Comment by superkuh | Hacker News Reader

Comment by superkuh | Hacker News Reader

Parent Full thread

Discord is a bad decision for security reasons, for privacy reasons, reliability, and for ethical reasons.

it's not just illegal things that are kicked off. If you violate a third party company's terms of service, say making bots for Team Fortress 2 (a valve video game) then you'll be banned suddenly as well. And Discord is no stranger to banning things that are not illegal but just controversial like, https://www.reddit.com/r/guns/comments/cvv5da/meta_rguns_dis...

In terms of privacy: they send a tracking request for every single thing you do in their client. Clicked on someone's profile, clicked on a channel, clicked on a server, etc. The URL was named /track before but they renamed it to "/events" recently (but it's still a POST with no response).

Their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).

Most programs can download new code and open whatever files they want as long as their process has the permissions. You can certainly argue that that shouldn't be the case, but calling Discord a RAT because of it is pretty silly.

(Not defending it on the other counts, though. If I wanted a platform for anything controversial or privacy-sensitive, I wouldn't trust Discord or any other centralized, unencrypted service.)

> Most programs can download new code and open whatever files they want as long as their process has the permissions

We should avoid and shame the programs that do that. This is literally a backdoor.

You would have to add every program with an auto-updater onto that list, because that's what they literally do; take files streamed online and slap them into its install directory

Like shit, I have 3rd party mod managers for video games that are exclusively built to do such that

Most programs I use (on Linux) do not come with an auto updater. Instead, I get updates through my distro's package manager.

I have Discord installed, because unfortunately that's where my friends are. However, it cannot access arbitrary parts of the file system because it is installed via flatpak; it only has access to ~/Downloads and ~/Pictures.

This is one benefit of Linux distro package managementany people forget - apps can't just update themeselves (possibly after their updater being compromised) but go via package maintainers and are built from source on trusted distro infrastructure.

>Most programs can download new code and open whatever files they want as long as their process has the permissions. You can certainly argue that that shouldn't be the case, but calling Discord a RAT because of it is pretty silly.

I think it's reasonable to call it a RAT because it executes arbitrary remote code AND has those permissions.

Google Chrome and Firefox (on windows) do the same, via auto update mechanism. Would you call it a RAT?

I feel as if there is a meaningful distinction to be made between a program that occasionally downloads binary patches to itself (and will run fine without it), and a program that gratuitously downloads scripts every time it is run, runs them directly from ram so that they can't be audited, and refuses to run if it is not allowed to do this.

So if you're running Chrome/Firefox dev-channel then they're a RAT? Or is twice a week not enough to trigger your threshold? What about the canaries that are updated daily? What about betas that are updated every week?

I'm not sure how you come up with a good distinction.

>So if you're running Chrome/Firefox dev-channel then they're a RAT?

No, because it's opt-in and it's explicitly needed for the purposes of a dev/nightly build. This is as opposed to a voip client which needs unrestricted access because... they want to be able to run A/B tests on uninformed subjects?

One other distinction to make is that auto-update typically runs the same code on a lot of computers, rather than a RAT which is good at running code on a specific computer.

There's still room for problems... the auto-update could deliver a special version for special people or deliver a version that has special code targeted at run-time, but it's not as easy. And I'd love to see work on minimizing problematic updates as well.

Not most programs that I run (ie, hexchat for IRC which is better than discord in all ways). And those that do don't do it silently every time they start, and not just after they start, but any time they're running with no notification to the user.

No, a program with an 'update' feature built in is much less offensive than a program who's entire code is remote and new every time but still has local privs.

I don't care if discord knows my friends list or who I've clicked on.

There are no alternatives. Bandwidth costs money, and P2P is deadly. That's why discord exists in the first place.

Which is why discord gets run in a browser tab for me.

Other software could do that too without you having any idea, surely that's an argument for being careful with permissions and how your software runs rather than against Discord in particular?

> before but they renamed it to "/events" recently

Pretty sure it has been /science for at least 2 years.

> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString()

And that is why you encrypt your SSH keys with a passphrase, use a Keychain, etc. Discord isn’t unique in its ability to read file on the FS. Pretty much anything can do that.

Does that really help much? It still has access to .bash_profile

What secrets are you putting in your bash profile? I used to be guilty of putting AWS keys in there, I guess, but nowadays we have aws-vault.

For example it could register a fake ssh-agent that just grabs your password first time you type it

> Pretty much anything can do that.

Nah, pretty much anything except proprietary software has a higher chance of being written by people I trust and packaged by people I trust and probably audited by me and other people, and is not capable of loading executable code from any server after installation.

Reply on news.ycombinator.com