9 ms·

> Teamspeak, which has other problems like server admins viewing the IP addresses of other users in the server, if that counts

superkuh 5y ago
The employees and their contractors and related at Discord corporate can see your IP address too and much more. Luckily it won't be Microsoft owning it as they could correlate against their software empire too. But Discord does have significant profit motive to collect information about you. In fact, their entire proprietary protocol, client, and restriction of clients is based around ensuring this.
- ripdog 5y ago
  He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to his IP, which potentially could be used for DDOS or geolocation. The kind of 'data collection' which could have visible impacts upon his life.
  - Topgamer7 5y ago
    Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.
    - ripdog 5y ago
      Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.
      - jfim 5y ago
        There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.
        paulmd 5y ago
        Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
        jfim 5y ago
        As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
    - serf 5y ago
      with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP. The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.
      - Topgamer7 5y ago
        Don't underestimate the skill and ingenuity of pissed off 15 year olds. With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting. Blind devotion to a cause and a flexible mind can overcome many problems.
  - sascha_sl 5y ago
    Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID. I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.
    - uzakov 5y ago
      > Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. This is the first time I hear of this, can you please link a source?
      - sascha_sl 5y ago
        The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.
        judge2020 5y ago
        So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it). 0: https://discord.news/trust-and-scam/ https://discord.news/trust-and-scam/
        5y ago
  - superkuh 5y ago
    And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.
    - judge2020 5y ago
      They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.
- 2iP1zbR 5y ago
  this is true, but also goes for every internet-connected service that i choose to use, as far as my IP address goes i've been invited to random, huge discord servers to play just one game, and after the games over i usually leave the server unless i know everybody. i never have to worry about the server admin or one of his buddies deciding they didn't like me for whatever reason and DDOSing the shit out of me for weeks, forcing me to change my IP address because i didn't use a VPN. that's just personal; it could even turn a profit if a professional gamer joined a server, several users recorded the IP address, bet against them in an upcoming game, then DDOS'd the shit out of them.
  - welterde 5y ago
    The game server admin also sees your IP address though? So unless you are only hanging out on discord and not actually playing you are still exposing your IP address. Also only the voice server admin sees the IP address and not every user on the server, so your scheme wouldn't really work either.
    - 2iP1zbR 5y ago
      yes, i should have said "the voice server admin records the IP address" instead i think game servers are a different subject, and they have their own buffet of problems
cma 5y ago
Like anyone together in a discord voice chat, since it is p2p webrtc, right?
- johncolanduoni 5y ago
  It is not P2P. The place where they most clearly state that as far as I can find is actually the documentation for their game SDK[1], but you can check that this is the case with netstat. In general it’s hard to get good voice or video chat with P2P connections because of the low upload of most residential internet connections, so few serious chat apps do it. [1]: https://discord.com/developers/docs/game-sdk/networking https://discord.com/developers/docs/game-sdk/networking
  - judge2020 5y ago
    There's also this: https://blog.discord.com/how-discord-handles-two-and-half-million-concurrent-voice-users-using-webrtc-ce01c3187429 https://blog.discord.com/how-discord-handles-two-and-half-mi...
gsich 5y ago
Well, that is obvious and not changeable.
xdrosenheim 5y ago
I never understood what was wring people seeing my personal, private IP address... I can call my ISP and get a new one in seconds, or turn my router off for 5 minutes to get a new one.
- steveklabnik 5y ago
  When you're playing games, it can mean that people can DDOS you, or otherwise just like, send bad stuff your way. Both of the solutions you have still disrupt the game, even if they do temporarily solve the issue.
  - denkmoon 5y ago
    If the people you're playing with DDOS you, you need to find new people to play with.
    - steveklabnik 5y ago
      Sure, but that doesn't help you in the midst of it. It's also like, sort of kind of not how social games work in many cases. In order to make friends in the first place, you gotta get out there.
      - denkmoon 5y ago
        Do you want to be friends with people in a community where having the admin look up your IP and ddos you is acceptable???
        steveklabnik 5y ago
        Imagine I want to go out tonight. None of my friends do. So I go to a new place and start talking to people at the bar. One of them stabs me. No, I do not want to be friends with those people. But I don’t know that yet, because we have not met. The only way to meet them is to... meet them.
tenryuu 5y ago
If you're in a situation where you do not feel safe by the administration team of a server, you probably shouldn't stick around. While I do understand the concern about something like this, if the admin team are people you know and trust, this data is not going to be used against you. Trust is always important for these things, regardless of the platform. Discord didn't even have my email address for the four first four years I used it
Deradon 5y ago
I'm running my teamspeak instance within an LXC container on my physical host. So the only IP I do see is good old home (127.0.0.1). But admins better not use the IP-ban feature in this setup ...

superkuh 5y ago

The employees and their contractors and related at Discord corporate can see your IP address too and much more. Luckily it won't be Microsoft owning it as they could correlate against their software empire too. But Discord does have significant profit motive to collect information about you. In fact, their entire proprietary protocol, client, and restriction of clients is based around ensuring this.

ripdog 5y ago
He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to his IP, which potentially could be used for DDOS or geolocation. The kind of 'data collection' which could have visible impacts upon his life.
- Topgamer7 5y ago
  Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.
  - ripdog 5y ago
    Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.
    - jfim 5y ago
      There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.
      - paulmd 5y ago
        Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
        jfim 5y ago
        As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
  - serf 5y ago
    with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP. The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.
    - Topgamer7 5y ago
      Don't underestimate the skill and ingenuity of pissed off 15 year olds. With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting. Blind devotion to a cause and a flexible mind can overcome many problems.
- sascha_sl 5y ago
  Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID. I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.
  - uzakov 5y ago
    > Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. This is the first time I hear of this, can you please link a source?
    - sascha_sl 5y ago
      The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.
      - judge2020 5y ago
        So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it). 0: https://discord.news/trust-and-scam/ https://discord.news/trust-and-scam/
        5y ago
- superkuh 5y ago
  And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.
  - judge2020 5y ago
    They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.
2iP1zbR 5y ago
this is true, but also goes for every internet-connected service that i choose to use, as far as my IP address goes i've been invited to random, huge discord servers to play just one game, and after the games over i usually leave the server unless i know everybody. i never have to worry about the server admin or one of his buddies deciding they didn't like me for whatever reason and DDOSing the shit out of me for weeks, forcing me to change my IP address because i didn't use a VPN. that's just personal; it could even turn a profit if a professional gamer joined a server, several users recorded the IP address, bet against them in an upcoming game, then DDOS'd the shit out of them.
- welterde 5y ago
  The game server admin also sees your IP address though? So unless you are only hanging out on discord and not actually playing you are still exposing your IP address. Also only the voice server admin sees the IP address and not every user on the server, so your scheme wouldn't really work either.
  - 2iP1zbR 5y ago
    yes, i should have said "the voice server admin records the IP address" instead i think game servers are a different subject, and they have their own buffet of problems

cma 5y ago

Like anyone together in a discord voice chat, since it is p2p webrtc, right?

johncolanduoni 5y ago
It is not P2P. The place where they most clearly state that as far as I can find is actually the documentation for their game SDK[1], but you can check that this is the case with netstat. In general it’s hard to get good voice or video chat with P2P connections because of the low upload of most residential internet connections, so few serious chat apps do it. [1]: https://discord.com/developers/docs/game-sdk/networking https://discord.com/developers/docs/game-sdk/networking
- judge2020 5y ago
  There's also this: https://blog.discord.com/how-discord-handles-two-and-half-million-concurrent-voice-users-using-webrtc-ce01c3187429 https://blog.discord.com/how-discord-handles-two-and-half-mi...

gsich 5y ago

Well, that is obvious and not changeable.

xdrosenheim 5y ago

I never understood what was wring people seeing my personal, private IP address... I can call my ISP and get a new one in seconds, or turn my router off for 5 minutes to get a new one.

steveklabnik 5y ago
When you're playing games, it can mean that people can DDOS you, or otherwise just like, send bad stuff your way. Both of the solutions you have still disrupt the game, even if they do temporarily solve the issue.
- denkmoon 5y ago
  If the people you're playing with DDOS you, you need to find new people to play with.
  - steveklabnik 5y ago
    Sure, but that doesn't help you in the midst of it. It's also like, sort of kind of not how social games work in many cases. In order to make friends in the first place, you gotta get out there.
    - denkmoon 5y ago
      Do you want to be friends with people in a community where having the admin look up your IP and ddos you is acceptable???
      - steveklabnik 5y ago
        Imagine I want to go out tonight. None of my friends do. So I go to a new place and start talking to people at the bar. One of them stabs me. No, I do not want to be friends with those people. But I don’t know that yet, because we have not met. The only way to meet them is to... meet them.

tenryuu 5y ago

If you're in a situation where you do not feel safe by the administration team of a server, you probably shouldn't stick around. While I do understand the concern about something like this, if the admin team are people you know and trust, this data is not going to be used against you. Trust is always important for these things, regardless of the platform. Discord didn't even have my email address for the four first four years I used it

Deradon 5y ago

I'm running my teamspeak instance within an LXC container on my physical host. So the only IP I do see is good old home (127.0.0.1). But admins better not use the IP-ban feature in this setup ...