7 ms·
Discord runs Powershell on load to find Nvidia binaries
- nkrisc 2y agoThe linked tweet says nothing about Nvidia binaries, how was that determined?
- aeurielesn 2y agoCan barely see the tweet without an account. I wonder when that's going to require an account as well.
- stefan_ 2y agoIt’s searching for nvidia-smi binaries, which is a glorified status monitor for NVIDIA GPUs. Presumably to do nothing more than figure out what driver version you are running.. (The powershell bit seems to be used for something else however, so that’s just ancillary stupidity)
- littlestymaar 2y agoIt's below on the thread, see: https://threadreaderapp.com/thread/1824872498363523537.html https://threadreaderapp.com/thread/1824872498363523537.html Honesty I wished every HN post linking to Twitter was just changed to a threadreader link because otherwise only registered Twitter users can see the content being posted.
- falsaberN1 2y agoI agree a million times. Specially because if you aren't seeing things happen live or semi-live (couple days of delay) there's a huge risk the entire thing will be gone when you go check it out (or have it flooded with memes, drama and general nonsense making it a headache to parse the relevant bits). Twitter is just really bad for persistent information. In a perfect world we'd have articles filtering the massive noise-to-data ratio and serving as a persistent archive of whatever happened in there.
- croes 2y agoCouldn't that kill threadreaderapps bandwidth?
- littlestymaar 2y agoHN isn't that big and threadreader is quite popular already. If anything it would increase their revenues and I'm pretty sure they would be happy about that.
- nkrisc 2y agoOh, thanks. I didn’t realize there’s context that can’t be seen if I don’t have an twitter account.
- littlestymaar 2y agoIt's been so since Musk tried to stop the hemorrhage that occurred after his takeover.
- katzinsky 2y ago[flagged]
- chronogram 2y agoI tend to use the website versions of the chat services, but have the electron versions installed because they tend to have better screen sharing performance in my experience.
- ath3nd 2y agoBy the same logic, this applies for slack, Teams and Zoom. p.s. I haven't installed the desktop app for either, and don't intend to because I kind of agree with you.
- 000ooo000 2y ago>I am here for good faith arguments, not just to poke at people.
- uconnectlol 2y ago[flagged]
- Sophira 2y ago> it has all kinds of special snowflake behaviors too like alt+f4 just closes it instead of sending it to the tray (while clicking x does close it) Did you type this wrongly? Closing the app is a normal Windows behaviour for both Alt-F4 and clicking the X. [edit: Parent edited their comment to say the correct thing - this comment doesn't apply any longer!]
- RGamma 2y agoHaven't looked into any of them but there's alternate Discord clients.
- 000ooo000 2y agoIt's a direct quote from GP's bio.
- deleted 2y ago[deleted]
- numberless 2y agoFor people who want to view the post and comments without a Twitter/X account: https://nitter.poast.org/da_wamwoowam/status/1824872498363523537 https://nitter.poast.org/da_wamwoowam/status/182487249836352...
- its-summertime 2y agoThe code to find the binaries is very clearly Javascript, not Powershell From: https://x.com/da_wamwoowam/status/1824874909572665735 https://x.com/da_wamwoowam/status/1824874909572665735 `readdirSync`, `statSync` are from https://nodejs.org/api/fs.html https://nodejs.org/api/fs.html
- eemil 2y agoThis is why I run everything possible in the browser. Discord, teams, zoom, outlook, etc. It also makes switching computers and operating systems a breeze. Not that I switch often, but I like to remain platform agnostic.
- croes 2y agoBrowsers are a platform too
- rimunroe 2y agoOther than features specific to a given browser—-which seem to be more uncommon as a user than as a developer—-how can browsers lock you in in anywhere near the way a standalone application can?
- xeonmc 2y agoWebHID comes to mind
- rimunroe 2y agoYes. As I said, there certainly are APIs which are only supported by a certain browser or family of browsers. I just don’t think avoiding vendor lock-in for browsers is anywhere remotely as difficult as it is with operating systems. Admittedly, I’m a web developer and don’t do native development. However, I frequently run into applications which don’t support macOS or Linux, whereas I very rarely run into sites—especially for everyday tasks—which don’t work on Safari or Firefox.
- its-summertime 2y agoThey are a platform that can nest into other platforms.
- tomalaci 2y agoFor those who don't want to piece together things from twitter, the summary is this: Discord attempts to find nvidia-smi libraries by launching series of powershell scripts. Those scripts are really terrible with a lot of if-else logic based on hardcoded strings and environment variables. They are also apparently fairly slow and scan over 800 directories. Honestly, this is just yet another example of Discord not really developing their software well security-wise. Another example bad security example: 2FA implementation is not really that secure since you can continuously ask for backup codes to be sent to your email which you presumably open frequently on the same PC (there is already automated malware that will abuse this and circumvent your 2FA via newly generated backup codes). Yet another terrible implementation: QR codes. There are rampant phishing attempts that work fairly well because they trick people into accepting invite to some discord server. Once you are in it then you are presented with a "anti-spam/anti-bot" verification check which asks you to scan and confirm a QR code. Little do majority of people know is that it is a login QR code and once you scan that then the hackers will just take over your account in less than a second as all this stuff is easily automated already.
- sidewndr46 2y agoCan you explain more about this QR code scam?
- numpad0 2y agoIf I'm reading GP right: there is a QR code displayed prominently on Discord login screen, which is an image. Opening the link on a phone that is also logged into Discord skips everything and completes login process. That QR code can be sent to a victim under false pretense for account takeover?
- Sophira 2y agoMy understanding (which may be incorrect) is this: On the login page of the web version of Discord, you have the option to log in in two ways: either by using a username/password combination, or by scanning a QR code with the Discord app on your mobile. The QR code is linked to your desktop session, and scanning the QR code with a mobile device will cause Discord to authenticate the desktop session with the credentials stored on the mobile. Thus, if the attackers take one of the QR codes from their own desktop session and give it to you, scanning it will authenticate their desktop session with your credentials. The QR codes have a rotating code that's meant to prevent old QR codes from being used, but that only means that the attackers just need to re-request the QR code every so often and show the new one.
- dwroberts 2y agoNot condoning the method, but I can take a good guess as to what they're doing: They're trying to find out how many NVENC streams are in use on the card / whether any are free Which isn't important for general use but is relevant if you're screen sharing/streaming your display
- deleted 2y ago[deleted]
- zokier 2y ago> this person has never programmed on windows in their lives https://nitter.poast.org/da_wamwoowam/status/1824874909572665735#m https://nitter.poast.org/da_wamwoowam/status/182487490957266... How about some fucking empathy? Yes, maybe the dev isn't a windows expert, but I'd guess most devs aren't. Most people don't have the luxury of pulling in a specialist to do every little feature, nor the luxury to do a deep dive to figure the absolute correct way. Such is the reality of (commercial) software development. I don't think we need to have snarky attacks on the front page of HN for that.
- Brian_K_White 2y agoOk this particular piece of garbage software is not the crime of the century, and we all have dirty underwear, but there is nothing about this that deserves the tiniest bit of empathy. This is not an empathy situation. This is an atrocious job full stop. Anyone attempting, or purporting to do this job should know this, and if they don't know this, then that very fact is the unforgivable thing. I say this as someone who has barely programmed anything for windows. I managed to make a custom version of putty for work that replaced the registry for a text file for settings, and made it lauchable to make saved sessions portable. And I managed the amazing engineering feat of producing a .exe that wraps a twain scanner library. No ui, just a cli that copies argv to the library calls. And I wrote a powershell script that talks to a device over rs232. Thats about it. More than my mom could do but all in all essentially nothing. The criticism of this utter shit is not elitism. When I first had that work project to hack on putty, at first I took a look just to see if I could figure it out. I immediatly decided I could not figure it out in any reasonable time. So I tried to hire a freelancer to do it. Pay someone who actually does this, right? You know what they did? For $3k usd in 2005 or so? They fucking called regedit. As in they executed the regedit exe in a system call to import a text reg file. The settings are still stored in the registry, and I already knew how to run regedit to export and import .reg files. I could have done that much by just wrapping my exe in a bat file that runs regedit before launching putty, and that would have been a better engineered result than putting it in a system call, because it would be more flexible since the bat could be modified infinitely later without recompiling. They were working on c code that already had code examples in it for working with the registry directly, and for reading and writing files, and yet when they needed to read a file to load settings, they ran an external executable that reads a file and puts the contents into the registry. And putty actually has a fairly modular settings module! The registry stuff isn't baked in all over the place. There is a single c file that does all of the settings storage and retrieval. You can essentially swap the whole file out with anything else. Am I some supergenius just because I knew enough to not try to do a job I didn't know how to do? Am I a supergenius just because I was able to at least read code even if I couldn't write it, enough to see what it was doing and that it was a shit way to get the outward appearance of what I asked for? How come you aren't completely offended and scandalized by solutions like these? What code that I rely on are you writing right now? We do indeed all have dirty underwear but this is not a case of "not an expert". That is inexcusably misrepresenting the essence of the criticism here.
- Apreche 2y agoI mean, what do you expect? If you took all the software engineers on this site and assigned them to develop that feature, how many would be able to do it better? I imagine most won’t be able to even begin without spending a lot of time studying the subject matter. I hardly know any Powershell at all, let alone the better more correct Windowsy way to do it. Only the more experienced Windows app developers would get it right. How many of those are there in the world? How many are working at Discord? Most likely some dev who was not a super Windows expert was assigned this task, and figured out how to do it using the tools that they already had the most familiarity with. In this case that was Powershell. This is what most of us do every single time we code. We prioritize getting a solution that achieves the desired result, which this does. We prioritize getting it done quickly, which means using familiar tools instead of spending a bunch of time learning something new. We prioritize passing tests, which this probably does. Performance is not a priority at most places until it becomes so bad that it’s extremely noticeable. Discord on Windows is most often used on powerful gaming PCs that won’t notice this inefficiency. That said, now that someone so kindly pointed out the issue, maybe Discord will fix it. Or maybe not. If it’s not a bugfix, or a new feature, or a security patch, why would they prioritize it?
- dvfjsdhgfv 2y ago> I imagine most won’t be able to even begin without spending a lot of time studying the subject matter. And that's the correct approach. Whenever I pick a task, I make sure I either know the matter in question or need to study it - in which case I inform my co-workers and especially the Tech Lead this needs to be taken into account. Frankly, even if it was an internal piece of software used just by a few hundred/thousand people, I would be ashamed of doing it this way because I would be afraid it could have negative impact on my career in this organization.
- banana_giraffe 2y agoIn other words: Discord uses a third party library to gather system information. On Windows, that library uses some logic that can fallback to PowerShell to gather information. https://www.npmjs.com/package/systeminformation https://www.npmjs.com/package/systeminformation https://github.com/sebhildebrandt/systeminformation/blob/master/lib/graphics.js#L387 https://github.com/sebhildebrandt/systeminformation/blob/mas... https://github.com/sebhildebrandt/systeminformation/blob/master/lib/graphics.js#L825 https://github.com/sebhildebrandt/systeminformation/blob/mas...
- esmeraldametteo 2y ago[flagged]