[HN Gopher] Discord Is Threatening to Shutdown BotGhost
___________________________________________________________________
Discord Is Threatening to Shutdown BotGhost
Author : exists
Score : 74 points
Date : 2025-06-23 20:16 UTC (2 hours ago)
(HTM) web link (update.botghost.com)
(TXT) w3m dump (update.botghost.com)
| czk wrote:
| I've often thought about the amount of data that these bot
| services must have access to (they could log millions of private
| channels), data thats silo'd away from search engines/indexers
| and could be pretty valuable to sell to someone training an AI
| model, or doing other things.
|
| A while back there was a service called 'Spy Pet' that ran
| hundreds of discord bots selling access to searchable data logs.
| I wonder if discord is primarily concerned about the massive
| logging capability of services like these.
| haneul wrote:
| Yea the data market from discord bots is quite a thing. Really
| concerning, imo.
| areyourllySorry wrote:
| spy.pet used user accounts. botghost uses bot accounts, for
| which you need to enable certain intents in order to read
| messages.
| ocdtrekkie wrote:
| One of the things I found surprising is that many of Discord's
| bot permissions are not scoped to servers at all. I've been
| asked to authenticate with a bot service for _one server_
| numerous times that requests access to things pertaining to
| _all servers_ I use, and that seems very wrong.
| fakedang wrote:
| This isn't Discord doing this out of the goodness of their
| privacy-concerned hearts. They'll eventually try to do a
| Salesforce-Slack kind of play here by preventing external
| entities from monetizing on their platform.
|
| Tech will turn into a casino where the house (aka the platform)
| always wins.
| paxys wrote:
| After Reddit's API shutdown the writing was on the wall.
| Services like Reddit and Discord are huge data troves, and now
| this data has a concrete $$ value. Offering unrestricted API
| access means that third parties will store and sell this data.
| So shutting them down (and monetizing your data yourself) is an
| obvious decision. Slack recently changed its ToS to disallow
| this as well - https://www.reuters.com/business/salesforce-
| blocks-ai-rivals....
| koakuma-chan wrote:
| Sorry for your loss. I too virtually stopped using Discord in
| favor of, mostly, Reddit (lesser of two evils).
| zapzupnz wrote:
| I'm not sure how the two are remotely comparable. I don't go to
| Reddit for live discussion, voice and video chat, etc.
| koakuma-chan wrote:
| I used to go to Discord for help, and now I go to Reddit for
| help.
| anonym29 wrote:
| The lesser of two evils is still evil. Make Forums Great Again!
| gagik_co wrote:
| Agree! I finally set up my own NodeBB forum for my app
| support and I'm very excited to move in this direction. It
| was a nicer experience than expected.
| immibis wrote:
| Reddit is more evil than Discord IMO - they did this years ago,
| tried to shut down all bots and unofficial apps, _and_ they
| heavily manipulate consensus opinion, which Discord doesn 't as
| far as I know.
| add-sub-mul-div wrote:
| I can't think of any way to look at this where Reddit is the
| lesser evil. I respect the position but I don't understand it.
| Reddit and Twitter reached the floor of enshittification with
| their respective 2023 actions. Discord and others may follow
| the precedent and get there, but my usage hasn't been affected
| yet. The Discord official client, unlike Reddit/Twitter, is
| still ad-free except for the occasional icon highlighting their
| "Shop" tab.
| koakuma-chan wrote:
| > is still ad-free
|
| I use an adblock, so I don't see any ads on Reddit.
|
| > I can't think of any way to look at this where Reddit is
| the lesser evil.
|
| Reddit is the lesser evil for my personal use case because
| more and more Discord servers require a verified phone number
| to send messages. I can't get help if I can't send a message.
| neom wrote:
| I'm building a lot on discord right now, I like it but I keep
| getting scared, then I think, eh, irc servers could have gone
| away too I suppose, in fact they did, much was lost. I'm sure I'm
| missing a lot of nuanced thinking in this though.
| LambdaComplex wrote:
| You can always run your own IRC server. If Discord shuts down,
| then you're out of luck.
| neom wrote:
| Indeed. Discord have really nailed the... ircd, if you will,
| for what I use discord for (community building in non-
| technical abstract user bases), it's perfect, terrifying, but
| perfect.
| immibis wrote:
| You can run your own Revolt, Mattermost, or Rocket Chat
| server, which is basically Discord.
| sneak wrote:
| If you believe this you haven't used Discord very much.
| johnisgood wrote:
| and Zulip. But they do not support video and audio calls,
| for one.
| monkeywork wrote:
| The massive nuance you are missing is that IRC had a default
| expectation of being ephemeral in nature. Sure you might use
| IRC for chatting and have some bots around that - but typically
| your long term storage of information would have been handled
| in something like a forum, website, email list, file
| repository, etc - so that even if an individual IRC server went
| down it wasn't a big deal to move along. IRC was/is less a
| platform and more a protocol.
|
| Discord on the other hand does everything IRC does but people
| have made it take the place of forums, blogs, file repos, etc
| etc. All this information is locked up in a platform that can't
| be searched or often even accessed without signing up for the
| platform. Unlike IRC however Discord is not a protocol that
| others can tie into - it's a platform and they can/do actively
| lock people out of it.
| mschuster91 wrote:
| > The massive nuance you are missing is that IRC had a
| default expectation of being ephemeral in nature.
|
| Bouncers and log bots have been a thing even 20 years ago
| when I was active on Freenode. In fact, a bouncer and log bot
| was what made me get my very first own VPS... time flies. It
| lasted a year until my first attempt at a libc upgrade
| failed, that was a lot of work to fix.
| MiscIdeaMaker99 wrote:
| We definitely had bots on IRC in the 90s.
| sneak wrote:
| IRC is decentralized; you can self-host. Discord, despite
| misusing the term "server", is one user database and one
| centralized organization.
| colesantiago wrote:
| Repeat after me and frame this.
|
| Never build your main business on somebody else's platform.
|
| Always assume that you will get shutdown / rugged when you do so.
| like_any_other wrote:
| Yeah, if you want to pump oil, you better also build your own
| railways to distribute it, because you won't like what Standard
| Oil will charge you for their trains.
| shreddit wrote:
| That's actually solid advice. At a certain point it's cheaper
| to build your own datacenter than to rent servers...
| macspoofing wrote:
| >Yeah, if you want to pump oil, you better also build your
| own railways to distribute it
|
| You're being facetious, but OP is right. For software
| platforms, this has been a constant. It happened with
| Twitter, Facebook, Google (Search/Ads, Maps, Chat), Reddit,
| LinkedIn - basically ever major software platform started off
| with relatively open APIs that were then closed-off as it
| gained critical mass and focused on monetization.
| brookst wrote:
| And it's bigger than software. This is just vertical
| integration; both your suppliers and your customers will
| ask if they can replace you. As they should. If your only
| value is as a middleman that your upstream supplier can
| easily replace... well, that's not a lot of value.
| like_any_other wrote:
| I'm not being facetious, I'm pointing out a real problem -
| the market fraction accessible to a new business, that
| isn't reliant on the good will of some giant incumbent, is
| shrinking. This time it's Discord, another time it's Google
| ads/search blacklist, or Microsoft flagging your website or
| program as malicious, or Facebook shadowbanning you (or
| charging to show your posts even to people who explicitly
| followed you [1]), or Walmart extorting you for shelf space
| access, VISA and PayPal rejecting you..
|
| If your move is to simply retreat, and give up all this
| ground, what market is left for you? People who get their
| news and ads by paper mail, shop only at tiny independent
| stores, paying in cash? How many businesses can survive
| with ~5% (a generous estimate of the described market's
| relative size) of their current traffic?
|
| [1] https://www.bentbusinessmarketing.com/why-your-fans-
| arent-se...
| fnimick wrote:
| You're hardly safe on operating system platforms either.
| Look at the long history of Apple sherlocking independent
| vendors.
| macspoofing wrote:
| >Never build your main business on somebody else's platform.
|
| Yep. It's a lesson that keeps being re-learned the hard way.
| sneak wrote:
| I'm sure Uber and DoorDash and Lyft and Tinder and Instagram
| and WhatsApp are regretting the billions and billions they
| made doing this.
|
| It's bad advice.
| macspoofing wrote:
| >I'm sure Uber and DoorDash and Lyft and Tinder and
| Instagram and WhatsApp are regretting the billions and
| billions they made doing this.
|
| I'm not sure which platforms those companies built their
| businesses on .. are you equating build an app on iOS or
| Android with building an app that relies on, say, Facebook
| APIs and only works on Facebook?
| almosthere wrote:
| Not really possible. If you're using the DNS system or even an
| internet connection - you're on someone's platform that may
| want to pull your plug.
| lordnacho wrote:
| How are you going to avoid Microsoft, Apple, Google, and AWS?
| The most common OS, browser, and infra platforms.
|
| You have to build on something, and there's going to be a
| corporation somewhere in your stack.
| adesanmi wrote:
| These companies charge money for their services and have
| competitors. AWS' entire business models is providing
| developer services, and if I don't like their offerings I can
| go elsewhere.
|
| Discord, Twitter, Reddit, etc. that have become hostile to
| third parties have free APIs to reel in developers to make
| their platform more attractive to users, and once they've
| reached critical mass, they turn around and fuck over those
| developers. This is because their primary business model is
| serving their users, and developers eventually "get in the
| way".
|
| So the person you're replying to should add an addendum:
| never build your app/business on top of third parties IF
| their primary business models aren't providing services to
| developers.
| immibis wrote:
| Unless you're prepared for the business to last an unknown
| limited amount of time.
|
| Pretty much every business is built on shaky foundations. If
| you never built business on shaky foundations, you'd never do
| anything at all. You needed an IBM-compatible PC to use
| Windows! You need a web browser to use Hacker News. Y
| Combinator is only meaningful as long as dollars are worth
| something.
|
| If you make a business that runs on IBM PCs, make a few billion
| dollars, then 10 years later IBM rugpulls the PC line and sues
| everyone who copied it... was there really a "lesson" that
| needed "learning" or did you simply succeed at business and
| make a few billion dollars?
| toast0 wrote:
| The problem with building everything without dependencies on
| other peoples' platforms is that it's a lot of work to build
| your own chip fabrication machines when you just wanted to sell
| chat bots.
|
| Chat bots on your own hosted platform which has no users isn't
| something people will want to buy. I mean, some people will
| want to buy it for click to chat on their websites or
| something. But if there's a market for chat bots in general
| spaces, you have to address that market where people are
| chatting, which is Discord, apparently.
| pnw wrote:
| It feels to me like Discord is speed-running the developer
| relations playbook that we've seen happen over a longer timeframe
| with large platforms like Apple and Google. This is the second
| high profile incident like this in recent weeks IIRC.
|
| What's even stranger to me is that Discord was putting on a full-
| court press to get developers onto their platform over the last
| twelve months. This kind of response is certainly not going to
| help make devs feel all warm and fuzzy about continuing to build
| on Discord.
| PokemonNoGo wrote:
| Has there ever been anything warm and fuzzy about discord?
| altairprime wrote:
| Discord has a monopoly on access to its users, and so does not
| need to concern themselves with making it attractive to build
| there: the users are the draw, not the developer-friendliness
| of the platform. BotGhost should seek anti-monopoly
| enforcement; having EU users file the appropriate EU claims to
| appeal for Discord to be subjected to the DMA would be far more
| a threat to Discord's monopoly than user support tickets are
| likely to persuade them.
| brookst wrote:
| Wait, doesn't every company have a monopoly on access to its
| users? Are we all monopolies?
| mschuster91 wrote:
| There's one thing missing from the "What you can do", although I
| admit it's a tough call for anyone not located in SF: actually go
| on the street and physically protest at the office. It's easy to
| dismiss blog posts, youtube videos or social media shitstorms,
| we've all grown accustomed to the noise.
|
| But it's hard to ignore actual people on the street in front of
| your office calling out your bullshit. In addition, it gives nice
| pictures for the press, and _that 's_ the only thing investors
| actually fear.
| mslansn wrote:
| If you care so much about the users as you say then you will
| release the code in a docker image so they can continue using
| your product.
| areyourllySorry wrote:
| their target audience does not know what a "docker" is, much
| less wants to lease a server for hosting
| mslansn wrote:
| You can teach someone how to rent a vps and run a docker
| image with one 10-minute youtube video. Then they can use the
| drag and drop editor and run the bot themselves. If they
| don't want to pay for hosting that's too bad. A vps to run a
| bot will cost a couple bucks a month.
| swyx wrote:
| yes but also once you let that happen there will be
| thousands of discord servers holding tokens, with no
| security updates...
| koakuma-chan wrote:
| It's actually pretty hard to install Docker... Add Docker
| official GPG key... Install a bunch of crap...
| mslansn wrote:
| Literally four commands that can be copypasted.
| https://docs.docker.com/engine/install/fedora/#install-
| using...
| koakuma-chan wrote:
| Look at Debian
| JadoJodo wrote:
| *You can teach ~someone~ a very technical user how to ...
|
| I get the non-techie blindspot that all of us have in some
| form or another. With that in mind: it took three days to
| give my brother a crash course in Linux + Docker for his
| own home server (and even then he only knew the very
| basics). He's fairly proficient in tech: builds his own
| desktops, knows the basics of code, doesn't shy away from
| digging into the why, etc.
|
| It would be unrealistic (and frankly irresponsible) to
| expect someone to setup _and understand_ a Docker server
| setup from a 10-minute video.
| macspoofing wrote:
| Oh come on. I'm sure they care about the users, and they were
| also hoping to build a business. Why the hostility? You don't
| have to kick them when they are down.
| Banditoz wrote:
| Playing devil's advocate a bit, if this service hosts a Discord
| bot you create for you, that means it uses the bot token, right?
| The service has to store and secure hundreds of thousands of
| tokens, if all of those get breached/leaked, an attacker can do a
| lot to a lot of Discord servers assuming it has the requisite
| permissions.
|
| However, they do claim that Mee6 (the biggest Discord bot by # of
| servers, iirc) offers a similar feature but Discord is letting
| them slide?
| paxys wrote:
| Discord holds user session tokens right? If those tokens are
| leaked then attackers will have access to Discord user data.
| Seems like Discord should be shut down.
| Banditoz wrote:
| Hmm, good point, but Discord can't control the security of a
| third party platform like this.
|
| Not saying it's the right thing to do, but it seems to be
| their reasoning.
| sneak wrote:
| Discord has the plaintext of every single message ever sent
| via Discord, including all DMs.
|
| Can you imagine the value to LLM companies?
|
| It's probably the single largest collection of sexting
| content outside of WeChat (and Apple's archive of iCloud
| Backups that contain all of the iMessages).
| almosthere wrote:
| So it sounds like you just go open source and let people host
| their own bot
| immibis wrote:
| You can already do that. People who want to do that aren't
| using BotGhost.
| nubinetwork wrote:
| I was under the impression that writing a third party client
| was against TOS, and don't you have to write a client to get
| your bot to interact with the server?
| majorchord wrote:
| They flip-flopped on the issue: https://0x0.st/8wYc.png
| merb wrote:
| The biggest problem is that discord has no way to authorize these
| platforms without the user giving them credentials. It's really
| stupid because it would be so easy to fix.
| everforward wrote:
| I think that's because Discord doesn't want them to do it this
| way. I suspect Discord wants BotGhost to operate their own bot
| with their own credentials, and have users invite the bot to
| their servers (similar to how many existing bots work).
| BotGhost could tell which no-code workflows apply based on
| server and/or channel ID.
|
| I think Discord has a fair argument that if BotGhost "writes
| the code" (read: translates workflows to actual execution), and
| BotGhost operates the bot, then really it's BotGhost's bot and
| they should own the bot and have it be visible to users as
| their bot.
| robinhouston wrote:
| I was sympathetic up until the line
|
| > Over 3 million users and bots created
|
| which struck me as thoroughly disingenuous. Surely they know how
| many users they have, and how many bots have been created. Why
| conflate the two?
| superb_dev wrote:
| They clearly have the data too. Their home page states ~2M bots
| and ~1.5M users
| encom wrote:
| >Discord Is Threatening to Shutdown
|
| I was excited there for a second.
| pavel_lishin wrote:
| > _If BotGhost is forced to shut down, your bot will stop
| working. Your settings, custom commands, custom events, market
| commands, market events and any work at all hosted on BotGhost
| will be lost. Because BotGhost does not produce code, there is no
| way for us to export your bot 's configuration._
|
| > _BotGhost cannot export bot configurations due to its no-code
| structure. If shutdown happens, all bots and user data will be
| permanently lost._
|
| I don't think I understand this part - what does the "no-code"
| mean in this context? How can this data not be stored _somewhere_
| for the service to function _at all_? Does this mean that
| BotGhost also has no backups, and a technical glitch could cause
| a similar problem?
| paxys wrote:
| An end user creates an application in Discord. They create a
| bot within that application, and Discord generates a token for
| the bot. They then copy the token into BotGhost, and BotGhost
| "operates" the bot. The application itself is still owned by
| the user, and BotGhost has no access to it.
| markasoftware wrote:
| botghost should still theoretically be able to serialize and
| export the bot's logic
| lsaferite wrote:
| They could export a DSL that captures the workflow at
| least.
| teraflop wrote:
| What they mean is "the 'no-code' logic for your bot is stored
| in a proprietary format that's only understood by our software,
| and we don't want to release our software publicly, nor do we
| want to document the format."
| throwaway7679 wrote:
| There are lots of details about the technology, license
| agreements, service history, comparable platforms, and whatnot,
| which all form reasonable support for botghost.
|
| None of that matters in the slightest. They're dealing with an
| indifferent, capricious, unaccountable company. And trying to do
| it without enough leverage to even get a response.
|
| It seems like it's about to end the way it was always going to.
| out-of-ideas wrote:
| yup, agreed- worth going over the non tl;dr (sufficient to say
| the tl;dr misses some good juice, but thats what the page in
| full is for).
|
| i was sorta curious on the policy changes over time, since
| botghost has been around since '18. all i can say is good luck
| to botgost
|
| histories of policies-ish:
|
| - from the tl;dr (they also explain #4 as well in the non-
| tl;dr):
|
| > Discord issued a breach notice to BotGhost, claiming the
| platform violates Developer Policy 4 by handling bot tokens,
| which has been a core part of how BotGhost has worked since
| 2018.
|
| - policy from discrap: https://support-dev.discord.com/hc/en-
| us/articles/8563934450...
|
| > 4. Do not collect, solicit, or deceive users into providing
| passwords or other credentials. Under no circumstances may you
| or your Application request or attempt to obtain login
| credentials from Discord users. This includes information such
| as passwords or account access or login tokens.
|
| - policy in 2022 (of that page, but note the random digits in
| the numbers make it terrible to easily see history), thanks
| archive.org!:
| https://web.archive.org/web/20221001073449/https://support-d...
|
| > Do not collect, solicit, or deceive users into providing user
| login credentials. Under no circumstances may you or your
| Application solicit, obtain, or request login credentials from
| Discord users in any way. This includes information such as
| passwords or user access or login tokens.
|
| - and archive.org of github of the before 2022 change
| (mentioned in the above archive) (does not really mention
| collecting of user auths - as per my quick glance [i welcome a
| double check]):
| https://web.archive.org/web/20220921062136/https://github.co...
|
| edit: fix copy-pasta
| throwaway7679 wrote:
| > NEITHER DISCORD NOR ITS AFFILIATES, SUPPLIERS, OR
| DISTRIBUTORS MAKE ANY SPECIFIC PROMISES ABOUT THE APIs, API
| DATA, DOCUMENTATION, OR ANY DISCORD SERVICES.
|
| The existence of terms like this make any discussion of the
| other terms look pretty silly.
|
| Their policy is simply that they do whatever they want, and
| that hasn't changed.
| out-of-ideas wrote:
| > Their policy is simply that they do whatever they want,
| and that hasn't changed.
|
| yup! and don't forget they can change their policy whenever
| they want too
|
| also they rank D on this site:
| https://tosdr.org/en/service/536
| immibis wrote:
| General PSA: in most situations these things like "terms of
| service" and "breach notice" have no legal effect. (I am not a
| lawyer and this is not legal advice)
|
| What they do is the same as a "cease and desist": they warn you
| that Discord might consider suing you or might try to ban you by
| technical means.
|
| It's all about business, not what the terms say. If Discord
| thinks BotGhost is good for Discord's bottom line, they'll let it
| exist. If they think it's bad, they'll stop letting it exist. I
| haven't the slightest clue why Discord now thinks BotGhost is bad
| for Discord's bottom line, but it's probably got something to do
| with legibility (in the Seeing Like A State sense) to investors
| for their IPO. Or they're working on a competitor internally.
| linotype wrote:
| Kind of lame to put competitors on blast.
| apt-apt-apt-apt wrote:
| This same story plays out with every monopoly platform e.g.
| Apple.
|
| Basically, you are likely in competition with something they are
| making, or are otherwise bad for business. The specific policy
| violation they choose doesn't matter- you are getting dicked down
| because they want it to be so.
| meepmorp wrote:
| > every monopoly platform
|
| discord ain't a monopoly in any relevant sense of the word
| nxrabl wrote:
| > A recent security breach on our platform brought BotGhost to
| Discord's attention.
|
| The breach in question is documented here:
| https://youtube.com/watch?v=lUiLBBab1RY
|
| I don't think there's a text write-up, but tl;dw a combination of
| missing input sanitization and no-code UI trickery made it
| possible to leak other users' bot tokens, and despite patching
| the exploit pretty quickly on exposure, BotGhost's developer
| tried to cover it up and refused to reset potentially affected
| tokens.
| rozab wrote:
| Seems like this is it. They should have got Discord to revoke
| all the potentially affected tokens. Instead, they tried to
| hide it and Discord forced their hand.
|
| I really dislike the way they try and play this down in the
| doc:
|
| https://update.botghost.com/#-summary-of-the-breaches-
___________________________________________________________________
(page generated 2025-06-23 23:01 UTC)