81–90 of 135 posts
> A recent security breach on our platform brought BotGhost to Discord’s attention. The breach in question is documented here: https://youtube.com/watch?v=lUiLBBab1RY I don’t think there’s a text write-up, but tl;dw a combination of missing input sanitization and no-code UI trickery made it possible to leak other users’ bot tokens, and despite patching the exploit pretty quickly on exposure, BotGhost’s developer trie…
I really dislike the way they try and play this down in the doc:
Earlier quoted context omitted.
You can already do that. People who want to do that aren't using BotGhost.
I was under the impression that writing a third party client was against TOS, and don't you have to write a client to get your bot to interact with the server?
Earlier quoted context omitted.
their target audience does not know what a "docker" is, much less wants to lease a server for hosting
You can teach someone how to rent a vps and run a docker image with one 10-minute youtube video. Then they can use the drag and drop editor and run the bot themselves. If they don’t want to pay for hosting that’s too bad. A vps to run a bot will cost a couple bucks a month.
I get the non-techie blindspot that all of us have in some form or another. With that in mind: it took three days to give my brother a crash course in Linux + Docker for his own home server (and even then he only knew the very basics). He’s fairly proficient in tech: builds his own desktops, knows the basics of code, doesn’t shy away from digging into the why, etc.
It would be unrealistic (and frankly irresponsible) to expect someone to setup _and understand_ a Docker server setup from a 10-minute video.
Earlier quoted context omitted.
I can't think of any way to look at this where Reddit is the lesser evil. I respect the position but I don't understand it. Reddit and Twitter reached the floor of enshittification with their respective 2023 actions. Discord and others may follow the precedent and get there, but my usage hasn't been affected yet. The Discord official client, unlike Reddit/Twitter, is still ad-free except for the occasional icon highl…
> is still ad-free I use an adblock, so I don't see any ads on Reddit. > I can't think of any way to look at this where Reddit is the lesser evil. Reddit is the lesser evil for my personal use case because more and more Discord servers require a verified phone number to send messages. I can't get help if I can't send a message.
Even if it was, "Requires a verified phone number" is not "Evil". You might not like it, it might be incomprehensible, it might be exclusionary, but it's not "Evil".
Earlier quoted context omitted.
You can run your own Revolt, Mattermost, or Rocket Chat server, which is basically Discord.
If you believe this you haven’t used Discord very much.
Create new account: all servers stuck in preview mode permanently
Create new account: instantly auto-banned
Create new account: phone-walled immediately
Create new account: banned immediately after providing phone number
Ban appeal: "our automated system is working properly, appeal denied"
Doesn't matter what computer/ISP/OS/browser/etc. I use, the experience is always one of these.
For whatever it's worth, I actually think this dev is understating the impact of their security issues. They had 2 token leaks - albeit conditional and with prerequisites. Given the sorts of tokens that a user has to supply to use this sort of generic app builder, this is pretty serious.
That said, I think inconsistent enforcement, when it favors them, is a really bad look on Discord. It totally looks like they're doing cover-their-ass, whack-a-mole, public relations-driven enforcement.
Earlier quoted context omitted.
I’m sure Uber and DoorDash and Lyft and Tinder and Instagram and WhatsApp are regretting the billions and billions they made doing this. It’s bad advice.
>I’m sure Uber and DoorDash and Lyft and Tinder and Instagram and WhatsApp are regretting the billions and billions they made doing this. I'm not sure which platforms those companies built their businesses on .. are you equating build an app on iOS or Android with building an app that relies on, say, Facebook APIs and only works on Facebook?
When Uber came out and for years afterward, there were no location APIs in mobile browsers.
When Instagram came out, there was no way to access the camera or photos in web apps.
