[madeofpalk]

I think Discord bots bots have a huge security and privacy issue where there are these mega (and less mega, but still large) bots that are just unnecessarily slurping up all private conversations in a lot of servers, without a lot of people's knowledge.

As a user in a server, you don't really have a way to consent to whatever third party bots reading your message. You've just got to hope you see that the bot was added, or see it in the user list. The server admins consent to the bot being added (and as an admin you still need to hope and trust that they're not doing anything dodgy with all the unnecessary information they're getting), but no one else in the server gets to consent or is made aware of the new audience they're broadcasting to.

I think for the broader Discord community - which is pretty broad with a lot of younger and non-technical folk - making reading messages a privilege intent is the right move.

[Aerroon]

When you join a server you can go through the entire history of that channel. A user or a bot pretending to be a user could come in at any point and slurp all of that up.

If you restrict this capability then ultimately you'll just end up with bots pretending to by users.

[madeofpalk]

I think the difference though is that as a user, you cannot do that easily. Whereas a bot can automate this across many channels and servers (especially as this restriction only applies to bots in 100+ servers).

User bots I think is a different, equally valid problem (if not more problematic) that's probably harder to solve. "Rogue bots" look just like normal bots that a server admin would voluntarily install without knowing what it's dong behind the scenes. Bot users are actively malicious and breaking the ToS, and can't reach the same scale as bots (because all server admin cannot just add one to their server).

I think they're both problems, but represent different points on the threat matrix. It's kind of like saying "iPhone shouldn't restrict access to the camera roll for App Store apps when viruses can just bypass and get them anyway".

[Aerroon]

Bot users aren't necessarily malicious at all. That's how automated bots always start out as. And there's no way to tell whether a user is a bot or not if they don't interact with the server.

Besides, if you say something on a public discord chat it's like saying it on Twitter.