5 ms·

They're going down the same path as Twitter. The API is to be locked down so the company can't be out-innovated.

judge2020 5y ago
Discord is rightfully _terrified_ of a news story like "top Discord bot in tons of servers hacked, every message it saw in the last 3 years has been leaked via bittorrent. there are about 300 Million unique users' messages in it". It only makes sense to start clamping down on what info bots can receive while still allowing them to achieve interactivity via slash commands and whatnot.
- scode2 5y ago
  Yes, something similar to this actually happened with a giant directory of users. They still could have gone about the rollout much better by adding features that the community requested to slash commands before forcing everyone onto them.
- meowface 5y ago
  Yes, I've always thought it was only a matter before this eventually happened. I completely understand why they would want to scramble to prevent that. The point made by the discord.py creator elsewhere is true: this is more likely to happen with invisible self-bots than bot-bots. But it would be far more catastrophic if it happened with an actual bot, since lots of small, private servers and channels make use of those. It's the difference between leaking things most everyone involved kind of already knew they were broadcasting publicly vs. potentially leaking enormous amounts of data that everyone involved assumed would be private because they didn't consider the scenario of a popular bot secretly spying on them. This is one of those counterfactual scenarios where everyone would be furious at Discord if this happened and they didn't take steps to prevent it. And frankly, it seems quite possible it already has happened but the bot owner has just been using the data for some nefarious intelligence or profit purpose and has no intentions of burning their trick by leaking anything.
  - tentacleuno 5y ago
    > potentially leaking enormous amounts of data that everyone involved assumed would be private because they didn't consider the scenario of a popular bot secretly spying on them. People tend to be quite nonchalant about bots in private channels, in my experience. It tends to be taken for granted that they're not hoovering up all the messages. I'd go so far as to say we need a data catastrophe like the one you described to wake everyone up. A music bot does not need read permissions in your private staff room! I took over administration of a server which did so and quickly clamped down on the permission of bots.
    - jart 5y ago
      Is it possible for a Discord admin to tell which users are bots and ban them?
      - judge2020 5y ago
        In general, for official bots yes - Administrators are the only ones with permissions to add bots to servers, but the permission prompt is usually one that asks for full Administrator permissions and they often don't bother to go back in and remove access to certain channels for eg. music bots. Another problem is User bots - ie. clients that look like a regular user but are still doing bot stuff or simply ingesting all messages they see, which is easy since Discord's client implementation between bots and users are almost exactly the same. They could have used some wasm/javascript virtual machine thing that would make it hard to figure out what the Discord client is doing and would make it harder to sign in to Discord via a user bot, but then we'd probably have another set of HN users complain about Discord hiding stuff from users or something.
        jart 5y ago
        Discord deserves a binary lambda calculus virtual machine, to protect our telecommunications. https://justine.lol/lambda/ https://justine.lol/lambda/ This will serve the interests of app developers too, since anyone who manages to figure out a way to game it will probably be able to get a PhD from Berkeley afterwards.

judge2020 5y ago

Discord is rightfully _terrified_ of a news story like "top Discord bot in tons of servers hacked, every message it saw in the last 3 years has been leaked via bittorrent. there are about 300 Million unique users' messages in it". It only makes sense to start clamping down on what info bots can receive while still allowing them to achieve interactivity via slash commands and whatnot.

scode2 5y ago
Yes, something similar to this actually happened with a giant directory of users. They still could have gone about the rollout much better by adding features that the community requested to slash commands before forcing everyone onto them.
meowface 5y ago
Yes, I've always thought it was only a matter before this eventually happened. I completely understand why they would want to scramble to prevent that. The point made by the discord.py creator elsewhere is true: this is more likely to happen with invisible self-bots than bot-bots. But it would be far more catastrophic if it happened with an actual bot, since lots of small, private servers and channels make use of those. It's the difference between leaking things most everyone involved kind of already knew they were broadcasting publicly vs. potentially leaking enormous amounts of data that everyone involved assumed would be private because they didn't consider the scenario of a popular bot secretly spying on them. This is one of those counterfactual scenarios where everyone would be furious at Discord if this happened and they didn't take steps to prevent it. And frankly, it seems quite possible it already has happened but the bot owner has just been using the data for some nefarious intelligence or profit purpose and has no intentions of burning their trick by leaking anything.
- tentacleuno 5y ago
  > potentially leaking enormous amounts of data that everyone involved assumed would be private because they didn't consider the scenario of a popular bot secretly spying on them. People tend to be quite nonchalant about bots in private channels, in my experience. It tends to be taken for granted that they're not hoovering up all the messages. I'd go so far as to say we need a data catastrophe like the one you described to wake everyone up. A music bot does not need read permissions in your private staff room! I took over administration of a server which did so and quickly clamped down on the permission of bots.
  - jart 5y ago
    Is it possible for a Discord admin to tell which users are bots and ban them?
    - judge2020 5y ago
      In general, for official bots yes - Administrators are the only ones with permissions to add bots to servers, but the permission prompt is usually one that asks for full Administrator permissions and they often don't bother to go back in and remove access to certain channels for eg. music bots. Another problem is User bots - ie. clients that look like a regular user but are still doing bot stuff or simply ingesting all messages they see, which is easy since Discord's client implementation between bots and users are almost exactly the same. They could have used some wasm/javascript virtual machine thing that would make it hard to figure out what the Discord client is doing and would make it harder to sign in to Discord via a user bot, but then we'd probably have another set of HN users complain about Discord hiding stuff from users or something.
      - jart 5y ago
        Discord deserves a binary lambda calculus virtual machine, to protect our telecommunications. https://justine.lol/lambda/ https://justine.lol/lambda/ This will serve the interests of app developers too, since anyone who manages to figure out a way to game it will probably be able to get a PhD from Berkeley afterwards.