6 ms·

That's AIcist :D But really, you can't tell human accounts from bots.

by jotm 4y ago

franga2000 4y ago
With a sophisticated enough crawler, sure, but that would require a significant amount of R&D. I don't know of any organization that both has the resources to do that, is willing to break Discord's ToS and make their index public.
kmeisthax 4y ago
Given what I've heard about people getting banned for "self-bots"[0] they seem to err more on the "ban humans that look too bot-like" side of that dilemma. That being said, while there is some overlap between the two, it's not terribly difficult to detect specific things that bots would want to do, such as scrape a Discord channel, and ban any human accounts that match that profile. A regular human is going to be sending lots of messages and querying message history only rarely; a bot is going to hit the message history API as quickly as the rate limits allow and never send a single message. Browser fingerprinting could also be used to sus out bots that don't look like a web browser enough. Most bot developers are just making HTTP requests rather than firing up a real browser and attaching to it with WebDriver[1]. Once you do that then you have to play walls-and-ladders[2] with the Discord user-interface team. Oops, your bot just clicked on the fake invisible "please ban me immediately" button that we snuck in right next to the link that opens #general! Oops, we decided to obfuscate all message content so that incoming message JSON is unreadable and outgoing HTML requires having your specific Discord CSS loaded to view it! Just as there's unlimited ways to disguise a bot as a human, there's also unlimited ways to unmask them or frustrate them while remaining usable for human users. Turing completeness is a harsh mistress, and scrapers only work because people find economic value in being scraped - not that scrapers have an inherent advantage. [0] Scraping your own Discord client token and using it to authenticate a Discord bot with your own account [1] Writing a WebExtension content script to inject input into a browser would also work to self-bot [2] https://devblogs.microsoft.com/oldnewthing/20120117-00/?p=8523 https://devblogs.microsoft.com/oldnewthing/20120117-00/?p=85...

That's AIcist :D But really, you can't tell human accounts from bots.

by jotm 4y ago

That's AIcist :D But really, you can't tell human accounts from bots.

franga2000 4y ago

With a sophisticated enough crawler, sure, but that would require a significant amount of R&D. I don't know of any organization that both has the resources to do that, is willing to break Discord's ToS and make their index public.

kmeisthax 4y ago

Given what I've heard about people getting banned for "self-bots"[0] they seem to err more on the "ban humans that look too bot-like" side of that dilemma. That being said, while there is some overlap between the two, it's not terribly difficult to detect specific things that bots would want to do, such as scrape a Discord channel, and ban any human accounts that match that profile. A regular human is going to be sending lots of messages and querying message history only rarely; a bot is going to hit the message history API as quickly as the rate limits allow and never send a single message. Browser fingerprinting could also be used to sus out bots that don't look like a web browser enough. Most bot developers are just making HTTP requests rather than firing up a real browser and attaching to it with WebDriver[1]. Once you do that then you have to play walls-and-ladders[2] with the Discord user-interface team. Oops, your bot just clicked on the fake invisible "please ban me immediately" button that we snuck in right next to the link that opens #general! Oops, we decided to obfuscate all message content so that incoming message JSON is unreadable and outgoing HTML requires having your specific Discord CSS loaded to view it! Just as there's unlimited ways to disguise a bot as a human, there's also unlimited ways to unmask them or frustrate them while remaining usable for human users. Turing completeness is a harsh mistress, and scrapers only work because people find economic value in being scraped - not that scrapers have an inherent advantage. [0] Scraping your own Discord client token and using it to authenticate a Discord bot with your own account [1] Writing a WebExtension content script to inject input into a browser would also work to self-bot [2] https://devblogs.microsoft.com/oldnewthing/20120117-00/?p=8523 https://devblogs.microsoft.com/oldnewthing/20120117-00/?p=85...