4 ms·

Hi, I lead the anti abuse team at Discord. I've looked into this case a bit more in-depth to see what was going on. Although I can't get into specifics, given

by jhgg 6y ago

Hi, I lead the anti abuse team at Discord. I've looked into this case a bit more in-depth to see what was going on. Although I can't get into specifics, given the poster was kind enough to provide us with ticket IDs, I was able to look into this a bit further to see what actually triggered the account ban. > Discord bans me for using their official client This statement is false, unfortunately - and our abuse detection flagged the account for using our API in ways that our official clients do not. In this case, there was indeed a 3rd party client involved. Although our rules and heuristics do not specifically target 3rd party clients, it does target things that "don't look like what our official client does" which is very effective at targeting spambots that are constantly waging war against our platform - but has the unfortunate side-effect that using a 3rd party client in certain ways may lead to account termination. In general, appealing the ban would lead to an unban (we're humans after all, and we're trying to stop spammers/bad actors, and that's what this system is meant to stop.) I am going to following up with our T&S team to understand why this case saw such a rocky conclusion.

ve55 6y ago
Something that could be missing from this story is that they may have been in the official web client, but they may have executed custom code (for example, console JavaScript, an add-on, user-extension, etc), that resulted in this, since obviously the web browser will make whichever API requests it is instructed to make. So i could imagine a user wants to do something that Discord makes it difficult to do (perhaps they want to search channel logs locally, or delete all of their messages in a channel, or amny other things), and if I wanted to do that myself I might just throw some JavaScript into the console in a for-loop, which would obviously result in irregular API requests.
- jhgg 6y ago
  No, this was not the case. A 3rd party client was very much involved here. > So i could imagine a user wants to do something that Discord makes it difficult to do (perhaps they want to search channel logs locally, or delete all of their messages in a channel, or amny other things), and if I wanted to do that myself I might just throw some JavaScript into the console in a for-loop, which would obviously result in irregular API requests. We don't really weigh sus requests too highly (to the point of acct termination) unless they are likely to impact other users, or be used to move laterally on the platform (join servers, send friend requests, open new DMs... etc.)
  - ve55 6y ago
    Thanks for the quick update, that's reassuring. I would still be a bit worried myself of a potential ban if I did try to perform such examples (in my parent comment), as the proprietary nature of the platform can make such actions necessary in order to have sufficient control of one's data and environment. I do acknowledge how difficult dealing with abuse at-scale can be too, so sometimes unfortunate situations are partially-necessary as compromises here. I do appreciate reassurances that things aren't as bad as some may claim though, since Discord is particularly worrying for me wrt the centralization and level of control they will have over the next years/decades of the entire online social space.
Narretz 6y ago
I wonder why the user didn't get a better reason for their ban? These unclear explanations make it really difficult for users to follow-up on bans.
sillysaurusx 6y ago
Thank you for looking into this! My first thought reading their story was "They must've used their discord token in some unusual way." ... which is exactly what I've been doing too: https://github.com/Tyrrrz/DiscordChatExporter https://github.com/Tyrrrz/DiscordChatExporter Do you happen to know: Is there a risk of Discord banning me for using that tool to automatically export chat logs for processing via a bash script? Basically, it's a tool to convert discord servers into json. Their official wiki gives instructions for using your personal user token rather than any bot / API token: https://github.com/Tyrrrz/DiscordChatExporter/wiki/Obtaining-Token-and-Channel-IDs#how-to-get-a-user-token https://github.com/Tyrrrz/DiscordChatExporter/wiki/Obtaining... I admit, I used my personal token without giving it a second thought, even though I should've known better. I haven't been banned, but this story reminded me that I should be careful. Am I being overly paranoid? Is it fine to use your personal token in situations like this, where it's basically a CLI tool? Also, I run a discord server for ML with ~1k users. If I get banned by Discord, will server ownership transfer to someone else? Or will the whole server get knocked offline too? Feel free to ignore this if you want -- I'm merely asking in case you happened to know. Happy thanksgiving!
jkcclemens 6y ago
Thanks for looking into it. To be honest, it didn't cross my mind that Ripcord would be the reason why, considering I've used it for years successfully. I only use it because the bloated Discord electron client makes my laptop want to kill itself, but I guess I just won't use Discord on my laptop anymore. I was using the official client when it happened, but Ripcord was open on my laptop (which I wasn't using) at the time, so it makes sense that it might've sent requests the normal client doesn't when a DM is closed or something. Or maybe you flagged it earlier than that. Either way, I'm glad to be unbanned now, but this customer service was unacceptably bad. I didn't get a real answer on why I was banned (until HN got the attention of a non-CS rep), and when I was told I would be unbanned, I wasn't and was ghosted afterward. (Also I'll update the page I wrote)
- sillysaurusx 6y ago
  It seems like it did cross your mind, since your title is "Discord bans me for using their official client," which multiple people noted is rather ... unusual. :) This was a missed opportunity to bring attention to the fact that Discord is banning people for using Ripcord, which seems kind of crazy: https://cancel.fm/ripcord/ https://cancel.fm/ripcord/ https://news.ycombinator.com/item?id=19617699 https://news.ycombinator.com/item?id=19617699
  - jkcclemens 6y ago
    It may seem like it did, but ultimately I know what did and did not cross my mind. It is shitty of Discord to do that, though.
- jhgg 6y ago
  Huge apologies on this one. Most of your tickets were still in the queue - and no one has gotten to them yet. Some other tickets were closed in error because it looked like the issue was resolved - as your original ticket had mentioned there was an unban. As for the initial unban, a bug had caused the "successful appeal" macro to apply - but it did not actually unban your account. Hence the confusion. We are definitely working on improving this and the experience - and I'd like to apologize for the quite honestly shitty experience you had. 2020 has been a wild year for us, and we are still playing catch up operationally on some things - with the rapid surge of usage on the platform. Unfortunately the people handling these appeals don't have all the information necessary to explain exactly why you were banned - and as a general policy we try to keep those exact details under wraps to thwart attempts from people to try and reverse engineer / circumvent our anti spam. (Of which there are many, so... so many people trying to do this.) We are working hard on improving our process around this - but it's a rather gargantuan effort. From both the improvement of automation and tooling, and also staffing in general. But we are actively working on it - and a lot of my day job is to make sure we are handling these kinds of cases in a timely manner and also making sure nothing slips through the cracks due to a bug like your tickets have.

by jhgg 6y ago

ve55 6y ago

Something that could be missing from this story is that they may have been in the official web client, but they may have executed custom code (for example, console JavaScript, an add-on, user-extension, etc), that resulted in this, since obviously the web browser will make whichever API requests it is instructed to make. So i could imagine a user wants to do something that Discord makes it difficult to do (perhaps they want to search channel logs locally, or delete all of their messages in a channel, or amny other things), and if I wanted to do that myself I might just throw some JavaScript into the console in a for-loop, which would obviously result in irregular API requests.

jhgg 6y ago
No, this was not the case. A 3rd party client was very much involved here. > So i could imagine a user wants to do something that Discord makes it difficult to do (perhaps they want to search channel logs locally, or delete all of their messages in a channel, or amny other things), and if I wanted to do that myself I might just throw some JavaScript into the console in a for-loop, which would obviously result in irregular API requests. We don't really weigh sus requests too highly (to the point of acct termination) unless they are likely to impact other users, or be used to move laterally on the platform (join servers, send friend requests, open new DMs... etc.)
- ve55 6y ago
  Thanks for the quick update, that's reassuring. I would still be a bit worried myself of a potential ban if I did try to perform such examples (in my parent comment), as the proprietary nature of the platform can make such actions necessary in order to have sufficient control of one's data and environment. I do acknowledge how difficult dealing with abuse at-scale can be too, so sometimes unfortunate situations are partially-necessary as compromises here. I do appreciate reassurances that things aren't as bad as some may claim though, since Discord is particularly worrying for me wrt the centralization and level of control they will have over the next years/decades of the entire online social space.

Narretz 6y ago

I wonder why the user didn't get a better reason for their ban? These unclear explanations make it really difficult for users to follow-up on bans.

sillysaurusx 6y ago

Thank you for looking into this! My first thought reading their story was "They must've used their discord token in some unusual way." ... which is exactly what I've been doing too: https://github.com/Tyrrrz/DiscordChatExporter https://github.com/Tyrrrz/DiscordChatExporter Do you happen to know: Is there a risk of Discord banning me for using that tool to automatically export chat logs for processing via a bash script? Basically, it's a tool to convert discord servers into json. Their official wiki gives instructions for using your personal user token rather than any bot / API token: https://github.com/Tyrrrz/DiscordChatExporter/wiki/Obtaining-Token-and-Channel-IDs#how-to-get-a-user-token https://github.com/Tyrrrz/DiscordChatExporter/wiki/Obtaining... I admit, I used my personal token without giving it a second thought, even though I should've known better. I haven't been banned, but this story reminded me that I should be careful. Am I being overly paranoid? Is it fine to use your personal token in situations like this, where it's basically a CLI tool? Also, I run a discord server for ML with ~1k users. If I get banned by Discord, will server ownership transfer to someone else? Or will the whole server get knocked offline too? Feel free to ignore this if you want -- I'm merely asking in case you happened to know. Happy thanksgiving!

jkcclemens 6y ago

Thanks for looking into it. To be honest, it didn't cross my mind that Ripcord would be the reason why, considering I've used it for years successfully. I only use it because the bloated Discord electron client makes my laptop want to kill itself, but I guess I just won't use Discord on my laptop anymore. I was using the official client when it happened, but Ripcord was open on my laptop (which I wasn't using) at the time, so it makes sense that it might've sent requests the normal client doesn't when a DM is closed or something. Or maybe you flagged it earlier than that. Either way, I'm glad to be unbanned now, but this customer service was unacceptably bad. I didn't get a real answer on why I was banned (until HN got the attention of a non-CS rep), and when I was told I would be unbanned, I wasn't and was ghosted afterward. (Also I'll update the page I wrote)

sillysaurusx 6y ago
It seems like it did cross your mind, since your title is "Discord bans me for using their official client," which multiple people noted is rather ... unusual. :) This was a missed opportunity to bring attention to the fact that Discord is banning people for using Ripcord, which seems kind of crazy: https://cancel.fm/ripcord/ https://cancel.fm/ripcord/ https://news.ycombinator.com/item?id=19617699 https://news.ycombinator.com/item?id=19617699
- jkcclemens 6y ago
  It may seem like it did, but ultimately I know what did and did not cross my mind. It is shitty of Discord to do that, though.
jhgg 6y ago
Huge apologies on this one. Most of your tickets were still in the queue - and no one has gotten to them yet. Some other tickets were closed in error because it looked like the issue was resolved - as your original ticket had mentioned there was an unban. As for the initial unban, a bug had caused the "successful appeal" macro to apply - but it did not actually unban your account. Hence the confusion. We are definitely working on improving this and the experience - and I'd like to apologize for the quite honestly shitty experience you had. 2020 has been a wild year for us, and we are still playing catch up operationally on some things - with the rapid surge of usage on the platform. Unfortunately the people handling these appeals don't have all the information necessary to explain exactly why you were banned - and as a general policy we try to keep those exact details under wraps to thwart attempts from people to try and reverse engineer / circumvent our anti spam. (Of which there are many, so... so many people trying to do this.) We are working hard on improving our process around this - but it's a rather gargantuan effort. From both the improvement of automation and tooling, and also staffing in general. But we are actively working on it - and a lot of my day job is to make sure we are handling these kinds of cases in a timely manner and also making sure nothing slips through the cracks due to a bug like your tickets have.