[vore]

There is a third party you have to implicitly trust, the bot developer. Given most of these bots are used to provide specific functionality, them being able to read messages seems too broad in scope – I know I don't want to have to trust another invisible party to also do the right thing.

That said, this looks like very poor communication and imposition of a lot of developer toil on Discord's part.

[huibf]

They should allow server owners to choose whether every bot they have added can read every message or just /commands. But that would require too much intelligence on their part :P

[Dylan16807]

That's already in the permissions system unless they did something weird to it.

[huibf]

Then I don't understand what the problem is, really.

[judge2020]

The problem is admins haphazardly adding tons of toy bots to servers with sometimes hundreds or thousands of members, and those bots being a front for storing tons of user data (including eg. user online status, user tag (name#1234) history, a large DB of the users' messages across years). The users in these servers aren't informed of such change and Discord can't trust these developers to say "we don't log messages" without requiring them tie a legal identity to any potential malicious logging.

[platz]

This is an interesting comment and was totally missing from the OP's description of the issue; I had to dig into this tread to get it.

If the OP fails to present or hide the full picture to me it harms his credibility.

[Dylan16807]

> Unfortunately, at the same time, there were growing concerns with a user-bot ring that made a website and scraper known as "dis.cool", which farmed user information.

> Most library developers felt the changes were misdirected and targeted the wrong type of bot. The threat model was based on user-bots being bad actors, and not regular bots, while the changes targeted regular bots. We also felt that it was easy to sidestep the restrictions by just having a bot ring, similar to what is now done today with user-bots.

> Discord claimed [the new requirements, including government ID] would help with security and privacy by preventing malicious bots from growing and obtaining sensitive data. The library developers responded that it wouldn't help since malicious bots had to be invited and the crux of malicious bots were, and still are, user-bots.

Seems like a reasonable description of the issue to me, covering everything in that comment.

If you feel it gets lost in the words then I think the proper thing to criticize is the writing style, not the credibility.

(If the term is unclear, "user-bot" means it's a normal user account being used in an automated way.)