Guilded.gg is (a bit) broken… 

Update: So, a lot has transpired in the last 2 days. A Guilded staff member claimed that these vulnerabilities were never reported, causing a fair chunk of backlash and drama. No biggie because I was already shown that multiple disclosure attempts were made and acknowledged. 24 hours later, Guilded responds in their partner server stating that "for some unknown reason, the reports were closed before it ever reached the team". Now this could be because Guilded's hackerone program is through Roblox and there is miscommunication, but I don't have a solid answer. However, they said they were diving into old closed bug reports to ensure that they were actually fixed. And I can confirm this as I received reports of old tickets opening back up. So overall, mixed response from Guilded. I'm glad they are getting their platform fixed and making sure their bug program is operational. But I wish I didn't have to kick them in the butt to do this in the first place. Original post: Fun little facts for the nerds + comments about disclosure Three years ago, Guilded had a thing where you could view every server that a guilded user was in when you visited their profile (not good obviously because that means you could see people's personal server with friends). There was a reddit post about it here: www.reddit.com/r/guilded/comments/hkhsev/comment/fxgipdk/ Guilded made a fix to remove that stuff from the client. You couldn't click on someone's profile and stalk them. Now, that was three years ago. However between then and A MONTH AGO, you could still get all that information through the API (the comment I linked to stated that). So for three years you could just stalk someone on Guilded. (Thank you amia for letting me know about this) Regarding disclosure, Guilded was made aware of these issues months and months ago, yet nothing happened. Considering the previous thing took a solid 3 years to fix (and some of these exploits were being abused in the wild), giving Guilded a swift kick in the butt was in my eyes a good option. I know some of yall might be upset, but nothing makes me happier than a Guilded skid getting mad at me for "revealing" his method.

We need to remember though that competition to Discord is good and healthy. I hope they can put the issues aside and live up to Discord

Tried out Guilded with some mates, and it was alright, nothing too crazy. But gotta say, the app has a couple of quirks. We ran into some audio glitches, video stream bugs, and a few other hiccups that still need fixing. Also, there were some features that didn't really click with us, like the Voice Channel and the Streaming Channel, that were seperated. Didn't see the point, you know? Not that we're big fans of Discord, but when it comes to stability, Guilded's got some work to do. Just wish that the Devs, update the Core feature more frequently since at one point it got quite annoying.

guilded is such a good idea, but so badly implemented

A naked man fears no pickpocket.

Guilded barely worked properly in the first place, so this is probably going to be the nail in the coffin for it to not be chosen by people looking for Discord alternatives.

I love the responsible disclosure of making a youtube video about it

Some time ago I reported an issue to Guilded staff that allowed you to bypass all server side checks regarding messages - you could essentially post messages from someone's account without them ever knowing. Not only that, you could post them in any existing channel (including private dms), and even send system messages (such as those that you see when editing a thread). It took them OVER A YEAR to even acknowledge this issue, and even now I'm pretty sure it partially works. I have no idea what their priorities are but clearly it's not user safety.

And that, ladies and gentlemen, is why you validate user input on the server side, not in the client.

I rememeber seeing Guilded and it was during the time when Discord was fiddling with NFTs. I was excited at first cuz I love a lot of the features Guilded has! Free unlimited Emojis, animated pfp and banners, gradients on usernames, whispering, lots of cool stuff!! But it was just lacking in BASIC features. Streaming didn't work, might still not. The mobile app to this day still doesn't have a voice sensitivity option. Basically unusable for my friend who would constantly stutter unless using push to talk. And honestly, I really need my music bots.

The crash is probably because the API has a max request limit, which means that there is a fixed number of requests per unit of time for all Users.

I like how Roblox says it's "safe"

Neat, just a few days ago I was talking with some friends about guilded and wondered if you ever make another video about it. Didn't expect that outcome though.

Thanks for this coverage, I was very recently checking this platform out and we just couldnt stop running into issues

Thank you for the Mercfleet tip that I will likely forget about in a few days.

that reloading tip just changed gaming for me forever holy shit

reminder that while competition to discord is (mostly) good, guilded is still owned by roblox corporation. their whole business strategy is literal child labor that isn't regulated yet

releasing that code sounds like a good idea, perfect to expedite the bug fixing :)

gill issue?

Guilded - when you need the ILLUSION of golden security details

Guilded (nor its staff) we're aware of these issues. (Source: Jared, Guilded staff member)

when you remember that roblox has data breaches, you aren't surprised that guilded is broken

the crasher reminds me of the old Xfire crippler that would crash peoples clients just by spamming messages and also take down people livestreaming on it.

6:18 this makes me think about matrix/element. You can't delete, just kick everyone and leave

Love how Discord is self-aware enough to have "nonce" as a message ID.

Yo, they didnt patch the malformed stuff? I remember finding that years ago

These guilded servers seem to be very trashy if they cannot block a singular computer from overloading the servers. I have made servers at one time and they were more stable than what guilded offers. Very interesting video!❤

Did they already Hotpatch the expiolts? trying the forcing ownership on a server i made with a ALt. And i can't seem to get the api request to be accepted

Its really sad, that a skid with a laptop or phone, can just be like, oops, and crash an ENTIRE PLATFORM

HAVE A GOOD DAY EVERYONE

More Discord news, yay!

is there somthing like discord that me and my friends can use since discord vc doesnt work in my country and also not guilded

That script sends a dos or ddos attack to guilded’s backend which is probably weak since they thought it was hidden right?

This is the only time I have heard of Guilded.

dude makes a once in a blue moon video about guilded and casually shows that he can crash/slow down the entire API with a single computer

You better not get taken down for sharing the Crash metod since, uhh.. for the first time I ever hear about this guilded and haven't read the TOS yet 🤓☝

The script NTTS showed at the end most likely just rate limited him, which means your IP is temporarily blocked from sending data to a website so it can prevent a DDOS. I dont have the script and havent tested it so this is just a guess.

i love guilded!!!!

Can a video about IRC integration into discord be a thing? The only real way a discord alternative can thrive is if there is some level of cross-communication.

That's wild, If I were a evil person I could possibly post IP grabbers and stuff in my own server and then using the transfer ownership API to brute force through everyone's User ID and then everyone gets IP logged 😭😭

I like the "(A bit) broken" title, ha, and so i though when i watch the vid.

How much did discord pay you😭

I used it exactly once for the Roblox bundle.

7:35 this is a spiffing brit video title

i forgot this existed

I'm actively looking for a a Discord alternative for my friend group but this being owned by Roblox to begin with immediately wrote it off.

2:55 Robot NTTS who fails to do the captcha :/

I think the last one could already be described as a DoS. And that's not really legal

3:25 How did you get this code/script?

Thats pretty dangerous that you can grab an IP deffenietly NEEDS to be fixed!

Wait, if videos can load any URL, could it load javascript: URLs?

*oh no*

Even with all this, if they had built-in polls I would switch in a heartbeat.

(7:45) That would be 13 Dec 2023 20:59 UTC in normal terms and 2023-12-13T20:59Z in ISO 8601

As a developer, AAAAAAAAAAAAAAAAAAAAAA

how to unlink guilded to your roblox group?

bro is working for discord 💀💀💀💀💀💀

i guess the crasher is a loop that signals the api hard. and therefore it gets overflowed(ddosed) so that the api cant give anyone the necesary data for your browser/app to load

I saw you in Event Stage on Discord Dev Server 😁

Guilded forces me to Log In to X in Guilded app, even tho i already have the X app. But when I successfully logged into X in the Guilded app, I can't return back to the Guilded app. wtf am i supposed to do

where are these exploits shared? 1:01

guilded tells me my email (that ive been using for 18 years) is invalid?

Which Browser You Use?

whats the point of guilded?

anybody know how the crasher was done yet?

why kingcobra lmao, at least it wasnt goblin boy cyrax

why does the message object have a prop called nonce 😭😭😭

gotta question the legality of showing all of this lmao

Never even heard of this one

what was the point of guilded to begin with?

is it a DOS (denial of service)

Ever heard of responsible disclosure?

Before 1 hour / Before 1K Views GANG

I wish Guilded had more members :c

Hey you forgot to mention that matrix is the best discord alternative we currently have

i like cheese

les gooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

6:23 always record yourself committing crimes and then post them on youtube

please dont tell santa

1:04 This reminds me of something...

If guilded fixes problems that caused this needing to be escalated into a public call-out, and adds a light mode, I'll probably try switching to it as my platform.. although, moving my friends there is unlikely.

I believed in Guilded because they gave us global emotes for free when Discord removed and paywalled them T_T but then they got bought by Roblox and now this...

Did some research and it took me ~1h to make a similar script. It's really not that hard

“All 5 of them” YOU FORGOT ABOUT GUILDTALE

It genuinely blows my mind how there isn't a single good competitor to Discord yet, especially considering how bad Discord is itself

Great heavens

I have a guilded exploit that will crash an entire channel similarly to that last showcased js script, but it's one channel at a time, but the crash is persistent, and cannot be fixed by the user, and isn't a constantly running script I reported this to guilded and they denied the report!

Never tought Guilded would be this broken ☠☠

hello no text to speech :)) (edit): pls respond

not surprised it's a glitchy mess considering it's owned by roblox.

Why would someone use guilded instead of matrix or revolt

the fastest RU-vid has recommended me your video after its been uploaded-

I'm more of a Postman man myself rather than Insomnia.

Roblox gotta have mods working on guildid too

im here

It has better features than discord but nobody uses it

Giggity

Its so sad we cant have nice things. No matter what we get something and there is always that one person that chooses to ruin people because "fun"

are you sure you didn't just ratelimit yourself

Just hope to God if you are a developer this guy doesn't cross your app xD