Hacker News Reader

Comment by illusive4080 | Hacker News Reader

Why does Discord allow a server for a botnet owner?

There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

Discord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.

Only a couple years ago the outrage was that Discord was too eagerly banning servers and users.

I know several people whose Discord accounts were banned because they participated in a server that later had some talk of illegal activities in one of the channels. There are similar stories all over Reddit.

If a Walmart has ~100 people in it and wants to get rid of 4 shoplifters but really sucks at selecting them well then the likely result is 4 normal people are very upset while all of the shoplifters are still there.

In the same scenario, even if Walmart is right about who they ejected 75% of the time then they still have ~1 shoplifter remaining and ~1 very upset person.

Even in an ideal world where Walmart is right about ejection 100% of the time it doesn't mean they start receiving 0 new shoplifters either, it just means the number of people wrongly made upset is 0.

Discord's problem (on both ends) lies in lack of depth in investigating bans. It takes resources to review when someone shouldn't be banned and it takes resources to make sure you ban everybody. Putting too low of resources into banning just means that both sides of the scale manage to get tipped in the wring direction at the same time.

Two things can be true at once. They can ban normal things too much and ban bad things too little.

Ever tried to ban a botnet owner from a service they want to use?

It’s basically impossible. They have money, IPs, identities, anything you could possibly want to evade.

They are rich in regard to the tools needed to abuse services haha.

If you just look at the messages in those kinds of discords. It's blatant. They aren't even trying to hide it.

It would be pretty funny if the age verification stuff blocked some of these folks.

Discord age verification is only for content filters, adult-themed servers, and a few other features.

They aren’t requiring age verification for everyone to join servers and chat. The headlines and panic really got away from the actual story.

Why wouldn't they? There are Discord servers about anything you can imagine and also what you can't or don't want to image. As long as they don't start disrupting their infra Discord couldn't care less.

Also, how would you even go about classifying them as botnet operators?

I imagine because banning these things is both whack-a-mole and like finding a needle in a hay stack.

botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.

A MAU is a MAU... They likely use relatively little computing capability while making numbers look really good...

botnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.

Reply on news.ycombinator.com