Sorry for your loss. I too virtually stopped using Discord in favor of, mostly, Reddit (lesser of two evils).
are you sure you know what 'lesser' means?
/s
Discord Is Threatening to Shutdown BotGhost
111–120 of 135 posts
Re: Discord Is Threatening to Shutdown BotGhost
#112>THESE GUYS DO IT TOO
Yup just throw everyone else under the bus.
Re: Discord Is Threatening to Shutdown BotGhost
#113Earlier quoted context omitted.
> is still ad-free I use an adblock, so I don't see any ads on Reddit. > I can't think of any way to look at this where Reddit is the lesser evil. Reddit is the lesser evil for my personal use case because more and more Discord servers require a verified phone number to send messages. I can't get help if I can't send a message.
That's the individual server, not a standard Discord policy. Subreddits can also make gates that are exclusionary. So... not Discord the company. Even if it was, "Requires a verified phone number" is not "Evil". You might not like it, it might be incomprehensible, it might be exclusionary, but it's not "Evil".
It’s a discord issue if individual servers are incentivised to require a verified phone number.
Re: Discord Is Threatening to Shutdown BotGhost
#114I have not been able to use Discord for years, even when I try hard against my better judgement. It always ends with one of these: Create new account: all servers stuck in preview mode permanently Create new account: instantly auto-banned Create new account: phone-walled immediately Create new account: banned immediately after providing phone number Ban appeal: "our automated system is working properly, appeal denied…
Try using a gmail account.
Re: Discord Is Threatening to Shutdown BotGhost
#115I have not been able to use Discord for years, even when I try hard against my better judgement. It always ends with one of these: Create new account: all servers stuck in preview mode permanently Create new account: instantly auto-banned Create new account: phone-walled immediately Create new account: banned immediately after providing phone number Ban appeal: "our automated system is working properly, appeal denied…
Try using a gmail account.
I'm not able to create one without a phone number, been trying for years.
Re: Discord Is Threatening to Shutdown BotGhost
#116> A recent security breach on our platform brought BotGhost to Discord’s attention. The breach in question is documented here: https://youtube.com/watch?v=lUiLBBab1RY I don’t think there’s a text write-up, but tl;dw a combination of missing input sanitization and no-code UI trickery made it possible to leak other users’ bot tokens, and despite patching the exploit pretty quickly on exposure, BotGhost’s developer trie…
Maybe uncharitable, but it seems like BotGhost comprehensively doesn't take security seriously. Not only were there bad vulnerabilities, but they didn't have the logging (or didn't use it) to see who was affected; didn't want to roll keys; didn't want to announce; and didn't even have their own bots use their own security features. So yeah. I'm a bit more sympathetic if Discord decided that BotGhost in particular wasn't going to be using Discord's platform any more. Because I'd guess the probability these are the last of BotGhost's serious vulnerabilities to be about 0%.
So now botghost is doing a pentest. But I dunno... my guess at the likelihood of doing a good job backfilling security into a codebase that wasn't built with that as a core concern is also low.
Re: Discord Is Threatening to Shutdown BotGhost
#117Earlier quoted context omitted.
To read message archives or to read messages in realtime? Because I was working on a sideproject that required monitoring the messages in a channel, not just slash commands.
Read messages in realtime.
At least I know now before I put more effort into it. Thank you for the warning.
Re: Discord Is Threatening to Shutdown BotGhost
#118I've often thought about the amount of data that these bot services must have access to (they could log millions of private channels), data thats silo'd away from search engines/indexers and could be pretty valuable to sell to someone training an AI model, or doing other things. A while back there was a service called 'Spy Pet' that ran hundreds of discord bots selling access to searchable data logs. I wonder if disc…
Discord locked down the ability of bots to read message contents back in 2022. For bots used in over 100 servers, doing so now requires explicit approval from Discord (in addition to the standard approval the server owner would need to give). For most bots, the rest of the bot API is rich enough for this to not be an issue. That cuts out a lot of the value for LLM training; and will reduce the blast radius if Discord…
this is good to know! thank you for the info
Re: Discord Is Threatening to Shutdown BotGhost
#119General PSA: in most situations these things like "terms of service" and "breach notice" have no legal effect. (I am not a lawyer and this is not legal advice) What they do is the same as a "cease and desist": they warn you that Discord might consider suing you or might try to ban you by technical means. It's all about business, not what the terms say. If Discord thinks BotGhost is good for Discord's bottom line, the…
Discord has been against botting personal accounts for a long time. If you want to automate, you make a bot account and ask the server permission to join with it.
Then it's a good thing that's what BotGhost does. Except Discord's saying you're not allowed to do that either now.
Re: Discord Is Threatening to Shutdown BotGhost
#120> A recent security breach on our platform brought BotGhost to Discord’s attention. The breach in question is documented here: https://youtube.com/watch?v=lUiLBBab1RY I don’t think there’s a text write-up, but tl;dw a combination of missing input sanitization and no-code UI trickery made it possible to leak other users’ bot tokens, and despite patching the exploit pretty quickly on exposure, BotGhost’s developer trie…
Maybe uncharitable, but it seems like BotGhost comprehensively doesn't take security seriously. Not only were there bad vulnerabilities, but they didn't have the logging (or didn't use it) to see who was affected; didn't want to roll keys; didn't want to announce; and didn't even have their own bots use their own security features. So yeah. I'm a bit more sympathetic if Discord decided that BotGhost in particular was…
That logging you want (every command and response) would have been a huge GDPR violation.
I suppose they could have logged only if a bot token was detected in output. But if you'd think to do that, then why not also just block the output?