Hacker News Reader

Comment by AngelOnFira | Hacker News Reader

tl;dr, Discord is forcing bots that are in over 75 servers to make use of slash commands, because Discord will no longer send raw messages starting April 2022. So no more `!pause`, or whatever else you might normally type. And this change isn't easy to implement for Discord.py, and would require full bot rewrites for devs using the library. So along with a lot of other negligence towards bot developers from Discord, Discord.py's single developer has stepped down, and no other core library developers chose to step up.

View on HN

> Discord is forcing bots that are in over 75 servers to make use of slash commands, because Discord will no longer send raw messages starting April 2022

Can someone explain why that is? My understanding is that adding bots to a server requires Admin/Owner access, who are already at liberty to read all messages. If you don't trust bots scraping your messages in a server, don't you implicitely distrust the owners? Just leave the server?

There is a third party you have to implicitly trust, the bot developer. Given most of these bots are used to provide specific functionality, them being able to read messages seems too broad in scope – I know I don't want to have to trust another invisible party to also do the right thing.

That said, this looks like very poor communication and imposition of a lot of developer toil on Discord's part.

They should allow server owners to choose whether every bot they have added can read every message or just /commands. But that would require too much intelligence on their part :P

That's already in the permissions system unless they did something weird to it.

Then I don't understand what the problem is, really.

The problem is admins haphazardly adding tons of toy bots to servers with sometimes hundreds or thousands of members, and those bots being a front for storing tons of user data (including eg. user online status, user tag (name#1234) history, a large DB of the users' messages across years). The users in these servers aren't informed of such change and Discord can't trust these developers to say "we don't log messages" without requiring them tie a legal identity to any potential malicious logging.

This is an interesting comment and was totally missing from the OP's description of the issue; I had to dig into this tread to get it.

If the OP fails to present or hide the full picture to me it harms his credibility.

> Unfortunately, at the same time, there were growing concerns with a user-bot ring that made a website and scraper known as "dis.cool", which farmed user information.

> Most library developers felt the changes were misdirected and targeted the wrong type of bot. The threat model was based on user-bots being bad actors, and not regular bots, while the changes targeted regular bots. We also felt that it was easy to sidestep the restrictions by just having a bot ring, similar to what is now done today with user-bots.

> Discord claimed [the new requirements, including government ID] would help with security and privacy by preventing malicious bots from growing and obtaining sensitive data. The library developers responded that it wouldn't help since malicious bots had to be invited and the crux of malicious bots were, and still are, user-bots.

Seems like a reasonable description of the issue to me, covering everything in that comment.

If you feel it gets lost in the words then I think the proper thing to criticize is the writing style, not the credibility.

(If the term is unclear, "user-bot" means it's a normal user account being used in an automated way.)

I wonder if it's the real target here is bridges - without being able to relay messages (without ToS violating puppeting), it's going to get a lot harder to migrate users from discord.

Is there much use of giant bridge bots?

I run a bridge but that's just one server.

I doubt bridges are a threat. It's all about capturing revenue streams.

I was using bridges to migrate to Discord, so…

Guess I’m back to IRC.

This sounds like you might be able to get Discord to approve your privileged intent

I remember a while back reading a thing where basically there were bots out there essentially scraping entire chat logs without its users really being aware of this. There's probably also a lot of stuff going around with identity (like people making bots that look like official ones but aren't) etc.

I get people complaining about this situation, but there is a gradient of access between "no content access whatsoever" and "the bot can see everything". Slack's API does a pretty good job of making some of this work

Yes. That is the case, and we (developers) argued that, the response we received was "but the _users_ may not know, even if the owner has authorized the bot".

WTF is a slash command?

/<command> as in /help or /rules

https://en.wikipedia.org/wiki/Slash_(punctuation)#Programs

Reply on news.ycombinator.com