4 ms·

Yep. Discord is not a chat protocol. It is a proprietary corporate service. The reason you can't use alternative clients for their service is (the TOS and...) t

Yep. Discord is not a chat protocol. It is a proprietary corporate service. The reason you can't use alternative clients for their service is (the TOS and...) that the client spies on you and that data is (part of) your payment. They send a tracking request for every single thing you do in their client. Clicked on someone's profile, clicked on a channel, clicked on a server, etc. The URL was named /track before but they renamed it to "/events" and then recently "/science" (but it's still a POST with no response). Also their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. On launch the desktop client opens websocket server for command and control listening. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).

neilv 2y ago
I'm always saddened when I see an open source project's page say something like "Join us on Discord!" I can understand an open source project being on GitHub, since, at one point, they were a pretty warm-fuzzy place, and so attracted a lot of open source projects, before they sold out to Microsoft. But I really don't know how so many open source projects looked at Discord, early on, and thought that's a good idea. AFAICT, Discord is pretty antithetical to open source and, especially, libre software.
- stackskipton 2y ago
  Because there isn't a good replacement in open source software. Matrix and others are pretty normie hostile. I help run a few Discord servers and due to financials, I'm always worried about extremely hostile actions by them to make money. My list of things good open source replacement would have: Decentralized chat servers with history Run a optional centralized login service so users have one login Optional centralized service knows what servers the user is a member of so any client they login to will automatically know which servers they are member of. Centralized Mobile Notification service Federation is absolutely not a requirement or a way around this.
  - delta_p_delta_x 2y ago
    > others are pretty normie hostile This is a fairly reasonable generalisation to make about the vast majority of open-source software. 'Normie-hostile'.
  - kurisufag 2y ago
    i've semi-successfully moved a university linux users group onto matrix fwiw, with most people (regular discord users) happy using element's desktop/mobile UI. it's as close to a discord-y experience as you're likely to get.
    - stackskipton 2y ago
      University Linux User Group I would say is already not normies. When I say normie, they are not posting on Hacker News and never heard of Y Combinator ;) They are your non tech friends and a lot of open source needs to interact with them where they are. Where they are is Discord.
  - mdaniel 2y ago
    > Because there isn't a good replacement in open source software https://github.com/zulip/zulip/blob/9.4/LICENSE https://github.com/zulip/zulip/blob/9.4/LICENSE (Apache 2) and if you mean "good [hosted] replacement" https://zulip.com/for/open-source/ https://zulip.com/for/open-source/ It, of course, does not speak to your decentralized wishlist but I'm sure they'd welcome an issue describing your goals
    - s2l 2y ago
      I really want to use zulip but last I checked they charged for push notifications. Without it, my group lost interest in using it due to missed messages. I saw a post about webpush a day ago. Not sure if anything has changed for zulip in that area.
      - alya 2y ago
        If you are using Zulip for an open-source project or a community, you are likely eligible for our free Community plan, which includes push notifications. https://zulip.com/help/self-hosted-billing#free-community-plan https://zulip.com/help/self-hosted-billing#free-community-pl... We charge businesses for our push notifications service because we need folks using our 100% open-source product to run their business to help pay the cost of developing it.
- hnlmorg 2y ago
  I agree with you in principle but in practice there aren’t really any good options. You either have something relatively niche that’s open but people are unlikely to have installed and is often non-trivial for project maintainers to set up and maintain. Or you have something that solves those concerns but is proprietary and sometimes even actively hostile to 3rd parties. It feels like the whole messaging ecosystem has taken several steps backwards over the last 20 years.
  - mdaniel 2y ago
    I'll point out that everything is relatively niche until it becomes popular, and then it's "well, what else would you use?!" and that's how Discord even became a thing that anyone would mention. Or this weird thing named Slack - pfft, who would use a chat named that
    - hnlmorg 2y ago
      Sure. But it’s not a project maintainers job to make an unrelated communications tool popular. Plus there’s also the problem of finite time and proprietary tools just being more convenient.
      - igor47 2y ago
        Freedom. Convenience. Is there a tension between those?
  - DrillShopper 2y ago
    WebChat + IRC server works just fine, only requires a browser for somebody to drive-by use, and allows more serious/heavy users to use whatever client they want. Install a logging package on the IRC server to make logs available publicly and searchable (or you can just have a bot user that does this if you're using an IRC server that someone else is hosting). This was the norm in the late-90s through about 2010 and then suddenly it wasn't good enough.
    - hnlmorg 2y ago
- spacechild1 2y ago
  I'm part of an open source project with a self-hosted Discourse forum. It's just better in every aspect. (Discourse even has built-in DMs and chat.) I find it incredibly sad that people generally have moved away from open forums to proprietory silos like Discord or FB groups.
bri3d 2y ago
> that the client spies on you and that data is (part of) your payment. What value do you think this click tracking data has? I'm genuinely curious. To me this seems like Product Manager Telemetry, which is still an insidious and pervasive privacy problem (see: Microsoft Windows), but I can't quite understand how this is a You Are the Product situation. What purchaser is going want to buy data about where people are clicking on the Discord client? What value does this provide them? > Also their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. A full-fledged desktop app could also load code from a server and execute it. Or just install an "automatic update." If you're worried about this kind of thing you should be sandboxing every application that can access the Internet.
- thomastjeffery 2y ago
  It doesn't matter how much value it has. If you pay in dollars, and suddenly the dollar is deflated to way less value than the euro, you have still payed.
- superkuh 2y ago
  Normal applications do not completely replace themselves every time they are run. I hope you can see the difference. It's easy to see that the files in an actual application running on your OS don't change. It's much harder when there are no files and everything is downloaded anew every time you start the application. Totally different than "automatic updates" of actual applications.
- RunSet 2y ago
  > the client spies on you and that data is (part of) your payment. >> What value do you think this click tracking data has? That it is collected at all shows that, at least to data miners, a user's data has a value greater than the cost of collecting it.
  - bri3d 2y ago
    No, the data is collected for internal use by product managers. It has little value I'm aware of on the open market and is unlikely to be collected for sale. That's my entire point. Enshittification is Bad, yes, but it's also had an even more caustic knock-on effect where a certain subset of people assume every part of every piece of software is part of a gigantic conspiracy against them, and in turn become extremely non-curious about figuring out why and how things work the way they do.
liendolucas 2y ago
Thanks for that! Wasn't aware of the aggresive tracking nor their remote admin capability. This screams to be containerized at all costs. I will try to reduce its use to the bare minimum and only from the browser as I've been doing so far and will ever install their client.

neilv 2y ago

I'm always saddened when I see an open source project's page say something like "Join us on Discord!" I can understand an open source project being on GitHub, since, at one point, they were a pretty warm-fuzzy place, and so attracted a lot of open source projects, before they sold out to Microsoft. But I really don't know how so many open source projects looked at Discord, early on, and thought that's a good idea. AFAICT, Discord is pretty antithetical to open source and, especially, libre software.

stackskipton 2y ago
Because there isn't a good replacement in open source software. Matrix and others are pretty normie hostile. I help run a few Discord servers and due to financials, I'm always worried about extremely hostile actions by them to make money. My list of things good open source replacement would have: Decentralized chat servers with history Run a optional centralized login service so users have one login Optional centralized service knows what servers the user is a member of so any client they login to will automatically know which servers they are member of. Centralized Mobile Notification service Federation is absolutely not a requirement or a way around this.
- delta_p_delta_x 2y ago
  > others are pretty normie hostile This is a fairly reasonable generalisation to make about the vast majority of open-source software. 'Normie-hostile'.
- kurisufag 2y ago
  i've semi-successfully moved a university linux users group onto matrix fwiw, with most people (regular discord users) happy using element's desktop/mobile UI. it's as close to a discord-y experience as you're likely to get.
  - stackskipton 2y ago
    University Linux User Group I would say is already not normies. When I say normie, they are not posting on Hacker News and never heard of Y Combinator ;) They are your non tech friends and a lot of open source needs to interact with them where they are. Where they are is Discord.
- mdaniel 2y ago
  > Because there isn't a good replacement in open source software https://github.com/zulip/zulip/blob/9.4/LICENSE https://github.com/zulip/zulip/blob/9.4/LICENSE (Apache 2) and if you mean "good [hosted] replacement" https://zulip.com/for/open-source/ https://zulip.com/for/open-source/ It, of course, does not speak to your decentralized wishlist but I'm sure they'd welcome an issue describing your goals
  - s2l 2y ago
    I really want to use zulip but last I checked they charged for push notifications. Without it, my group lost interest in using it due to missed messages. I saw a post about webpush a day ago. Not sure if anything has changed for zulip in that area.
    - alya 2y ago
      If you are using Zulip for an open-source project or a community, you are likely eligible for our free Community plan, which includes push notifications. https://zulip.com/help/self-hosted-billing#free-community-plan https://zulip.com/help/self-hosted-billing#free-community-pl... We charge businesses for our push notifications service because we need folks using our 100% open-source product to run their business to help pay the cost of developing it.
hnlmorg 2y ago
I agree with you in principle but in practice there aren’t really any good options. You either have something relatively niche that’s open but people are unlikely to have installed and is often non-trivial for project maintainers to set up and maintain. Or you have something that solves those concerns but is proprietary and sometimes even actively hostile to 3rd parties. It feels like the whole messaging ecosystem has taken several steps backwards over the last 20 years.
- mdaniel 2y ago
  I'll point out that everything is relatively niche until it becomes popular, and then it's "well, what else would you use?!" and that's how Discord even became a thing that anyone would mention. Or this weird thing named Slack - pfft, who would use a chat named that
  - hnlmorg 2y ago
    Sure. But it’s not a project maintainers job to make an unrelated communications tool popular. Plus there’s also the problem of finite time and proprietary tools just being more convenient.
    - igor47 2y ago
      Freedom. Convenience. Is there a tension between those?
- DrillShopper 2y ago
  WebChat + IRC server works just fine, only requires a browser for somebody to drive-by use, and allows more serious/heavy users to use whatever client they want. Install a logging package on the IRC server to make logs available publicly and searchable (or you can just have a bot user that does this if you're using an IRC server that someone else is hosting). This was the norm in the late-90s through about 2010 and then suddenly it wasn't good enough.
  - hnlmorg 2y ago
spacechild1 2y ago
I'm part of an open source project with a self-hosted Discourse forum. It's just better in every aspect. (Discourse even has built-in DMs and chat.) I find it incredibly sad that people generally have moved away from open forums to proprietory silos like Discord or FB groups.

bri3d 2y ago

> that the client spies on you and that data is (part of) your payment. What value do you think this click tracking data has? I'm genuinely curious. To me this seems like Product Manager Telemetry, which is still an insidious and pervasive privacy problem (see: Microsoft Windows), but I can't quite understand how this is a You Are the Product situation. What purchaser is going want to buy data about where people are clicking on the Discord client? What value does this provide them? > Also their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. A full-fledged desktop app could also load code from a server and execute it. Or just install an "automatic update." If you're worried about this kind of thing you should be sandboxing every application that can access the Internet.

thomastjeffery 2y ago
It doesn't matter how much value it has. If you pay in dollars, and suddenly the dollar is deflated to way less value than the euro, you have still payed.
superkuh 2y ago
Normal applications do not completely replace themselves every time they are run. I hope you can see the difference. It's easy to see that the files in an actual application running on your OS don't change. It's much harder when there are no files and everything is downloaded anew every time you start the application. Totally different than "automatic updates" of actual applications.
RunSet 2y ago
> the client spies on you and that data is (part of) your payment. >> What value do you think this click tracking data has? That it is collected at all shows that, at least to data miners, a user's data has a value greater than the cost of collecting it.
- bri3d 2y ago
  No, the data is collected for internal use by product managers. It has little value I'm aware of on the open market and is unlikely to be collected for sale. That's my entire point. Enshittification is Bad, yes, but it's also had an even more caustic knock-on effect where a certain subset of people assume every part of every piece of software is part of a gigantic conspiracy against them, and in turn become extremely non-curious about figuring out why and how things work the way they do.

liendolucas 2y ago

Thanks for that! Wasn't aware of the aggresive tracking nor their remote admin capability. This screams to be containerized at all costs. I will try to reduce its use to the bare minimum and only from the browser as I've been doing so far and will ever install their client.