3 ms·

Spam attacks have nothing to do with 3rd party clients.

timpattinson 6y ago
malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack
sudosysgen 6y ago
This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.
kenniskrag 6y ago
then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.
notamy 6y ago
Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten. Obligatory "I don't work at Discord, just actively develop against their API" goes here.
m12k 6y ago
I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.
- notamy 6y ago
  There are third-party mods for the client (see ex. https://github.com/powercord-org/powercord https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.
  - jaywalk 6y ago
    What does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/ https://powercord.dev/) there seems to be absolutely no information about what it actually does.
    - 2fast4you 6y ago
      It seems to be a platform for other plugins/themes to target
- sudosysgen 6y ago
  As an Electron app, you can make the official client do literally anything with a bit of effort.
- rozab 6y ago
  The official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like. So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.
  - ev1 6y ago
    They don't typically care about client mods as far as I can tell, the use case they ban accounts for is using a third party client entirely. That being said I don't think slack/discord should be a thing for open source communities.
ev1 6y ago
"Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately. There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.

malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack

This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.

kenniskrag 6y ago

then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.

notamy 6y ago

Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten. Obligatory "I don't work at Discord, just actively develop against their API" goes here.

m12k 6y ago

I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.

notamy 6y ago
There are third-party mods for the client (see ex. https://github.com/powercord-org/powercord https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.
- jaywalk 6y ago
  What does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/ https://powercord.dev/) there seems to be absolutely no information about what it actually does.
  - 2fast4you 6y ago
    It seems to be a platform for other plugins/themes to target
sudosysgen 6y ago
As an Electron app, you can make the official client do literally anything with a bit of effort.
rozab 6y ago
The official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like. So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.
- ev1 6y ago
  They don't typically care about client mods as far as I can tell, the use case they ban accounts for is using a third party client entirely. That being said I don't think slack/discord should be a thing for open source communities.

ev1 6y ago

"Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately. There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.