He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to his IP, which potentially could be used for DDOS or geolocation. The kind of 'data collection' which could have visible impacts upon his life.

And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.

They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.

Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon.

Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID.

I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.

> Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon.

This is the first time I hear of this, can you please link a source?

The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.

So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it).

0: https://discord.news/trust-and-scam/

That's one incident. I'm talking about a pattern of behavior where staff members act unprofessionally. That includes telling your users "I can just change your ID lol" even if they don't end up doing it.

Discord didn't fire the person who was joking about database edits the most (or anyone to my knowledge). All they did was close the outlet for staff to show their badge off and brag about it. That doesn't fix anything, my assumption is that this is still going in.

> I'm talking about a pattern of behavior where staff members act unprofessionally.

Could you please provide some sources? As the other poster noted this is the first time we hear of this. Would be keen on knowing more

As long as you provide yours about Teamspeak servers.

I dont believe I spoke about nor said anything about Teamspeak. What are you referring to?

However, individually deleting messages using their API does delete them from their servers[0].

[0]: https://blog.discord.com/how-discord-stores-billions-of-mess...

It does, but that is not always an option. What if you shared personal information on a server you no longer have access to? Your only option is to wait a week for your data export and then wait another 2-3 weeks for a support ticket to get to the stage of threatening Discord into actually removing individual messages. What if you're being stalked? What if you said something incridebly dumb on a server you assumed was limited to very specific people? A month to removal is untenable. Discord needs searchable dashboard that allows one-click removal.

Discord considers all servers public, not because they actually are (many are for friend groups or even classes etc.), but because that'd mean your consent for keeping any message you send is in question whenever someone is invited to a guild you were not expecting there. Their argument against removal is always "following public conversations is in the public interest". Any European court would tell them to fuck off if someone finally sued them over ignoring GDPR requests, because in the end most Discord servers (absolute numbers, not by volume) can not be considered public.

Not only that, Discord communities are all invite-only, even the discoverable ones are technically invite-only (discoverability process of Discord requires a permanent invite).

> Discord needs searchable dashboard that allows one-click removal.

The thing is there is no user→message mappings stored in their database. The data structures are designed for message→user traversal. Nothing like Facebook's user activity log.

at least on large servers, the search indexes are reasonably up to date and include user IDs.

(on small servers they're unfortunately on-demand, but you could still store a set of all guilds a user ever joined and build an overview)

I tried the data export, but did not get any of my messages from the guilds I am no more a member of.

Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.

with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP.

The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.

Don't underestimate the skill and ingenuity of pissed off 15 year olds.

With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting.

Blind devotion to a cause and a flexible mind can overcome many problems.

Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.

There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.

Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite.

Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years.

https://twitter.com/the_secret_club/status/13812019496479047...

https://twitter.com/the_secret_club/status/13809601207257333...

https://twitter.com/the_secret_club/status/13808687591292969...

Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now.

https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro...

Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff.

https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-...

Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...

As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it.

Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking."

Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.

It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.

Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on.

Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars.

Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.

this is true, but also goes for every internet-connected service that i choose to use, as far as my IP address goes

i've been invited to random, huge discord servers to play just one game, and after the games over i usually leave the server unless i know everybody. i never have to worry about the server admin or one of his buddies deciding they didn't like me for whatever reason and DDOSing the shit out of me for weeks, forcing me to change my IP address because i didn't use a VPN.

that's just personal; it could even turn a profit if a professional gamer joined a server, several users recorded the IP address, bet against them in an upcoming game, then DDOS'd the shit out of them.

The game server admin also sees your IP address though? So unless you are only hanging out on discord and not actually playing you are still exposing your IP address.

Also only the voice server admin sees the IP address and not every user on the server, so your scheme wouldn't really work either.

yes, i should have said "the voice server admin records the IP address" instead

i think game servers are a different subject, and they have their own buffet of problems