Security Working Group meeting - Wednesday October 12

[James Bottomley]

On Mon, 2022-11-21 at 07:19 -0600, Patrick Williams wrote:
> On Fri, Nov 18, 2022 at 08:00:25AM -0500, James Bottomley wrote:
> 
> > I thought I should note here that I can't join this meeting because
> > I
> > can't get a discord account.  I'm not sure it's a huge loss because
> > I'm
> > only advising on the TPM pieces of the current IBM Research OpenBMC
> > effort, but I mention it just in case this problem is excluding
> > anyone
> > else from the meetings and because it is a discriminatory decision
> > of a
> > proprietary platform which is impeding collaboration.
> > 
> > When I try to sign up for a discord account it insists on a phone
> > number verification (OK, annoying, but lots of other proprietary
> > silos
> > do this as well, so not unusual).  My problem is it won't accept
> > any of
> > the phone numbers I possess because they're all VOIP ones (I
> > switched
> > to using VOIP for my phones [both mobile and land line] decades ago
> > because I've got family in several countries around the world and
> > have
> > moved around as well so keeping all my numbers and in-country local
> > ones for family was a trick only VOIP could do in the early days). 
> > There appears to be no basis for discord's discrimination against
> > VOIP
> > other than the company running the silo also provides VOIP services
> > and
> > presumably doesn't like the competition.  Now I could go out and
> > buy a
> > non-VOIP SIM chip for my mobile just for this, but these are hoops
> > I
> > shouldn't have to be forced to jump through to participate in an
> > open
> > source project.
> 
> Hello James,
> 
> It is unfortunate you are having issues.  It isn't our intention to
> block anyone and this is the first time I've heard this complaint
> (regarding phone number activation).  There is a setting our Discord
> servers that can be used to block people who do not have phone
> activation, but I do not have that enabled.  The anti-spam setting I
> have enabled is:
>    - "Medium" :
>       * Require verified email address.
>       * Must be registered for 5 minutes.

Right, but if I follow the instructions below, I'm not registering with
your servers, I'm redirected to the main discord.com site.

> The only one that requires a verified phone number is "Highest".
> 
> To test out what you are describing I did the following:
> 
>    - Navigated to our invite link under Incognito (to avoid Discord
>      seeing my normal login):
>          https://discord.openbmc.org (or)
>          https://discord.gg/69Km47zH98
> 
>    - Clicked "Register".  Filled out "myemail+burner at gmail.com", a
>      username, password, and an arbitrary date of birth that is more
>      than 18 years old.
> 
>    - Dealt with the captchas.

Actually, no, this doesn't work either.  It brings me to the same
account creation screen on discord.com and then demands phone number
verification again.

> At this point I could see the OpenBMC server but not post anything.
> There was a message that I needed to verify my email.  I went to
> gmail and opened the email link in the same incognito session and
> then refreshed the Discord tab.  Then it gave a message that I needed
> to wait 5 minutes after registering and proceeded with a count down. 
> After 5 minutes I was able to both post and join the meeting
> channels.
> 
> Please give this a try and feel free to reach out directly if you are
> still running into issues.

I've no idea why this doesn't work for me.  I suppose it could be
source IP address (I am on comcast cable and discord.com seems to be
IPv4 only).

Regards,

James

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20221121/1a0e9983/attachment.sig>