4 ms·
This has been well known for a while; they block all third party clients and libraries outside of using their official bot API. Having been on the receiving en
by ev1 6y ago
This has been well known for a while; they block all third party clients and libraries outside of using their official bot API.
Having been on the receiving end of over 50k compromised accounts attacking my server (with verified phone enabled); largely stolen oauth/access tokens from real users, I can also see why they would do that as a platform owner.
On the other hand, as a rms-thoughtpattern, this is awful.
- sim_card_map 6y agoSpam attacks have nothing to do with 3rd party clients.
- timpattinson 6y agomalicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack
- sudosysgen 6y agoThis is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.
- kenniskrag 6y agothen there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.
- notamy 6y agoThird-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten. Obligatory "I don't work at Discord, just actively develop against their API" goes here.
- m12k 6y agoI'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.
- notamy 6y agoThere are third-party mods for the client (see ex. https://github.com/powercord-org/powercord https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.
- jaywalk 6y agoWhat does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/ https://powercord.dev/) there seems to be absolutely no information about what it actually does.
- 2fast4you 6y agoIt seems to be a platform for other plugins/themes to target
- sudosysgen 6y agoAs an Electron app, you can make the official client do literally anything with a bit of effort.
- rozab 6y agoThe official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like. So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.
- ev1 6y ago
- ev1 6y ago"Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately. There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.
- Derek_MK 6y agoOutside of bots and spam, third party Discord clients also often disable a lot of Electron's options that guard against XSS stuff escaping the sandbox, which is pretty dangerous. I wouldn't be surprised if Discord wanted to minimize the chance of some really big problem stemming from lots of users using these unsafe versions.
- arsome 6y agoThe client in question here doesn't use Electron at all, so I don't think that'd be too relevant.