#👾-core-development
1 messages · Page 202 of 1
jumpscare
yorp
This is a really cool idea
New setting in AnonymizeFilenames:
A list of file extensions for which the opposite of anonymiseByDefault will be used.
So if anonymize by default is True, this is a list for file extensions which shouldn't be anonymized by default, and the other way around.
List setting could probably use a more useful description than the current one? Tried to keep it short.
File extensions for which to use the oppposite Anonymize by Default behavior
invertedExts could be cached but eh, its a...
It does not deal with CSS colors. The colors always get passed to encode as 24-bit colors, so that is the intended behaviour. If you force it to only accept 6 characters, you will break compatibility with other plugins for no reason.
It does not deal with CSS colors. The colors always get passed to encode as 24-bit colors, so that is the intended behaviour.
It was meant to be CSS colors but I implemented it very lazily so its unintended intended behavior. Stop trying to be self righteous thinking you designed and wrote the system when you didn't.
Sorry, that's not how I intended to come across.
@hallow kestrel aww… I really love this idea
This adds an option to the Mention Avatars plugin to remove the @ symbol.
I though it just looks odd having the avatar and the @ symbol lmao
Minor issue, thought I should mention it at least.
Description
When resizing the terminal window too small, text starts to duplicate, especially the Use the arrow keys to navigate: ↓ ↑ → ← prompt.
Environment
- OS: Linux Mint Cinnamon 21.3 x86_64
Screenshots
i wonder if this is possible with css for now?
I tried and failed
doesnt look like it
move the settings definition to the index file
thinking of having additional author fields
perhaps a main author and other authors fields
mainly something which differs the main authors from the ones that do minor or medium changes
@austere talon thoughts?
None
None
None
None
ShowHiddenChannels (found no module):
ID: -
Match: ```
+1]})},"overflow"))
None
None
None
where did the 1 go
bascially what they did was +1]})})},"overflow"))
but for sake of stable compatibility I just removed the one for now
ah
do you know how to load all chunks
nope
load all chunks and search for this in the devtools
check if it's only one result
okay nice
same with +1]})})},"overflow"))
then we can switch the find for that
this got pushed to stable from what I can tell
also is it me or your fork has the discord types branch from ryan merged?
equicord or disbored?
fun fact: this turns your discord pink 
equicord
wait what
it doesn't to my knowledge
how lmao
wait why does it do that
screenshot I wanna see discord pink
ah okay
IT DID THAT TO ME ON REPORTER
everything was pink
after
is this the vencord theme
no that's discord stuff
kinda makes a fire theme tho
loadLazyChunks forcefully loads everything that discord would lazily load at some point
like how it only loads settings when you open them
should be right
I forgot how to do the correct branch through git so I had to nav github.com
horror
use the one that doesn't include the 1
That's weird, my force load function — which loads every chunk registered in the webpack, not just those that would actually eventually be loaded — does not pink
alr
show the code for it
I know a difference from our implementation which could be the reason
Yeah the implementation is very different
I love that all I commit to vencord is 1-3 character changes
yours is more simple because it only loads them
but doesn't require their entry points
Oh, does yours execute them too
yeah
Yeah that might make a difference
pr is good
I like pinkcord 
but if it was only that your implementation would have caught it
it changes all the brand colors to hotpink 😭
I'm almost certain a css chunk always has their js part of it
and you forcefully load all the chunks that have js files mapped to them
when you call .e you indirectly load the css part too
I'm almost certain but you could test more if you want
There are side effects such as some chunks overwriting the whole webpack object though, so I had to work around that
wreq.e internally uses wreq.f which js an object used for loading the js and css part of chunks
huh?
that doesn't happen
kyuu exploding stuff 101
actually I think it's cuz you are loading chunks meant to be inside a Worker
Actually you're right, it does pink
they have importScript stuff inside their own webpack instance
Must be a recent addition
https://discord.com/assets/9fdfe2ca9090245f5074.js is one of the chunks that overwrites webpack
btw don’t put this your QuickCss
@import url("https://discord.com/assets/0817de0ebfeebd74217a.css");
yep it's a chunk for running inside a worker
notice how it has importScripts(
that's why it includes its own webpack instance
new discord theme leaked 🔥
real
I really should make my extractor include the css
Makes sense
But I don't suppose there's any way to detect which chunks do that before actually loading them, is there?
https://github.com/Vendicated/Vencord/blob/immediate-finds-modules-proxy/src/debug/loadLazyChunks.ts
you just have to fetch them first
I guess
also
for your plugin you could just use that function to loadLazyChunks lol
no need to implementation on your own anymore
Hotpink is in module 59051, loaded as if (_24.default.cssDebuggingEnabled) require.e("59051").then(require.bind(require, 459645))
I don't know why the .e'd module id is different from the require'd one
it's almost always like that
that's why it's so complicated to force load everything
you are required to manually look for where a chunk is loaded to find its entry point
(the required id)
not so long ago there was an object which had every entry point mapped to the chunks required to be loaded
you prob remember that
wreq.el
but yeah that's no longer generated
Yeah sounds familiar
loadLazyChunks is much slower than mine since it's less parallel
wtf stable just keeps crashing when I enter here
But it does successfully load everything except while avoiding the 7 worker shits
it's literally as fast as it can be
uses promise.all everywhere it can
however it requires a chunk to be loaded to finally be able to search for another chunk
which I can see where the difference comes from
Yeah I think that's the main part
Plus it does another fetch for each file beforehand, but the cache ought to take care of that, right?
I have no clue where this hot pink is coming from
yeah
^^
ty
do you want the css that makes it happen?
I have it
ah
DEVELOPER_OPTIONS_CSS_DEBUGGING
Hey, where did the discord devtools button go btw
Used to be a bug net icon next to the vencord toolbox
Looks like you're supposed to be able to toggle css debugging from there
Clicking it opens https://support.discord.com/hc/en-us, hovering it shows a tooltip
check your dev settings maybe you need to enable
Did I accidentally untoggle the is staff setting somewhere
it was removed I think
Oh, it's a setting in experiments plugin
if anything I know there is a flux event you can dispatch to open it
Enabling that setting made it work
But it seems the css debug setting isn't there
The file contains lots of strings about build overrides
Probably somewhere under developer settings » add build override
Eh, I don't care enough to look into it
Probably that setting is meant to find things that are colored with absolute colors instead of --green-300 variables
oh wait you are right
very interesting
I remember they fixed some hardcoded stuff some weeks ago
im done trying to forcefully disable randomy things to do with css debugging
I'll accept my fate of hot pink
Try deleting the stylesheet node from the dom
Or unchecking it in the stylesheets tab, I think that's a thing you can do
instead of it saying "Mutual Groups" it will say "(number) Mutual Groups"
will use
This commit is a proposed amendment of #1792.
Currently, the {{NICKNAME}} placeholder allows reading a user's nickname in voice events. If the user has no nickname, it uses the username instead.
I would like to propose the user's global display name be used, if available, before falling back to the username, because the username is always all lowercase, often difficult for the text-to-speech system to pronounce, and may not reflect how the user prefers to be known.
This commit make...
Is it just me or does this look AI written
Not the PR but the message
it does, but it really doesnt matter lol
Minor change, but it really irritated me, sorry.
- a minor grammatical fix
Just "running with sudo" isn't really enough transparency, especially for some shell script.
what
Were sounded better imo, there’s no need for a change.
yop
thats because its the grammatically correct way of writing that lol
were is more proper
@rugged spire I remember you were working with the sentry in the electron side
does that need to be disabled?
yeah
no
I don't know anymore
discord already has us blacklisted 
yeah but still
I originally decided to nuke it because the sentry version was super buggy
it's funny how they have us blacklisted on electron side but not on renderer side
since one we already disable and the other not
remember how everyone was spamming #🏥-vencord-support-🏥 about it
I didn't see that
at this point my opinion is that sentry disabler in native should exist but only if it can be done in a non-hacky way
can you link me a message?
it was only linux users using the debian package
and what would be a non hacky way
have you seen how we disable the one in the renderer?

Yes. Do not tell me to do it that way before trying to do it that way yourself because it doesn't work
unless you can load the sentry from the asar it will load immediately and any patch is relatively too late
I'm not
I'm just saying we do things in very hacky ways
ohh I see
I want you to know my "solution" was just blatantly monkeypatching require
No I am not proud of it.
to be fair the base of anything is a monkey patch
vee kept telling me to just insert null into the require cache directly but uh I really couldn't reliably load the require cache in the first place
I might try it for fun
Good luck. TL;DR of what you need to do is make require("@sentry/electron") return null
The Horrors
I will try next week when I'm home
None
None
None
None
canary...?
ah
what the fuck
oh they did
where do they get the static-edge from
I can't fix this so someone else will have to do
it's in the global env
wtf its directly google servers
Google-Edge-Cache
GLOBAL_ENV.STATIC_ENDPOINT
does that exist in stable?
can you do this for me
sure
webpack needs to append that when loading chunks to lets see how it does
yea static-edge is just pointing to google cloud
yes
but what if the ISP effectively has a google cache server
i'm not confident thats whats happening in my case
hm
might be other side of my country cache server
okay I suppose since the script is hosted in https://static-edge.discord.com, when you fetch /assets/... it automatically tried to fetch using static-edge
but vencord is ran on normal discord.com so it tries to fetch the wrong url
WHAT IS THAT
@limber skiff it seems like discord.com still hosts all assets from static-edge.discord.com
cors error is what loadlazychunks does
I see
1 of the many
LMFAO
we love canary ❤️
was that directed to my PR? (#2725)
I actually love this idea
yeah but I'm not saying your work is not good in any way
Solves the problem of "I want my work to be credited but this isn't notable enough to say I made a significant portion of this plugin"
It just made me re-think about how sometimes someone does a huge plugin on their own and another person adds another good feature another time and get credited as a whole too
it's not specific to your pr
would definitely be nice to have
I was confused because I thought it was about the functionality of the plugin lol
but how would these additional authors would be shown in the UI
idk?
maybe hide them from contributor modal
maybe like that +9
oh yeah
that all additional authors go into that overflow thingy
But then you have to determine what is a major or minor contribution
yeah fair
Though I guess that's kinda already the case
yep
this would be nice but having a title there would be good too
I mean like, lets take the pr I made, it's relatively small, but it's 20 lines added out of 60 total lines
That is significant IMO (at face value)
Maybe just add a separate creator field
it's definitely worth credit but not to be considered a main author
yeah reasonable
unrelated to the author thing, I did the changes you wanted btw
oh nvm I should remove the export
agreed, but also at the same time I propose something different
what is it
Just one small issue with that
Love me some [object Object]
we don't need something so specific
I know this is way too much work, but technically you could use the git history of the plugins folder to get all contributors, and then set some requirement at how many line changes it counts as author
Line counts are a terrible metric though
probably
Not stopping my 1-3 character changes from contrib 
has anyone ever had vesktop crash with this error before
console output:
❯ vesktop
[Vencord] Installed React Developer Tools
(node:16521) ExtensionLoadWarning: Warnings loading extension at /home/meyer/.config/vesktop/ExtensionCache/fmkadmapgofadopljbjfkapdkoienihi:
Manifest version 2 is deprecated, and support will be removed in 2024. See https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline for details.
(Use `electron --trace-warnings ...` to show where the warning was created)
[16521:0726/161043.779636:ERROR:atom_cache.cc(229)] Add chromium/from-privileged to kAtomsToCache
[16521:0726/161253.098815:ERROR:CONSOLE(2)] "Electron sandboxed_renderer.bundle.js script failed to run", source: node:electron/js2c/sandbox_bundle (2)
[16521:0726/161253.098846:ERROR:CONSOLE(2)] "TypeError: object null is not iterable (cannot read property Symbol(Symbol.iterator))", source: node:electron/js2c/sandbox_bundle (2)
^C^C
after this it freezes and needs to be killed
it's a bug with react developer tools being installed in electron
just doesnt affect everyone
managed to fix it by removing the extention
rm -rf ~/.config/Vencord/ExtensionCache/*
whats the point xd
isn't String.prototype.includes search any kind of occurrences of given ID? like let's say ID of 123456789012345 can be matched against 1123456789012345 or 1234567890123450 even the chance to trigger so is low?
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
🪦
Is it okay to ask Server and Channel white/blacklist as well?
I believe even I'm a No Reply Ping guy, there are a very few set of channels where I would prefer reply ping can be allowed.
Anyway, thanks for making a god's work.
snowflakes should always be the same length, and if it matches something that way it would be user error
Makes the "add reaction" buttons disappear when the limit for reactions (20) has already been reached
resolves: #1944
ports volume booster to web/vesktop
VERY ROUGH RN, will polish soon
I don't think so, snowflakes are growing very slowly. On my case, I have 1-digit lesser than nowadays snowflakes. Users around 2015 era tend to have 2 or more digit lesser than nowadays.
Tbh idk why nobody did this earlier.
It wasn’t even that hard, just an hour of looking at the debugger and setting breakpoints to find the right place to patch
your changes seem completely uncontroversial to me
almost nobody changes this, though it isn't a bad thing that this has ben changed
Both ways of doing this are fine, however both are less than ideal. User list API should be added for cases like these.
<sub>Before anyone tells me, yes I am aware I keep preaching this idea (see #2210 ) yet I have never actually made such an API or UI for it</sub>
@fossil inlet and @dusk blaze should kill explode me for this comment I think
before vee yells at me the witty comments are totally just a coping mechanism
FUCK I NEED TO FIX SPN
AGAIN
FUCKING DISCORD
I'm uncertain if removing quick react is a good idea; I am a chronic quick react user (to the point I use 2 plugins to improve that experience) and as such I would appreciate settings for each patch?
Also how about making the add reaction labels say something like "Add Reaction (reactions/20)"
works but idk if it really is 200% volume sounds like the "fix" you told me you made where it was 2x the volume it was supposed to be is actually what is intended
tl;dr: i think your fix broke it more
I'm uncertain if removing quick react is a good idea; I am a chronic quick react user (to the point I use 2 plugins to improve that experience) and as such I would appreciate settings for each patch?
Also how about making the add reaction labels say something like "Add Reaction (reactions/20)"
Yeah i honestly think this is better
good idea?
Yes
"appi" :D
:D
how can you use software in finnish
it aint that bad
it is that bad
Seemingly they added scrolling back to the popout so this also adds back dropdowns for permissionsviewer and reviewdb. Toggleable between the current buttons and these dropdowns
fix simplified profile notes
4
7
2
procrastinate
yeah its 1 fucking am
?remindme 14h fix spn, maybe
Alright @rugged spire, in 14 hours: fix spn, maybe
!remind 3hr look into this
Alright @fossil inlet, in 3 hours: look into this
Hey, how do I add this to my client?
Hey, how do I add this to my client?
Wait for it to be merged
Wait for it to be merged
In case it doesn't get merged, how do I add this to my client?
Wait for it to be merged
In case it doesn't get merged, how do I add this to my client?
Either:
- You don't.
or - You clone the fork and install vencord from it.
Wait for it to be merged
In case it doesn't get merged, how do I add this to my client?
I might release it as a user plugin while it waits to get merged
If you can't figure that out, then just wait.
No, fridge is the best icon
@fossil inlet, <t:1722096210:R>: look into this
@fossil inlet, <t:1722107034:R>: look into this
Content
As of build 667, the WebSocket API has gone public, and is now the recommended way for sending notifications.
WebSocket docs: https://xsoverlay.vercel.app/Developer/API/websockets/websockets
Reference: https://store.steampowered.com/news/app/1173510/view/7792991106417394332?l=german
Request Agreement
- [X] I have read the requirements for opening an issue above
oh thanks
i wasn't gonna do it until xiexe removed the udp stuff lol
bro i tried to go to files view and realized it's an issue and not a pr

oh so it doesnt even need native anymore
cause u can connect to WS in browser
Dynamically grabbing files from all these random github repos is incredibly insecure.
This isn't the best way to accomplish this goal by far, but it would be better fixed sooner rather than later.
My changes that stop hotlinking from cdns is controversial, it can safely be undone.
My editor changed some indentation in the areas with html, I can go back and fix that if needed
Oh, the test will fail because none of these uploaded files will be on main yet, if you want we can make a separate PR to push the uploaded files first.
grabbing pictures from other repos truly is so insecure
grabbing pictures from other repos truly is so insecure
there are 4 javascript files, 1 wasm file, and 1 zip file loaded as a chrome extension
and even then, images from single maintainer repos outside of the main vencord repo, could easily get changed to illegal content, which i consider insecure.
everything remotely fetched from Vencord is either from a trusted author or commit/version pinned which means impossible to modify
also you do realize you are calling assets from the owner of Vencord and other file types such as png and css insecure
everything remotely fetched from Vencord is either from a trusted author or commit/version pinned which means impossible to modify
also you do realize you are calling assets from the owner of Vencord and other file types such as png and css insecure
yes, pngs and css files can easily be changed to illegal content.
being a trusted author doesn't mean anything if it takes no authorization to change it, they could get hacked, go rogue, or get bribed.
being version pinned only mea...
and commit pinned files can still be modified by abusing git rebase
correct me if im wront, but isnt that the sha hash of the file not the git hash?
for example, the polyfill attack applied to version fixed versions of polyfill, and affected thousands of sites.
https://sansec.io/research/polyfill-supply-chain-attack
the mentality of "well I'm too small to get targeted with something like that" isn't good for a program with thousands of users, and it doesn't even have to be a direct target.
Unpkg and cdnjs are both trusted cdns and the versions are pinned meaning the library authors can't change the code. Fyi, cdnjs is owned by cloudflare, so if you don't trust cdnjs, you shouldn't be using Discord at all, because cloudflare can already run arbitrary code in Discord due to Discord using them as a cdn.
Images and Audios are inherently safe since they can't execute code.
All code files linked to github are pinned to long commit hash which means it's impossible for the author...
Correction: Cdnjs is not actually owned by cloudflare, but it is made by mostly cloudflare engineers so the same thing still applies.
Actually, you changed this from a long commit hash link (immutable) to a main branch link (can be replaced by us at any time)
Thus you changed this from fully safe to remote code execution...
it can only be rce if you have no main branch protection, which is also bad. I can't make it a commit hash link without it already being in the repo, this was intended to be modified before merged.
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
Unpkg and cdnjs are both trusted cdns and the versions are pinned meaning the library authors can't change the code. Fyi, cdnjs is owned by cloudflare, so if you don't trust cdnjs, you shouldn't be using Discord at all, because cloudflare can already run arbitrary code in Discord due to Discord using them as a cdn.
Images and Audios are inherently safe since they can't execute code.
All code files linked to github are pinned to long commit hash which means it's impossible for ...
name checks out
I mean, they're persistent, I'll give em that
usually leads to a ban from the repository, but yep
!! the glowies are gonna hack vee and ruin my vencord!!
it doesn't really make much sense to me though theres a lot better icons like a xbox one for example
the icon IS an xbox one, they are jokingly calling it a fridge.
it doesn't really make much sense to me though theres a lot better icons like a xbox one for example
the icon IS an xbox one, they are jokingly calling it a fridge.
nuh uh it is fridge... gamin fridge
uwu
it doesn't really make much sense to me though theres a lot better icons like a xbox one for example
the icon IS an xbox one, they are jokingly calling it a fridge.
NUH UH ITS A FRIDGE
it doesn't really make much sense to me though theres a lot better icons like a xbox one for example
the icon IS an xbox one, they are jokingly calling it a fridge.
NUH UH ITS A FRIDGE
the fridge icon looks stupid idk where this is going but it should look like a xbox one imo
something like this
but more simple probably
the fridge icon looks stupid idk where this is going but it should look like a xbox one imo :
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
**__ImageZoom (errored):__**
ID: `124347`
Match: ```
/placeholderVersion:\i,/
Error: ```
Invalid destructuring assignment target
**__PictureInPicture (had no effect):__**
ID: `546432`
Match: ```
/\.nonMediaMosaicItem\]:!(\i).{0,10}children:\[(\S)/
FriendsSince (had no effect):
ID: 926150
Match: ```
/BOT_PROFILE_CREATED_ON,.{0,100}userId:(\i.id)})})/
**__ShowHiddenChannels (found no module):__**
ID: `-`
Match: ```
+1]})},"overflow"))
SpotifyControls (found no module):
ID: -
Match: ```
"AccountConnected"
findByCode("type:\"UNSYNCED_USER_SETTINGS_UPDATE\",settings:{useSystemTheme:\"system\"===")
findStore("SummaryStore")
None
None
ignore this one
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
**__ImageZoom (errored):__**
ID: `124347`
Match: ```
/placeholderVersion:\i,/
Error: ```
Invalid destructuring assignment target
**__PictureInPicture (had no effect):__**
ID: `546432`
Match: ```
/\.nonMediaMosaicItem\]:!(\i).{0,10}children:\[(\S)/
FriendsSince (had no effect):
ID: 926150
Match: ```
/BOT_PROFILE_CREATED_ON,.{0,100}userId:(\i.id)})})/
**__ShowHiddenChannels (found no module):__**
ID: `-`
Match: ```
+1]})},"overflow"))
SpotifyControls (found no module):
ID: -
Match: ```
"AccountConnected"
findByCode("type:\"UNSYNCED_USER_SETTINGS_UPDATE\",settings:{useSystemTheme:\"system\"===")
findStore("SummaryStore")
None
None
@rugged spire, <t:1722087252:R>: fix spn, maybe
oh ok… got scare for a second
bro scared me
same

discord bouta push stuff to recreate that

why bro's pr is closed :frowning_face:
why bro's pr is closed ☹️
Because this solves a non-issue and makes an ugly mess of files. Even as someone who thinks hotlinking is a bad idea in Vencord, it doesn't even fix certain hotlinks that bothered me, and of those that it does fix, it does them in such a messy way (you do not need commit hashes in the filesystem like that) that I'm not surprised that this was closed
maybe
fine
one part fixed
other part fixed
I have tried to install Vencord on my MacBook Pro multiple times. Regardless of what I seem to do, it doesn't show up in my settings. Does anyone have a solution for this problem?
Okay, since I can already foresee this going on for ages, I'm just going to lock it with the final statements:
- This PR solves nothing, really, and would be immediately superseded by #2707 anyway.
- The image assets that Vencord fetches are, once again, immutable and cannot be replaced, simply removed.
- As Vee already said, cdnjs is used by Discord themselves so if a supply chain attacked occurred there would be much bigger issues. Same with unpkg.
- Loads of your hotlinks now link to `...

real
lovely response @turbid hatch
ty
Regarding that hotpink css debugging mode mentioned a few days ago — anyone else noticed that the -hsl variables all have invalid syntax? They're set to 330 100 71% when it should be 330 100% 71%
wha?
If you force load all webpack chunks everything becomes hotpink
FIRE
why does discord bundle that with the main release
Who knows
10/10 Design
Why is it triggered by simply loading a chunk rather than say, a css class
Love the [server] tag
@swift fjord @dapper tiger @fiery jungle BACKPORT NOW
polls uhh semi work 😭
cause more efficient

Has anyone looked into venmic implementation for macos, to get screenshare audio in vesktop.
you just need to use screen capture kit
I think
but also there's some issue or pr about this
note: Discord Desktop supports screen capture kit since late last year afaik
least hacked in debug option
I just read the google doc and kinda laughed
because even if the moyai.mp3 was on the vencord repo
I could still just change it

hop on normal pyoncord
the what
Identifying Critical Weaknesses and Risks in the Vencord Discord Client Mod A Dive into Potential Security Concerns, Vulnerabilities (Supply Chain/RCE), Management Challenges, Communication Failures, and Code Quality Issues Publish Date - 27/07/2024 (July 27th 2024) Authored by Laythe (TheCrazy...
lmao
its so bad
I'm still on vendetta
been talking a bit about it in #🌺-regulars
Hasn't broken yet so why switch
they're making a mountain out of a mole hill
LMAO
please tell me this was written by AI
I refuse to believe people that retarded actually exist
It's not AI
(i think)
fully real
LMAOOO @limber skiff did u see this
can't believe you'd merge code with a deliberate security hole flagged by github 😔
bad maintainer
how dare project maintainers merge code without asking others to review it
that point was so funny
imagine telling Linus Torvalds that it's unfair bias that he can make changes to Linux code without asking others for approval

it's illegal to force commit ykk
thank god they didn't pay attention to the commit messages of our branches
just like us
I didn't see about that
no idea I never touched that section
lmaooo
We are working on a document on how to migrate to better discord as a Vencord user for the time being
never used BD but aren't all plugins community-maintained or something? 🤔
We are working on a document on how to migrate to better discord as a Vencord user for the time being (contrary to popular belief, it really isn’t slower) and will be porting the Vencord plugins with no good alternatives to better discord.
(I personally did a quick look at better discord’s code, while it’s not great there were no major issues to write home about)
if you cared enough to make this 22 page document on vencord about how insecure it is you definitely would have realized how much worse bd is security wise
still open from 4 years ago
BD also seems like a huge pain to write plugins for
betterdiscord contains a sandbox escape by design, which means that any code inside the browser sandbox can escape to the host and do anything on your system
this means that any plugin could technically do anything on your system, and if discord has an XSS it could much worsen the impact
this guy is about to suggest migrating to replugged next
Consider how hard it is to read bd plugins
it's fine, the average BD plugin dev is just awful at coding
consider that most bd users just decide to install plugins without looking into them too much which is just waiting for a token grabber
this is mostly outdated
the only point that still applies is the CSP
which vencord is also partially guilty of
probably yeah
ive been meaning to make csp more strict than it currently is
but you will always get user complaints
"buah I can't load my favourite font from http://totallynotavirus.ga/malware.ttf anymore"
as long as you don't patch the exploit im using
contrary to popular belief, it really isn't slower
My old laptop begs to differ
in hindsight I wonder why all mods used to be so insecure
there's no reason to enable node integration or disable context isolation
yet all mods did it
It sounds good on paper that mods are more powerful
the only reason is so you can use nodejs stuff in the browser but like just use ipc
probably one mod did and the rest went along with it
vencord has full nodejs capabilities via easy ipc
and is secure
meanwhile betterdiscord still exposes a shit ton of nodejs apis to the browser which enables sandbox escapes
really there's no reason a mod should have that
native.ts is peak
she doesn't know
The native.ts approach only works with statically loaded plugins, no?
So it wouldn't work on bd
i remember a long time ago if we'd load all discordrn modules the timestamps would become hindi 
not necessarily
it can also be done dynamically at runtime
not hard
most of vencord's native.ts logic is at runtime
I'll admit that I haven't looked into how it works, since it doesn't work in userscript anyway
really all it is is:
- send
vencordPlugins.MyPlugin.myFuncNameevent from browser to main - look up
MyPluginin the plugin object - invoke its
myFuncNamemethod - return the result
Some conversation happened on Discord after I posted the Badge Simulator :tm: above (which is just a big HTML page that gives a preview of all non-square donor badges with object-fit: cover and object-fit: contain), and the takeaway is: most badges aren't affected that much, a few look a lot worse, a few look a lot better.
I think the right move would be to close this PR and let people reach out to fix their badges if they don't like how it fits, to replace it with an image that is ac...
could easily implement this in bd too
but they would have to change the plugin format
single format won't cut it
@scenic fog usually I check that badges look alright and if not i resize them but sometimes I forget
I checked yours too but it looked alright to me (on dark theme)
but it being modifiable at runtime means the issue is present again since you can create the logic you want and escape the context isolation
I have no idea why it looks so much worse on light theme lmao, but yes of course you can change it to a better cropped one
nah
not if you give no control to renderer
you only trust the main process
since this allows the browser to change the folder vencord is loaded from to anything, you could abuse it
but it's hard to abuse because you would first need to somehow manage to deploy a malicious vencord install on the host and know the location of it. not really possible on vencord because there are no filesystem apis exposed
it's still a sandbox escape though technically so I wanted to fix it
on BetterDiscord it's much more severe because it allows you to write any file on the host
and also exposes an api that lets you open file:// urls
so you can write an executable then open it
or you can overwrite some discord file and it'll be run on next launch
or even patch other programs to deploy a virus
replugged also had a sandbox escape some time ago in their updater cause it allowed the renderer to replace replugged.asar with any asar
i reported it to them and they fixed it I think
elaborate whats wrong with current csp?
you could require hashes ?
like what the html integrity attr on link and script tags, idk if that is csp enforcable tho
isnt there no way to load hotload script tags in vencord at this point
patch helper eval is locked to dev build
It does raise the volume but it doesnt seem to be ex: 500% louder.
also it basically functions as a fake deafen at the moment.,...
It does raise the volume but it doesnt seem to be ex: 500% louder.
yeah this was my experience too
also it basically functions as a fake deafen at the moment.,...
we cannot ship that, theres a good reason why fake deafen is explicitly not a feature, regardless of that I think I'd still like to have a "I want my friends to be quiet for a bit" button
Fake deafen refers to the exact opposite
where it says you're deafened but you can still hear
Exactly
i would assume that gain is just set to 0 on web clients when deafened or something like that 

this makes the plugin a "limited" client because of the origin not being localhost anymore, but it doesn't matter as limited clients
can still send notifications just fine
fixes #2734
you should make this a top level function. that way you don't have to define a variable for your plugin and can instead just call the method directly
won't this spam reconnect attempts if the user doesn't have XSOverlay open? I don't think a retry is a good idea.
Why not just check websocket state & try to start if necessary on demand, whenever a notification is supposed to be sent?
what exactly is being caught here? it doesn't seem like any error could occur in the code contained in it
won't this just discard this event?
it might take some time for the websocket connection to open, which will cause this to fail:
start();
socket.send(...)
You can solve that by making this function return a Promise that resolves once a connection has been opened:
socket = new WebSocket(`ws://127.0.0.1:${settings.store.webSocketPort ?? 42070}/?client=Vencord`);
return new Promise<void>((resolve, reject) => {
socket.onopen = resolve;
socket.onerror = reject;
setTimeout(...
also it basically functions as a fake deafen at the moment.,...
somehow I didn't notice this, thanks!
typed a paragraph just to remember that patch groups exist
ppl keep doing it and it keeps doing the same thing
PSA: DONT RENAME YOUR DAMN BRANCHES PLEASE
my bad lulz
i fixed it
i hate git!!
real
I hate git can we just file upload everything and have no versioning
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
fr
just put all the code in a huge docx file
Entire codebase is now vencord.zip hosted on catbox
If you want to """pull""" """request""" you have to send a zip bomb file with your changes to vee
nah, megaup
vencord1.25.2.zip
vencord1.25.2-new.zip
vencord1.25.2-new-new.zip
vencord1.25.2-real-one.zip
nuh zippyshare
adds a copy preset hash button to each decor preset
theres probably far better ways to do this LMAO but this works 👍
vouching for this, the management bot for decor is currently broken and the only way to get the hash of a preset to modify them currently is through the api, and this would help alot
made the default list way better
idk if https://lite.duckduckgo.com should be there tho
oki
added youtube instead of ddg lite
Alphabetical order when 
This Plugins decodes the base64 links in the client itself, It has a dedicated UI button on the ChatButtons and Open a separate Modal window to display the decoded base64 string.
for your next plugins, add yourself to the Devs object instead of putting the author inline
this can easily be done with a user app, i doubt this will be merged
don't add yourself to devs for minor changes
authors: [Devs.Moxxie, Devs.Ethan],
same as below
i feel like using the toast API might be better for that
Toasts.show({
id: Toasts.genId(),
message,
type: Toasts.Type
});
suggestion
I have resolved the Devs object issue in the new commit.
this can easily be done with a user app, i doubt this will be merged
But it will more useful as a plugin in vencord, because this operates only on the client side and has nothing to do with discord.
Whereas if its an user app or a bot, Discord will be able to see what is being shared and decoded. And the reason why someone encode such stuff, There is a reason they dont want discord to be able to see that stuff.
bro thinks base64 is private 
it's not private either way, anyone can easily decode it
But its not directly under discord surveillance. Thats what it achieves.
lol
honestly if you want privacy in discord, you are better off using a different platform, its way too niche
😭
Discord can already decode it as soon as you send the message
If it was AES or whatever it would be something
(still very in secure considering you need to put some default password)
i don't think that you have understood that for you to even get the b64 message to decrypt
you...
need to make it go through discord servers
this plugin isn't achieving anything
this is
a) not useful
b) a duplicate
c) better done via a bot
d) base64 achieves nothing for privacy. use an end to end encrypted messenger like signal, matrix, xmpp, etc
bc its a custom thing for github
bet forgejo can do this 1000x better
i mean all it does is add a button to commit the change
Thinking about PRing my MessageLinkTooltip, but the existence of MessageLinkEmbeds makes that kinda awkward. They're similar enough in functionality that it's silly to have both, but have very little in common in implementation, so merging them into one feels weird. Thoughts?
@dusk blaze fun fact /?q= isnt actually needed to make a sreach on DuckDuck its unneeded filler
I’m saying this because you should submit the removal of that
the ?ia=web it’s just something that they add after the fact
why not do it yourself
I’m not going to be at my computer until late today and I don’t know how on phone
forgejo doesnt have suggestions
true
they should be merged
just noticed
you can rework this setting
display style
or smth like that
but have very little in common in implementation
how?
/?q= isnt actually needed to make a search on duckduckgo its unneeded filler
(ignore the ?ai=web duckduckgo added that after the fact)
Probably was a better way to do that, but
its also just something that duckduckgo will add themselves if/when its need
the photo in question
I'm pretty sure I had a very good reason to implement fetching the message in a different way
But I don't remember what, so I guess I'll see what happens if I just use the existing fetcher
Added a setting which allows the user to disable link embedding for their masked pastes by wrapping the link inbetween the <> symbols
Looked into the Tooltip&Embed merge a bit more, and my conclusion is that it would get very messy, with bad code and poor ux.
- The settings don't make much sense
- Using tooltip makes rich/automod choice quite redundant. Adding tooltip as a fourth choice would be one solution, but having three choices for three very similar options and one for something very different is unsatisfying
- Background color is meaningless; it will have tooltip background
- Black/whitelist isn't entirely nonsensical, but not very useful since you're already actively choosing to trigger it by hovering
- In embed mode it uses accessory api, while tooltip requires a patch. Is there any way to make a select setting require restart only on certain choices?
- Rendering is almost entirely different between the two cases. Pretty much the only common code between the modes is the webpack finds for ChannelMessage and MessageDisplayCompact.
- Message fetching logic also differs greatly
- In embed mode, it uses a Queue to load all linked messages as fast as possible without spamming discord's servers.
- It also caches results, but since MessageStore also stores the fetched messages this mainly seems to store load failures
- In tooltip mode, we only want to load one message at a time, and we want that one to load as fast as possible
- Sure, it's possible to have 50 message links and slide the mouse over them quickly, but is that edge case worth optimizing?
- Caching failures doesn't seem useful here, and imo leads to a worse user experience. Load failure? Move the mouse off and try again
- Tooltip mode also requires a loading spinner, which I don't know if it's easy to implement with the queue approach
- In embed mode, it uses a Queue to load all linked messages as fast as possible without spamming discord's servers.
So merging them would basically turn it into two different plugins under one name, with conflicting settings and vanishingly little common code. That's not something I'm willing to do as I don't like writing bad code.
It would be two plugins under one name, sharing almost no code
the fetching is already a plain function (iirc, if not, just reactor it) so it shouldn't take much to skip the queue
why do rendering differences matter? Just make two components
how is it two plugins
it's the same thing
displaying linked messages inline
Two plugins with similar purpose, yes, but different and incompatible both design and implementation
it's not incompatible tho
tbh just allow having both options on at once
make it separate options
both enabled by default
there's not really any downside from having both options at once
and just make the hover part ignore the blacklist
should be intuitive
Yeah fair
What's the updateMessage thing for btw, rerendering the message once it's fetched?
yes it's written in the documentation of it
yes
embeds added
need to rerender
Seems weird to rerender the whole message because an embed finished loading
wha
it's how discord does it
it's the same as when someone edits a message
yep, and it doesn't matter honestly
remember how a context menu is fully re rendered on every button hover
I get that it doesn't matter, but it still seems weird
this is actually so weird
The embed ought to only rerender itself, not its parent
Probably easier to get submenus working that way I assume
And it's not like rerendering is always recursive, if it returns a similar enough component react will just reuse the previous dom
it's still hella expensive
hover over buttons over and over and watch your cpu usage go up
Yeah not disputing that point
but the embed doesn't exist yet?
it's adding embeds to the message
and it's hard to so specifically rerender something
then discord has to diff the messages and figure out what changed
It can add a component that initially renders as empty
it's way easier to just rerender the whole message
And then useState or whatever to update once loaded
that doesn't work
the parent component is memo'd
it doesn't really work like that in a tree model
you're basically proposing they use a retained rendering model
which isn't how react works
/shrug Always worked that way for me
they use memos so if only the embeds change, only the embed component is rerendered
Yes
how? you'd need to store your hooks in a global map or abuse a context provider
both are bad
Which is a component like any other, and can rerender itself once the data it needs is available
but the data is passed down from parent
you have to rerender the parent that manages the data
unless you propose every embed component should add its own subscriptions
The MessageEmbedAccessory parses out the embeds, fetches the data for each mentioned message, and rerenders the parent message. What I'm proposing is that it creates a child for each of those message mentions, and that child uses some nice useState or useStateFromStores or whatever to rerender once the message is fetched
But it's not like it's particularly important anyway
it's fineee the way it is
not like the updateMessage function was made just for that anyways
!remind 20h use this for OpenInApp https://www.electronjs.org/docs/latest/api/protocol#protocolisprotocolhandledscheme
Register a custom protocol and intercept existing protocol requests.
Alright @austere talon, in 20 hours: use this for OpenInApp https://www.electronjs.org/docs/latest/api/protocol#protocolisprotocolhandledscheme
Register a custom protocol and intercept existing protocol requests.

its kinda bad currently that it might make links just not openeable if you have no handler
like trying to open steam link without steam installed
it will open steam:// and cancel the https:// and then ur system is like nah bro we don't have a steam:// handler so the link isn't opened at all
possible to add a context menu to open normally?
i hope that works systemwide and not just for the own app
there is no good way of detecting if an app is installed so it's the other solution
not really without extra effort
check the link 😭
wait don't tell me it does that lmao
😭
i see
I thought you were mentioning the issue would still happen
noooo
nooooo
what's left for asar installer
the update issues u had on windows
did ur parents take it away or smth
"get it back" made it sound like it was taken away from you ahahhaha
true true
What it says on the tin. Merged/rewritten from my MessageLinkTooltip plugin, as well as implementing https://github.com/Vencord/plugin-requests/issues/961.
ig I should make getUserSetting not type the return as nullable
not the first case I see someone using ! after calling it
Just throw something if it fails ig
yep
Anything else stopping it from getting merged?
welll how should a plugin handle it
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
Setting?.useSetting()
i can almost certainly promise if you put .+? or another quantifier after every , in currentUser:\i,guild:\i, it will magically fix itself
It won't
Current user isn't in that find anymore
Doesn't seem to be working for me too on Windows
Looks like I messed something up and the type checker is failing
hey where is the plugin?
on the feat branch
hey where is the plugin?
It not done
@austere talon, <t:1722285139:R>: use this for OpenInApp https://www.electronjs.org/docs/latest/api/protocol#protocolisprotocolhandledscheme
Register a custom protocol and intercept existing protocol requests.
nop
never
Adds opening Apple Music links (https://music.apple.com) in iTunes. Technically this works with any Apple URL, though a lot of them crash the app, so I decided its best to only support Apple Music for now.
The same URL schema does work on Cider aswell, but due to upcoming (breaking) changes I've decided to wait on supporting Cider:
imo cider should support the apple:// protocol
or whatever protocol Apple uses
I would assume that most cider users only have cider and not the normal apple music app
Yeah thats true, but kinda like
i tested the cider protocol
and it doesnt really work
in the sense of when its loading and you click on a link it just.. copy pastes your clipboard into the message box..?
Also at this point I think the plugin should be rewritten in some way to avoid the repetitive logic
im gonna do that then 
well id add an object to store all the info for each link (the regex, description, protocol/customHandler (for weird urls i guess)) then auto generate plugin settings and ofc use it in the handleLink function, or do you have something different in mind?
amazing :3
protocol/customHandler
well besides this

oh?
i'd just do like
spotify: {
match: /https://..../,
replace: "spotify://$1/$2"
}
via regex groups
either that or
spotify: {
matcher: /https:\/\/..../,
formatUrl: (match, group1, group2) => `spotify://${group1}/${group2}`
}
second is proably better

ik!! just saying... >:3
50 million split statements on top
Refactors the code of the plugin to make it easier to add new apps.
Adds Apple Music via iTunes support.
is this [a-z]{2} for locale matching? is it guaranteed that part is always present?
Either remove this console.log or use a dedicated Logger (from @vencord/utils)
no need for a loop here :P
const rule = urlReplacementRules[platformType];
if (rule?.accountViewReplace && pluginSettings.store[platformType]) {
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
None
None
None
ShowConnections (had no effect):
ID: 958120
Match: ```
/currentUser:\i,guild:\i,onOpenProfile:.+?})(?=])(?<=user:(\i),bio:null==(\i)?.+?)/
**__MessagePopoverAPI (errored):__**
ID: `773176`
Match: ```
/\i&&!\i\?\(0,\i\.jsxs?\)\(.{0,200}renderEmojiPicker:.{0,500}\?(\i)\(\{key:"reply-other"/
Error: ```
Could not find message variable
None
None
None
Forgot to remove the console.log.... its so over
Im not sure to be honest, from all the links I've gotten from iTunes/Apple Music and tested they've included the locale. But then again, without passing locale iTunes either crashes or errors. There are also no locale problems as iTunes translates the page again (i.e. using de as the locale on an English device also displays the page in English) so I see no issue using us in the replace here. Anyway just to be safe I'll update the match to have the locale optional.
this makes GifPaste have two selectable behaviors from the settings modal:
- insert the gif into the input box
- instantly send the gif
you can select between the two behaviors, and this PR adds another setting which handily allows you to use the alternate behavior when the shift key is held down.
in essence, if your behavior is set to "Insert link into the chatbox", you can now hold shift to instantly send a gif. (similar to skipping a modal)
conversely, if your behavior is set ...
dont mind me i am testing smth

trying to figure out the requirements for getting free copilot from being maintainer
dless of the ping toggle
if always ping. why ping toggle..
Aren't you referring to this, which already exists?
Also, all you have done is rename the variables it seems, and add yourself as a contributor. Making this a pointless PR.
Mind showing what changes this does?
Wait, sorry if I'm wrong, but, doesn't #1975 supersede this?
From what i can tell, that plugin modifies the actual message component to look like it mentioned you (i might be wrong)
it actually mentions you
i really like the idea but genuinely have no idea how to download this
51ae019 feat(plugins/openInApp) Refactor code and add A... - surgedevs
we should replace this vendicated fella with shiggybot
way better...
actually merges prs

rip popover api
Whose blood?
We don't speak of them anymore
rip @pine topaz 🪦
How is that motherfucker still alive
mommy always said i was special



