8 ms·

I am closing down the Cordless project

80 points by sim_card_map 6y ago

ev1 6y ago
This has been well known for a while; they block all third party clients and libraries outside of using their official bot API. Having been on the receiving end of over 50k compromised accounts attacking my server (with verified phone enabled); largely stolen oauth/access tokens from real users, I can also see why they would do that as a platform owner. On the other hand, as a rms-thoughtpattern, this is awful.
- sim_card_map 6y ago
  Spam attacks have nothing to do with 3rd party clients.
  - timpattinson 6y ago
    malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack
  - sudosysgen 6y ago
    This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.
  - kenniskrag 6y ago
    then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.
  - notamy 6y ago
    Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten. Obligatory "I don't work at Discord, just actively develop against their API" goes here.
  - m12k 6y ago
    I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.
    - notamy 6y ago
      There are third-party mods for the client (see ex. https://github.com/powercord-org/powercord https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.
      - jaywalk 6y ago
        What does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/ https://powercord.dev/) there seems to be absolutely no information about what it actually does.
        2fast4you 6y ago
        It seems to be a platform for other plugins/themes to target
    - sudosysgen 6y ago
      As an Electron app, you can make the official client do literally anything with a bit of effort.
    - rozab 6y ago
      The official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like. So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.
      - ev1 6y ago
  - ev1 6y ago
    "Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately. There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.
- Derek_MK 6y ago
  Outside of bots and spam, third party Discord clients also often disable a lot of Electron's options that guard against XSS stuff escaping the sandbox, which is pretty dangerous. I wouldn't be surprised if Discord wanted to minimize the chance of some really big problem stemming from lots of users using these unsafe versions.
  - arsome 6y ago
    The client in question here doesn't use Electron at all, so I don't think that'd be too relevant.
lights0123 6y ago
https://news.ycombinator.com/item?id=25184751 https://news.ycombinator.com/item?id=25184751
bzb6 6y ago
As their terms of use have said since day 1. What’s the news?
- jaywalk 6y ago
  The news is that they've suddenly decided to enforce something that has been ignored since day 1.
passerby1 6y ago
Reminds of a similar ICQ policy.how does discord enforce this? Do they use a similar tactics like a frequent protocol changes?
- ev1 6y ago
  They collect a significant amount of device information, even more if you have the apps instead of just browser, do tons of fingerprinting, all things I would consider gross as a personal opinion
mxscho 6y ago
Discords around financial or economic topics (e.g. cryptocurrencies, Steam trading) are heavily abused by scammers that use large numbers of bots to attack or phish users. I could see an argument where Discord wants to keep control over how they are fighting such abuse, and banning all non-granted API access could be one part of that.
pearjuice 6y ago
Discord bans users for not adhering to the terms of service is a better title.
ddevault 6y ago
This kind of behavior should be illegal. Remind me again why anyone here is using proprietary chat software? Just use IRC, or if you simply must use something else, use Matrix.
- keb_ 6y ago
  User-friendliness. IRC and even Matrix is daunting to the average mom or gamer-friend. Even if they're not, there's the network effect (I can't convince even a quarter of my friends to move over to Matrix or IRC).
- jaywalk 6y ago
  This kind of behavior should absolutely not be illegal. As much as we might hope for and prefer open APIs, companies must have the right to protect their APIs as they see fit.
- h2odragon 6y ago
  My wife and child can use discord. Anything else is "just for talking to daddy" and not worth the trouble to learn how to use.
- bootstamping 6y ago
  Discord has integrated: -communities (as servers) -forums (as text channels) -direct messages -voice chat -video chat -private group calls This can all be used from their web-app. Their centralized server model allows people to join/leave calls at will, saves conversation history, and just so happens to give the company a great deal of data. It's all extremely convenient. I agree with you that Discord is abusive of its power, and I would much prefer to utilize a free-software solution. Unfortunately, I do not believe any communication software in the world, free or unfree, comes close to the value proposition of discord.
  - pritambaral 6y ago
    > This can all be used from their web-app Video chat and screen sharing is not supported on their web app, and they push you to download their (electron) app for those features.
dboreham 6y ago
AOL Instant Messenger wars returned.
rvz 6y ago
This isn't really surprising since Discord owns the whole API and it was only a matter of time this would happen which is why I have little hope for third-party clients for GitHub, Twitter, Reddit, YouTube etc, since they have official clients for them. [0] Either the API gets blocked for third-party clients, or you purchase a high price for it. [0] https://news.ycombinator.com/item?id=22609319 https://news.ycombinator.com/item?id=22609319
samdixon 6y ago
I wonder how long until Discord starts blocking things like Matrix or IRC Bridges. That or the Bot API may already be useful enough to say something "works", but is so functionally useless that you have no reason to use it. (e.g. you can bridge to a channel, but not bridge instant messages)
neuland 6y ago
This project seemed innocuous enough. And it's a shame Discord killed it. As long as services are centralized, platform owners keep doing things like this.
ColinWright 6y ago
Can someone please do an ELI5 for this? I have no idea what it is, what it relates to, or why it's important, other than: * It's about 'bots, and * It relates to Discord. Thanks.
- hundchenkatze 6y ago
  It's nothing specific to bots. Discord's TOS doesn't allow you to use a thirdparty client. This has been the case since day 1 (I think) but they haven't been enforcing it. Now the creator of this client has had their account banned, so it seems that Discord may be cracking down on the use of unofficial clients.
  - Ennea 6y ago
    Mind you, Discord's ToS do not specifically mention third party clients at any point. They do say that they can ban your account for whatever reason, however.
tomaszs 6y ago
Isn't Didcord on-premise? How could he be banned? Hopefully someone will be able to answer. Please don't downvote only because you think the question is stupid.
- kevincox 6y ago
  You are probably confusing Discord with Discourse. https://discord.com/ https://discord.com/ https://www.discourse.org/ https://www.discourse.org/

80 points by sim_card_map 6y ago

ev1 6y ago

This has been well known for a while; they block all third party clients and libraries outside of using their official bot API. Having been on the receiving end of over 50k compromised accounts attacking my server (with verified phone enabled); largely stolen oauth/access tokens from real users, I can also see why they would do that as a platform owner. On the other hand, as a rms-thoughtpattern, this is awful.

sim_card_map 6y ago
Spam attacks have nothing to do with 3rd party clients.
- timpattinson 6y ago
  malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack
- sudosysgen 6y ago
  This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.
- kenniskrag 6y ago
  then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.
- notamy 6y ago
  Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten. Obligatory "I don't work at Discord, just actively develop against their API" goes here.
- m12k 6y ago
  I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.
  - notamy 6y ago
    There are third-party mods for the client (see ex. https://github.com/powercord-org/powercord https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.
    - jaywalk 6y ago
      What does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/ https://powercord.dev/) there seems to be absolutely no information about what it actually does.
      - 2fast4you 6y ago
        It seems to be a platform for other plugins/themes to target
  - sudosysgen 6y ago
    As an Electron app, you can make the official client do literally anything with a bit of effort.
  - rozab 6y ago
    The official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like. So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.
    - ev1 6y ago
- ev1 6y ago
  "Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately. There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.
Derek_MK 6y ago
Outside of bots and spam, third party Discord clients also often disable a lot of Electron's options that guard against XSS stuff escaping the sandbox, which is pretty dangerous. I wouldn't be surprised if Discord wanted to minimize the chance of some really big problem stemming from lots of users using these unsafe versions.
- arsome 6y ago
  The client in question here doesn't use Electron at all, so I don't think that'd be too relevant.

lights0123 6y ago

https://news.ycombinator.com/item?id=25184751 https://news.ycombinator.com/item?id=25184751

bzb6 6y ago

As their terms of use have said since day 1. What’s the news?

jaywalk 6y ago
The news is that they've suddenly decided to enforce something that has been ignored since day 1.

passerby1 6y ago

Reminds of a similar ICQ policy.how does discord enforce this? Do they use a similar tactics like a frequent protocol changes?

ev1 6y ago
They collect a significant amount of device information, even more if you have the apps instead of just browser, do tons of fingerprinting, all things I would consider gross as a personal opinion

mxscho 6y ago

Discords around financial or economic topics (e.g. cryptocurrencies, Steam trading) are heavily abused by scammers that use large numbers of bots to attack or phish users. I could see an argument where Discord wants to keep control over how they are fighting such abuse, and banning all non-granted API access could be one part of that.

pearjuice 6y ago

Discord bans users for not adhering to the terms of service is a better title.

ddevault 6y ago

This kind of behavior should be illegal. Remind me again why anyone here is using proprietary chat software? Just use IRC, or if you simply must use something else, use Matrix.

keb_ 6y ago
User-friendliness. IRC and even Matrix is daunting to the average mom or gamer-friend. Even if they're not, there's the network effect (I can't convince even a quarter of my friends to move over to Matrix or IRC).
jaywalk 6y ago
This kind of behavior should absolutely not be illegal. As much as we might hope for and prefer open APIs, companies must have the right to protect their APIs as they see fit.
h2odragon 6y ago
My wife and child can use discord. Anything else is "just for talking to daddy" and not worth the trouble to learn how to use.
bootstamping 6y ago
Discord has integrated: -communities (as servers) -forums (as text channels) -direct messages -voice chat -video chat -private group calls This can all be used from their web-app. Their centralized server model allows people to join/leave calls at will, saves conversation history, and just so happens to give the company a great deal of data. It's all extremely convenient. I agree with you that Discord is abusive of its power, and I would much prefer to utilize a free-software solution. Unfortunately, I do not believe any communication software in the world, free or unfree, comes close to the value proposition of discord.
- pritambaral 6y ago
  > This can all be used from their web-app Video chat and screen sharing is not supported on their web app, and they push you to download their (electron) app for those features.

dboreham 6y ago

AOL Instant Messenger wars returned.

rvz 6y ago

This isn't really surprising since Discord owns the whole API and it was only a matter of time this would happen which is why I have little hope for third-party clients for GitHub, Twitter, Reddit, YouTube etc, since they have official clients for them. [0] Either the API gets blocked for third-party clients, or you purchase a high price for it. [0] https://news.ycombinator.com/item?id=22609319 https://news.ycombinator.com/item?id=22609319

samdixon 6y ago

I wonder how long until Discord starts blocking things like Matrix or IRC Bridges. That or the Bot API may already be useful enough to say something "works", but is so functionally useless that you have no reason to use it. (e.g. you can bridge to a channel, but not bridge instant messages)

neuland 6y ago

This project seemed innocuous enough. And it's a shame Discord killed it. As long as services are centralized, platform owners keep doing things like this.

ColinWright 6y ago

Can someone please do an ELI5 for this? I have no idea what it is, what it relates to, or why it's important, other than: * It's about 'bots, and * It relates to Discord. Thanks.

hundchenkatze 6y ago
It's nothing specific to bots. Discord's TOS doesn't allow you to use a thirdparty client. This has been the case since day 1 (I think) but they haven't been enforcing it. Now the creator of this client has had their account banned, so it seems that Discord may be cracking down on the use of unofficial clients.
- Ennea 6y ago
  Mind you, Discord's ToS do not specifically mention third party clients at any point. They do say that they can ban your account for whatever reason, however.

tomaszs 6y ago

Isn't Didcord on-premise? How could he be banned? Hopefully someone will be able to answer. Please don't downvote only because you think the question is stupid.

kevincox 6y ago
You are probably confusing Discord with Discourse. https://discord.com/ https://discord.com/ https://www.discourse.org/ https://www.discourse.org/