💤💤💤 @xiiixv - Tumblr Blog

ducktracy-deactivated20260315

i finally did it. i finally made a video of some of my favorite spongebob quotes in the whole series. i finally fucking did it

blackqueerblog

this should be taught in AP Literature

anime--irl

ikari-archive

鳥の歌, Bird’s Song (2007)

dir. Yoshitaka Amano

11thsense

A representation of my thought process at all times

angelbabyspice

this is literally how teenagers talk irl

thesilencedmasses

This literally sounds like a voice-acted recreation of a group chat

superficialhouse-blog

I’m dead.

cosmic-magical-being

A brief summary of American Horror Story: Coven.

hate-deactiv

this video is so fucking accurate

supremecordeliagoode-deactivate

I cried a little

tatehorror

this is the best thing i’ve ever watched

surprisebitch

throwback to the best AHS season

februarfebruar2222-deactivated2

Peter Kogler

24ozsteak

thinking about that WoW epidemic

24ozsteak

swampgallows

i was telling my dad, ever the skeptic, about corrupted blood back in March at the start of lockdown, and how the cdc studied it. how it can be used as a model for what to do and how people might act in the event of an unpredicted pandemic, and how people were playing out the same behavior during covid.

he said “so they fixed it, right? how did they fix it in the game?” and i told him the truth: they didn’t. they couldn’t control it. they had to reset the servers and roll them back to the time before the ZG encounter.

a CNN article recently referenced another “viral” event in world of warcraft: leeroy jenkins facepulling as a metaphor for the expedited reopening of businesses. what it fails to mention however is how the video ends. everyone who charges in with leeroy dies. he wipes the raid.

it really feels like that meme where it’s like “wow, cool video game reference!” and the point soaring over their head says THE DAMAGE WAS IRREVERSIBLE. THE THREAT SPREAD TOO RAPIDLY AND EVERYONE DIED.

wheel-skellington

weird reframing of the corrupted blood incident to make it seem, for some reason, like it was all selfish actions that people said was unrealistic because real people would help others. in fact its literally the opposite, it was used as real world data specifically because of the player driven efforts to fix it

the-jellyfish-galaxy

The reason this plague in the game was a good model is because we had all walks of life type people reacting in different ways.

Those with healing magic would go into infected areas to see if they could save the infected or at least keep them alive through the disease. Those that couldn’t do that tried to warn players before they entered infected areas. NPC could be infected and have “no symptoms”; they could be asymptomatic carriers and pass it to nearby players.

The best part though was by the time Blizzard had finally come out and said “if you are infected, try to quarantine yourself so you don’t spread it!!” the player base was ALREADY DOING SO. The players had recognized the problem and worked together in myriad ways to fix it.

They also had negative reactions as well, another reason this was such a good example of a real outbreak. They had a couple people report healers or alchemists who were claiming to sell cures/treatments to the disease that ultimately would do nothing. They had a group of players that would hide in the mountains near cities and just pass the disease back and forth between themselves and then raid cities to infect them all over again. They had higher level players start rebelling on the servers. Saying it was an overreaction and if you get it you’ll just die and you can come back and be fine, etc. Since they could get the disease and survive, ie it didn’t do enough damage to them since they were higher level, they felt it unnecessary to care about whether they got it or not. They complained about not getting to play like normal just because this plague could kill lower level players.

ALL of these reactions, good and bad, were real enough to what we assumed a real life epidemic would play out that people started to use it as a model. And now look, we have proof that it was accurate.

However, what we needed to learn from it was primarily that it wasn’t reversible. The bad reactions and lack of care from the few players that weren’t cooperating made it impossible in the end to contain. The only reason it was fixed at all is the game had to reverse time, literally just delete their entire game log a few weeks and time travel weeks into the past to before the plague even began.

Think about that.

The reason no one believed it was a valid model is that it was a video game and thus the consequences weren’t permanent. “No one would act like that in real life.” But look at how we are handling this outbreak. Is it not eerily similar?

And we can’t time travel.

seraymeric-discord-spyware

Ser Aymeric, the Discord bot, was designed to be spyware.

Some background, for those who aren’t familiar with the situation:

Lethys is the creator of a popular FFXIV-centric Discord bot called Ser Aymeric. It’s admittedly a very useful bot, and is popular because of it’s feature-set.

Lethys is well known in the community as a serial predator of gay men.

Lethys is obsessed with harassing individuals he sees as his enemies.

Lethys has leveraged the popularity of his bot to secretly surveil individuals he has grudges with in the past.

I worked on Ser Aymeric directly and had access to the code. Lethys brought me on to work on Aymeric’s dashboard administration interface.

I was asked to hold off releasing this information until after Discord did an investigation. I am uncertain whatever came of that investigation, so either it never happened, or Discord doesn’t understand the ramifications of this situation.

Lethys has two spying capabilities built into Ser Aymeric:

The first was built in Version 1 of the bot, specifically to spy on Lethys’ rival Lux and his XIV Male Mods Discord server. It’s known as the ‘secret h’ function (command ?h), and was able to dump the last 1000 lines of chat from any channel Aymeric is present in. He specifically built it to spy on XIV Male Mods’ private admin channel to see what they were saying. He was obsessed with them as a rival server to Lethys’ Gayorzea community. This function could have been used to export the text of any channel on any server that Ser Aymeric was present in, but XIV Male Mods was the only one I’m aware of it being used against.

For Version 2, much of the bot was rewritten, but rather than making things better, he grew the spyware capabilities.

It was during the V2 rewrite that Lethys brought me on to work on the administrative frontend for the rewrite, and therefor had access to the code. Despite his claims in the past, I was listed as a developer on the credits and homepage ever so briefly.

Version 2 logs every message by every user in every channel that Ser Aymeric has read permissions to. It stores them in a MongoDB (a type of database software) collection called 'messages’. These records (referred to as JSON objects) represent all message sent, across all the servers Aymeric is present in. They are plain text, unencrypted and personally identifiable. Lethys could query them on a per-server, per-channel or per-user level.

In his privacy policy he claims this logging is for the 'quotes’ feature, but it goes far beyond that. This is all messages, whether or not someone has invoked a quote command or not. Everything.

This is a look into the live production database Ser Aymeric is running off of, using MongoDB. You’ll notice a 'messages’ collection containing a large number of objects.

An example of one of the objects inside the 'messages’ collection. This represents a message someone shared. Every single message that is shared in a channel that Ser Aymeric has read access to is logged and stored, regardless of if they have been quoted, deleted, or whatever the case may be. Everything. In spite of what the author claims or states in their privacy policy.

Here is another example. This shows how easy it is to query down to a specific user, channel or server level. In this case it’s my own Discord ID. This was posted in a private administrative channel that although Aymeric had read access to, had no reason to be logging whatsoever.

Here is a live shot of that same message, inside a closed admin channel. The message ID is 617875866122190859, channel ID is 480809457056743424, server ID is 179321234046058497 and author ID is, again my own, 62310340079128576. This mirrors exactly what is in the live database on Ser Aymeric.

So, the long and short of it is, a known sexual predator with a history of harassing his victims and those he has grudges against has a wildly popular Discord bot which enables him to see what anyone is saying without their knowledge on any server, to be aware of what servers they are present in, what channels they have permissions to, and more.

Let the scale of that sink in. At the time of this writing it’s on 18,372 servers, and monitoring 1,210,120 users who are completely unaware. It’s gobbling up every message across every Discord server it’s present in, collecting private information without people’s consent or knowledge, readable by him, and no way to delete it. It is not even remotely GDPR compliant, in spite of Lethys’ being a citizen of the United Kingdom. It’s a gross invasion of privacy.

Every server that has Ser Aymeric present in it is unwittingly enabling Lethys to continue to spy and harass his victims. Do not use this bot. Do not trust Lethys with you or your friends information. You will learn, as I did, that he is not someone you should put your trust in.

Some have claimed it would be impossible to process every single message that Aymeric has access to. That’s simply not true. Aymeric, like all bots, *has* to process every message in a channel it has read access to. How else do you think it would know you used one of it’s commands?

As far as storing those messages, Lethys recently updated his privacy policy to admit that yes, he does really do that. The reason the database doesn’t swell to an unmanageable size is because he runs a process to occasionally wipe out old messages from the live database — however, old messages are still saved in backups. I do not know how often he runs this processed, but I would expect he gives it a pretty wide clearance, as once those messages are out of the live database they can’t be quoted or referenced for deletion/edit auditing features. So what, 60, 90 days? I’m not sure. In any event, even when the live database is trimmed for performance, your data is never really gone, and is conceivably retrievable by him from backups.

A 30, 60 or 90 day allowance is plenty of time for him to readily go back and read messages from people he’s taken issue with, though. I’m not sure I’d be comfortable with anyone reading a rolling 30 day history of my text messages to the people I care about, with access to more if they were really curious.

Also, just to get this out of the way, because people keep declaring I’m full of shit, yes, I did work on the bot:

https://discordapp.com/channels/265561352683126786/265586371178135562/618034546503581698 (although I’m sure he’ll delete it.)

Update: In light of my tweets, a new version of Ser Aymeric has recently been released advertising itself as “secure” because it encrypts these messages. This is literally impossible to do from a cryptography standpoint, as I explain here. Message history and quoting is impossible to do with an encrypted database. Aymeric is no more secure from Lethys’ spying than it ever has been, and I’ve nothing to indicate that Lethys has spontaneously developed a moral compass.

Update: People have in the past faulted me for conflating Lethys’ personal issues with the security concerns of the bot, but I strongly believe the two are inseparable.

The ‘secret h’ function outlines the developer’s state of mind: we can abuse this and use it to our advantage, and they did. The many, many stories on Twitter and elsewhere from people who have been harassed by Lethys’ speak to his character and trustworthiness. Years of personal experience seeing just how unbalanced Lethys informed my opinion on how he might use the bot.

V2′s logging functions are not inherently evil, the problem is, in the wrong hands, they can be abused. ‘secret h’ demonstrates that they HAVE abused this power in the past, so how are we to trust them now with even more power? We can’t. You shouldn’t. That is what I’m saying. You put your trust in the developer to do the right thing with your data by using their bot. And this developer is not trustworthy.