hckrnws

Here's the October 2025 Discord data breach mentioned at the end of the article:

https://www.bbc.com/news/articles/c8jmzd972leo

> Discord, a messaging platform popular with gamers, says official ID photos of around 70,000 users have potentially been leaked after a cyber-attack.

However, their senior director states in this Verge article:

> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.

Why they didn't do that the first time?

> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.

This is also contradicted by what Discord actually says:

> Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation.

What are the non-most cases?

Also, _Discord_ deleting them is really only half the battle; random vendors deleting them remains an issue.

Not to mention collecting them at all means those servers are a primo location for state actors to stage themselves to make copies of data before being deleted.

To say nothing of insider threats of which likely exist across every major social media platform in service to foreign govs.

It was this deep into the thread when I decided I don’t think I need internet service this bad, let alone Discord. I think I’m out. Let us know how it goes!

All of these types of developments, of the trap door starting to close, really do totally depend on the addiction, the dependency that was created to make sure the people would be unable to withdraw themselves. We now have some generations of people who have only been online and in a fantasy world of games and “TV”. It seems the system has calculated that we have crossed the threshold after which the system is self-reinforcing and there is very little chance of effective resistance, let alone reversal.

I think you may be attributing far too much malice of forethought to any them that may be conspiring to design the 'system'

Everyone thought that we were designing the system, but it's really been the system designing us.

(Only half joking; the medium is the message, and changes us as much as we change it)

malice aforethought

> Not to mention collecting them at all means those servers are a primo location for state actors to stage themselves to make copies of data before being deleted.

Not to nitpick, but in this case they'd be collecting data they already own.

In addition to the sibling comments, even if they do own the ID itself, they do not own the association with Discord users, and the ID might also be faked.

1. Foreign state actors

2. Inter-hostile agencies within the u.s.

The feds don't own state IDs in the US, at least.

Vendors like that would be in deep GDPR shit if they claim to not store highly sensitive data and then do in fact store highly sensitive data.

Generally the GDPR is not rigorously enforced, but when it comes to sensitive data like face scans, IDs, medical data etc. the hammer comes down a lot swifter and harder.

"We delete them immediately after we have sold them to our 579 parters"

Weird that I have to get a list of all the cookie vendors that know I visit a website to show me an ad about something I already bought but the guys with my ID don't need to be listed.

Under GDPR they need to be listed.

GDPR isn't a cookie law — it's a PII law. They need to tell you all parties that get your ID picture, or they're in breach.

GDPR is not a PII law. The term is not mentioned once in GDPR. GDPR speaks of "personal data", which as Wikipedia puts it "is significantly broader".

Doesn't PII, mean personal information which is is another term for personal data?

Well since you have these IDs, for national security (AML, criminals and whatnot), we will need you to keep them if our endpoint says so, here's the endpoint

    https://.gov/print?text=true

>"Identity documents submitted to our vendor partners"..

Yeah, say goodbye to those the privacy and safety of those documents.

How can we even confirm that they are actually deleting them. Trust me bro vibe

Imagine the neural network you could train over such a large dataset of ID's so when you pay your bills or do the flight check-in you avoid the hassle of manually inputting the data yourself? Ah, yes, we have that already.

Since when the city one lives in is mentioned in the birth certificate?

It was only one example they gave, and they accept multiple different types of ID; a driver's license or national ID card being other likely ones, and DLs do say where you live.

None of those documents reliably state my city of residence. At best they document where I once lived, but not even that is guaranteed.

Not updating your DL after changing your address is a crime* in all US states. I'm not as familiar with law elsewhere, but would be surprised if that's not true most other places.

*There are exceptions for active duty military personal and other limited exceptions.

It is a law but rarely enforced, also some places like Washington are primarily digital meaning you update your DL address online but they don’t print a new ID unless you request it or your DL is expired

That's pathetic. It would mean you can't live anywhere without a street address, such as a camp site or a ship. You also can't be a nomad.

So much for "land of the free".

Unless you’re wild camping, campsites have addresses. So do marinas where a ship would need to be docked more or less regularly to establish residency.

As for being a nomad, you don’t need a driver’s license or any kind of ID to wander if you’re willing to sleep rough. If you want to drive on public roadways though, you better have a primary address where the courts can send someone if you kill someone in a traffic accident and bail.

Docking is expensive, so no. It's also only needed once per 5 years or so for maintenance.

Government fining you a ticket doesn't mean your address has to be on the drivers license. They could register the number plate to an SSN for instance.

Did skip my last sentence? A traffic ticket is not the worst thing you can do in an automobile. And not everyone eligible for a drivers license will have an SSN.

For most situations where you don't have a permanent address, your address is either the place where you receive mail or the courthouse.

And if you don't have a place to receive mail?

Receiving mail is a requirement for participating in the legal system, which is a requirement for citizens.

Laws of the government can't override laws of physics. If you don't have a place where you can receive mail, do they just arrest you or what?

America is one of the least free countries — they think they're free because the guns=free principle is drilled into them since birth, but it's a lie.

In some places in the U.S. it is (or at least was until recently) illegal to be healthy and unemployed.

You are legally required to update those within 10 days of moving.

[flagged]

It's pretty standard in a lot of Europe, one is required to update ones license with each change of address (although many people don't).

Along with such weird (to us) things as applying for an exit visa from your current town when you want to move to a new town...

Which parts of Europe have a town of where the person lives on their driving license? And what do you mean by “us”?

Germany has the full address the ID card and the issuing office (containing the city) on both the driving license. They are also digital so who knows what they also store on them.

My Spanish identity card has my full address. Not sure if the DNI does as well, or only the foreign resident version.

> And what do you mean by “us”?

US folks are pretty used to being able to up and drive across the country with a suitcase, without filing any paperwork (at least till the taxman comes knocking next April)

Have to get your vehicle registered in your new state as well (if you own one) as well as your driver’s license. God help you if your vehicle is towed and your license/vehicle is not registered in the current state. Absolute mess.

I ask you about drivers license, you tell me about the national ID.

You did not ask about driver's licenses. You asked about "document I have on me".

Many people in many countries carry their national ID card in instances where Americans would carry their driver's license.

(And, to be clear, if you are American and drive, your driver's license contains your address.)

UK driver's licence has my full home address on it. Come to think of it I think my Polish one used to as well.

Australia and UK goes the full distance. Your full address: https://en.wikipedia.org/wiki/Driver%27s_licences_in_Austral...

> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.

Everyone says this, including the TSA. But they never say they don't keep a hash, or an eigenvector of your biometric. Which is equally as important.

They also never say it goes through datacenters in room 641A or though Utah before it's "deleted", because it's a US company and they can't refuse that.

In case someone is unaware, 641A and Utah and both references to the US mass surveillance systems in this context. Specifically interceptors that a company wouldn't be able to prevent from saving your data for the few seconds they need to process and delete it

I might be misremembering, but AFAIK, that kind of surveillance mostly worked because many companies didn't bother encrypting datacenter-to-datacenter traffic, thinking that those networks are trusted. That mistake has since been rectified though.

With almost everything going over TLS these days and HTTPS being the norm, even for server-to-server APIs, it's much harder to snoop on traffic without the collaboration of one of the endpoints, and the more companies you ask for that kind of collaboration, the higher your risk of an unhappy employee becoming a whistleblower.

That's also about US companies that can't refuse or can't bother to challenge that a dragnet is set up in their process.

ISPs themselves didn't save any data. However, they gave interception rooms to the NSA (which is indeed technically not them).

Nowadays ISPs aren't the right scale to do it for the reasons you mentioned. But the USA lowkey moved the dragnet to the main datacenters with prism, then made it mandatory for all with the CLOUD act.

And if the threat is not coming from the USA, but some other country starts to ask Discord to BCC them the IDs of their citizens, we can do the odds on whether Discord will challenge it or not.

Now I want to ask Discord who is their third party provider ? Why don't they process IDs themselves ?

> it's much harder to snoop on traffic

Unless you have a master key which decrypts all traffic.

That is not possible with modern TLS 1.3, which mandates perfect forward secrecy.

Unless you use Cloudflare (or roughly any other DDOS protection system), in which case you're letting those companies MITM all requests on purpose. Protected between you and Cloudflare by PFS and any other acronym you like.

I think the odds that Cloudflare hasn't been forced into data snooping by the government are approximately zero. It's the by far the biggest, juiciest target.

I believe the original finding was that they were not deleting IDs that were involved in disputes.

And do they really actually delete it this time?

I have it on good authority that they really truly delete it this time, super duper pinky promise

Once it's out there the only assumption that holds is no trust, and therefore all bets are off.

Until we have some kind of "One Time ID Verification" service that would work, the ID will never be deleted. Or a hash of the info or some kind of identifiable info.

Humm yeah, like a government digital ID of some sort. Except people go mental about that, so sending scanned copies of my personal ID documents to every bank/solicitor/estate agent/mortgage broker/random internet service it is then...

Or if they don't need your ID.

> We do not keep any information around like your name

But they might be sending a copy to the NSA, similarly to how Alphabet, Yahoo, Apple, Meta etc. have been doing (PRISM program, part of the Snowden revelation [1]). The US has the legal mechanisms of requiring this to happen, secretly, such as NSLs [2].

[1] : https://en.wikipedia.org/wiki/PRISM

[2] : https://en.wikipedia.org/wiki/National_security_letter

I bet the NSA does not even require their cooperation. They are probably already inside their systems.

They're a nonsense company, and trusting them with any information is foolish. They'll store everything and anything, because data is valuable, and won't delete anything unless legally compelled to and held accountable by third party independent verification. This is the default.

The purpose of things is what they do. They're an adtech user data collection company, they're not a user information securing company.

> The ID is immediately deleted.

I call it bollocks. Likely they have to keep it for audit and other purposes.

"delete" doesn't mean delete anymore, like you say, there are always audit logs, and there is "soft" deleting.

Expect any claims that things are being deleted to be a bold faced lie.

They wouldn't _have to_, audit checks if you stick to law, your own policies and such, but I think they will.

So how do they prove they actually checked someone's age?

How does shop clerk proves they checked someone's age before selling them alcohol?

They don’t need to prove that. The government or whatever would have to prove that they aren’t checking ages, by going to the site and seeing a lack of age verification.

They explained it in their announcement at https://discord.com/press-releases/update-on-security-incide...

TL;DR: The IDs were used in age-related appeals. If someone's account was banned for being too young they have to submit an ID as part of the appeal. Appeals take time to process and review.

Discord has 200,000,000 users and age verification happens a lot due to the number of young users and different countries.

This is corporate cover speak for “we keep all data”

Yeaaah, nope.

GDPR is no joke and storing people’s actual ID card photos is a gigantic liability. Companies treat that stuff like it’s toxic waste, they want to get rid of it as fast as possible and permanently.

So Discord only just survived financially because of heavy fines imposed from their earlier breach of trust? All their C-suite were fined commensurate with their remunerations+wealth?

How come they didn’t do that the first time? There’s really no guarantee this time will be different or that the 3rd party is any better.

We’re talking about Discord. The same people who put everyone’s “server” as a chat room on WebRTC.

They don’t share your same sense of toxicity.

Maybe that's generally true but you're saying that about a company that has leaked 70,000 IDs that were supposed to not exist just last October.

And yet...

Why should we suspect the age verification and age-related appeals would involve different teams or processes?

Age verification is done by an iframe to k-id.com.

Appeals are done in the actual Discord ticketing system.

Appeals are like escalations. They bypass automations and move to manual review.

Uh... EVERYONE with a Discord account has to go through age-related appeals now. That's what the announcement is.

>Why they didn't do that the first time?

The company they hired to do the support tickets archived them, including attachments, rather than deleting them.

Ah sorry our contractor did all that highly illegal stuff. Too bad we can't pierce the corporate veil anymore... shucks.

Ah, so it was the "staffer" excuse.

rogue engineer

How convenient.

Compliance

Deleted from some location or purged from their entire system?

> We do not keep any information around

... "around"

Sigh, I guess it's time to move platforms again or get your identity stolen. The more a company makes a fuss about trusting users, the more likely they store all of their shit in plaintext with vibe coded server security.

Liars…

[dead]

It should go without saying but,

*CANCEL YOUR NITRO SUBSCRIPTION NOW IF YOU'RE PAYING FOR ONE* (for whatever reason)

This was just announced today and a flood of canceled payments within the next 24 hours are the easiest way to send a message. And also tell people on the servers you're on to do the same. It's not like they give you anything of real value for that money.

It boggles my mind that they need a photo ID to prove that my 9-year-old account with a saved credit card belongs to an adult. The linked Steam account is 18 years old.

from the article:

`For most adults, age verification won’t be required, as Discord’s age inference model uses account information such as account tenure, device and activity data, and aggregated, high-level patterns across Discord communities. Discord does not use private messages or any message content in this process`

they don't do this for age verification, they do this to build dataset to sell.

> Key privacy protections of Discord’s age-assurance approach include:

> On-device processing: Video selfies for facial age estimation never leave a user’s device.

> Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation.

> Straightforward verification: In most cases, users complete the process once and their Discord experience adapts to their verified age group. Users may be asked to use multiple methods only when more information is needed to assign an age group.

> Private status: A user’s age verification status cannot be seen by other users.

Yes, I definitely trust the multi-billion dollar corporation regarding my data

Discord is an app that's so routinely reverse-engineered there are projects with a million+ users designed around patching changes to it, straight in the binary.

https://betterdiscord.app/

Do you think their big evil plan is to make up a lie that will last maybe 3 weeks, jeopardize the user trust and lose nitro revenue

Surely there is so much money to be made selling random people's faces.

If they tell you they're not selling your data they're not selling your data. What you should worry about is incompetence

Not even 6 months ago a third party they used for ID verification got breached

https://www.bbc.com/news/articles/c8jmzd972leo

Of course discord has no track record of overextending their privacy policy and selling data you would not expect (sarcasm).

For example but not limited to "programs you run and other system specific information". I believe I read a while back they recorded titles of all opened windows but I can't seem to find a reference for that.

https://www.reddit.com/r/privacy/comments/rsxeee/you_should_...

> Do you think their big evil plan is to make up a lie that will last maybe 3 weeks, jeopardize the user trust and lose nitro revenue

???? Yes? Companies nuke their core product all the time for the sake of a big IPO number.

Surely there is so much money to be made selling random people's faces.

I really hope I misread sarcasm in that statement. Because of course there is a lot of money in that

How much? 2 bucks per user?

Their paid users shell out 3 a month...

And then you think of the real world

> secretly selling your IDs data behind your back, they have to account for that revenue in their books, put it in their privacy policies or do it illegally, it's weak to whistleblowers, third parties get breached all the time (as well as yourself), and you have to trust the people you're selling this to. It's not credible.

Right, because that never happened to discord or any other multibillion VC fueled company that offers its services for free. See also meta repeatedly lying about absolutely anything that has to do with privacy.

Do you think they reverse engineer the server side?

Oh hey Direwolf I've contributed some stuff to your mods.

You mean if they lied about just the IDs but not the faces? The paragraph quoted mentions that the verification is done client side, "never leaves your device".

If we admit that they're saying they won't store it, then secretly selling your IDs data behind your back, they have to account for that revenue in their books, put it in their privacy policies or do it illegally, it's weak to whistleblowers, third parties get breached all the time (as well as yourself), and you have to trust the people you're selling this to. It's not credible.

There's similar debates with Whatsapp and their E2E encryption. Read this

https://blog.cryptographyengineering.com/2026/02/02/whatsapp...

> If they tell you they're not selling your data they're not selling your data.

Oh you naive child. /s

If they tell you they are not selling your data, its because they have a license agreement with another company which is selling your data. 'They' very specifically arent selling it, however they are very much profitting from other companies using it.

Yeah because they don’t haha. It boggles the mind because the headline is clickbait.

Youtube routinely asks for ID on accounts that are already of drinking age, they dgaf they want document scans they can use for profiling and to likely sell to 3rd parties.

> and to likely sell to 3rd parties.

Can you provide literally any evidence that would suggest this is the case?

Since selling PII is a common practice in the US industry, I believe the onus is reversed, they need to prove that they delete/keep-private.

Given how YouTube makes money from advertising, I suspect it's more profitable for them to keep the data to themselves and use it for targeting. I would not be surprised if they also share it with Adsense & other Alphabet entities (and presumably with government agencies), but am doubtful beyond that.

Not that this is much better than directly selling to third parties.

Yep, that's my reasoning too.

This sort of thing is common enough that simply establishing means, motive and opportunity are convincing to me. If not yet then soon. You can't hope for a smoking gun every time.

Give it a couple years for the inevitable data breach to leak all the details

Discord has been immensely hostile to the public in general since forever, and people love to flock to it and throw money at the company behind it.

I don't expect the masses to change their incomprehensible habits just because of this.

It's not incomprehensible. Discord makes it so much easier to organize communities than most other platforms.

Telegram, Slack, Facebook, Team Speak, Reddit, GroupMe, nothing really offers the same feature set and ease of setup that Discord does.

How many of them let me turn up/down or mute individual participants in a group voice call?

"easier" - what really matters is end user freedom, the rest is just decoration

Wrong. What really matters is delivering dopamine reward signals in the user's brain. Everything else is just a mechanism.

Apparently not because they have 200mill users.

I also value end user freedom, but I also accept reality. And I guarantee you you have compromised on your freedom/anonymity for convenience online. We all have. And ultimately discord is so turnkey that most people just don’t care

I'm in a Signal chat for a bar trivia group for some reason. I've missed invitations a few times cause it silently got out of date. But at least Obama can't read my messages.

You compromised your freedom, then. Signal is a central–server network with a license that means you can't legally modify the client and use it on the network, and it identifies people by their phone numbers.

The two nice features it has. I don't need bots to exist.

There is no binary version of how everyone is compromised. Because I refuse a bunch of applications like Discord I can assure you my footprint is lesser than those who use it.

I agree completely. My point is that people simply will do that though, so instead of approaching it with hostility and judgment you should approach it with understanding and, if they’re willing to hear it, maybe as an opportunity to educate. Proud proclamations and judgment won’t get people to see how important this is.

It’s not just “window dressing.” UX matters. So you need to talk to people in a way that acknowledges why they want those conveniences in the first place. It’s the same reason I recommend Plex to some people and Jellyfin to others.

> nothing really offers the same feature set and ease of setup that Discord does

Apart from the open voice channels, what Discord features is Slack actually lacking? (and huddles can sub-in for voice channels much of the time)

This doesn't feel like a real question... Slack free tier is basically crappy Discord, limited message history, no voice channels, huddles are also behind the paying tiers. It is basically worse on all aspects unless you start paying

Most importantly, Slack limits the amount of message history you get to keep if you’re not paying. And the payment plans are per-user fees which quickly becomes non-viable for non-commercial use.

A nonprofit I help out just moved from Slack to Discord for a very simple reason: Slack pricing was too expensive, and as the amount of people increased, the price continues to climb. Discord is free

It is not, you just aren't the customer but the product sold.

free as in beer is clearly what they mean. They are a non-profit talking about pricing.

The biggest one for me is that Discord will keep all history for free servers, whereas Slack only gives you access to 3 months iirc (and as of a year or two ago, has started permanently deleting older content).

For large communities, the very granular role-based permission system of Discord can be put to some good use, I don't think Slack has a trivially equivalent feature.

reliable message delivery, lol. slack drops messages silently. it is not fit for purpose.

Dude, Slack deletes everything almost immediately unless you have a paid version which isn't cheap.

Honestly... People deserve this. They deserve the consequences. They were warned. They chose this.

They also don't care. But I do care, chose the opposite, and will still bear the consequences, once a sizable population does certain things.

Ok, do your worst. I got on Discord cause they offered the best free service, I'll just as easily leave if that ever stops being the case. "Teen mode" seems not bad, I need something worse.

You will not leave easily. There's no point to you leaving if all your friends remain. Chances are they could not care less about these issues and would rather leave you instead of mass switching to a less convenient alternative.

I'd leave with or without them if it sucked. They can and will text me instead, just like they do since I left WhatsApp (because it sucked). The communities of randoms I don't even know irl can't, but that's exactly why it doesn't matter so much.

That and my friends probably care the same or more than me about privacy.

Yeah, we've seen time and time again that the network effect of social media makes it next to impossible to actually move to a different service. The Discord feature set is great and all, but it's the fact that your communities are there that keeps everyone on it. I'm hoping they get enough backlash / canceled Nitro from this because I don't want to lose the communities I'm in. Already did that with Facebook/Instagram/etc and it sucks.

Ha ha joke’s on you! I’d need to have friends in the first place!

Y’all forgot that the only reason we’re on Discord was because MS actively killed Skype. Skype was much better software circa 2012 before MS let vulnerabilities run rampant, degraded the UI, and moved off the remarkably robust P2P calling system.

I never had a Skype call work properly on the first try, even before Microsoft broke it

I too remember Skype's universal salute: "do you hear me?"

That's known as the millennial pause. Older generations like millennials want to ensure a communication is working before committing information, while GenZ and Alpha just start talking.

It's named after the pause after pressing the record button while you check it changes shape, but "can you hear me?" is the same thing.

I'm gen Z. You had to start Skype with "can you hear me" because the answer was usually no (via text). I now do that with phone calls because forced bluetooth has made headsets less reliable than before.

I hear people saying that every day in Slack and Teams

Teams is broken too

I must be a lucky one because calls always worked for me on teams. On the other hand, everything else is a dumpster fire.

Just cancelled mine after reading this comment, I only really cared about the bigger file uploads and the HD screen-sharing anyways and I can live without those.

Now that I think of it, I bet I could host a decent instance of some open-source alternative in a public cloud for around the same cost as what I paid for Nitro ($100 a year)...

I think there are actually discord client mods which let you stream in high quality anyway.

WebRTC is ridiculously easy.

Cancelled. Was a right job trying to get in as it just refreshed everytime I tried on mobile. When I went to the site separately after clicking subscribe it magically let me in.

The cancel login flow didn't inform me that it found my login suspicious but the subscribe one did

Not a subscriber, but I understand your call for retribution.

I suppose the silver lining is that they are putting the responsibility for age verification adults. Which imo is better than requiring everyone; kids get a free pass to the kids stuff...

Unless they're changing things with some sort of automated classification, then it's users who designate which servers and channels have adult content.

In my experience, you run the risk of getting your server shut down in small servers if someone reports it. Or risk losing your community server status in larger public servers until you come back into compliance.

Also in my experience what teenagers are going to do when they hit an age gate is use a fake picture/video. Sometimes they'll get banned for that and then they'll make a new account and do it again.

Yeah I agree. I actually see most of the stuff in the teens mode as a feature

They should disable ads and algorithms from social media by default and give those only for verified adults!

I'll reply for both you and GPP,

I don't know if this will personally affect any servers I use since they're not obviously adult, but I assume the slope will be slippery and if they're doing a faceID system now it will only get worse. Article says "analyze a user’s video selfie, which Discord says never leaves the user’s device"

...are they really going to implement a facial recognition algo in the browser, or is this a "download our app or fuck off" situation? I'm guessing the latter.

I pay for nitro as of now (not for much longer). If absolutely nothing else, I'm not going to give them monthly payments (which generally required a CC. Aka "I'm an adult") and still not be trusted to be an adult.

And that's the thing, these policies are always loose and will be abused.

- M rated game? Okay, it's adult only now. Sure.

- Emulators? Well they can play adult stuff. Now they just happen to add friction on something that is convenient for billionaire studios.

- LGBT content? Well you're talking about sexuality. Of course you need to be an adult. Here let's take face scans and totally not be a sitting duck for any malicious parties looking to identify traditionally disenfranchised people

The escalation is fairly obvious at this point. We've seen it happen in real time.

Thank you for reminding me, I've been meaning to cancel for months but it's only 2.50EUR and having to sign into my apple account was such an effort I never got around to it.

Just did.

And the community im interacting with is looking into self-hosted options.

I bet they expect the canceled payments. Management will push through.

Cancelled

cancelled. thanks for suggesting

I canceled that shit years ago.

Why should we send a message?

I'm sure I'm in the minority here, but I read the announcement and other than the risk of a slippery slope into more invasive ID demands, I'm not sure I have a huge problem with it.

The default experience will be the "teen" experience - they list what that entails - stuff that's flagged as adult/NSFW/etc. is blurred out until your age is verified, which for most(?) people will require ID or face scan. DMs/friend requests from people you don't know take some extra clicks to view. Fine.

It depends on how broad the definition of adult content ends up being I guess, but I'm simply not convinced that requiring ID to view "adult" content is the end of the world. If that means porn, I'm 100% OK with it, put porn behind gates. It has become far too easy to access. It's 2026 and we now have a generation of gooning addicts out there who never have actual sex and it's basically a guarantee that they won't find partners or start families any time soon, exacerbating an already problematic decline in the birth rate. This is not a version of society or anyone's "rights" that I care to defend. You want to goon, show ID. That's how it was before the Internet anyway.

On the other hand if it means any speech that the platform deems to be "controversial" will be blurred out then my response will not be to submit ID, I'll simply limit how I use the platform. Anonymous speech continues to matter and needs protection. But Discord was never the entity that was going to provide that protection.

I mean Discord is a gaming chat room. Expectations should be set by that fact. I don't need a gaming chat room to be NSFW, or even host i.e. political speech really. I get that people have used it for more than gaming, but it was always pretty clear what it was. If people don't like that this gaming chat room no longer supports other uses, they should switch to an alternative.

We're all going to have to scan our faces and upload our IDs just to use the internet because of your weird obsession with birth rates? Wonderful.

> we're all

Speak for yourself, I didn't touch discord for 3 years.

I don't use it, but it doesn't start or stop at Discord. Age checking is already implemented as live face video & ID uploads and already deployed by every large tech company all over the world. They just have to flip a switch in our market.

To use my phone, Google wants me to verify my identity and age[1][2].

They're boiling the frog, give it a few years, and if you want to use any internet connected device at all, you'll need to sacrifice your face and ID as tribute. If you want to talk to someone else, you'll need to identify yourself with the platform or network on which you communicate. If you want to run an app that serves you any user generated content in any capacity, you'll need to identify yourself first.

[1] https://www.zdnet.com/article/google-play-users-are-starting...

[2] https://support.google.com/accounts/answer/10071085?hl=en

Clearly the outrage is about the slippery slope and the current techno-fascism gripping the US. I'm not being sarcastic.

You do it for the children now, you poo-poo concerns because "who uses discord for non gaming anyway" and you're just letting the foxes in the henhouse.

Twelve months from now and they'll want it for every chat.

The problem with the slippery slope argument is that it's a fallacy. That is the origin of the term, it describes a type of argument that's logically invalid. Yeah I am concerned that things could get worse and this might be the first step to broader censorship that we don't want, but a fallacious argument alone is unpersuasive to anyone who tries to form opinions rationally. Specific evidence needs to exist for the claim for it to be convincing.

Since slippery slopes are invalid by nature they're a type of argument that can be made for pretty much anything. If the case here is that a slippery slope is being used to defend pornographers and the "right to goon," I'm not on board. I think we have a long way to go to roll back porn's grip on teens and adults alike and reduce the harm it does to relationships, and this is just the beginning. Take for instance how Instagram at this point is basically a lead generation service for fraudulent OnlyFans businesses that sell parasocial relationships with a porn model's image where the customers aren't actually talking to her, they're talking to a team of guys in a basement in Eastern Europe somewhere. I think you shut down OnlyFans, you prosecute Meta, and to the extent where Discord is doing the same thing IG is, you prosecute Discord too. There's a long long list of things that needs to happen and shutting down the porn pipeline for teens on Discord is just the beginning.

> The problem with the slippery slope argument is that it's a fallacy. That is the origin of the term, it describes a type of argument that's logically invalid.

No, slippery slope is an informal logical fallacy and its validity depends on the specifics of the argument and its context. It is not automatically logically invalid.

First it was “just extreme porn”, then “just porn”, then “anywhere that could potentially contain adult content”, then VPNs, now all social media, all in about a year. You’re claiming slippery slopes aren’t real while in the gift shop at Splash Mountain.

In Russia none of that slippery slope stuff happened. Just they murdered journalists and opposition, installed TPUs at every ISP and passed a law making any VPN related advice illegal. And people are fine with that apparently

In Thailand porn was straight up illegal for ages and everything else was sane and open... until new government decided to kill freedom of speech.

So slippery slope is illusion. If government is bad it don't need to try to be so complicated and gradual. It can't even think so far ahead, they will no longer be elected when that times comes.

As for social media banning for teens that's just common sense. Social media is fuming pile of garbage designed to make people feel miserable so that corporate overlords make $$$ https://www.bbc.com/news/technology-58570353.amp

There’s a trivial way of fixing social media without mass surveillance or free speech restrictions: Just put a punitive tax on advertising revenue. People can say whatever they want, but the incentives behind social media disappear. This won’t be implemented because this was never about making society a better place.

And your examples only show that where there’s no safeguards, governments don’t need to be subtle, but in semi-functional democracies, they still need to at least pretend to be electable.

No, it started with "protecting the children" around 2010, and followed the bit-by-bit step-by-step boiling the frog approach for years, until the grip on the internet (as well as offline publications) became strong enough to do you know what to you know whom.

Outside of formal logic an argument does not need to be logically sound to have merit. You are extrapolating from "logical fallacy" to (something approximating) "invalid line of reasoning in most or all cases" which is simply not correct.

There are many potentially slippery slopes in politics. The extent to which they prove to be a problem in practice depends entirely on context. Approximately none of those cases will involve formal logic.

Taking away porn access would be great except you can't do it at scale without with eliminating porn from the Internet altogether and prosecuting anyone who shares any, or by eliminating privacy and anonymity from the Internet altogether.

I agree with your take on the damage of porn to the youth but don't yet agree that asking the government to watch every conversation is worth it. (That's what you're enabling long term)

In order to make sure businesses aren't giving porn to teens, you can require they do meaningful age verification at the time they want to provide the porn. You can impose criminal penalties on a domestic business which doesn't do this, and other penalties on foreign businesses (such as locking them out of the payments network). You don't need to get 100%, even partial success will act as a deterrent. This is how the world worked before the Internet, you needed to show ID to buy porn, and public opinion is in favor of the world working this way again. Crucially, penalties on businesses (not consumers, and starting with the biggest ones) are the way you need to go because this is the only way this can feasibly be enforced.

The libertarian concerns around privacy, freedom of expression and surveillance are all valid, but they're downstream. We have hard evidence that porn damages sexual health and relationships, and it has basically zero value to society; it's like digital cigarettes in this sense. We can't allow ourselves to be paralyzed on this issues because of a theoretical slippery slope. Whether Discord is going about this the right way is open for debate, and whether legislation solves the porn problem without introducing surveillance risks is also a good discussion to have. But the porn as well as the fraud and exploitation which always seem to accompany that industry need to go. Libertarians would be wise not to conflate the endorsement of privacy with an endorsement of porn -- most people support the former to some degree, but when people come forward with enthusiastic support for the latter, more often than not their motivation is addiction or profit, not a crowd the defenders of privacy want to be lumped in with.

I don't care what degenerate stuff you look at as you are free to do so.

Privacy is a fundamental right, at that my opinion one of the more important ones, as when the right to privacy is removed the other ones are impossible to keep.

To give up the right to privacy because you don't want kids looking at degenerate stuff on the internet is stupid, additionally the kids will work around your barriers.

How about we teach kids (and adults) the dangers, putting the responsibility on the consumer instead of micromanaging/censoring everyone's information intake.

If a minor drives in a car without a license we also don't require the car brand to install license & age verification in each car. We punish the kid that did it.

I'm biased, as I lead the Zulip project. But I think this is a reasonable place for me to post some thoughts.

Given current events in the USA, I can't emphasize enough how worried one should be about the fact that a few companies like Discord, Google (Gmail), and Meta have databases with access to the private conversations of hundreds of millions of people with their closest friends and family members, linked up with their identity.

Some of the big strengths of running a self-hosted Zulip server for your community are:

- Zulip servers are operationally simple, highly stable and easy to upgrade.

- Zulip is much better than Discord or Slack for managing the firehose of busy communities. Or at least, a lot of people tell us that they prefer the user experience to everything else they've tried, after a few weeks of getting used to it. :)

- Your community leaders get to make the policy decisions about data protection, identity, etc.

- It's 100% FOSS software, with an extremely readable and maintainable codebase that ~1500 people have successfully contributed code to. I don't think you'll find modern alternatives with a comparable featureset to Discord that are more resilient to the sponsoring company being acquired or going out of business.

- We are a values-focused organization (https://zulip.com/values/) where providing a public service is important to us all.

- Each server is completely self-contained and independent, with the only centralized services needed from us being desktop/mobile app publication and mobile push notifications delivery (which is free for community use and soon to be E2EE).

I'm happy to answer any questions.

Because I have some experience with FOSS, I know you don't get the recognition that you deserve. So on behalf of everyone who's too distracted to say thank you.

Thank you!

Admittedly, it did take a day (less than), but once I got used to the interface Zulip provides. It's better than what I would have asked for! It's phenomenal software! The whole experience is better than anything else that exists. And everyone charging for the same features should feel embarrassed given how much better Zulip is!

Genuinely, it's impressive what y'all have created. So thank you!

Yes, hear hear! As someone who've run a couple of FOSS communities, many of them having chats via IRC, Slack, Discord, forums and more, using Zulip has always been one of the most welcome options, yet also the one that takes the longest for people to understand if they've never seen it.

But it's easily worth it, as you can actually come back and read through old discussions and understand things and it isn't a mess. It's like if you could force Slack/Discord to only do threads, and the entire UI is optimizing for that specific UX. Overall pleasant experience once you get over the initial bump :)

This feels like you're chatting with yourself.

I'm asking because I hate Matrix and actually want you to convince me: why should I accept the risk of migrating my friend group from Discord to Zulip, which has already "broken the seal" of restricting features behind a monthly fee even for self-hosted users, when I could migrate us to Matrix instead? Matrix seems like the much less risky option.

I see that you have a "community" tier that's free and doesn't restrict notifications, but it's not clear to me exactly what's involved in proving that we should qualify.

Mobile push notifications are a special case because it's literally not technically possible to self-host them. Or rather, it's possible if you build the iOS and Android apps from source and distribute them through TestFlight or an analogous Android channel, but it's not possible for the developer of an App Store or Play Store app to allow its users to point it at a different push-notification server, because the public key has to be hardcoded in the app binary. So if you want your self-hosted Zulip server to work with the Zulip client apps in the App Store and Play Store, you have to use Zulip's push server, and there's nothing Zulip can do to fix that.

Matrix works analogously; if you use the Element app from the App Store or Play Store, then you're using Element's push notification server, even if your Matrix homeserver is self-hosted. It's possible that Element allows their server to be used gratis in situations where Zulip charges a fee, I don't know their policies or anything, but in principle Matrix still leaves you exactly as dependent on a third party's goodwill unless you make your friends install a privately distributed mobile app.

Zulip IIUC does not restrict self-hosting of any feature that's technically possible to self-host.

It would be nice if you could run separate instances of an app that were considered separate, and forking around a push notification key would make a lot of sense. Another reason I would like to do this is to be able to have different Discord accounts coexisting on the same device. (But, the idea of having some set of different Zulip instances is maybe the exact same use case, with better server-side support.)

There is a lot of truth in what you write, so I am just going to point out the UnifiedPush project[0].

Of course with the, rather large, caveat of that not working outside of

> TestFlight or an analogous Android channel

This implements a push service (caveat: Android only) that is less restrictive than what google provides, and allows the reuse of an existing notification server (ntfy, prosody, etc) by other installed apps.

Since f-droid exists, this allows for a halfway decently user-friendly-ish way to completely self host outside of relying on googles server's and zulip, for example, could offer the ability to receive notifications through it if there's an a unified push distributor available on the phone. It seems that there is at least awareness for this in the project [1].

But with google tightening the noose around alternative ways to install apps, who knows how long this will be even possible.

[0] https://unifiedpush.org/ [1] https://github.com/zulip/zulip-flutter/issues/1198

But how ntfy does it then? It is one app that allows you to subscribe to multiple different notification endpoints. I have uptime notifications set up this way.

Wouldn't it be possible for Zulip to go this route as well?

The same way that Element does - they host a service for you that relays push notifications their Firebase Cloud Messaging endpoint for Android or iOS Instant Notifications for Apple. I believe ntfy's hosted option is the way they offset the costs of hosting this, even if self-hosted options can take advantage of those servers free of charge.

I think it's reasonable for Zulip to ask for compensation for access to these gateways, since Apple and Google do not make them available to end users free of charge, and the burden of responsibility to ensure that these systems aren't abused is on them. Also, the fact that they offer mobile push notifications for any self hosted server of up to 10 users is pretty generous, and there seems to be a Community plan option for larger servers that includes "groups of friends" as a qualifier. It really seems they're offering quite a bit.

This isn't true, self-hosted Android push notifications in ntfy are provided using a "foreground service" by default (i.e: the app keeps a websocket open and listens), unless you set up firebase for yourself and build a custom version of the app with the cert baked in.

https://docs.ntfy.sh/subscribe/phone/#instant-delivery

So it either drains battery and gets significant delays (as per ntfy's own docs), or it still uses Google's solution. There is no free lunch.

I think you misread, the delays are if you don't use instant delivery. I use it and it's extremely consistently delivered instantly, which makes sense, it's a websocket.

As to battery drain, I'm sure it technically does consume more, but according to my phone it's an insignificant amount: <1% of usage which is the lowest stat it gives you. Their docs suggest the same thing:

> the app has to maintain a constant connection to the server, which consumes about 0-1% of battery in 17h of use (on my phone). There has been a ton of testing and improvement around this. I think it's pretty decent now.

https://docs.ntfy.sh/faq/#how-much-battery-does-the-android-...

Honestly it's a good solution that works well with few downsides, the only real one is that iOS doesn't support doing it, but personally I don't have any apple phones so I do get an essentially free lunch.

Google doesn't have any magic way to do instant notification that nobody else has access to. The only thing they have access to in this regard is disabling any battery optimisations without triggering warnings.

Notification and battery performance is on par with google's solution except when an android build does dumb things to prevent the background activity, in which case notification performance gets worse and battery draw gets worse (not sure why exactly, it's just a common issue in these regards).

Well, there is an advantage, if everything is using the one service then you only need to have one thing alive to check it, so each new app is "free" if you already have push enabled (assuming that push notifications are rare enough the activity isn't the cost), as where each app doing it themselves is going to cause more battery use, so it isn't directly equivalent.

However, it also isn't a big deal, at least in my experience, at least for ntfy.sh.

Listening on a socket doesn't drain any battery when no data arrives unless the app does other things that actually use CPU. That's just what Google/Apple want you to believe so you depend on their proprietary lock in services.

Also like, how else would the Google / Apple services do it? Probably via sockets right? I guess you could do it in a pull-based approach on a timer, but that doesn't seem more efficient to me.

But waiting on multiple sockets for each app is surely more expensive than a single one, isn't it?

It does.

Ntfy pays Apple/Google for the ability to deliver notifications to you. They use the free plan as a "gateway drug." It's just a cost of business to them, a marketing tactic to acquire paid users, no different in principle than plastering ads on billboards.

You can't set up your own Ntfy server (at least not without also having a private copy of the Ntfy app).

(Things may be different on the fDroid side, but many custom notification servers are a batterly life and privacy concern nevertheless).

You can self-host their notification server, and in their app you provide this server's url.

Because ntfy doesn’t, at least not in a way that detaches you from a central authority.

On its own notification to your device will happen eventually when the ntfy app on your phone wakes up and polls. Pull, not push.

My ntfy server has a config line for an upstream, which is a service that then uses push. Basically it’s self hosted and handing off push.

The default behaviour for self-hosted on Android is to have a foreground service which holds a websocket open, so it does get pushed from the server and doesn't rely on your phone being awake.

https://docs.ntfy.sh/subscribe/phone/#instant-delivery

The upstream approach you describe is only necessary for iOS devices that don't permit apps to do that.

https://docs.ntfy.sh/config/#ios-instant-notifications

On Android the OS implementation of "push" notifications is pull/poll based as well. At some interval, the OS polls Google's servers to see if there are any messages available. Firebase essential acts as a message broker, so that it only has to poll a single server, instead of a separate server for every service that wants to send notifications, and there is only a single service polling.

But I really wish Android supported specifying additional servers to poll (and/or replace the default server), so you could use a self-hosted service in addition to or instead of Google's service.

The difference between ntfy and another type of push is that you don't need a server owned by the group that makes the app forwarding messages through apple or Google. You can have your chat server send messages to your ntfy server, which then arrive on your phone.

The solution for this is to install the self-hosted Zulip as a PWA, but unfortunately they don't support web push.

Yeah. This is exactly my worry: as soon as solutions to technical problems like this start going in the direction of "we'll offer a monolithic solution and charge users for access to it" instead of "we'll make it as generic as possible even if the alternatives for now are flawed", it makes me wonder about the long term trajectory of the project.

I don't mean to cast aspersions on the developers—I respect everybody's right to try to get paid for good work, and this looks like good work. I am just not convinced it's the right option for my specific needs.

I think it's right to worry about this. However, the Zulip project has a long (10 year?) history and track record with a stable team.

It's not a technical problem, it's a policy problem from the mobile vendors. You'd basically be paying them to deal with Apple's and Google's messaging infrastructure through their (zulip's) infrastructure.

Can someone explain to me why we should do engineering work to build features where the stated objective is to help corporations use our product without paying for it?

Remember, self-hosted mobile push notifications already have a free community plan!

I can't say whether Zulip might be a fit for your needs. But you can always email our lovely sales/support team. https://zulip.com/help/self-hosted-billing#paid-plan-discoun... should give you a sense of our policies.

> Can someone explain to me why we should do engineering work to build features where the stated objective is to help corporations use our product without paying for it?

I'm not sure what you mean by this. I am looking for a replacement for Discord for my small community of friends, and before today I had never heard of Zulip and knew nothing about its pricing or policies or history.

> our product

It's either your product first or an open source project first. If you care more about having a marketable product then it's fair for people who care about open source to go elsewhere.

What would "as generic as possible" look like in practice?

https://news.ycombinator.com/item?id=46954896

I understand that (IIUC in Matrix the client decides what push gateway to use, and the Element client just hardcodes matrix.org and lets anyone use it for free), but it doesn't really do much for my practical concerns. I'm looking for something my users can tolerate (which means no monthly fee) and that I can be reasonably confident won't rugpull us or vanish in the next ~10 years.

I guess my question is, what makes you confident that Element won't change the terms under which people can use their push server?

Nothing, but there already exist many other Matrix clients (shitty as they may be at present), as well as (IIUC) an Element PWA that uses web push (which is IIUC supported by Synapse) for notifications. Synapse also (IIUC) can be configured to use an arbitrary push gateway.

This is what I mean by "generic" in the other comment you replied to. I appreciate the value of tightly integrated server and client applications, and fully believe that Zulip's implementation of notifications may be both a) better for usability and b) a lower maintenance burden for the development team than supporting web push in a PWA, but---again---I am looking at this from a certain perspective where the way Matrix is architected and the breadth of the ecosystem imply less long term risk for my use case.

> because the public key has to be hardcoded in the app binary

Nope. On iOS the flow is:

1. Generate a "push token" on the device (with the user's approval).

2. Send this token to your server.

3. Now you can send notifications to the device via this token. Your server needs to authenticate itself with Apple, and this requires an Apple account. But it's not linked to an individual app.

The situation is different on Android. Google went out of their way to make it impossible to customize `google-services.json` at runtime. So the built-in "easy" flow won't work. But notifications ultimately work using veeeeery obfuscated remote procedure calls to Google Play Services and you can run them manually. I need to do a write-up about this....

You're implying some difference here that I don't see.

Both platforms need some way for the client to register to their respective push services, Apple needs an Apple account, Android needs google-services.json.

Both platforms require your app to generate a token which the platform's respective push service holds, and send it to your server which you then use to identify the client you're pushing to.

Apple also requires the Auth p8, Bundle ID, Team ID and Key ID, which are roughly equivalent to the contents of the google-services.json.

> Your server needs to authenticate itself with Apple, and this requires an Apple account

How does Firebase Cloud Messaging work with Apple without an Apple account, or is that implied in the client generated push token residing in Firebase?

I'm not sure, because I'm using Apple's notification servers directly, not through Firebase.

I believe it works just as a proxy, and you need to specify your own Apple credentials when you set up the Firebase project?

i would read that write-up!

> but it's not possible for the developer of an App Store or Play Store app to allow its users to point it at a different push-notification server, because the public key has to be hardcoded in the app binary

Setting up stoat.chat right now, I'll let you know if I have any notification issues with it ...

I don't think we've ever charged a friend group or other non-incorporated group of people a dime for self-hosted notifications.

For the community tier, you don't have to do anything up to 10 users.

If your server has more than 10 users, you fill out a brief form (https://github.com/zulip/zulip/blob/main/templates/corporate...). We work hard to consistently process these requests within a couple business days, and the vast majority of communities are approved for full sponsorship without further interaction.

(Large communities managed by a business are quoted nonzero but extremely discounted pricing for self-hosted notifications).

I use Zulip every day for the julia programming language (https://julialang.zulipchat.com).

I really like Zulip, and I'd like to migrate my friend-group onto it, but it probably won't happen. I think Zulip is just a bit too heavy-duty for a friend group chatting, and also lacks the visual polish that a lot of people want.

For now, my friends and I mostly just use Signal for group chats, which leaves a lot to be desired, but IMO is still just a better experience for our purposes than Zulip or Matrix.

That said, if you have friends who are keen to try things out, I would definitely recommend at least trying Zulip and see what you like and what you don't. It has a lot of really nice features and things to love.

Having interacted a fair amount with the Zulip devs over the years, and being an open-source product, I believe that they have no plans or intention of trying to fleece or milk self-hosted users or small communities.

Thanks for the input. I'm working on setting up an instance, so we'll see how it goes!

Regarding risk: I certainly won't blame you for feeling risk-averse given the history of the tech industry. I can tell you about some unusual choices we've intentionally made to minimize risk for our users:

- We eschewed VC funding. A big part of my motivation was that I felt that VC funding usually requires eventual enshittification. https://zulip.com/values/ talks more about this.

- Zulip has been 100% FOSS software for more than a decade.

- At the very beginning, we built a complete data import/export system that allows migrating between our Cloud hosting and self-hosting; we put a lot of care into maintaining it well.

I can't promise that we'll never have something to sell for self-hosting communities. For example, I could imagine offering a paid add-on for encrypted backups.

That said, I'd like to push back on the idea that charging businesses for a tool that's an important part of their daily work "breaks the seal". Organizations with a software budget should be happier to pay a fair price for ethical, user-first software from a friendly vendor than for a closed-source product from a megacorp. And Zulip's full-time development team should be able to make a living building ethical FOSS software.

Thanks for the response. I'll discuss it w/ my users.

> That said, I'd like to push back on the idea that charging businesses for a tool that's an important part of their daily work "breaks the seal". Organizations with a software budget should be happier to pay a fair price for ethical, user-first software from a friendly vendor than for a closed-source product from a megacorp. And Zulip's full-time development team should be able to make a living building ethical FOSS software.

I think you touched on the sort of thing I'm concerned about with your mention of enshittification, though I think you're probably right that VC funding is involved in most cases. It is good to know that you've been at it for a decade and have (apparently) built a sustainable business selling a product people like.

My concerns (which I hope are understandable) aside, I certainly support your right to charge money for what you've made, as I said here (https://news.ycombinator.com/item?id=46953048).

>Organizations with a software budget should be happier to pay a fair price for ethical, user-first software from a friendly vendor than for a closed-source product from a megacorp.

Yet we don’t pay for Linux, grep, vim, etc, etc. Why is your open source project the only one worthy of requiring payment?

IMO you should drop the doublespeak of claiming these are open source values while simultaneously charging money. It’s offensive to people who contribute to actual open source projects like matrix, clang, Linux, kubernetes, and on and on.

Grep and vim are a much smaller magnitude than Linux, so don't mix the two. And you do pay for Linux indirectly, it ain't written by some developer in their basements out of their good heart for a long time. It's written by Intel, Nvidia, cloud vendors' etc - full salaried employees. You just pay for it via hardware or cloud fees.

But to be honest your stance is extremely detached from reality. It's a huge privilege to be able to work on a hobby project, people tend to need food and a place to live, you know?

Grep and vim are obviously stand ins for a myriad of tools that together are much larger than Linux. And even Linux still has unpaid volunteers and even the majority corporate contributors are not that relevant to the discussion because none of them have control over the project to the degree that they could enshittify it.

> people tend to need food and a place to live, you know

That has never been enough reason to require that others support your business model. I for one don't need or want any more "products" in my life, especially ones that are or depend on services I can only get from a single vendor.

How is it double-speak? The "free" part doesn't mean "free beer"...

Huh? Where did he argue that you shouldn't pay for those things?

The federation of Matrix seems risky to me to the person self-hosting. I don’t want to host random people’s content. I’ve read some interesting articles about the design flaws of Matrix that led me to believe that it’s not a good option.

What is confusing to you about the community tier? It is basically describing any type of community of people who are not a for-profit business. Groups of friends, non-profits, volunteer groups, etc.

Zulip isn’t charging you anything unless you’re a business with more than 10 users and need push notifications, and that is still only $3.50/month/user if you don’t need more enterprisey things like SSO and compliance stuff.

> The federation of Matrix seems risky to me to the person self-hosting. I don’t want to host random people’s content. I’ve read some interesting articles about the design flaws of Matrix that led me to believe that it’s not a good option.

You can just not federate.

My experience with Matrix as a "discord replacement" at the scale of a few tens of people is that it works and is stable but is also jank and has a lot of features I don't really care about, federation being one of them. Hence my enthusiasm for a possible alternative.

> What is confusing to you about the community tier? It is basically describing any type of community of people who are not a for-profit business. Groups of friends, non-profits, volunteer groups, etc.

The part that isn't clear to me is how you prove to the Zulip people that you are worthy of being included in that tier. I'm certainly willing to write a few sentences explaining my use case, but the help page is light on specifics.

I'm pretty sure it's just an honor system similar to a lot of similar software.

Corporations tend to self-comply because they don't want to risk failed audits and lawsuits.

[flagged]

I'm sorry, would you rather I had framed this post as an aggressive critique of the Zulip developers without addressing my own context? I think anyone who has seriously tried to use Matrix as a chat app rather than a chat app but also an expression of one's principled preferences for federation, decentralization, and e2ee everywhere will know exactly what I'm talking about.

I don't mean to shit on Matrix either. It's a hard set of problems they set out to solve, and Matrix is usable and legitimately self-hostable.

I recently moved a small community group from Slack to Zulip. Half because of the UX for infrequent visitors (topics are so much better than "50 unread messages in #general"). And half because of your organisational values, which are more aligned with ours than are those of Salesforce.

The Bluesky team talks about "credible exit", and Zulip has that in spades - which makes me not want to exit.

Thank you for the work you do. Hanging out in CZO watching the Zulip team work in public is inspiring!

> topics are so much better than "50 unread messages in #general"

my experience is exact opposite

Agree, unfortunately. Zulip is one of those apps I want to see succeed but I cannot for the life of me get used to the UX.

Huh, I have the opposite experience, I love Zulip's UX. The fact that everything is a thread in a channel means I can quickly skip the threads I don't want, and I don't have to mark things as read in an all-or-nothing fashion. Slack doesn't let you do this, if you read a channel, it's now read, and you can't say "actually, keep this thread unread for later".

I understand that part but it makes it really difficult to peruse when joining a large instance. I have little to no idea what I'm even looking for, which actions are going to cause side effects others can see, etc.

How so? I haven’t used Zulip but am curious to hear why

Not the person you are replying to, but I much prefer catching up on a small number of channels, than having to click around a bunch of different individual topics. But it is a tradeoff.

You don't have to click into topics. Zulip has a "channel view" which lets you see all messages in a channel, chronologically, just like Slack or Discord or IRC. That's actually the default experience when you click on a channel in the sidebar.

It also has an "entire server" view if you want to see everything in one stream.

I see thank you!

I think it depends on how you're interacting with the instance/server. I find the rust zulip much easier to follow than the k8s slack (or the lancer discord). I can see on a (much) quieter instance where it's a group of friends you want to see most messages where a single channel is a better option.

I agree with this. We use Slack at work, where we have a small team, and most of us are reading most messages in realtime. It works*

Contrast that to my experience with a group of volunteers who might log in a couple of days a week, communication is a lot more async, and you might not care about all the topics of discussion. I have found Zulip makes it easier to come back and catch up on just the bits you care about.

*I still think Slack encourages a "continuous partial attention" way of engaging with chat that I don't like. But, we do make it work.

Imagine communication server as... a house

Discord server is a flat. It's full of predetermined brick-walled rooms (channels) that have titles on the doors. You look at the titles, you choose the closest to the topic you want to talk about, you walk in.

Slack server is a meeting place. It has rooms, rooms have titles... but you can't talk in them. If you start a conversation there, you're encouraged to "go outside" (to a thread) with whoever joins you to solve the problem. If you walk into the room, you'll only see pointers to "meeting places outside" (also sometimes you can't even discover that room exists without a pointer?)

And Zulip is a warehouse (or a blimp hangar) - it's one open space with no walls. When you come in you hear everyone echoing off the walls. To not get lost, there are markings on the ground that color-code which parts of the space are for what category. And people are standing in groups, so you can come closer and concentrate on one topic at a time

---

If I want to ask a question,

- on Slack I'm immediately get shoved into a car and driven away to discuss (I don't feel community)

- on Zulip I have to navigate the cacophony of main screen, stand in the open and scream my question, hoping that people approach and form a group around me (I feel both open and alone)

- while on Discord I walk into a room that's "close enough", maybe look at conversation that happened right before to get a feel, and ask away (I feel like I'm in a lived-in space and can navigate the tone)

---

If I want to participate in a conversation

- on Slack I have to keep track of new threads. I have to explicitly open each one. I have to read through to see the convo state

- on Zulip I have to scan the "all recent messages" main screen, form an opinion on what discussion I'm interested in, explicitly open it, start reading last messages (now of the specific topic) again to form opinion again on what the state of convo currently is

- on Discord I can see the channel name to pre-emptively get general theme I'll be in (and I can mute channels I'm completely not interested in), I open it and start acquainting myself with the current convo state right away, learning specific topic from the context

---

I can definitely see how Discord's hard structure-ization can fail on large scale, when there is constant demand to use the rooms.

And I definitely have experienced channel "memory leak" (when they get allocated at one point and stop getting used as activity lowers, necessitating archival or garbage collection)

But I do feel that discord got that perfect middle ground between "everything together" and "everything in separate" extremes that all other options tend to fall into

This experience sounds very formed by the particular communities you've interacted with on each platform?

Personally I found Flowdock's thread model the best at least for small'ish teams (company size was <30). You can see it in action at https://web.archive.org/web/20210728031306/http://blog.flowd.... Unfortunately the company itself didn't survive. It was eventually acquired by CA which then killed it later.

(from my older comment) Essentially there is a default view which contains all messages as usual. Each message also has a symbol next to it. If it's grey message bubble, it's a message that is not tied to any thread (it can be replied to to start a new thread. Previously if no other messages have appeared on channel so far, it can be dragged & dropped to another thread). If it's colored message bubble, it's the first message in the thread. A colored arrow means it's part of the thread with that color.

This allows you to mostly just stay in default view with all of the channel's messages. As long as people are putting the messages in the thread itself, you could quickly use the colors to see which thread the message is on (color collisions did happen, but they were fairly rare). You would need to open the thread only if you needed more context or wanted to reply to it, though replying can also be done by writing to channel & dragging the message to thread.

Yes it's odd that nobody I know has copied this. Clearly better than what Slack and Teams are doing.

Your metaphor is slightly insane but I agree with the conclusion 100%. People who try to segregate every single line of text into a completely seperate walled off space is incredibly annoying, if for no other reason than real conversations tend to cover multiple subjects.

In Zulip, if a thread meanders with messages about a tangent, the authors/mods can choose to move those messages to a new thread (and IIRC messages with links between the two threads are created so it's easy to jump back and forth for any missing context)

I agree with most of what you said, apart from Slack in practice.

> on Slack I'm immediately get shoved into a car and driven away to discuss (I don't feel community)

It completely depends on the community / people. I'm in multiple slack servers where the threads are an exception for things that would otherwise really pollute the discussion. But otherwise, everyone just chats mostly in #general (or different rooms if the community is really large)

Slack depends heavily on the vulture that you build around it. I've been in companies where it was either everything in the specific channel (Discord like)/dm only, and in others, where threads have worked wonders. What caused this?

Different people at the wheel making decisions on how we will all use it, and encouraging the structure.

agreed, slack channels can definitely have the "lived-in space" feel to them (which is feel is the key point to the GP's comment)

Hey, just wanted to say that I am a happy Zulip customer.

I used it at my previous employer and after a month of hangringing from people- many did not desire to go back to what we had before. (though some people did say they wanted Slack for the emojis and “prettiness”).

Now I started in a new position and I’ve positioned Zulip (on prem) as the only viable solution since we’re shirking SaaS as a strategic move.

The people who followed me to the new place are quite glad of this, or at least thats what I am told.

So, thank you, sincerely.

Thanks so much for sharing the story!

> hangringing

I’m sorry to be that guy but it’s “handwringing” - twisting your hand like you wring your clothes until you agree

I believe it was actually meant to be haranguing

https://dictionary.cambridge.org/dictionary/english/harangui...

Hey man, don't be sorry!

I actually didn't know so this was a good correction! :)

I think you got flagged for the "incorrect" definition, but I think you were being playful with a mnemonic to remember it- so that's not fair.

> like twisting your hand until you agree

I'm also gonna be that guy - hand wringing is a stereotype of an expression of distress, not coercion. You're thinking of the idiom "twisting someone's arm".

Some of the big weaknesses of running a self-hosted Zulip server for your community are:

- Your server admin can see DMs (or at least metadata, not sure if Zulip does E2E for DMs). The same is true for centralized services in theory, but unless you're a terrorist or a person of interest to a major government, it's extremely unlikely that a Discord employee will have an incentive to spy on your messages specifically. Your admin is likely part of your community and may know you personally, so the temptation is much, much higher.

- If the admin dies and nobody else has the keys to the kingdom, the server can go down at any point, and there's no way for users to reconstitute the network semi-automatically. Discord servers don't just go away unless somebody actively makes them to.

- It's much less secure in practice, it relies on your admin to always be on guard and constantly update their server to prevent vulnerabilities, either in Zulip or in the myriad of other self-hosted services running on it. One guy in his basement that goes on vacation once a year and has family responsibilities is far more likely to make mistakes than a team of trained cybersecurity professionals.

- Many Discord users are in 20+ servers. Anything that doesn't provide a one-click server joining experience (for users who already have an account on a different server) is nowhere near a Discord replacement.

- People want bots (for things like high-fidelity Youtube music streaming on voice channels), and those are mostly Discord-only.

- Anything open source will be worse at phishing and fraud / abuse prevention by definition, as many fraud-prevention approaches rely on the fraudster blindly guessing at what the code and ML models (do you even have ML models for this) are doing.

> it's extremely unlikely that a Discord employee will have an incentive to spy on your messages specifically

No, but history shows some unscrupulous staff members will always snoop, whether its just pure interest or something more nafarious like intent to sell on the black market. This makes the risk of your private data being leaked > 0, which should always be treated as a valid risk.

>- People want bots (for things like high-fidelity Youtube music streaming on voice channels), and those are mostly Discord-only.

So basically Discord is a warez service?

> If the admin dies and nobody else has the keys to the kingdom, the server can go down at any point

This is how infrastructure works, and supposed to work, besides the point that servers "die by themselves" which of course isn't true in reality. You decrease the bus factor if this is a problem for you.

> Discord servers don't just go away unless somebody actively makes them to

If all the sysadmins at Discord died and nobody else has the keys, exactly the same problem happens. Discord though surely have multiple backups of the keys and so on, something you too can do when you have your own infrastructure, so overall that argument feels almost dishonest, since you don't compare the two accurately.

> Anything open source will be worse at phishing and fraud / abuse prevention by definition

What? Completely orthogonal concerns, and if your main "fraud-prevention approaches" depend on security by obscurity, I'm not sure you should even attempt to be involved in those efforts, because that's not what the rest of the industry is going by a long mile.

> People want bots (for things like high-fidelity Youtube music streaming on voice channels), and those are mostly Discord-only.

Actually, the further I get in your comment, the more it seems like you don't actually understand what Zulip offers nor what the parent comment is about. Music streaming on voice channels? Completely outside the scope of Zulip...

----------

I think you have to understand the comment you're replying to a bit better, before attempting to lift Discord above Zulip. They're specifically talking about Zulip as an alternative "for managing the firehose of busy communities", not as a general replacement for every single Discord "server" out there. Yet you've responded to the comment as that's what they've been doing.

> This is how infrastructure works, and supposed to work

No, infrastructure doesn't have to work this way. This is a very old-school mentality.

Sign the content with a key that you control. Back up the content locally. And boom- your server is easily replaced. It only helps copy data around and performs certain conveniences.

I've been working on this full-time for a few years. If we succeed, we solve link rot (broken links) on the web.

Well, you're basically repeating what I'm saying, but with more detail. It's still what I true, "the one who holds the key holds the kingdom", just shifting it to the user rather than the admin. This is great, and works too, but doesn't make what I say less true.

Glad to hear E2EE is coming soon, but it’s been “soon” for probably a year now. It’s a bit odd that encrypted notifications still don’t work, and I’d argue it’s a very big caveat with regard to privacy and security.

Our main reason for using Zulip is that we work in a highly regulated space (healthcare) and would like to be able to safely talk about things. I suspect this sort of situation is a major motivator for Zulip adoption, so it’s weird that transit encryption was left as an afterthought.

(There has always been an option to just not include message content in mobile notifications).

Cryptography is not something you can do sloppily, and requires coordination between the mobile and server teams. Zulip 11.x included the protocol, but while doing the mobile implementation, we decided to make several more changes which have delayed it to the upcoming Zulip 12.0.

Some important context is that we retired the old React Native mobile app this summer in favor of the new Flutter apps (https://blog.zulip.com/2025/06/17/flutter-mobile-app-launche...), which has been an enormous improvement in the quality of the app and developer experience.

But as you can imagine, the cutover and relentlessly addressing feedback after it took a lot of time for the mobile team. We've also experienced an AI slop bombardment in the last few months that has consumed a lot of time. I'll save that story for another time.

What is Zulip's position on speech they/(you?) disagree with -- if someone is paying for non-selfhosted Zulip, are you going to delete/shutdown/dox users/operators that you politically disagree with?

If say the hyprland people were using a Zulip instance and someone astroturfed/brigaded/massreported a campaign to shut them down because they didn't agree to some external code of conduct and external enforcement of such, what would Zulip's response, as a company, be?

Moderation of self-hosted servers is entirely the responsibility of the server's owners (and perhaps hosting providers, if it's extreme enough). We have no way to know what's happening on self-hosted servers, and it's none of our business.

Regardless, there is no technical mechanism through which we could block access to a self-hosted Zulip server via the web application (which is hosted by the self-hosted server itself and designed to work on both desktop and mobile devices).

For Zulip Cloud, you can read https://zulip.com/policies/rules. One of the nice things about Zulip's model is that communities that we do not want to host can just migrate to self-hosting.

Thanks for your work. Moved my company from Slack to self-hosted Zulip after Salesforce unilaterally decided to transfer our account to Alibaba Cloud and the transition has been very smooth. We especially appreciate proper markdown support !

Wow what the hell, Salesforce.

My biggest feature use of Discord is the drop in / out voice with PTT. I couldn't quite tell if this feature exist.

PTT = push to talk (at least that seems the most probable match on Wikipedia)

Doesn’t exist in Zulip, theres a “camera” button that generates a jitsi link, I tried (and failed) to make it a google meet link, but it works surprisingly well, though it is a context switch.

Yeah Google Meet doesn't have an API to just create a call; several people have tried to hook together the Calendar APIs to make a reasonable similar integration and failed.

I assume this API omission is intentional on Google's part but don't understand the motivation.

I'm really hoping for Zulip to succeed, which is why I'm even commenting. But it really needs people with UI/UX expertise. E.g. good user onboarding does not mean showing them a 2 minute video, as another comment on here mentioned.

This is great to hear and ironically we (Pidgin) just decided that Zulip was going to be the next protocol we were going to add support for just barely 24 hours ago before all this Discord nonsense!

https://discourse.imfreedom.org/t/protocols-to-support/234/1...

Awesome, feel free to start a thread in #integrations in chat.zulip.org! We'd be happy to chat about some of the things that will make your life easier to do carefully when writing a new client.

The main thing regards our double-entry API changelog system. Basically, the API documentation for individual endpoints, say https://zulip.com/api/get-user, natively cover for each endpoint all the changes relevant for that endpoint from https://zulip.com/api/changelog... and how to write nice code using feature level checks to support all server versions.

That sounds great! I literally just wrote the initial skeleton last night so there's lots of work to do so any help is greatly appreciated! I'm hoping to have something somewhat usable by the end of the month.

Happy to hear Pidgin is still at it after all these decades. I still fondly remember using it when it was still called Gaim and only spoke OSCAR, back when Rob was involved before he started Asterisk. I lurked on IRC back then and even made a simple TUI when libpurple first came out.

Also your website (https://zulip.com) is so fast and snappy, I was surprised to see everything load instantly when clicking around. I have not tried the app yet, but seeing a static website like this is quite refreshing.

How does Zulip compare to Campfire and Stoat (and other FOSS) efforts? How is onboarding for non-tech people?

Onboarding has a thread going here: https://news.ycombinator.com/item?id=46951401.

My understanding is that Campfire hasn't been actively developed for ~10 years (https://once.com/campfire/changelog shows some minor fixes after the OSS launch; their GitHub has no 2026 commits). There are no mobile apps. It is not an actively maintained Discord alternative.

Stoat is early in development. For example, https://github.com/stoatchat/stoatchat has 1421 commits, compared with 68K for https://github.com/zulip/zulip/. I wish them luck! It's really important that we have multiple independent efforts.

https://www.rocket.chat/ and https://mattermost.com/ are open-core military contractors these days. You'll see what I mean if you visit their websites. But like Zulip, they are full-featured team chat systems, and if the parts of their system that are OSS work for your organization, they're certainly valid options.

Finally there is Matrix/Element. They have an inspiring vision and similar values to mine, and I'd recommend checking it out. Element/Matrix is built on an ambitious distributed consensus protocol with an E2EE option, which provides capabilities Zulip don't have but also adds complexity. Zulip is focused on just doing team chat really well, and does not support more than ~100K users in an instance. Hopefully will have a lot more resources now, thanks to Current Events. I wish the Element team the very best of luck!

----------------------------------------

Overall, Zulip's focus has always been on making a delightful chat experience, especially when you have multiple conversations happening at the same time. We aren't trying to build a clone, but instead the best possible experience for having lots of possibly complex conversations. So there will be some differences from what you're used to.

But critically, we spend a very large amount of our time relentlessly fixing micro-interactions that annoy us or are reported to us. If you read #design, #issues, and #feedback in https://zulip.com/development-community/, you'll get an idea of how we work.

So while there's some features we don't have that are present in other products, and we don't have dozens of designers on staff to do cool end-of-year animated reports like Discord does, you can expect few bugs and a lot of interaction design polish.

-----------------------------------------

The one mistake that I think a lot of folks make in evaluating options is focusing on buzzwords like E2EE without thinking through their threat model. E2EE doesn't add much practical security over self-hosting for many threat models, and it comes with significant usability trade-offs. And some current E2EE systems don't actually protect against a malicious server, say because they only protect message content, not metadata like who has access to what... just against raiding the server's disk.

(For example, WhatsApp has E2EE for message content, but I expect Meta's databases know everyone who's had a conversation with me on WhatsApp and the precise timestamps and approximate lengths of every message I've sent or received on the platform. And apparently some keyboard apps send what you're typing to remote servers!).

> Campfire hasn't been actively developed for ~10 years

For people looking for a simple chat that stays simple, is this a bad thing? When do we call something feature complete? If a product is free, they no longer need to manufacture new features to justify continued payments. It does look like there were updates 2 months ago. Based on the few number of open issues, and a PR closed last week, it feels like it’s being maintained, even if it’s not getting major new features.

I’m not a Campfire user, so can’t speak to the UX, but I feel like there is a market for actively maintained projects, that are considered feature completely, which aren’t searching for new features to shoehorn in. In the long-term, this need to constantly add features generally gets interpreted as enshitification by users. Avoiding falling victim to this relentless push for “more” can be seen as a feature in itself.

>For people looking for a simple chat that stays simple, is this a bad thing?

If the application does everything you want it to do, then no, it's fine. How much new development does grep get these days?

However, it was mentioned that it has no mobile apps, and that's a deal-breaker for probably most organizations and teams. If you can't access your team's communications channel when you're away from your desk, that probably isn't acceptable to many. And of course, developing and supporting mobile apps (on at least 2 platforms these days) is a large effort, and also requires constant maintenance since the two dominant platforms are continually evolving and changing their APIs.

No mobile app sounds like a feature in my book. Few things are so urgent that people should be expected to be reading and replying to chats while away from their desk.

Looks to me like it doesn't have mobile apps because it doesn't need them to work on a mobile.

I think the single most convincing feature that I would like in a conversation app is for there to essentially be two companies with a public benefit charter that said that they cannot have common ownership or management, yet provided the same paid service, developed a common product though open source and had an etremely easy migration between them.

Ideally migration should be easy enough that it would be easy enough to automate a mobious strip subscription where it seamlessly alternated between providers.

If that structure existed it would be nearly impossible for a single provider to enshittify. The sad fact is that no matter how many assurances (often sincerely delivered) have been made, we have all seen instances where buyouts, management changes, or just someone in control going nuts, have turned platforms sour.

Open source is great but as this thread shows, just being open source does not mean functional or maintained.

So like git and GitHub/GitLab/BitBucket should have made GitHub enshittification impossible?

No, How git and GitHub/GitLab/BitBucket should have made git enshittification impossible.

Based on some (admittedly very surface level) research, one spot where Zulip will still struggle to replace Discord is Voice/Video chats and Screensharing - the little I could find about voice chatting in zulip is that it has to be configured to use an external service (jitsi, zoom, etc)

If you do no configuration, it'll use the public Jitsi service for video calls. So no action required unless you want a different video call provider.

> Zulip is much better than Discord or Slack for managing the firehose of busy communities. Or at least, a lot of people tell us that they prefer the user experience to everything else they've tried, after a few weeks of getting used to it. :)

Could you expand on this?

Slack has basically one main hierarchy level (messages are grouped into channels) while Zulip has two, streams and topics. So you can create a stream for each project (say) and create a different topic for any given point that needs discussion about that project.

Kind of like if each slack thread discussion had a title and was discoverable from the left sidebar and didn’t get in the way of the other threads.

> didn’t get in the way of the other threads

But also, critically, if you want to, you can drop back to the "show me everything sequentially" view. Threads hide discussions away - which is good when you want to focus on something else, but bad when you can't remember where a discussion was.

The killer feateure is that it's very easy to move last $x messages to another topic, so if someone writes a short note that begins a conversation everyone is free to reorganize it, and also moving messages between threads is easy and nice.

From what I have read (not having actually used Zulip) it always sounded like the chats were threaded in the same way that mailing lists or newsgroups are threaded.

How accurate is that understanding?

That seems like a reasonable comparison. I've thought of Zulip as halfway between IRC and a forum.

Check out https://zulip.com/for/communities/ and some of the linked case studies; they explain it better than I'll be able to in a quick comment.

But the main reason is that the topics-based organization and ability for moderators to move/split conversations means one can read and participate in a community much more fully given a fixed amount of time.

Does your app pass the grandma and quarterback test? Can I get my grandma and the group's jock/quaterback to use it without handholding?

I'd say so, especially if you start on desktop and have them watch the 2-minute onboarding video. We are satisfied with what we see with our internal usability studies with nontechnical users.

Among customers, one reference that I can quickly cite is this one:

https://zulip.com/case-studies/gut-contact/

> Agents at GUT contact use Zulip every day to communicate with their team leads. “Most of our agents are in their 60s or 70s, so the software must be as simple as possible. That’s why we love Zulip,” says Erik Dittert, who’s been leading GUT contact’s IT team for the past 20 years.

I would recommend doing a little training/handholding call/video when moving over a community -- but this is true for any new app.

My mom needed training to do basic things in Squarespace, and I had a friend who worked at Slack whose manager started every chat message with "Hi <name>" and ended it with a signature, like you would an email. :)

    > and have them watch the 2-minute onboarding video

That's an automatic fail.

First, quarterbacks are not typically the concerning position with respect to CTE. Second, because he plays football he doesn't have a 2-minute attention span? "Dumb jock" is about as accurate as "ignorant HN poster". Third, he either spent 2 minutes learning how to use discord, or stumbled through it long enough to learn, why can't he do the same thing with Zulip? Would it help if they chopped it into a dozen TicToks?

They were needlessly inflammatory, but none of that changes the fact that something requiring you to watch a 2-min video to get started does not pass the [non-inflammatory term for non-technical person but you know what I mean]-test.

I'm saying this in a jocular tone, because - otherwise - the reality is too depressing. But I know people like this.

Anyone with a large enough social group will have some people like this. These are people who've engaged in football, boxing or contact sports like rugby. Or, people with severe ADHD. Or have had some kind of traumatic brain injury. These are real users and they're my friends.

I won't switch to using your application if they're going to be left out in the cold.

If a messaging application can't be used by that person, then that's a default fail. I'm not going to expose them to it.

But you will expose them to Discord's nagging popups for random quest thingies, animated emojis, disorganised channels, etc.? It sounds like you've already decided it's a foregone conclusion.

I am not arguing from a particular desire to get your jock friends on Zulip. Like I said in another subthread, I consider Zulip to be mainly for people who want to achieve things together, not just hang out. It's a productivity app. I wouldn't recommend it as a social app. Why I'm replying is because I feel your approach to the discussion is a little... uncharitable?

They're already using discord. It's a single click.

I think you're misunderstanding me. I'm not here to argue particulars. I'm sharing my reality as a user. A user who runs multiple communities. Including one for my friends. And my friend group extends to 2k+ people (my friends, their friends, their friend of friends... It adds up).

It's not fair that the CTE friend uses discord out of the box, but that's the power of network effects. Any competing solution needs to be 10x better to incentivise the switch.

I can setup a new discord server in a click. Versus,

    Sponsorship and discounts
    Contact sales@zulip.com with any questions.
    
     Community plan eligibility
     Open-source projects
     Research in an academic setting
     Academic conferences and other non-profit events
     Many education and non-profit organizations
     Communities and personal organizations (clubs, groups of friends, volunteer groups, etc.)

That's a huge friends group! :)

You don't need to email the sales team unless you have questions about the policy. It should be clear that "groups of friends" are eligible from the text you quoted.

You just need to spend 2 minutes filling out a brief form that's integrated in the server setup process if/when you have more than 10 users on your server. We enjoy hearing the brief notes users provide about how they are using Zulip. Is that too much to ask in exchange for reliably delivering you a service that you use every day?

It takes quite a bit longer to install a self-hosted server or configure an organization for thousands of users than to fill out the form -- I'd expect most people to spend more than 2 minutes creating a VM before they even get to running the installer. I'd expect that nicely configuring a Discord server for 2K people takes hours.

Is there something that we could change in the website that would make it obvious this is not an onerous process? The purpose of the section is to make clear that self-hosting Zulip is free for this sort of non-incorporated community use ... but we do need to have some eligibility process where you describe what you are, or it's free for Amazon too.

Not the original commenter, but I have faced similar friction from people who are not grandmas or quarterbacks. I don't particularly agree with its tone, but I agree with the original commenter's general message.

I won't be so confident to identify what it is, but there is something that causes "end users" to bristle at Zulip.

Where I'm coming from, everyone uses Slack. I spearheaded an effort to switch to Zulip because our Slack server is on a free plan and our messages get sucked into the void after 60 days now. Everyone agrees that this is bad, and that we don't have the money for Slack premium (we're an academic organization, so AFAICT we wouldn't even have to self-host to avoid paying), and yet so many people do not want to switch. Here are some common responses I've gotten:

* I refuse to use another messaging app and Slack is nonnegotiable for some of my collaborators.

* I don't want to learn a new UI.

* I don't want to learn a new UI that isn't basically the same as Slack.

* I will only switch if everyone else switches.

This is half a social problem ("I will only be receptive if everyone is using this"), but I do think there is some legitimate friction in Zulip's UI. I am fairly confident that we could successfully switch to Zulip if the Slack dissenters could be convinced to use Zulip --- or if Zulip could somehow be coerced into being more Slack-like.

As the "agent of change" at my organization, I felt like the resources Zulip provides are lacking in what I really need. Like I know there are technical details on how to move to Slack (https://zulip.com/help/moving-from-slack), but what I really need is help with the above: convincing people to try and acclimate to the UI. And yeah, I kind of agree that a 2 minute video on how to use Zulip is not the resource I need since it presupposes a degree of openness and cooperation that I don't have access to.

These are somewhat disorganized thoughts, but happy to expand upon anything if you're interested. I really do want to successfully move our org to Zulip since I'm tired of our messages disappearing.

It's not required. It's just there if you want it. Zulip is easy enough to jump into, especially if you have friends who actually care to onboard you into a community.

Adminning a Zulip for a small community group, I've actually found I have better tools to help with this. E.g. in Slack, we had constant nags to "please reply in the thread!" In Zulip, I can just move messages where they belong, and either leave the automated notes there to show where the messages went, or DM the person to let them know what I did.

Rather than getting outraged about prejudices that you don't want to be true, try to see the point of the response you are replying to: if you need to watch a two minute video to understand a chat application then it does not have a good user experience.

Tbf, Discord takes way more than 2 minutes to understand.

But reveals it step-by-step. When you click on a Discord link without an account, it says: Hello! What is your name? You check there are no faefolk around, and then type your name. Now you are in the chat room and you can chat to people.

A lot of discords have hoop jumping for rules or explainers. Then Nitro nags almost immediately and periodically thereafter. Server ops beg for Nitro boosts/packs.

I've gotten through a few of these, but they're not trivial.

But the friend group server won't have hoops, and the other nags while annoying don't act as a barrier to basic use.

discord lost me at having to use task manager to shut it down on Windows.

I am using it every day but never saw the need to download it.

I use it for a non-it non-engineer group and everyone is happy with browser experience.

The mobile app is worse as it only allows writing in a few views that are not easy to access, and is becoming slower over time.

> start on desktop

Echoing this. Navigation is better and clearer on desktop. The mobile apps works really well once you know what you're doing. Part of onboarding into Zulip is being able to get an "overview" of the community and the discussions that are currently happening, and this is easier on desktop.

In my experience, the median user for communication apps is mobile _only_. Before that, it better be a website that works well on phones, and decently on desktop.

As a developer I don't like it, but reality doesn't have to appease me.

This is a case where people can start talking past each other.

In my view and experience, Zulip is a collaboration platform for groups who want to get shit done. I wouldn't recommend it for a "place to hang out".

People who are serious about achieving something will use a laptop. Similarly, in a cousin comment - they will watch a short onboarding video.

No platform is "intuitive" for everyone. WhatsApp and Signal are "basically just SMS" so they can lean on the knowledge phone users built in the 00s and 10s. Anything else is a new mental model and takes some adjustment.

EDIT: also if you are an open source community, or a company, and you choose Discord for your support/project collab community... do better. (Looking at you CloudFlare)

> People who are serious about achieving something will use a laptop

Two decades ago it was said "People who are serious about achieving something will use a desktop" in response to laptops being underpowered.

> People who are serious about achieving something will use a laptop.

That really depends on what that "something" is.

That's true, and there are also people - like my partner - who only own a mobile device. She unfortunately wouldn't be able to have what I regard as the ideal experience joining a Zulip.

Data point of one: in my small community group that has moved to Zulip we do have a grandma contributing. No jocks though so I can't speak to that.

I would also like to note that Slack did not pass the grandma test in our case. I highly doubt that Discord would given how hyperactive the UI is.

As a software engineer who's had to interact with Discord only a handful of times, I had no idea when other people could hear me or where I had to click to find people I was looking for.

I've only rarely used it for voice, so I think I'm not in the right demographic. But I find its text/chat UI janky as hell.

man, I want to support something like Zulip, I would even want to work on a product like this but one thing I'd say is you have to go back and study why Slack beat Hipchat and others. It's so simple in hindsight but it was the marketing and the UI/UX of Slack that made it so much easier to use. If you'd like, I have a ton of ideas and experience building UIs and would love to give you some of my input. Too much typing for a comment at the moment.

You should stop by #feedback in chat.zulip.org and share your ideas!

Regarding the history: Slack had very effective marketing, powered by a lot of venture capital. And HipChat was a weak product that had an embarrassing total hack, which did not leave customers with confidence that their data was safe there.

Zulip is not venture-funded, so we're reliant on people sharing it with others to get the word out.

As a side note, I don't think Slack could have succeeded if it launched today. Microsoft Teams has far far more users as Slack, and it's slopware. You can thank the end of anti-trust enforcement for that.

Fun fact: Shortly after MS Teams launched I created an internal "reconstituted" desktop Teams client for myself and the poor souls in my org that had MS Teams thrust upon them. It extracted resources from the (unminified!) electron app as well the js and CSS files from their web version, then repackaged it again via electron, wrapping into a standalone executable. Think like a really complicated greasemonkey/tampermonkey script.

My fork at the time replaced their criminal white space use and offered a more compact and information dense alternative using CSS and JavaScript, injected all post rendering. Ah, the silly things one is capable when faced with a minor inconvenience and a wandering mind...

Do you know if migrating from Mattermost to Zulip is remotely possible?

I had been using Mattermost because it's also (mostly) FOSS. However, they've recently been changing their released OSS edition to restrict capabilities... Unfortunately the org I maintain it for is having some issues with it now and I have metaphorical egg on my face.

Yep, it's easy: https://zulip.com/help/import-from-mattermost.

Hi @tabbott I've been meaning to pass this feedback on for 5 months, and I hope it comes across in the spirit it's meant.

I tried Zulip (cloud offering) with some techie/designery friends, so we should have been right at home but... the desktop app on macOS and the web app was visually unappealing and clunky, and we ended up going back to a paid Slack plan.

I looked for docs on how to theme Zulip (so I could contribute), or for existing theme packs that would soften the transition but found neither.

tl;dr: The functionality was good (Love the threading!) but the UI feels like the 2000s came calling. Some UI polish would go a long way.

My feelings as well.

What is the video calling and screen share experience like?

Zulip "shells out" to other apps like Zoom or Jitsi for this with a light integration in the UI.

I'd call that a pretty major feature omission since it means splitting things across multiple apps.

Why is it a major feature omission? Screen sharing isn't an easily solvable problem, there aren't any good FOSS libraries out there (at least that I'm aware of).

Expecting a way way way smaller team that didn't get $1billion in founding, like Discord did, is an extremely poor mindset to have.

All you're proving is the need to implement a tech tax to force companies to fund FOSS at the behest of the federal government, which frankly I'm all for.

It's a major omission because the voice and video integration is one of Discord's killer features. Sorry that it's hard, but something that doesn't integrate those seamlessly isn't a discord alternative

Okay, I'm sure if they got $1billion in funding they could implement the same feature but expecting a way smaller team with way less resources to have parity with such a company is just unrealistic.

I'm not expecting anything from anybody, but I'm also not switching to a discord alternative that doesn't support those features

Zulip is a website packaged into an electron app. It does not take $1billion to implement webrtc into a website as screensharing + video / audio calls are a solved problem on the web (Zulip is a web app).

Where did you get the idea that it takes a ton of money to do it?

Discord's main competitive advantages:

* Centralized identity, and participating in multiple communities at once: People sign up once, then navigate to whatever autonomous communities they choose quickly.

* No hosting requirement (good for ease of use): Want a new autonomous space? Create it! Boom! No installation, no hosting, no monetary cost.

* Video streaming: No other chat client does this easily. Not Mumble, Ventrilo, Teamspeak, or these chat programs.

If you want to defeat Discord, particularly in the gaming server arena, you need to make interacting with multiple servers better and you need screen/video streaming.

> Create it! Boom! No installation, no hosting, no monetary cost.

Don't Discord servers have free tier caps? A few of the larger ones I'm on beg for Nitro boosts/packs from premium users for capacity and features.

Discord's main competitive advantage was getting a cool $1billion in founding and being able to support a massive team without the need to worry about profit for the entirety of its existence.

Nobody gives a shit about that man. I don't care if it's unfair. I care that this app does the things I want. How it came to be is entirely irrelevant to me.

No different to ising Slack and Zoom which is a very common combination.

It is when you're talking about competing with Discord which has very good voice and streaming support

This is my problem with the alternatives, nothing has replicated simple voice channels (next to text ones) that you can see who's in and just jump in and out of, with screen share. This shouldn't be any harder to implement than video calling itself but almost nothing has done it. Even spacebar chat is more interested in keeping discord bots compatible than achieving feature parity.

how does zulip as a technical solution solve the ultimate problems with discord and gmail and so on - EU chat control, US porn control, etc?

arent you as a zulip instance owner going to have to implement all the same stuff as discord?

It depends on what you’re doing with the instance, where you and your users are located, etc.

If you create an invite-only Zulip chat for your pub trivia league or school parent association that’s all adults, probably not.

> https://zulip.com/values/

Every word of this page appears as its own line on mobile.

How well does Zulip protect users' privacy against snooping admins? I.e., does it have E2EE DMs? Unfortunately, this is a legitimate threat to be concerned about

How do you see Zulip comparing to anytype, https://anytype.io/ ?

You are referring to yourself as an “organization”, can you define that precisely?

> Given current events in the USA

Don't worry - they're repealing section 230 of the Communications Decency Act.

The one that says platforms aren't liable for what their users post.

This means there will be no platforms at all very soon.

What is the purpose of repealing this act? Make platforms liable and thus enact more restrictions, is that right?

Makes selective political retribution easier.

As you suggest, it's clearly to curtail free speech further; but in a way that their supporters can claim isn't fascist because 'it's the companies doing it not the government'.

We do really need non-USA based social media, stat.

>Don't worry

I'm not worried. We'll use Zulip which has values and thus takes responsibility for everything its users post, right?

Self hosting could be an option, but it does not help when a country require you to identify if a user is adult or not.

Doesn't self hosting usually exempt you? Most such regulations only apply to commercial entities above some minimum user count.

While I personally strongly favor federated solutions those are of significantly more concern in this regard.

Good luck telling a FOSS project what to do. At the very least you'd have to pay for the work and it seems to me they could claim whatever price they want.

Thank you! Zulip is a great project.

Value-focused organizations mean nothing to me. They throw out their values as soon as they are in the way of financial success.

Having a fully open-source self-hostable product improves this significantly.

What’s the state of accessibility on Zulip?

(Thanks for making Zulip, I love it)

You can do everything with the keyboard, and we do write everything with screenreader accessibility and colorblindness accessibility in mind.

But we don't have a dedicated accessibility tester on staff, so we're reliant on people reporting issues that bother them in actual use.

I should also mention there's a nice TUI app: https://github.com/zulip/zulip-terminal, which can be helpful for some people.

Thank you!

I'd like to convince other parts of my organization to move to Zulip, this will help.

Hi Tim! (We know each other :))

I'm curious whether you feel you're actually in control to actually make policy decisions about data protection or whether you feel you could be hit any day by the "$5 wrench" by the government any time they feel it necessary. I'm starting to feel that in this environment, nothing is safe, even if encrypted and on FOSS platforms.

Hey Dheera! It's been forever.

Personally, I advocate for self-hosting communications software, ideally on physical hardware that someone in your community has control over. Zulip runs great on old laptops, if you can solve the IP address problem for hosting it in your house.

And if you want to be extra careful, put your chat system behind a VPN/firewall, so it's difficult to identify what software is being used externally.

And if you're not going to do that, because it sounds like too much work, the next best thing is to at least pick a Cloud service where you can migrate your group to paranoid self-hosting overnight if you decide the work is now worth it.

Self-hosting this way doesn't protect against all threat models. I am human and have children who I love dearly, so it's hard to rule out the possibility of my being compelled to make a malicious release.

But at least the Zulip source code is entirely open and highly readable; so users would at least have a chance to notice and not upgrade. With a centralized architecture like Discord, you're entirely reliant on whisteblowers.

Hi Tim. For pricing, it would seem that large, public-facing, Discord-style organizations would have to go with the free plan to avoid the pricing being prohibitive. Think something like the new Limewire community on Discord which has 2 million members. Or am I missing something about what a 'user' is considered in terms of being billable or not?

On a related note, I'm gonna check out Zulip for PortableApps.com. Any interest in having the Windows desktop app be portable? (We'd love to do that if we wind up using it)

The advertised pricing is for workplace use where the users are on payroll; if you read the plans page carefully you'll see we have free or highly discounted pricing for other use cases, both in Cloud and self-hosted.

Zulip is not designed to support 2M user accounts in a single organization. But if you enable the public access option (https://zulip.com/help/public-access-option), such that no account is required just to read content, you can end up with 1-2 orders of magnitude fewer "total accounts" that just wanted to see something once and don't actually use the server.

Just dropping in on a completely unrelated note to thank you for developing PortableApps - as a kid with no UAC access almost two decades ago now it helped me immensely to develop my interest in IT :-)

It's kind of weird that e2ee is kind of afterthought everywhere. If I was making a chat system I'd obviously didn't want to keep anything that the users talk about on my servers unencrypted or decryptable. Why would you? If something is supposed to be public then keep it. If not, don't.

The weird "we pinky promise to try to keep it non-public for some time" is a weird idea.

Most consumers don't know the difference between "encryption" and "end-to-end encryption".

Zulip uses standard TLS encryption, where the messages are encrypted in transit, but the server has access to the messages.

The server having access to the messages is extremely useful for many key features. Access control policies. Search. Markdown rendering that can make guarantees to clients about its behavior. Mobile notifications for mentions. And many more. There's options for all of these problems, but it's /hard/ and you end up having a lot of risk of nasty bugs where "all the message history become unreadable" and a lot of performance issues.

This is why why end-to-end encrypted messenger apps like Signal are extremely minimal with basically no chat features, and can take a while to load long conversations ... there's a lot of expensive cryptography happening in the background. AFAIK it's not realistic to use the Signal protocol with the volume of messages people do in high-traffic Discord or Zulip communities.

Some other E2EE chat systems have more features but fail to actually provide end-to-end security. (For example, the server provides the source code for the web app and can freely modify that code to steal all the messages the user can still read, or the server is still in charge of metadata like channel membership ... so a malicious server could just add a fake user to every channel).

You get almost all of the security benefits of these "E2EE" chat systems by having a trusted person self-host the server, and setting a message retention policy if you want messages in certain channels to be automatically be deleted after a period of time.

Our vision for Zulip is not billions of people on our Cloud service. People should own their own communities, not corporations. And in that world, usually the person who runs the community can be trusted to host it.

> where the messages are encrypted in transit, but the server has access to the messages.

So the easiest and most useless kind. There were 1000s succesful db leaks for 1 successful mitm. Last time I heard of one, I did it myself on WEP. Https everywhere trend is super annoying for me because all it does for me is make my life difficult when I want to save time and transfer by setting up local caching proxy for myself.

> the volume of messages people do in high-traffic Discord or Zulip communities.

Why do people recieve volume of messages that's too expensive for their device to decipher? Are they gonna read them all?

Decryption should happen as needed. Before render. Before building local search index.

And what's up with notifications? Can't background process of my local app notify me?

> metadata like channel membership ... so a malicious server could just add a fake user to every channel

If you post to a channel anyone can join it's by definition public message regardless of any encryption. So no encryption needed.

> For example, the server provides the source code for the web app and can freely modify that code to steal all the messages the user can still read.

We should have an abstraction that is a socket that encrypts outgoing packets with my private key and deceypts incoming with provided public key.

Such chat apps should have only the right to use such sockets but not general ones.

It turns out e2ee in a chatroom is really, really, really difficult.

First time hearing about this project and it feels mature. However, the landing page example of the app on web is…messy and noisy to the point i am totally lost.

This is not the case for slack or discord. I think having an awesome clean first impression would do wonders to sell what younare doing.

Can you give more specific feedback -- what specifically are you looking at, and what specifically do you think contributes to it being noisy?

Well for me it's the animations, and it doesn't seem like prefers-reduced-motion is handled anywhere. I go to some great lengths to try to eliminate animations with custom js/css, and things are still moving and changing. The logos are probably most immediately noticeable.

I don’t have any questions as of yet, but reading your site; it speaks to me and those values align with mine. Just wanted to say that I think the world could use a bit more of this.

hope you get some money man. instead of just "oh you do FOSS, thank you" - fuck those guys.

Are we the bad guys?

LOVE Zulip!

Thanks so much for this!!

Why zulip instead of the good ol' IRC?

It has modern features. It stores message history. It has a fairly unique feature of letting you create ad-hoc "topics" (that go under a "Channel") that make it easier to manage the flood of conversation.

Channels + topics >>> just channels

Last I checked, IRC wasn't really mobile-friendly.

1: IRC loses all messages to you while you are not connected

Not for years. If that is still the case for you, ask your server hosts to update to a version that supports ircv3

https://ircv3.net/specs/extensions/chathistory says hi

Know of a good IRCv3 client for Linux/Web/Android? And what are some good v3 servers these days, besides Libera?

I've set up Ergo and KiwiIRC before, and it seemed pretty cool. I even enabled the Jitsi plugin in KiwiIRC, so it was like an indie alternative to Slack or Teams. I turned it off years ago, but if I were to do that again, I might try with UnrealIRCd.

Looking for your features but no voice chat, no screen sharing, no deal.

The built-in Jitsi integration lets you create a voice chat call via a single button click. You can also put those call links in a channel description if you like.

We do have plans to make the integration offer some additional ways to jump into a call, and have been talking about adding video chat. But our focus has been on building the best text chat possible, given there are multiple actively developed FOSS video call systems that we can integrate with.

Jitsi used to be so frictionless, but now that their public instances are a bit more locked-down (understandably...) I wonder if developing a deeper first-party integration would be sensible.

If you are selfhosting zulip, what prevents you to selfhost jitsi?

Looks like it has integration with Jitsi Meet https://zulip.com/integrations/jitsi

in slack and discord i don't need another app i just hit the huddle button (in slack) and join a voice chat room in discord.

This is the problem with pitching zulip to this audience. The original thing that got gamers to switch to discord, it was their original and probably still is their primary target market, was a single login to a huge universe of voice chat rooms. Before discord gamers were setting up/renting teamspeak and ventrillo services (that were voice chat only). Hell for the first couple of years of using discord with my gaming group the only thing anyone ever posted in text was what time they were going to be on and what game they wanted to play.

I would say the main thing that got people to switch to Discord was the fact that voice chat was free, paid for by VC money.

I have never created an account nor logged on to use jitsi.

very good take. IMO "current events" goes back to The Patriot Act if not further. Aggressive digital surveillance by 3-letter-agencies has been active for 20-60 years

Can you get Zulip supported by OpenClaw? Zulip was my first choice communication channel.

https://github.com/openclaw/openclaw/discussions/5163 suggests it already has a PR.

I'm told (https://chat.zulip.org/#narrow/channel/127-integrations/topi...) that upvoting that discussion might help it get prioritized.

so instead of discord, google, meta having access to private convos... we should all switch to Zulip and have Zulip being the one with access to those convos? Or join someones self hosted instance and let them have access to those convos?

I am confused.

You can host your own instance or choose someone you trust to host it. With discord, google, meta you have no options.

Zulip is amazing, thanks bro.

[flagged]

Why would you ask this?

Because X is becoming a Nazi bar.

Oh yeah

[flagged]

Yes, but it's fashionable to blame the US for things

[dead]

[flagged]

> enforcing the law

This is like believing DOGE was about efficiency :)

Understandable, but sometimes there isn't a better alternative that doesn't do user support via Discord. That's why it's important to have alternatives that work, so unrelated companies don't pick centralized platform chat software that happens to be convenient for their immediate needs.

Yes, American Hitler is in fact Hitler perhaps you're cool with:

1. Extrajudicious execution of US citizens 2. Construction of concentration camps 3. Openly saying that you'll interfere with state elections 4. Openly saying you'll take away guns and dimish gun rights

Let's just be honest with ourselves. No one. And I mean no one, can support Donald Trump and be a principled decent human being, conservative or otherwise.

I've been building a decentralized, open source platform at https://github.com/Qbix/Platform before it was cool.

I don't think it's cool even now.

I mostly got hate on HN every time I posted about it LOL. I think something about "decentralized" gets some people really riled up (maybe it's the association with crypto / blockchain?) but frankly, it's the ONLY solution to extreme centralization.

Someone's got to build a platform with all the features of Discord, but make it decentralized and open source.

I've spent over $1M and 10 years on it. I have to package it so that it's easy to install. But I'm working on something to take care of that, in the next few months, that will also include actually safe AI agents inside.

It will look sort of like this: https://engageusers.ai/ecosystem.pdf

I'm happy to welcome anyone aboard who takes the time to learn the platform, but I won't lie, it's huge. As you would expect an open source decentralized clone of Facebook / Discord to be. I just hope it's architected well enough for developers to pick it up quickly. At the very least, I think it's a lot less spaghetti than Wordpress and Joomla :)

PS: In 2018 I launched something that HN hates even more... a Web3 company that released open source smart contracts at https://github.com/Intercoin . Why you ask? Because once a lot of value is at stake (whether it takes the form of money, votes, or even just community roles), it's better to have thousands of computers secure it than "just trust" the central site.

When founders of famous centralized messengers criticized decentralization, I had to write this:

https://community.intercoin.app/t/web3-moxie-signal-telegram...

And history has proven me right... their only move is "withdrawing" from a country like Sweden. Well I guess the DSA would make them withdraw from all of Europe: https://www.reddit.com/r/privacy/comments/1ixrv14/signals_ce...

Don't forget, it's not just Discord. As of Jan 1, Texas is now requiring digital ID to download any app at all or visit many internet sites, and forcing Apple/Google to build it in "to protect the children" of course. And Utah is following suit soon too. The Supreme Court last year said that digital ID can be required by states.

Crypto is the problem not the solution, that's why no one cares. We aren't going to pump your shit coin so you can rug pull, give up.

You need someone to rework that ecosystem.pdf file if you're serious. You spent a million dollars on this but your ecosystem pdf looks like it was created by a 12-year old trying out slides for the first time.

Sold

> Zulip servers are operationally simple, highly stable and easy to upgrade.

You lost me there. I need to have all my contacts on Zulip. Nothing else matters to me

Then you're fucked, and stuck on big tech and hostile governments. If you can't convince friends to move, that is.

> Given current events in the USA,

This part absolutely isn't necessary because it's a wrong idea no matter who is in charge.

>>Given current events in the USA, I can't emphasize enough how worried one should be

I've been putting my pants on every morning for the last several years, had breakfast, gone to work, and come home without worrying about any current events in the USA and my life seems no different than 50 years ago except I have modern gadgets.

Social media is not the world. In fact, it's 10% of what the real world is like and how the real world thinks. It's why I ignore social media except for HN and one other but I only scan the headlines and rarely pop into comments like this.

And I'm happy.

EDIT: And the comments below are proof why you, too, should ignore all social media and why you, too, will be happier.

Thousands of people have put their pants on, had breakfast, gone to work, and then been intercepted by militarized federal agents, thrown to the ground, locked up in prison camps, then deported overseas.

Glad things are comfy for you though.

Or just beaten, locked up, abused, then released, because after all they had never done anything wrong to begin with!

never done anything wrong to begin with

Except illegally migrate to the US without applying or engaging in human traffic and smuggling.

You may not like it, but the USA is still a nation of laws. It's also a modern nation. Third world shitholes have lots of problems caused by illegal immigration because they don't do enough to enforce the law and restore order for their citizens.

I'm rather glad that US culture hasn't yet turned into another Afghanistan or Pakistan.

No, including illegal immigration. There are people who have immigrated fully legally within the boundaries of the laws of our nation and still gotten targeted, detained, arrested, and even deported.

There are American citizens getting stopped and harassed for their papers.

It's always hilarious hearing the "America can't become one of those shithole countries!" while advocating for policies and attitudes that are pervasive in said shithole countries.

Here are a few examples of said violations by our government: https://www.congress.gov/119/meeting/house/118180/documents/...

Now show me the country where law enforcement does not occasionally happen to inconvenience people who in the end turn out to be innocent.

Are you also going to call for ban of all vaccines because they or the methods in which they are administered can in rare cases be fatal?

Can't edit my prior comment, but anyway here are some thoughts from a Founding Father, 2nd President of the United States, and leader of the American Revolution, John Adams:

> We are to look upon it as more beneficial, that many guilty persons should escape unpunished, than one innocent person should suffer. The reason is, because it’s of more importance to community, that innocence should be protected, than it is, that guilt should be punished; for guilt and crimes are so frequent in the world, that all of them cannot be punished; and many times they happen in such a manner, that it is not of much consequence to the public, whether they are punished or not. But when innocence itself, is brought to the bar and condemned, especially to die, the subject will exclaim, it is immaterial to me, whether I behave well or ill; for virtue itself, is no security. And if such a sentiment as this, should take place in the mind of the subject, there would be an end to all security what so ever

Lots of wisdom in this

Where did I call for a ban on anything?

I'm simply calling for my government to obey the Constitution.

If they can't execute these operations without violating people's rights, then uhh... they can't execute these operations. That's not me "banning" anything, that's just called "following the law." Violating people's Constitutional rights (even immigrants', even illegal immigrants'!) is already banned.

It's not a crime to be an unauthorized resident of the United States; it's a civil offense. Knowingly hiring an ineligible worker is a crime, however. I'm curious why we aren't going after the employers attracting and hiring undocumented residents.

Besides, people were being deported in significant numbers across multiple presidents in both parties without resorting to the strategy and tactics of the current administration.

> You may not like it, but the USA is still a nation of laws.

I would love it if the US was a country of laws, but the rule of law has been quite thoroughly killed by the Trump administration. It wasn't very effective even before Trump, as you can see by how the prosecution of Trump's crimes got blocked or derailed every step of the way, but after his election, the Constitution has gone completely out of the window.

> Third world shitholes have lots of problems caused by illegal immigration because they don't do enough to enforce the law and restore order for their citizens.

Their problems don't come from illegal immigration. Not even a bit. Unless you use it as a euphemism for colonialism. The real problem there is corruption and a lack of rule of law. And the US is heading in that same direction fast.

> I'm rather glad that US culture hasn't yet turned into another Afghanistan or Pakistan.

Republicans are working on that.

Do you actually believe every person getting abused is an illegal immigrant, or are you just pretending because it's the only way to make your point?

[dead]

People who were actively violating the law of the country.

Not true. As mentioned elsewhere, plenty of people were not in fact violating any laws when this happened to them.

Here's another case. In this one, the government targeted someone who had violated no laws for exercising the 1st Amendment rights afforded to every individual in our country.

https://www.cato.org/sites/cato.org/files/2025-04/FIRE%20Ozt...

They should have thought of that before entering this country illegally. Millions more have an opportunity to avoid this risk right now by leaving voluntarily but they choose not to.

Newsflash: citizens have also been deported. Maybe you're next, who knows.

Want to bet?

Nobody needs to bet - in a lawful society, the law should protect citizens from government agents shooting them dead. ICE already shot dead two US citizens. What would a bet change here? That is a system that clearly does not work.

People died after they deliberately put themselves in harms way in an attempt to illegally interfere with law enforcement. That's tragic but doesn't make the law enforcement inherently wrong.

WTF are you talking about? Next time you fail to obey a yellow light signal, you'd be rightfully distraught if you were put in prison and someone were to say that you deserved it because you should have thought about stopping at the yellow as the law prescribed.

Citizens are abducted by ICE too. Even native Americans

Were these thousands of people all legal US citizens?

>Glad things are comfy for you though.

Things for my family, my relatives and me are great! When I was in my early 20s I often went hungry. Now I'm worth a lot of money. Couldn't be happier as a normal, decent, everyday US citizen.

As someone completely unaffected by both the protests and deportations, I still feel quite sad about the current situation.

I feel like we should still have empathy, not only for the people who are completely clean legally, but also for the illegal immigrants. Sure, they made a choice which put them at odds with the legal system, and yet I still don't want them beaten up, stripped of any of their rights (as non-citizens), with their families destroyed. I keep thinking, if I was in their situation, I could've made that same choice, it's certainly possible, if I was just born somewhere else.

Now I don't think illegal immigrants are guilt-free I suppose, some of them are horrible people I'm sure, and they still deserve humane treatment, I have a lot of faith that that's still one of the most important pillars of a good society.

Obviously we can argue about numbers, maybe abuse doesn't even happen often at all, maybe every single person abused has committed a crime. It could be, and even then we should try to be humane, if we can...

I am always happy to hear when people are doing well though! Most of us won't be directly affected, luckily, and I really hope it will stay that way as well. The less people in duress, the better.

You are free to spend your own money to make those people's lives better in their own country or even to get them US citizenship or residency through legal channels if applicable. Turning developed countries into a welfare system for the world's desperate is not a solution to anything and will only result in those developed countries regressing to lower standards of living if not outright imploding as you end up importing the root problems causing the desperation along with the immigrants.

Continually pandering to "humane" bullshit is why the country has become the way it is.

And what exactly is that way? Semi-official paramilitary groups harassing americans? Desperate attempts to demonize minorities? Threats to prevent future elections? Trade wars that fuck over the american economy and moronic foreign policy that pisses away decades of power accumulation? That's all the fault of asking people to be humane?

The erosion of accountability and personal responsibility. If there weren't any illegal immigrants there wouldn't be any need to go looking so invasively for them. This is a very strong course correction after many years of neglecting things.

The presence of illegal immigrants does not, in fact, mean we have to go looking for them. It definitely does not mean we have to break the law while doing so.

Also it's weird how the group that used to talk about personal responsibility elected trump, the literal antithesis of taking responsibility for anything ever.

> The presence of illegal immigrants does not, in fact, mean we have to go looking for them.

It does unless you are calling for the selective enforcement of laws.

> It definitely does not mean we have to break the law while doing so

Which is fair but most people upset with ICE are essentially calling for no enforcement due to a couple of incidents among a country of 300 million just like with any other issue being advanced by the opposing tribe. I think we can objectively say that the previous level of enforcement was not a sufficient deterrent to reduce the level of illegal immigration. Whether the current enforcement is "breaking laws" or if incidents are tolerable mistakes will be for courts to decide.

> Also it's weird how the group that used to talk about personal responsibility elected trump, the literal antithesis of taking responsibility for anything ever.

I think many of the voters, certainly enough to swing the scale, voted for the lesser of two evils rather than being believers in everything trump. As a random non-American I am not convinced they made the wrong choice.

[dead]

That's some serious right wing programming.

Wrong question. The right question is, "were any of them US citizens or legal residents?" And the answer is yes, some of them were. For some of them the use of past tense is particularly appropriate because they are no more.

That is not the right question because a) zero mistakes is not a reasonable standard for any country-scale operation and b) legal residency does not preclude there being a valid reason for deportation such as violating the terms of that residency permit.

What we’re seeing isn’t mistakes, it’s deliberate abuse. You don’t accidentally tackle somebody and shoot them in the back ten times.

[flagged]

Those people were people who previously made the decision to illegally immigrate to the US. Lots of people start their day normally and then get arrested by militarized cops because they are wanted for murder or assault or burglary or cryptocurrency fraud. The fact that the US has a criminal justice system including police that arrest people suspected of crimes, isn't new, isn't obviously worse than competing systems (e.g justice via informal militia/lynch mob), and doesn't have any implications for the use of Discord today that it didn't have a decade ago.

That assumes that e. g. ICE were only involved against people who have broken the law. First and foremost - this is not the case. Second: when you look at the two executions of US citizens, that is also something not touched by your comment. It is not good to try to describe e. g. ICE without also mentioning the negative sides, such as them having shot dead at the least two US citizens already for no justifiable reason.

> for no justifiable reason

How about we wait for the courts to come to a conclusion on that instead of making assumptions based on agenda-driven outrage media?

https://www.theguardian.com/us-news/2026/feb/09/irish-man-se...

No they weren't.

Did you even read the article? He entered the country on a tourist visa and never left. That is entering the country illegally. Getting married and applying for adjustment of status does not give him legal status. He should rightfully be deported.

Every story is like this without fail.

You just said that he entered legally. Then you said the opposite.

You do understand that visas have terms and limited durations, right?

Except most US voters disagree with you. Someone married to a US citizen does have residency rights, notwithstanding the paperwork quirk that you're supposed to exit and re-enter, which typically involves flying somewhere going to the US embassy to get a stamp and flying back. So just as most people don't support the death penalty for speeding, most people don't support criminal deportation for someone who has the right to be in the US but for whatever reason (perhaps lack of money or perhaps fear of strip searching and disappearing to the gulag) didn't follow the proper process. Because most voters don't see this situation as a crime and certainly not one requiring deportation, the law doesn't treat this situation as a serious crime, or actually a crime at all.

If you want to aggressively going after folks who have skirted immigration rules perhaps the place to begin is in the east wing (if it still existed).

This narrative has been debunked many times already. Legal residents, even citizens, have been arrested, deported, or shot. And people get denied entry based on social media posts. Your comment is way off base and severely detached from reality.

If the US criminal "justice" system arrests people suspected of crimes, why are the criminals running the country while innocents get locked up?

> Those people were people who previously made the decision to illegally immigrate to the US.

There are no limits here and there many publicly available proofs of people getting harassed and detained regardless of legal status and deported contrary to court rulings that apply to their situation. You don't need to repeat the current ICE/DOJ lies - they can speak for themselves.

You should consider how allowing millions of illegal immigrants impacts legal residents next time you vote then.

The legal immigrants have it the worst --- they're the ones who got in legitimately, that already being a struggle as it is, only to be cheated by all the ones who didn't.

I have considered it, which is why I'm voting blue.

You would have to include ALL actions, including ICE troopers shooting dead US citizens too. You can not merely confine it to "this is what they do in theory"; you need to look at what they do in practice.

This has nothing to do with the treatment of the current people residing in the US by ICE, regardless of status.

You should reconsider it.

Fixed this for you: "I haven’t been affected, so everyone else is overreacting."

Almost no one has been affected so yes.

First they came for the Communists And I did not speak out Because I was not a Communist

Then they came for the Socialists And I did not speak out Because I was not a Socialist

Then they came for the trade unionists And I did not speak out Because I was not a trade unionist

Then they came for the Jews And I did not speak out Because I was not a Jew

Then they came for me And there was no one left To speak out for me

I never liked this quote, because it makes help a matter of anticipated reciprocal help rather than simply a good thing to do. Besides, memories are short.

How much "good thing [we] do" is based on anticipated reward has been a topic of debate for roughly as long as we've had language, but I'll take anything that convinces people like that to actually care about people other than themselves.

[dead]

> I only scan the headlines

Have you scanned any headlines about ICE lately? Maybe do a quick search for news about Minnesota?

(I'm pretty sure that if you'd been putting your pants on in Minnesota, you would not have written this comment.)

Are you saying legal US citizens are having a tough time in Minnesota with ICE? My cousins and their families aren't. They're too busy leading their own normal, daily lives.

Yes; my neighbors had trouble going to the grocery store. From appearances, you might think they're on vacation from Mexico. They have been here for generations, and one of their family is a high enough ranking member of the military that I won't say more to avoid the risk of doxxing them.

Yes, two of them were just killed. Does that qualify as "having a tough time?"

And how many people live in Minnesota? What were they doing when they were killed?

I don't get your point. What proportion of residents does an event need to negatively impact for you to believe that it's hassling people?

Surely it can't be 100%, right? No event in any major city, even horrific events, actually affect everyone.

How many illegal aliens were killed in Minnesota?

What's the ratio of citizens to non-citizens that's okay? One citizen per every hundred or are you thinking 10-1?

Have you considered they could maybe just stop interfering with federal law enforcement and let them do their jobs as they have been doing for decades under all sorts of administrations? You'll be hard pressed to find a tear shed for agitators protecting illegal immigrant criminals with deportation orders.

Neither you nor anyone else believes this is how immigration enforcement has been done "for decades under all sorts of administrations."

You can make it appear as if you have a better grasp on reality by just acknowledging that this is a much different enforcement mechanism than we've seen in the past, but you think that's okay.

Anyway there are now several known cases of people being detained or deported without deportation orders. This is another point that you could at least give the appearance of honesty and grasp on reality by acknowledging.

You're right that immigration enforcement in the past did not have to deal with mobs trying to interfere with that enforcement.

DHS's own data proves that current enforcement priorities have changed.

So what's more probable in your mind?

( Hypothesis A ) -- Mobs trying to interfere with law enforcement has caused DHS to focus on arresting and deporting immigrants without criminal background

( Hypothesis B ) -- DHS's focus on arresting and deporting immigrants without criminal background has required significant scale-up of personnel with minimal training (validated by DHS's own data) and required tactics that a large number of Americans believe to strike an unacceptable cost-benefit balance

( Hypothesis C ) -- The two facts (enforcement approach and public response) are not causally related to each other at all

It's telling you chose to not answer the question and instead chose to introduce a different (straw man) question in response.

At least people in the past had the integrity to acknowledge their positions head-on. One of the lamentable things missing today

Interfering with federal law enforcement is not punishable by summary execution.

Huh? Did you respond to the wrong comment?

You keep moving the goalposts that much and maybe the patriots can win the Super Bowl.

[flagged]

There has been no such thing.

Just curiously, what do you personally get out of lying constantly in this thread?

It's not a lie to point out the truth. Words have meaning and wantonly applying the most scariest sounding words you can find does not help your cause.

Dopamine.

That is not a good analysis because it insinuates that everything stays the same. This is clearly not the case. Besides - no matter whether in a democracy or in a dictatorship, almost everyone puts on pants.

It is also incorrect to confine this "merely" to social media. This is clearly government overreach. They want data from The People.

If your eyes are closed, then things look the same whether you're in the middle of a calm meadow or on a highway about to be run over by a truck.

If you prefer not to look, maybe because you're convinced there's no truck, or you don't think it would help avoid the truck if there is one, fair enough. But the fact that your personal experience is unchanged is meaningless.

It is well known that news and social media is biased towards outrage. Most issues people get upset about are really not that big in reality and quickly forgotten once the public consciousness moves on to the next thing. If there is someone yelling "look out for the truck" all the time no matter what the rational choice is to ignore them.

It's sad and pathetic to see such apathy.

[dead]

[flagged]

[flagged]

[flagged]

I hope Discord understands the risks they pose to their audience when they open source their IDs again.

Discord is used by a bunch of closeted users having pseudos, who wouldn't do the same activities on it if everyone had their names.

A part of the Discord users is from countries from which Discord isn't even officially accessible (eg China) or where involvement in LGBT discussions could result to death row (Afghanis are still on Discord)

For me, a company that open sourced 70,000 IDs and ask for moooooore just weeks later is just a joke about the sharing economy

The problem isn't even for new users. Some users have over a decade of private hobbies and will now need to associate their governement ID to their profile. Discord pinky swears they ask but don't keep this time, which isn't enough.

Companies shouldn't be allowed to change such fundamental ToS after an account is created.

> Discord is used by a bunch of closeted users having pseudos, who wouldn't do the same activities on it if everyone had their names.

Exactly. I am sure they won't share their face or ID and will move somewhere else. Big opportunity for other platforms to stand up and grow their user base.

+1.

It's a push out.

That's fine. We'll take our attention elsewhere.

Discord also calculates a whole lot of (inferred) demographic information. Estimated age, gender, and surely much more. They also feed all the messages into a ML model, which guesses what people are talking about, and pushes a notification to other users. This is probably the culmination of all that, this is why they refuse to be e2e like every other reasonable messaging app...

Discord is focused on large groups. E2EE doesn't work in this case. Group management overhead traffic is too high and too unreliable, and a bad actor could just join the group under a pseudonym to log messages. Discord isn't E2EE for the same reason Hacker News isn't.

I REALLY doubt anyone XYZ while XYZ is illegal/pursued/banned in their country hasn't already extensively thought about their own threat model, and that disclosing this kind of infomration on a public platform is not safe.

You’re out of your mind if you think I’m gonna upload ID to use a “shitposting about video games with friends” service.

To protect my privacy, I have a photoshopped drivers license with a photo of my dog that I've successfully used for verification (e.g. AirBnB) in the past.

Though, with AI being used I suspect it wouldn't pass any longer.

It used to be that on the internet, nobody knows you’re a dog. ;)

* on fidonet

The perfect reply. Hats off to you, good sir.

Huh. Can you do that? I wonder what is legal status of this. I used to make all sorts of fake IDs (pretty good ones!) when I was a teen (you know, for purposes such as going to clubs, buying alcohol), but of course this is literally a crime, and not even a "minor" one. Apparently, back then it didn't bother me much, but with age I became more cowardly, I must admit. So now I use my passport data more often than not, even though I am not really a fan of the idea of giving a scan of your documents to some random guy on AirBnB (although, with some obvious caption photoshopped on top, to make the scan less re-usable). I mean, it's just a matter of fact that everyone requires them, and it also has that weird status of "semi-secret thing" that you are somehow aren't supposed to give to anyone, and I still have close to zero understanding of how that works.

So, I suppose you shouldn't give your fake id (digital or physical) to a government officials. It also seems "obvious" that it's similarly unwise to give it to a bank. But you can do that to a random guy on AirBnB? A hotel? To a delivery service (Uber/Wolt/whatever)? Dicsord? Where is the line between a bank (a private commercial corporation) and Discord (a private commercial corporation)?

At least where I'm from, the forgery or the possession of a forged ID is a criminal offense in itself, not matter the intent or whether it's actually used.

I'm not sure that photoshopping a dog in place of the portrait would qualify to though. It's immediately obvious that it is neither you nor a valid government issued document so doesn't that preclude it qualifying as forgery?

Yes, it is indeed not always clear what constitutes forgery (Germany).

> A document in the classic sense requires an embodied declaration of intent that identifies an issuer and is suitable for providing proof in legal transactions. In the case of a lawyer's letter, the signature is an essential part of the standard repertoire of authenticity.

https://www.heise.de/en/news/Document-fraud-via-email-Why-th...

So removing some parts to make it _could_ make it safe, to Not create a "risk of confusion":

> Even if computer processing creates the appearance of a genuine document, the typical characteristics of the original must be present to establish a serious risk of confusion. Likewise, the BayObLG did not consider the offense of forging evidential data according to Section 269 of the German Criminal Code (StGB) to be fulfilled.

Off topic, but I love how every country has its weird abbreviations that seem obvious but really aren’t, like BayObLG for Bayerisches Oberlandesgericht (Bavarian State Superior Court) or something close to that. Or how every British cop show assumes its audience knows exactly what a DCI is, as in “This is DCI Foxwaddle and I’m DCI Rugby-Botherington, may we have a word?”

Good question, IANAL.

Obviously you can go further: What if you just draw up the whole thing with a pencil? What if it's an ID identifying you as a citizen of Nowhereistan? Where does freedom of artistic expression end and a forgery start?

Again, IANAL, but I suppose it would qualify at least as fraud once you try to use even an obvious fake as "proof of identity" in place of a requested government issued document. In that case, there's an intent to deceive that's hard to deny, even if it's just about age verification for access to a digital platform.

I could imagine in court it might come down to details, like whether it's sufficiently similar to a real ID at a glance, or whether tamper-proof marks of an official ID were copied as well.

In any case I wouldn't want to risk up to a year of jail time over a joke.

>>But you can do that to a random guy on AirBnB? A hotel? To a delivery service (Uber/Wolt/whatever)?

The "legal" line is usually around fraud - trying to obtain some financial gain by providing false information. There is nothing to gain by giving a fake ID to discord - but it probably violates some rules around unathorized access to computer systems.

It's still fraud

It's definitely fraud, the consideration is access to their service.

It's likely against the ToS rather than illegal. But if they're deleting IDs correctly after verifying I guess you just have to get past 30 days

The mere possession of a fake ID is illegal on its face, using it is fraud.

But is a photoshopped image of an ID a fake id? Do you possess it? A photo of an id isn’t an id, it’s a photo. Ceci n'est pas une pipe

I suppose that's tongue-in-cheek? Otherwise I can only wish you good look in court with that defense. ;)

In my jurisdiction, it's clear- cut: yes, that would constitute a forgery.

But how does Discord sue you? On face might be a crime, but in reality it is expensive for Discord to sue someone just because of an ID.

Of course I agree this doesn’t worth it. If they force an ID I would just abandon the platform.

I was referring to the concept of "ceci n'est pas une pipe", and that even just digital forgery of an ID can constitute a crime that can be prosecuted independently from anybody suing.

Of course I highly doubt they'd sue. They either just don't let you in or you abandon them. I'm with the latter.

Yeah I agree. There is always some risk about government ID. Long gone the day that ppl could forge one relatively easily, when ID was just a piece of well made paper.

Youtube flagged one of my accounts as a teenager because I watched a few pop videos (lol) and I was not able to trick it with fake IDs, though I didn't try all that hard.

I've been grabbing music from youtube for years. I don't mean commercial music. I mean talented enthusiast who does not sell their music anywhere. Rest assured, it will absolutely be gone one day, and they way things are going, it feels like it will be sooner rather than later.

The Distributed YouTube Archive project is, sadly, on Discord.

I tried to do this when LinkedIn forced me to upload an ID. It didn't work unfortunately. I see the good in this but I know it will be abused. I want to run away but I don't foresee any way that the powers-that-be will let the common person use the Internet without an approved ID in the future.

This gives me some idea: just use AI to generate an ID.

wdym, how did your dog driver license even pass before AI ?!

He's a handsome boy.

Guessing they probably just ran some rudimentary OCR on the image to compare the name and DOB. I modified the actual license# as well as the picture.

Well then what was the point? If you gave them an ID that matches your name and DOB, they still got an identity vector that can conclusively match to your physical, government-acknowledged identity.

Not having a correct photo or license number didn't really mean anything to them if their OCR didn't have any half-decent verification that would look at the fields where that information was expected to be, anyway.

The tech used some variant of OCR, presumably

well, any dog can pass the driving exam in US

[dead]

I found a picture of someone my age, gender, and background and used that in the past for some things.

But not even worth that effort for this. Not a subscriber, but probably won't ever use it again, either.

Just use Ai to make a non existent human face, might as well

There was a story a bit ago about people using video of someone turning their head from side to side to trick these systems. And of course naturally people will easily get past it.

You do realize this is wire fraud right?

Wire fraud is more than just lying to someone over the Internet. It requires a financial gain.

Yeah, I've been warning everyone about the consequences but nobody wanted to hear it. So do people still want a general social media ban for teens?

Absolutely. Social media and its consequences has been a disaster for the human race. Ban it for everyone.

I've flown across the US to meet what will likely be lifelong friends[0], and just went out to dinner and an escape room with some others, all of which I connected with through Bluesky. The worst of social media is terrible, but I would hate to lose the best of it by banning it outright. The really negative parts come are

- Underage people who do not have the emotional maturity to deal with digital public spaces

- Emotional manipulation through "algorithmic" timelines (chronological or bust)

- Waves of unwanted interactions

Social media seems like it can be a positive tool to me. I would love to be able to continue to use it as I am. I do think there is a conflict of interest issue between the mental health of the people that use social media, and for-profit corporations that provide social media services. Regulating social media in a sane way has become difficult due to how much financial sway social media companies have on legislation, but it's an important fight to fight.

[0] I have a thread on my bsky account with a bunch of group photos, if you're interested it shouldn't be hard to find. I'm not linking it because I'm not interested in people engaging in it from here.

Social media doesn't mean communicating with people you know. Social media means optimized algorithmic feeds. You could have met the same friends over email.

This right here is why we keep having this problem. The benefits (or in more cases) the addictions are too enticing. So we take the good with the bad, except the problem is that the bad far, far outweighs the good.

Hacker News is also social media - at least by most reasonable definitions of social media. Should it also be banned?

I think we should ban all users until they provide 10 photos of their face from different angles and lighting. Passport and birth certificates and a lawyer letter confirming it’s really you trying to sign up under the username: LexiMax

Then all this will be synced with govs so can read all your messages. And sell to ad companies to spam you later. (They can link your phone number, email etc to you as you provided real id on all those).

And if you travel to some country that doesn’t approve what you ever said, maybe you broke their law, so you deserve a few years in prison.

And oxygen is also a poison. I don't know what's wrong with HN, but the moment there's _any_ basis for comparison, so many people here are extremely confident that there's no difference between the two things. I'm sure it's an earnestly-held belief, but it's maddening and simply incorrect.

Further, if in some contrived scenario we had to lose HN to get rid of all social media, I'd happily do it.

No, because banning social media at large probably isn't the right answer. It's certain interaction patterns that cause harm. That can be pushed back against either technologically (ex chronological feeds) or culturally (ie via moderation).

There's no perfect solution but some are significantly better than others.

The banned interaction patterns are the ones that make social media social media.

Having an account should probably be restricted to adults only. But it's such a low priority target compared to the other platforms.

The thing is that I literally just don't have the bad, that's why I listed those things. Bluesky is chronological by default, and that is what I use exclusively. There is a "Discover" feed, but I straight up removed it from my account. I have a few other user made feeds that I use very sparingly (basically just chronological keyword search feeds). There are powerful tools for blocking brigading (blocks detach quotes, or quotes can be detached without blocking). I am a mentally mature adult capable of dealing with public interactions.

It's wise to limit use under different conditions from these, but these conditions are seriously positive. I've never had such a positive experience with social media before. The fedi came the closest, but my experience was limited to interacting with technically inclined people who weren't the most socially skilled. Bluesky is approachable enough that anyone who can figure out mainstream social media can figure it out, so there is a much more diverse set of people.

Blue sky is a social network, not social media.

A subtle but important distinction

Sorry but you sound exactly like that comic. "Our blessed homeland, their barbarous waters"

https://knowyourmeme.com/memes/our-blessed-homeland-their-ba...

More seriously, I have seen similar exchanges many times on this social media where one party tries to exempt what is clearly a social media from his anti-social media agenda because he finds it personally more palatable. Usually he tries to exempt Reddit or HN but in this case it is Bluesky, which has the same features as Twitter ten years ago and is notorious for being always politically charged. It makes me think whatever criticisms he may have against social media are actually less about social media but about people he does not like being on social media. Like a driver complaining about all the other cars causing a congestion while he sits in his own car.

But fear not, because our blessed regulators (totally different from their tyrannical censors) will save us from the Big Bad. Never mind when Nepal blocked WhatsApp in its social media ban or when UK came after Wikipedia!

I don’t understand your point.

I don’t use any of these platforms, except HN. But the distinction between social media and social networks is pretty clear.

https://www.techtarget.com/searchunifiedcommunications/answe...

Disagree, that's reductive and beside the point.

It's useful to have words that distinguish major classes of activity online, even if several types are combined on a given platform. "Messaging", "Chat Rooms", "Streaming", "Forums", "Social Networking", and "Social Media" are all different things. You can quibble about what constitutes the edges of the definitions but they all have different key activities they enable.

If you lump everything together, you fail to understand the necessary nuances to identify the problems let alone solve them.

The key to understanding any given social platform is to understand the proportion of which activity that platform enables. This tells you things like the incentives, constraints, externalities, etc of the platform. Different designs have different effects.

I don't disagree in general. I wouldn't call 4chan a social media, for example.

What I find hilariously objectionable is pretending that bluesky is somehow better than all the social medias out there. It's not. It was founded by jack dorsey and copied the UI and features of old Twitter. Its main selling point is "twitter but no Elon musk" and is, from my perspective, almost exclusively inhabited by politically antagonized people seeking a refuge which then resulted in US politics sucking the air out of everything else on that platform.

Can people forge constructive relationships on bluesky? I am sure they do, but they can also do it on X, Reddit, Facebook or whatever "bad" social media out there.

I agree it has roughly the same inherent design biases as X with a few nuances, though it now has drastically different creator incentives both explicitly and implicitly.

Can we still call 4chan antisocial media?

> What I find hilariously objectionable is pretending that bluesky is somehow better than all the social medias out there. etc.

Whether or not it's "better" is orthogonal to the point at hand.

Block lists, starter packs, and quote detaching did not exist on Twitter ten years ago. Person-scale moderation is simply more effective on Bluesky, and that leads to a better experience.

I am super curious about this distinction! Could you say more?

On a network, people interact with each other.

In ~media~, you have a few specialized ~creators~, and doom scrollers.

Compare Lunarstorm anno 2000 and instagram 2026.

The "media" in "social media" doesn't refer to image/video/audio, it refers to "the medium being used". Twitter/Blue Sky/etc are all social media. Read it like "a medium being used for social interaction".

OPs is closer to the truth; the shift from network -> media shows a useful distinction between what the focal point of activity is.

Note that "social" (as in social interaction with people you know) in "social networking" is a requirement, while it is not in "social media". You may as well call it "parasocial media" since that is the way most people use it most of the time.

Thus 'social media' is primarily based on content, while 'social networking' is primarily based on social connection and interaction.

If anything the terminology shift was the other way, we called forums and MySpace social media back then even though MySpace is called social networking now. "Networking" back then was pretty restricted to business / self-promotion oriented stuff like LinkedIn.

We didn’t call forums back then “social media”, we called them discussion forums…

I was there, just go to the official phpBB forums and search my name..

I was also there. We (ie the people I interacted with) called myspace social media and considered discussion forums to be a specialized subset of social media.

We also considered myspace to be a social network (due to the friend graph) while forums were not.

The chans were a weird almost edge case. I think they qualify as social media but the lack of persistent identities significantly changes the dynamics (obviously).

As far as I know chans are always considered "image boards" and they are usually distinct by the fact that the information is "pushed off" the board after a time or amount posted afterwards.

Nobody called a phpBB forum “social media” 20-25 years ago.

Nobody.

Not only did we do it back then, scroll around this thread - it's still a thing today, people are calling HN "social media".

This delineation does not match the common usage of the terms as I understand them. If you want to talk about parasocial media then just use that term.

It was renamed from social network to social media by business executives, who hijacked the social networks built by us

> "specialized ~creators~"

I can understand what this means in the context of visual platforms like Instagram and TikTok. (Slight quibble on TT in that a number of very large creators there record from their cars, kitchens, or otherwise do not employ specialized production.)

In any case, what does "specialized creators" mean in the context of (primarily) text-based platforms like Twitter, LinkedIn, and Facebook? Does that mean they are not social media?

> On a network, people interact with each other.

On any platform that would be considered social media by any definition, popular posts serve as a place for people to interact with each other. They are more ephemeral than a subreddit, but they serve the same function.

I am honestly not trying to troll, I just don't understand the distinction.

Twitter, LinkedIn and Facebook have the same patterns. There's no requirement for them to be in video form.

Most successful Twitter and Facebook posts are visual anyway.

This is a distinction that no existing or proposed law has made and is based solely on your feels.

A social network exists between people, it does not require a platform or technology. Social media is a medium where people correspond.

https://www.techtarget.com/searchunifiedcommunications/answe...

All the explainers in the world don't matter if people don't actually use the terminology that way.

And yet here we are, using the terminology that way.

By that logic, Discord would be a network. There's no default feed for Discord, you need to actively seek out friends and community.

Meanwhile, HN would be closer to media. It technically has a few personalities, and one default feed to doom scroll.

Blueskys only difference is that it hasnt been enshitified yet.

And when (if) that happens, everyone will just continue to use the same network through a better app. Blacksky is a notable example of this already happening.

Hilariously, the website hosting the post you are currently commenting on is Social Media by almost any definition. Autocracy and autocratic thinking are never the solution. You don’t know what’s best for everyone.

Not really. By a broad definition, yes. But here there is no algorithmic filtering of what you see based on data about you that is tracked and data about you purchased from data brokers. Nor is there a team of psychologists constantly working on ways to hit your dopamine triggers and keep you engaged.

But that isn't the main issue with Discord, either, despite their attempts to add features like the ICYMI tab. The problem of Discord is more in the social than the media.

Social media has none of that. Sometimes it is conflated with that as Facebook was social media for the first five minutes of its life, until they realized you can't make money with social media and quickly pivoted.

And every video game is a RPG because you play a role.

This place should burn too.

Sure, social media is bad for kids. Why can't their parents regulate them though? Isn't keeping kids away from dangerous things a basic requirement of being a parent?

I propose passing laws that make parents who let their kids on social media pay fines and risk having social media sites blocked by their ISP rather than just making all adults have to get an "internet license".

It’s bad for everyone, except for the advertisers, and arguably it’s bad for them as a 2nd order effect.

I think we just need to ban social media in general. It's done more harm to our societies than good.

What is social media?

What happens when the governments around the world decide to ban something that you care about? Will you be so eager to agree with them or will you cry that your rights and your freedom are being taken away?

Don't like social media, fine, nobody is forcing you to use it.

The loss of all anonymity and privacy on the internet is much worse than this generation's version of the "won't someone think of the children" scare. It's wild how many people are eating this up.

I’m not suggesting “upload an id”. I’m suggesting ban all these brain slugs outright.

Make META a criminal organization. Put Zuckerberg behind bars.

Yes we should give the government more power and put up “The Great American Firewall” so Americans can’t use any foreign Facebook like companies.

Do you disagree with the first amendment? That's fine, just get it repealed first.

I didn't respond to the suggestion of absolute prohibition because it's too ridiculous a concept to take seriously.

It's the only reasonable thing to do; the status quo is what's ridiculous.

What if there is simply nothing that can be done? I don't mean to sound defeatist, but what if there are some things that truly are like pandora's box. We can't put the lid back on. All we can do is educated people on how to use the tools correctly

>All we can do is educated people on how to use the tools correctly

This lives in opposition to the people who own the websites/apps goals. So it won't happen.

Your personal blog fucktrump.com is social media. I tipped the government about it so it can be correctly blocked and you punished with jail.

While we're architecting the lives of millions of strangers what other reasonable things would you personally like to disallow?

I'd love to arrest billionaires, but can we at least suggest some specific and resonable goals forst? Baby steps.

Eat the rich is a good mantra and banner, but not an action plan. Here in America we have at most 3 years of this left and at median 1 year (with a huge nebulous cloud based on the reaction to trying to seize power). There's a lot we can do to build up to the ultimate mantra.

So you chose to respond to something they didn't say instead? Weird tack.

Louis Rossmann had a vid about this and it's much more than jut anonimity, it's about protecting yourself from being exploited by algorithms. Can go as far as influencing your political voting, or who knows what else.

Does tiktok have good intentions keeping your hooked all day on end?

The one (teenage verification for specific services such as social media) does not require the other (require uploading ids to every site on the internet). For one, the scope is limited and secondly, there must be different schemes possible.

Who cares? What exactly is lost. Personally I’m not going to give them my ID, I’m just going to stop using those parts of the internet.

> "won't someone think of the children" scare

Pretending that's what the anti-social media stance is, is hilariously dishonest.

Anyone pretending there is any anonymity and privacy to protect on the internet, right now, has their head in the sand, especially if they use social media.

define 'social media' .. were BBSs social media? usenet? email? aol instant messenger? physical community bulletin boards? classified ads? newspapers?

Good bye, Hacker News. I knew ye uhh... Well, I knew ye.

HN would be improved if the comment section was removed and it was just high quality submissions. All the AI generated engagement bait articles would stop.

I agree that social media is a plague. Unfortunately, the legal definition of "social media" is likely to be so broad that it will include things like Hacker News or even old-school forums. The real plague is the infinite scroll, engagement-farming social media like Twitter, post-newsfeed Facebook, Instagram, or TikTok. I'm skeptical that laws addressing social media will target the right problem given how rich/powerful a company like Meta is vs. some guy running an Anime forum.

> some guy running an Anime forum.

I expected all of them to have become Discord channels at this point.

ID verification for sites that where people speak the truth.

Cesspit of AI-driven "validated" accounts for pushing propaganda.

It's the worst of both worlds.

Nope, I want the social media companies to be shut down, I want smart phones to go away permanently, and I don't want kids to be handed laptops or ipads in school.

Everybody hates teenagers, so yes.

It's not really about protecting them; people that claim this is the case are generally doing so to launder that hatred.

They're not hated, they're just treated as non-entities that aren't assumed to have or need any agency.

People under 18 are the largest disenfranchised block of citizens.

I mean, yes. Because we don't give kids all their rights yet. That's fair in many regards (not all. Having schools able to silence dissent legally feels all sorts of wrong). It also add protections, like not letting a 12 yo work in a coal mine or be sent to war.

More importantly, it's a powerful political spin used to justify often heinous actions. People want to protect kids.

Brilliant observation! I would like to make the statement more precise: not hate/hatred but jealousy.

This is the kind of thing I would have posted while in High School.

Absolutely, who gives a shit about some platforms on the internet.

Discord hasn't been video game only for a long time

I have discord for gaming communities, but also for political communities. Pod Save America has a discord with thousands of users talking political things. While I don't mask my identity there, I sure don't want Discord preemptively linking my state ID to my person. Screw that.

If you're worried about government retaliation they can already figure out who you are from what discord has, especially with a justice department that doesn't really even care about looking like they're following the law

Government, sure.

But it's the non-government entities you really need to be worried about. There are plenty of brokers buying up this data, making up assertions/predictions about the data, then selling it along downstream to secondary vendors who just blindly accept the data as true.

These are how people online get doxxed. It's not the government or FBI, it's these brokers who mine/buy data from sites/credit bureaus/local governments, link them across various social media, then build out profiles of individuals that they then sell to anyone with a big enough check book.

I've looked into these vendors before and their profiles on people are often wrong on several dimensions. So you don't want to do anything that's going to increase their ability to map you across the internet, because that's just going to improve their ability to identify you, while still selling lies about your personality.

We shouldn't reward their data collection and AI surveillance bullshit with apathy, though.

For sure, I'm just saying if you're in a political discord depending on what exactly is being discussed you should really be aware you already are certainly not anonymous to the gov if they don't want you to be

Then use that server without age verification?

I think Discord is trapped in an ugly place:

1 - Piles of parents too stupid or lazy to, well, parent the children they made;

2 - A very reasonable societal expectation that it shouldn't be easy for young kids to access, or even be exposed, to the worst dregs of the internet;

3 - Very different use cases (gaming, kids stuff, free/affordable slack for communities) all on the same platform;

4 - A pile of morons in legislatures who insist there's a magic highly private way to do all this, but (see Australia) refuse to lay out the actual method. It's a government-wide game of underwear gnomes.

> A pile of morons in legislatures who insist there's a magic highly private way to do all this, but (see Australia) refuse to lay out the actual method.

This is a case where there's plenty of evidence that it's actual malice, not just incompetence. Leaving aside that this shouldn't be done at all, there is no desire to do this in a privacy-preserving way, because destroying anonymity and controlling online discourse is the point for governments, not the "unintentional" side effect to be avoided. "Think of the children" is just the excuse to get people to unknowingly buy in, just as it has been for generations.

https://bsky.app/profile/tupped.bsky.social/post/3lwgcmswmy2...

That’s not a reasonable societal expectation. That should be an expectation of the parents to follow through on.

How reasonable is this expectation? All you do by intituting these draconian 'wont someone please think of the children' ID laws is make it marginally more difficult to access mainstream services where there's not much crazy bad stuff anyway. The rest of the internet is the wild west, and good luck controlling that.

The whole thing is security theater designed to conceal the fact that child security is not the objective, it's the justification.