Comment by superkuh | Hacker News Reader

Comment by superkuh | Hacker News Reader

Parent Full thread

Yep. Discord is not a chat protocol. It is a proprietary corporate service. The reason you can't use alternative clients for their service is (the TOS and...) that the client spies on you and that data is (part of) your payment.

They send a tracking request for every single thing you do in their client. Clicked on someone's profile, clicked on a channel, clicked on a server, etc. The URL was named /track before but they renamed it to "/events" and then recently "/science" (but it's still a POST with no response).

Also their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. On launch the desktop client opens websocket server for command and control listening.

They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).

I'm always saddened when I see an open source project's page say something like "Join us on Discord!"

I can understand an open source project being on GitHub, since, at one point, they were a pretty warm-fuzzy place, and so attracted a lot of open source projects, before they sold out to Microsoft.

But I really don't know how so many open source projects looked at Discord, early on, and thought that's a good idea.

AFAICT, Discord is pretty antithetical to open source and, especially, libre software.

Because there isn't a good replacement in open source software. Matrix and others are pretty normie hostile.

I help run a few Discord servers and due to financials, I'm always worried about extremely hostile actions by them to make money.

My list of things good open source replacement would have:

Decentralized chat servers with history

Run a optional centralized login service so users have one login

Optional centralized service knows what servers the user is a member of so any client they login to will automatically know which servers they are member of.

Centralized Mobile Notification service

Federation is absolutely not a requirement or a way around this.

> others are pretty normie hostile

This is a fairly reasonable generalisation to make about the vast majority of open-source software. 'Normie-hostile'.

i've semi-successfully moved a university linux users group onto matrix fwiw, with most people (regular discord users) happy using element's desktop/mobile UI.

it's as close to a discord-y experience as you're likely to get.

University Linux User Group I would say is already not normies.

When I say normie, they are not posting on Hacker News and never heard of Y Combinator ;) They are your non tech friends and a lot of open source needs to interact with them where they are. Where they are is Discord.

> Because there isn't a good replacement in open source software

https://github.com/zulip/zulip/blob/9.4/LICENSE (Apache 2) and if you mean "good [hosted] replacement" https://zulip.com/for/open-source/

It, of course, does not speak to your decentralized wishlist but I'm sure they'd welcome an issue describing your goals

I really want to use zulip but last I checked they charged for push notifications. Without it, my group lost interest in using it due to missed messages.

I saw a post about webpush a day ago. Not sure if anything has changed for zulip in that area.

If you are using Zulip for an open-source project or a community, you are likely eligible for our free Community plan, which includes push notifications. https://zulip.com/help/self-hosted-billing#free-community-pl...

We charge businesses for our push notifications service because we need folks using our 100% open-source product to run their business to help pay the cost of developing it.

Things become less normie hostile as more people adopt it. Two decades ago reddit was normie hostile.

Reddit was never normie hostile. It may have not been mainstream but hostile to your average user, no. You logged in with a browser like Facebook, you could subscribe or not to any subreddit you wish, those subscriptions would show up on any browser/mobile app you logged in on, everything was stored for you server side. Centralization is what most normal people expect. They don't want to futz around with remember things or having to setup the clients every time they switch. They want it all there every time on every device.

> Matrix and others are pretty normie hostile.

Judging by the design choices I've seen in Matrix 2.0 beta clients, this seems to be changing. A few important fixes and a lot of UI simplification are falling into place. I would not be surprised if I could get my family members using it once these are all integrated in fully functional clients. Here's hoping.

I agree with you in principle but in practice there aren’t really any good options.

You either have something relatively niche that’s open but people are unlikely to have installed and is often non-trivial for project maintainers to set up and maintain. Or you have something that solves those concerns but is proprietary and sometimes even actively hostile to 3rd parties.

It feels like the whole messaging ecosystem has taken several steps backwards over the last 20 years.

I'll point out that everything is relatively niche until it becomes popular, and then it's "well, what else would you use?!" and that's how Discord even became a thing that anyone would mention. Or this weird thing named Slack - pfft, who would use a chat named that

Sure. But it’s not a project maintainers job to make an unrelated communications tool popular.

Plus there’s also the problem of finite time and proprietary tools just being more convenient.

Freedom. Convenience. Is there a tension between those?

WebChat + IRC server works just fine, only requires a browser for somebody to drive-by use, and allows more serious/heavy users to use whatever client they want. Install a logging package on the IRC server to make logs available publicly and searchable (or you can just have a bot user that does this if you're using an IRC server that someone else is hosting).

This was the norm in the late-90s through about 2010 and then suddenly it wasn't good enough.

I’m old enough to have not only used IRC in the 90s but to have also written my own IRC client.

The problem with IRC is exactly what you described yourself. You “just” need to install a half dozen things to get a modern experience and it’s not something that either the project maintainers nor casual uses of your project are going to want to do.

I loved IRC for a decade or so and even I can’t bring myself to officially support it on my open source projects. It’s just a distraction — time that could be better spent actually writing code or supporting users and other contributors.

I don’t support Discord either, but I get why other maintainers might like the zero-effort solution. It enables them to focus on the project and not building auxiliary services.

This is the problem that people miss when they talk about “just use x”… they forget that being a project maintainer is a massive time sink and time is finite. So we sometimes have to make trade offs. If it’s a choice between configuring IRC or that highly requested new feature, then few maintainers are going to pick IRC.

Oh definitely, and if I implied otherwise I did not mean to.

I stopped developing open source software because I got tired of dealing with getting people in my email demanding things from me despite it just being a personal project to scratch an itch, so I understand that a developer may not have the time to set up infrastructure to offer a modern experience over IRC. If that's the case a project is in then I agree - actually developing the project is more important.

It's more of a lament that things aren't the way that they were, not a demand that everybody cater to my preferences.

I'm part of an open source project with a self-hosted Discourse forum. It's just better in every aspect. (Discourse even has built-in DMs and chat.) I find it incredibly sad that people generally have moved away from open forums to proprietory silos like Discord or FB groups.

> that the client spies on you and that data is (part of) your payment.

What value do you think this click tracking data has? I'm genuinely curious. To me this seems like Product Manager Telemetry, which is still an insidious and pervasive privacy problem (see: Microsoft Windows), but I can't quite understand how this is a You Are the Product situation. What purchaser is going want to buy data about where people are clicking on the Discord client? What value does this provide them?

> Also their desktop client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers.

A full-fledged desktop app could also load code from a server and execute it. Or just install an "automatic update." If you're worried about this kind of thing you should be sandboxing every application that can access the Internet.

It doesn't matter how much value it has. If you pay in dollars, and suddenly the dollar is deflated to way less value than the euro, you have still payed.

Normal applications do not completely replace themselves every time they are run. I hope you can see the difference. It's easy to see that the files in an actual application running on your OS don't change. It's much harder when there are no files and everything is downloaded anew every time you start the application.

Totally different than "automatic updates" of actual applications.

> the client spies on you and that data is (part of) your payment.

>> What value do you think this click tracking data has?

That it is collected at all shows that, at least to data miners, a user's data has a value greater than the cost of collecting it.

No, the data is collected for internal use by product managers. It has little value I'm aware of on the open market and is unlikely to be collected for sale. That's my entire point. Enshittification is Bad, yes, but it's also had an even more caustic knock-on effect where a certain subset of people assume every part of every piece of software is part of a gigantic conspiracy against them, and in turn become extremely non-curious about figuring out why and how things work the way they do.

Thanks for that! Wasn't aware of the aggresive tracking nor their remote admin capability. This screams to be containerized at all costs. I will try to reduce its use to the bare minimum and only from the browser as I've been doing so far and will ever install their client.

Reply on news.ycombinator.com