Make the guilds.join scope require Discord-approval

[kingmigdor]

There are a LOT servers that are currently abusing the guilds.join scope with having it as a requirement to join a server. There are some servers that require guilds.join in order to pass their verification-gate. In my opinion, this is not well handled, as having an account that randomly joins a guild is a bad user experience. (maybe for that special case, a toast-notification would be useful: "{application_name} made you join {guild_name}").

There's also the special case where tos-violating servers are using the guilds.join scope to move their members to a new server once the old server got banned from Discord. This case has also been reported very often.

So basically what people are doing is using the guilds.join scope to ban-evade from Discord, which is why guilds.join should require Discord approval.

[ooliver1]

another common use is malicious applications requiring it for lets say, a "giveaway" then adding these users to guilds that pay them enough

[kingmigdor]

Yeah correct, I also saw some servers buying members like that

[luis-7654]

I saw a Server That raids servers with their Application

[ooliver1]

god damn, thats pretty bad

[kingmigdor]

Yeah these raids are called "join raids" to spam welcome messages. It's without self-botting, and that's kinda a problem, as Discord may can't really tell the difference between a member restore or a join raid via oauth2

[luis-7654]

Good Idea !

[MinnDevelopment]

I think that #5003 is a better solution to this. Approved apps can still be used for malicious purposes, getting approved is simple, after which you can just change what you're doing. This is something we can already observe with malicious verified bots. Also, there would have to be some way to report the app if it were to abuse it.

[kingmigdor]

Yeah but even with a join_once, they could make a new verification system with a new guilds.join application on the new server after ban-evading

[ced777ric]

Even if discord makes it Approval only
that doesnt stop people from doing malicous things.

To be honest, for it to be be not abusable, the user needs to understand what the scope does and not just press Authorize the second they see a green button