (on Linux) do not come with an auto updater. Instead, I get updates through my distro's package manager. I have Discord installed, because unfortunately that's where my friends are. However, it cannot access arbitrary parts of the file system because it is installed via flatpak; it only has access to ~/Downloads and ~/Pictures.
    - m4rtink 7y ago
      This is one benefit of Linux distro package managementany people forget - apps can't just update themeselves (possibly after their updater being compromised) but go via package maintainers and are built from source on trusted distro infrastructure.

shkkmo 7y ago

Which is why discord gets run in a browser tab for me.

judge2020 7y ago

> before but they renamed it to "/events" recently Pretty sure it has been /science for at least 2 years.

devwastaken 7y ago

I don't care if discord knows my friends list or who I've clicked on. There are no alternatives. Bandwidth costs money, and P2P is deadly. That's why discord exists in the first place.

OJFord 7y ago

Other software could do that too without you having any idea, surely that's an argument for being careful with permissions and how your software runs rather than against Discord in particular?