Allow transferring server ownership to discord bot account
I would really like to see a feature in which we are able to transfer the server ownership to a Discord application (bot), via the Discord client itself, or just the API. It is possible to create a server using a bot account and have the bot as an owner, but I'd like to see a feature which allows us to give our ownership to a bot, so we don't have to create a new server just to have the bot as an owner (Which can often be useful)
-
That was possible I think before but that's not a good idea. Owners should be real person as they pretty much have the all options in a server. Bots can't pretty much do anything if they are going to become an owner. They don't have that much commands like deleting a server. -1 -
Why would anyone want to do this. There's no way a bot can fully manage a server. -4 -
Bots can transfer ownership and delete a server, and do pretty much anything a regular person can, you people are very ill-informed.
15 -
@Aquatic "You people". What I mean is that a bot should never be in control of a server.
-4 -
Why is that? People own personal bots themselves, of course, making some random bot in your server the owner is a terrible idea, but since bots can already make servers why not extend their functionality even more to allow them to be server owners, no one would be stupid enough to give someone like Dyno bot ownership of their server, all it takes is to give the user a prompt warning about them transferring ownership to a bot instead of a user and that's all. Bots can already interact with servers in every way, icon, name, roles, channels, regions, permissions, emojis and even delete the server.
8 -
If you disagree with my suggestion, for the love of god, at least please provide a valid point why it shouldn't accepted as a suggestion, not topics you probably don't understand about or just throwing in raw opinions like "they shouldn't be allowed to own servers".
As for @Forgi_Forgeth, please elaborate, as your point is either in the category of "topics you probably don't understand" or you're referring to actual bot security, which should not be an issue considering no major bot developer would risk their permanent reputation going out of their league to mess up a server. And I'm sure that 100% of people who know what they are doing would use their personal bots for managing servers, which aren't 'unpredictable'
7 -
Ok, here's my question - what would be the point in letting a bot own my server? What would it do for me? How would this feature make my discord experience better?
0 -
we need to set somethink like you must own the bot for give it ownership : like i own PureBot i can give him the ownership of Purebot system server 7 -
Putting a bot in control of a sever is a massive security hole. This is an incredibly dumb idea.
-8 -
To access the server, you would have to come up with a means of insuring that the connection with the server in which the bot is on and the discord derived itself is properly implemented, and extremely well tested. Man in the middle attacks, and packet sniffing become really f*cking easy, because you would have a bot access a server periodically (most likely at the same intervals, making it super easy to have another computer intercept packets and modify them.). If that were to be compromised, someone would gain complete control of the server, and can easily lock you out.
Security is to always be done on the idea that one should grant the absolute least amount of power needed to do a task, in case if an unknown security flaw exists to mitigate potential damage.
That's like semester 1 in any programming major.
Your proposing to give control to something which can't itself be easily monitored. If you proposed to do that at a company, you would be out of a job.-7 -
Traditionally, scripts are run to do the same thing with creating new instances of virtual environments. That script is run locally on the machine, which prevents having an outside force from trying to modify the script. If the virtual environment were to be taken down, one can easily create a new instance and not expose the machine behind it.
If you are the owner of one of the virtual environments, you want to try and protect it by backing it up. You can't do that with a discord server. You can easily lose your servers.
On discord's end, one can also use your bot to create a massive amount of servers to suck up bandwidth; an effective DDOS attack.-6 -
Why? What is the point of transferring ownership to a Bot account? -5 -
Hello everybody.
When i saw this topic i directly think i could give reason to @Aquatic.I am programming a full admin-bot who will be able to manage EVERYthings, without any exceptions, on my server.
One of his commands have to be able to destroy a server.
I don't know why my bot, because his task is to act as a Owner, couldn't BECOME the Owner of my server.
Guys it's really something you must add for Discordjs, please.
3 -
All's I'm hearing is that I'm creating a bot to run a server will all powers.
But why?
That's not a reason.
Seriously go back to college or take a course on defensive programming.
https://en.wikipedia.org/wiki/Defensive_programming-4 -
This is already possible lol but it’s really useless!
-5 -
How ?
2 -
@riotgrrl Adria
If they can packetsniff bots they can packetsniff you too btw.
There is already security in place with every message you or a bot sends.
Now the reason why you would want a bot to own your server would be to have multiple owners, where that bot can allow ownership commands to multiple users, you could even make a voting system to create democracy. Creativity is boundless.
There are people (me included) that want to create a server managed by a bot, I'd think that a completely automated server would solve some issues with power abuse or with time investment.4 -
Bot design isn't neutral as whomever is the programmer puts their bias into the code in some manner or another. If power abuse is the concern, assign all people as the same ranks and allow only democratic, full consensus decisions to be what can be done. You don't need a bot with admin privileges for that.
You still introducing massive potential security issues by having a bot with that power that isn't necessary.-5 -
FFS, all I want is to be able to make my personally controlled bot the owner of an automated server. Also @riotgrrl Adria yes, we understand making a bot that you don't control the owner of a server is a security flaw, but this would be a bot that I control. Oh yeah and like @NeuroTypicalCure said, if you could packet-sniff a bot, you could packet-sniff a user, so your point is invalid.
2 -
@riotgrrl Adria, oh yeah and bots can only make 10 servers at a time anyway so that thing about DDOSing is also stupid. One last thing, bots can only send 10 requests per 30 second interval, meaning any DDOS attack would not work, how about YOU go back to college?
3 -
@spudpotato you could automate all systems and also manage all users of the server, I have a big issue with testing because the bot cant change my roles etc.
1 -
In response to Adria's last reply,
Bot design can be open sourced, so it can be made neutral in the sense that it's transparent.
Democracy doesn't mean a thing if the owner can just delete the server whenever he wants.
I've been in some servers that were closed when the community didn't really want it to be closed, this deleting their entire history that they've had with all the members. Discord's export options don't keep conversations intact (only your data is kept but not the people you were talking to).
Anyhow coding a bot that lets more than one person vote on server deletion. Prevents a frustrated owner from nuking what a lot of people hold dear and have put a lot of time into.
Not saying this happens a lot, but it happens and it could happen to you.
You would need to lock every one out of accessing the api key, because otherwise you could host another version of the bot
So having the key accessible from an endpoint which you can only access when a vote is passed or something
There isn't any bigger security issue than just having a user. Unless the bot is terrible. But you know, humans are more terrible, because you can't easily fix those.
To lennie face guy:
The bot should be able to change your roles if he has the required permissions, either you change those from the invite link where you made the special bot account or you give him a bot role that has admin permission.3 -
Oh ok.
1 -
You can't transfer ownership to a bot as far as I know, but you can have a bot create its own server. This only works if your application is a user account or your bot account is in 10 servers or less. I had my bot create its own server and it works. I don't see any security flaws besides the fact that it might be hard to manage your server as you do not own it. Look at the documentation for your language. For Discord.js its pretty clear on how to do it.
3 -
Being the owner or administrator of a server forces you to view all channels, so I created a server using an alt. This server is ran by a bot I created. They made the rules, and there's an economy.
Members can buy houses (private text channels) that no one can see but them and my bot, Bean. Allowing Bean to be the owner of the server would be amazing, and would help me so much because it's annoying that my alt is in everyone's houses, and I want Bean to have the crown because he's the ruler. It would look so much better than his fedora.4 -
@NinjaKiller that sounds awesome, I see why you wouldn't want to be in everyone's "houses" because that kinda ruins the idea of it being private. I own a small community that has separate categories for most popular multiplayer games, and being the owner means that I have to scroll through *all* of these categories, even if I don't like the game they are for!
2 -
I just read everyone's messages, now I understand security risks associated with having a bot run a server, but everyone has argued the opposite to everyone's opinions.
Having a bot manage the server means that you also don't have to have all the permissions.
Sure it becomes a concern for man in the middle attacks, but that literally happens with any other thing in existence. Even your own discord client.
The safeguard discord devs could put in place like mentioned above is that only a bot that you own personally can assume ownership. So if you have a friend who owns a bot, unless you're a co-owner of the bot in some regard according to discord, you can't give the bot the server owner role.
It was said above that all you should do is give everyone an admin or high ranking role, however my counter arguement to that is what if you want all those people to be able to add others to that role. They surely can't add more people if they know that more people will be joining that high ranking role. Discord prohibits anyone but the server owner to assign people to the highest role even if you are that highest role.
A counter arguement to the above is "Oh well that's dumb, why would you let people use the bot like that, it'll just become a security issue when everyone can assign different roles". Well programming has it's flaws if you literally let everyone use every command. This is why developers have the IDs of roles and users. Each command can be locked down to be used for a specific role on a specific server. It can be secure if you think of the general use case and know who you don't want using said commands. Simple IF statements.
My use case is we have a server for our organisation, we communicate with our backing members, however because most of our core team have admin, we have control over most of the server. However it doesn't mean we have control over who has our role. We have new people join our team every so often and we have to wait for our friend in another timezone to login and add them to our role. I want to be able to offload that stress and burden from them. It's not overly a big deal for them, it just feels like it makes more sense to have equal control over the server including adding to our own role.
And yes, like @NinjaKiller, i'd rather restrict our access to channels we're not meant to see if we are to have private channels that only certain users can see without sacrificing on permissions or access to move people to the highest role. eg: non admin highest role with permissions to modify etc. with bot perms to move new team members to highest role on command.
The only abuse that can happen is things you let happen with the bot. Keep it secure and simple and there should be no problems. A program can only be as bad as it's creator.
4 -
You can do this via the API. However, it's more of making the bot create the server instead. You need to make it create a server, give you an invite and create a role for you with most perms.
-3 -
@SuperGDPro3
We know that, it has been mentioned multiple times here. If you read the post properly, you would know that we want to *transfer* ownership, not create a new server.2
Please sign in to leave a comment.
Comments
44 comments