Hacker News Reader

Comment by ev1 | Hacker News Reader

This has been well known for a while; they block all third party clients and libraries outside of using their official bot API.

Having been on the receiving end of over 50k compromised accounts attacking my server (with verified phone enabled); largely stolen oauth/access tokens from real users, I can also see why they would do that as a platform owner.

On the other hand, as a rms-thoughtpattern, this is awful.

View on HN

Spam attacks have nothing to do with 3rd party clients.

malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack

This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.

then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.

Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten.

Obligatory "I don't work at Discord, just actively develop against their API" goes here.

I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.

There are third-party mods for the client (see ex. https://github.com/powercord-org/powercord), but those are generally responsible in discouraging API abuse.

What does Powercord do? This is the first time I've been made aware of third-party mods for Discord, so maybe there's something obvious that I'm missing, but even looking at their website (https://powercord.dev/) there seems to be absolutely no information about what it actually does.

It seems to be a platform for other plugins/themes to target

As an Electron app, you can make the official client do literally anything with a bit of effort.

The official client is basically a chrome instance. You can press ctrl+shift+I and put in any script you like.

So far (to my knowledge) discord hasn't made any effort to prevent modding of its official client. Most people just do it to inject css etc.

They don't typically care about client mods as far as I can tell, the use case they ban accounts for is using a third party client entirely.

That being said I don't think slack/discord should be a thing for open source communities.

"Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately.

There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.

Outside of bots and spam, third party Discord clients also often disable a lot of Electron's options that guard against XSS stuff escaping the sandbox, which is pretty dangerous. I wouldn't be surprised if Discord wanted to minimize the chance of some really big problem stemming from lots of users using these unsafe versions.

The client in question here doesn't use Electron at all, so I don't think that'd be too relevant.

Reply on news.ycombinator.com