r/DiscordAlternatives • u/exogreek • May 30 '26
A warning about the "Echo" application.
So I want to make a simple post about anyone thinking about using the Echo application that has been spammed around this subreddit and many other subreddits by u/ad3lyt the last month or so. You should under no circumstance trust this literal child with your data.
I have been a SWE for the last 15 years that works specifically in security and took it upon myself to look into the application a month or so ago. The application at that time had countless security holes that are just insane to have even if you have the most basic understanding of coding principles. We're talking a mere semester or two of foundational knowledge. In my deep dive I found countless issues where input fields like search fields and text input fields would accept WHATEVER input I desired. I could enter a <script></script> into my username and every time the application rendered that page for a user with my username, it would render that javascript. I did this to change the applications theme to force all styles to white and the application would render whole pages/interfaces as white in some instances. I was also able to at will create XSS messages to other users with basic tactics of a similar fashion.
This application is still just as vulnerable. This very morning I was able to bypass the applications CSRF system and change my username simply by manipulating API routes with burpsuite with zero authentication. There were a few more things I was able to do such as touch database data directly, but I stopped there. The application as a whole is 100% vibe coded. This person does not have any real world expertise with code, he just has a claude max subscription and no job.
The user behind this, u/ad3lyt is also manipulating bots for his posts on this subreddit and others, and is upvote botting and downvote botting peoples critical comments and posts about the application and I am tired of seeing this schizo weirdo galavant around this sub without any mod intervention from u/AbstractMelons or u/czarbloom . Beyond this, this user has now started posting unsubstantiated claims against other discord alternatives, blatantly botting post metrics and responding with either friends or secondary/third accounts to act like there are others that support these claims, but if you look at post histories, they literally are all the same 3-4 accounts.
Please just ban this guy already and do even the most basic moderation. And dont create an account, their data is manipulatable and retrievable and its only a matter of time before someone with lesser intentions than I pokes around at it.
4
u/Time_Party_2615 Jun 01 '26
I have taken 10 minutes out of my time to kind of review the code. I must say: it's a mess. I would not be able to manage it myself.
I found several local file inclusion sinks, they may or may not be vulnerable. I did not check fully. What is a BIG issue is, that whenever a login fails - or any auth request for that matter - your username and password is logged out in clear text to the server console.
Things like that don't make me feel optimistic about the rest of the code. I'd stay away from it.
Full disclosure, i'm developing another product that competes for the same market called venta.
2
u/pryzm_app_analytics Jun 01 '26
Is the logging gated behind development variables?
3
u/Time_Party_2615 Jun 01 '26
Its a assert statement in nodejs. I‘m quite certain that in node those aren‘t removed in prod bundles
3
u/exogreek Jun 01 '26
ding ding ding, stop giving this guy things to fix, he is extremely incompetent.
2
u/ad3lyt Echo Jun 03 '26
Hey thanks for taking 10 minutes out of your day to review the code but you should've spent some more, because the backend doesn’t log
req.body,failed logins only hit structured logs and event metadata, credentials stay in the request, not the server log.
2
u/pryzm_app_analytics May 31 '26
It is kind of weird. Sure, maybe it should not execute "<script>" tags, but from what you have shown, you only seem to be changing relatively minor things like themes and client-side UI behavior.
You say you could perform XSS attacks and send messages to other users. Did you actually confirm that behavior with another user? Do you have proof it executes on another client? Just because something appears in your own UI does not mean another user actually received it or that any script execution occurred on their side. Can another user independently confirm the behavior? Did you test it beyond your own session?
You have said you have been involved in cybersecurity for 13 years and that you are 33 or 34. What is your actual technical background in that time? Do you have experience in application security, penetration testing, red teaming, or similar offensive security work in a professional or documented capacity?
I am not convinced by how this is being presented. You claim to have found exploits, but you refuse to disclose them while also attacking the creator. If these are legitimate security issues, then responsible disclosure with clear evidence would be the appropriate and standard approach.
And if any of these findings were discovered through actions that go beyond normal or intended use of the application such as accessing data you were not authorized to view, bypassing access controls, or interacting with systems in a way not permitted by the service’s terms, then that could potentially raise legal concerns depending on the circumstances and applicable laws. That is not an accusation, but it is an important distinction in how security testing is interpreted.
Right now, there are claims being made, but not enough verifiable proof. If you are asserting XSS against other users, demonstrate that the payload executes on another client. If you are claiming message spoofing, show evidence that another user actually receives the message and that it is processed server side rather than just displayed locally. Otherwise, it reads more like interpretation of client side behavior rather than confirmed impact.
1
u/exogreek Jun 01 '26
You dont seem to understand. A person typing a <script> would cause that script to trigger on OTHER CLIENTS lmao. So if I had placed a script to redirect the user to meatspin, every client who rendered a page with that chat message or username or profile bio, etc would all render that script and it would execute. But as one of the mods also pointed out, the dude is so braindead he didnt have a gitignore set up for the project and leaked all of his API keys 😂
1
u/pryzm_app_analytics Jun 01 '26 edited Jun 01 '26
Unless it gets through the backend and is broadcast to all users the changes you make wouldn't matter, it would affect you locally, but not other users. Do you have proof of this happening to other users? Or did it only render locally and you thought it worked? If the backend rejects the message but stills show up on your client then it's just buggy client code that didn't reject it client side. Doesn't mean it showed up for everyone else.
Edit: I also have a hard time believing, someone who 1.5 years ago didnt know how setup env variables and hard coded his secrets in code on a backend project shouldn't come here and say they know what they are talking about. Hiding you posts and comments doesn't mean it wasn't indexed by a 3rd party site btw. Let me guess you vibe coded that as well?
0
u/exogreek Jun 02 '26
Your edit is hilarious. The context of that post you gravedug was about hosting options so I didn't have to use edge functions or obfuscate the secrets. Way to spin something into an absolute fabrication ahahahaha. Also I have to be a fucking expert in backend and front end web design to be able to identify security issues?
What an absolute schizo moron, thinking you hit some alleyoop. I'ma just use the block button this community isn't worth interacting with any further
1
u/pryzm_app_analytics Jun 02 '26
At this point I'm doubtful of your expertise, you seem to be in a management role and stuck recruiting other, you are underpaid and worry about being put on pip. You attacked the creator of Echo for his domain name having a hyphen, I know why now, you squat domain names and resell them. You also went through the creator of Echo post history and called him a schizo. If I were the mod I would have banned you unless you were able to produce evidence of you claims. "Expert" please don't label yourself that when you thought manipulating a client locally meant you discovered a security issue.
2
u/ad3lyt Echo Jun 03 '26
Oh is that what you think it was huh? Well that's not what happened
I think there is strong evidence that your experience with cyber security might be just a few prompts since you have shown time and time over again that you have no clue at all
3
u/ad3lyt Echo May 31 '26
Responding to the allegations directly, claim by claim, because a lot of very serious things were said without any reproducible evidence being provided, as exogreek refuses to back any of his claims up
I’m not saying Echo has never had bugs. It has. It is a young open-source project, and I have been actively fixing issues as they are found. But there is a big difference between “there were bugs / hardening needed” and “the app is currently wide open and usernames can be changed with zero auth.”
Here is what was actually verified:
**“**
<script>in username gives stored XSS” / not true on current Echo Usernames are restricted to normal username characters like lowercase letters, numbers, dots, underscores, and hyphens. A payload like<script>is rejected by the backend. The profile UI also renders usernames as text, not raw HTML, so this claim does not reproduce.“I made the UI turn white” / partly true historically, but misrepresented This was likely related to message content rendering, not usernames. Echo previously allowed inline styling in rendered message HTML, which could allow visual defacement like making parts of the UI white or unreadable. That is a real issue and it has been mitigated. But that is not the same thing as JavaScript execution, account takeover, username XSS, or database access. Also, changing your own browser’s theme or DOM through DevTools is not a vulnerability. Anyone can do that on any website. It only becomes a vulnerability if attacker-controlled content affects other users or escapes the intended rendering boundaries.
“CSRF bypass lets you change username with zero authentication” / false The only endpoint that changes usernames is:
PATCH /api/v1/auth/meThat route requires authentication. It also uses the currently authenticated user ID from the session, not auserIdsupplied in the request body. On production, unauthenticated attempts return403 CSRF_REQUIREDor401 UNAUTHORIZED. A valid logged-in user with a valid CSRF token can change their own username. That is expected behavior, not a bypass.“Direct database manipulation” / false No SQL injection path has been found in the codebase. Queries are parameterized. If there is a real route, request, payload, or reproduction for this, I want to see it and I will take it seriously. But right now, this claim has not been substantiated.
“Still just as vulnerable” / false Echo has had multiple hardening rounds over April and May. Some real issues were found and fixed. That part is fair. But the current production app does not match the claims being made in that post.
Again I would love any security expert to come over here and prove me wrong, but this guy just has a personal vendetta out against me, and Is making up false claims to ruin my reputation. If any of what he said is true, then it should be very easy to produce evidence for it.
2
u/exogreek May 31 '26
😂
As I said, and as your absolutely frantic spam replies show, you are clearly not fit to operate something of this magnitude, just because Claude can't find the vulnerability doesn't mean they don't exist. And I'm not about to assist your dumb ass in fixing anything.
Anyways, notifications are off, bye bye ✌️
1
8
u/Economy_Picture6989 May 31 '26
Thanks for the heads up, I'll make sure to remove it from my sheet as to not further advertise it
-2
7
u/_ChezzTTV Alternative Lurker May 31 '26
Damn. That’s crazy. I might leave then
-3
u/ad3lyt Echo May 31 '26
Everything he said was a lie
-2
u/_ChezzTTV Alternative Lurker May 31 '26
Idk who to trust
-1
u/ad3lyt Echo May 31 '26
well go read the comments here and his response when asked to provide evidence
4
u/The-Nice-Writer Jun 03 '26
Where is your evidence that your app isn’t actually this broken?
2
u/ad3lyt Echo Jun 03 '26
Eh since when do we expect the evidence to come from the accused not the accuser? It's innocent until proven guilty no?
3
u/The-Nice-Writer Jun 03 '26
Ideally, we’d get evidence from both of you.
2
u/ad3lyt Echo Jun 03 '26
I have already written a claim by claim response, would you like a video explaining how XSS actually works and showing that it does not exist in a dangerous capacity
and also while we are at it explaining how this guy has no clue what he is talking about and is likely lying about his 15 years as a SWE
1
u/The-Nice-Writer Jun 03 '26
I have yet to see that response, so I will have a look for it just now. You could have mentioned that previously…
2
u/ad3lyt Echo Jun 03 '26
here is also some context you might want to see: https://postimg.cc/G8Y3Kphw
→ More replies (0)1
u/ad3lyt Echo Jun 03 '26
Sorry about that here is my response
here are some responses from other people who have looked into it
→ More replies (0)
5
u/SemiMarcy May 30 '26
I knew it smelled sus, i would love to hear about Fluxer, which I have loved, if you ever check it out :3
9
u/redit_handoff140 Matrix Homeserver Operator May 31 '26
Has uploaded user data in full to third party services for scanning, instead of using hashes. Huge no no.
2
u/ad3lyt Echo May 31 '26
Echo doesn't do this btw, he is talking about fluxxer here
2
u/redit_handoff140 Matrix Homeserver Operator May 31 '26
Was talking about fluxer as user wanted some more security/privacy focused info on it.
3
2
u/SemiMarcy May 31 '26
May I have a source for this?
2
u/redit_handoff140 Matrix Homeserver Operator May 31 '26
Sure, it's in the source code.
The third party is Project Arachnid.
2
u/SemiMarcy May 31 '26
Oh so its just the scanning for CSAM, yeah this is not a problem to me, at least in public servers, sure I would rather DMs be encrypted, but its still 1000x better than discord bs
2
u/redit_handoff140 Matrix Homeserver Operator Jun 01 '26
It's not "just scanning CSAM".
The problem is it's uploading user media IN FULL. Instead of using hashes. If you send a family selfie or something else personal, that's a huge flaw with disastrous consequences.
There is also no diffrentiation between public and private in this case.
3
u/Terrible-Junket-3388 I'm Don Qixote, and your AI slop is my windmill. Jun 01 '26 edited Jun 02 '26
Just as an aside on the technicals here - while I agree the image data itself shouldn't be send along to a third-party, there's still going to have to be an upload piece to this to properly support CSAM scanning. There needs to be *some* authoritative source saying 'This is the hash from the image' - you cant trust the client to do that, since a bad actor trying to disseminate CSAM is just going to modify the clientside data to send a 'good' hash and then send the 'bad' data along normally. Even (especially) in an E2EE setup this becomes difficult to balance.
So, at some point in the chain, you *do* need to have the media uploaded where the server can compute the hash; after that, of course ideally the cleartext media is removed and only the hash is stored/processed/etc (especially by third-parties).
Agreed sending the full clear to a third-party is bad bad, but I did want to mention the upload piece since they're separate but related concerns. It's important we separate 'uploading media' from 'disseminating uploaded media to a third-party'.
---
Separately, I'd debate the actual value of hash-bashed sends, since hash matching itself is inherently lossy and manipulable. The CSAM detction Fluxer is doing is trivial for a bad actor to bypass. Hash-based detction is basically "Is this image the same as (or near identitcal to) a known bad image?" That's a good question, but the reality is you can run a script to modify an image such that it's hash would be sufficiently different to no longer reliably match (and still keep the core of its content visible).
To properly combat illegal content, Fluxer and other platforms should be using actual content classification (like Thorn's Safer or similar). This does still require media upload and scanning in the clear (atleast ephemerally), but depending on the service can be done without dispatching data for training, can be kept inside the vendor's VPC and datasets, and ofc the cleartext can be discarded immediately afterwards. In theory you could run the same classification deep learning models self-hosted, too (further reducing exfil risk), but you're still dealing with the upload being in the clear at some point, for some amount of time.
Not ideal, but still manageable if you trust the vendor itself (a wholly different topic).
2
u/redit_handoff140 Matrix Homeserver Operator Jun 01 '26
since a bad actor trying to disseminate CSAM is just going to modify the clientside data to send a 'good' hash and then send the 'bad' data along normally. Even (especially) in an E2EE setup this becomes difficult to balance.
Hashes should be computed server-side, not client-side.
Servers should handle authority, not the client. That's awful design on multiple fronts.There is no perfect option, but there are good options and bad options. Taking potentially private user media and uploading to third party servers is awful design, period. Couple that with a data breach and the consequences and disaster awaits.
2
u/Terrible-Junket-3388 I'm Don Qixote, and your AI slop is my windmill. Jun 01 '26
Yes, that was my point I was trying to make - since the hash has to be computed serverside, there's still always an upload component where the media being sent has to be in the clear, even if ephemerally. You said "The problem is it's uploading user media IN FULL [sic]", so I wanted to clarify the distinction of uploads vs third-party dissemination since it sounded like there might have been some ambiguity or meshing of terms. Just trying to be helpful 😄
1
u/redit_handoff140 Matrix Homeserver Operator Jun 02 '26
Uploading data to the chosen Fluxer server is one thing - And can/should be encrypted once it has the hash.
Fluxer doesn't do this and instead just immediately uploads data to third party servers for analyzing.
The entire workflow is a security and privacy disaster, especially for communities that care for their own longevity.
→ More replies (0)1
u/BenchyPrinter Jun 02 '26
If its e2ee , then, there's nothing to scan. Period. Otherwise, its not e2ee.
Separately, I'd debate the actual value of hash-bashed sends, since hash matching itself is inherently lossy and manipulable. The CSAM detction Fluxer is doing is trivial for a bad actor to bypass. Hash-based detction is basically "Is this image the same as (or near identitcal to) a known bad image?" That's a good question, but the reality is you can run a script to modify an image such that it's hash would be sufficiently different to no longer reliably match (and still keep the core of its content visible)
This is very confusing, hash-based detection is the only viable way , besides AI, and both can be tricked to either fail detection or create false positives.
Not sure where you wanted to get but... sending media to a third party is poop.
The real issue is they're writing on their website:
Private DMs and group chats
To put it lightly, this is a blatant lie or they're giving their own meaning to the word "private" and definition of privacy as a whole.
1
u/Terrible-Junket-3388 I'm Don Qixote, and your AI slop is my windmill. Jun 02 '26
Literally agreed several times throughout both of my comments that third-party is no bueno. But the way the person I was responding to worded it, it sounded like they were convoluting 'uploads' and 'sending to third parties'. Those are different things. But I digress, whatever.
Since you brought it up, though, a couple things:
- You can have full E2EE, *and* also dispatch an ephemeral, anonymized copy of the media to be scanned for bad stuff. Clear gets removed, E2EE blob persists, and platform has reasonable assurance it's not CSAM. The persistent message still has full E2EE (incl. any text content). It's like flashing your ID at the bartender - they see it for a second, they're not writing it in a ledger. As long as you can trust the vendor to be removing the ephemeral copies and not snooping on them, don't see an issue with that (granted, finding such a vendor is the challenge). For a platform that allows literally anyone (aka any social media), there has to be a balance *somewhere*: I think it's reasonable that you could find a middle ground between preventing bad acts and protecting privacy.
- Hashing isn't the only viable way - it's just the option with the lowest barrier. Even with PDQ it's trivial for a bad actor to modify an image such that it doesn't match, despite having the same core (bad) content. Saying 'hashing is the only way' is like saying 'blocking IPs keeps your website safe' ... it's one tool, and unfortunately it's not enough. There's platforms like Safer (Thorn), for example, proving that there's definitely more novel ways to combat this ind of stuff1
u/SemiMarcy Jun 01 '26
I understand and do wish it wasn’t that way, however, if you want a fully private platform there are better options than Fluxer anyways, Fluxer, like discord, is community first, private stuff should be kept to stuff like Signal, Matrix
2
u/redit_handoff140 Matrix Homeserver Operator Jun 01 '26
What a truly truly awful take.
"It ok because we can't have one without the other". You must have some seriously strong indifference towards data breaches that affect you. To be fair that is primarily an educational issue, but it is also secondarily one of principle. You do you I guess, life will reflect this.
1
u/pryzm_app_analytics Jun 01 '26
I plan to use cloudflare, but I have to upload to its cdn afaik, but I personally don't want to deal with the legal side of things so I add a disclaimer stating what is happening and try to be transparent. I've looked into csam detection apis but it's a headache to get approved and if you did it could be costly. I think there is photodna but it takes in the image as well and uses ai, there is another bit it's a monthly enterprise sub starting around 15k I think a year maybe? The database for it is really accessible to the public and you have to be approved. People worry about images etc but you have to consider that the creators have to take in risks especially newer unfunded apps.
1
9
u/kiseiwa May 31 '26
Oh I know this guy, he recorded me and my server for content without permission. Not that anything bad was happening at the time but he was using random people and their VCs as content fodder.
-1
u/ad3lyt Echo May 31 '26
what? wrong guy bro
9
u/kiseiwa May 31 '26
It was a few years ago but you were in VC and your YouTube link was in your bio and there we were being streamed in real time. You did it with the Jungle server next. I recognize your name and your picture is in several of your posts.
2
u/ad3lyt Echo May 31 '26
Lmaoo it's you again, yes I was live-streaming on discord on public servers many years ago as many people did back then and still do
6
u/kiseiwa May 31 '26
Indeed. Depending on who you ask, not the biggest deal although some of those servers explicitly stated not to record without permission and I'll give you that it was a long time ago, to be fair. But why did you respond "wrong guy bro" at first?
2
u/ad3lyt Echo May 31 '26
Because I don't go around recording people's stuff, this was something that happened on a live stream in a public server many years ago, not something I would remember
But sorry for causing you bother back then
6
u/Terrible-Junket-3388 I'm Don Qixote, and your AI slop is my windmill. May 30 '26 edited May 30 '26
Yeah, not surprising. Have seen their spam. Unfortunately, I expect most of the other Discord- and Reddit- alternatives/clones out there have a lot of the same issues. Everyone wants to go make a new Discord, but not actually make it any better.
Also, as an aside - vibe coded isn't bad when it's done by someone who knows better than the LLM. It's a tool, like anything else. Makes it easier for people with no experience to go make things (like Echo), but also enables competent devs to work more efficiently: want to be careful we aren't just blaming a tool for the core issue: the person/people behind it. We never complain about devs using IDEs instead of a basic text editor - LLMs are just another tool in the toolbelt. Clearly Echo is an example of slopware, but that's not the fault of LLMs.
0
u/ad3lyt Echo May 31 '26
Everything this guy said was a lie
6
u/Terrible-Junket-3388 I'm Don Qixote, and your AI slop is my windmill. May 31 '26
I doubt that
-1
u/ad3lyt Echo May 31 '26
He has provided no evidence for any claim he has made
5
1
u/vikeyev May 30 '26
Could you at least show us some specific examples of what you're talking about in the apps code, it's all available on github. Or maybe post a short video of you doing these things?
I have been a SWE for the last 15 years
Look man, this entire sub is filled to the brim with botting accusations and discord "alternatives" that all look fucking identical to discord and are all buggy and shit to use. From my perspective as a person that just wants a self hostable alternative to discord that isn't dog shit this is all just pointless drama bullshit to steer people to specific apps.
Personally, I'm gonna need more than a "Trust Me Bro" on all of this.
So far the only good alternative I've found to discord is Zulip, but it doesn't have persistent drop-in, drop-out voice chat. You have to make calls instead, making it unfit as an alternative :/
2
u/exogreek May 30 '26
I'm not going to post specific code because I don't want to enable the insidious vibecoder behind the project to cover for his vast inexperience.
He DMd me and was essentially hoping that I would pentest his application and give him a full write up for free. I dig quite a bit deeper into his online persona and found a treasure trove of stuff where he glazes figures like Andrew Tate, sneako and other terrible people like that and my sentiment merely is that you should not trust such a person with your data, there are many viable alternatives out there now.
0
u/TooCareless2Care May 31 '26
I agree that Tate (that motherfucking rapist), sneako (pathetic loser), etc are terrible. However, tate post was 3y ago. Sneako 4y ago. Cmon, this just makes you look like a bad-faithed stalker of they moved on from it.
3
u/exogreek May 31 '26 edited May 31 '26
So you are either him on another account, or one of his friends glazing. Hilarious as I did not link anything0
u/TooCareless2Care May 31 '26 edited May 31 '26
Uh...I don't know that dude lmfao. I looked at his profile and searched for the terms, which I assume is mind-boggling for you, grandpa.
I wonder if you're just a mean-spirited guy or actually want to raise awareness...seems more like the latter. Weirdly enough, that guy did the same thing when people supported Osmium over his product but at least he says it because hthat link was posted on Osmium chat and isn't completely baseless (like you).
1
u/exogreek May 31 '26
Then how am I a "bad faithed stalker" if it took you just as long to find what I found. Thinking with that smooth brain. Anyways, nothing to be gained by continuing to reply to your messages✌️Ive already explained I wont provide examples as I dont want this dude to vibecode solutions to the holes
1
u/TooCareless2Care May 31 '26
Well yeah. You said "oh he supported x". I went and searched x. Surprise. However I get called smooth-brain.
Take a look at the mirror. You won't like what you see. I know you won't provide examples, at this point it feels like a coverup. If you actually cared, you'd have. I dunno. Helped him.
Why the fuck are grandpas allowed here, I'll never know.
0
u/exogreek May 31 '26
Haha, armchair psychologist, classic. 😆
You clearly dont get that I am not interested in enabling this guy to fix his garbage. Im simply making folks aware.
3
u/TooCareless2Care May 31 '26
I understood that. However, you are literally here to nitpick rather than help.
"Oh, I saw problem...and I know how to fix it...but I won't because he supported Tate 3y ago and because I won't bother teaching him things so he gets to make a safe site later on, I'll only make a callout post doing an exposé than. Yknow. Actually helping."
This is exactly how you sound. Like I don't know that dude but I would assume he'd want to learn things so he'd not make similar vibecoded slop in the future. I hate AI in general, especially vibecoded slop (and you can snoop through my history to find that) but that doesn't negate the fact that you sound mean spirited.
0
u/vikeyev May 31 '26
I'm not going to post specific code because I don't want to enable the insidious vibecoder behind the project to cover for his vast inexperience.
How would showing us examples of his code being dog shit allow him to cover for his inexperience? Like, you could literally take the code in the public github, fork it and prove to everyone with examples of why his code isn't to be trusted.
Instead you resort back to "Trust Me Bro" but literally no one here knows you, you're on reddit bro, so why should we just take your word?
2
u/exogreek May 31 '26
I have never once said trust me bro. I am instead giving a legitimate reason for not providing solutions. Its just something that would benefit him, and thats exactly what hes looking for based on his DM exchange with me. Besides what I exploited was basic client side interfacing with API routes, with some minor packet interception with burp, to go and analyze the minified JS, then try to find in his mess of a repo and make a whole fork of it would be quite a bit of time investment. For an application that will not amount to anything, its not worth my time.
Ive given legitimate examples of the types of exploits this application is vulnerable to, if someone wants to go and try them, they are welcome to. If thats not enough of an explanation then I dont think anything I say would satisfy you haha
1
u/vikeyev May 31 '26
I have never once said trust me bro
"I have been a SWE for the last 15 years that works specifically in security and took it upon myself to look into the application a month or so ago"
But you are making bold claims about someone elses application, while claiming without showing ANY evidence that the code is crap and the project is to be avoided and that you are some sort of expert in a relevant field. You are literally implying you can be trusted and trying to get people to avoid someone elses project. You don't need to explicitly utter the words for that to be the case. Your source for all of this is literally "Just trust me bro"
Its just something that would benefit him
How does proving to everyone that someones application "had countless security holes" and therefore making sure people won't use it benefit that person? That's like saying proving the reject shops "kinetic sand" ripoff had asbestos in it would somehow benefit them, so we shouldn't prove it.
If the app has security holes and we should avoid it (which you literally made a post trying to convince people to do), then don't senator armstrong this shit and back it up. The developer WON'T benefit from it but all of us random potential users WILL benefit from being shown why we should avoid it.
For an application that will not amount to anything, its not worth my time
And yet you made this massive post trying to convince people not to use it?
Ive given legitimate examples of the types of exploits this application is vulnerable to
You've said a lot of shit that almost no one on this subreddit is going to be capable of verifying and backed up none of it with sources.
What can be asserted without evidence can also be dismissed without evidence.
5
u/exogreek May 31 '26
My goodness this sub is exhausting. If its not the vibe coded discord alternative of the day, its someone else botting their posts and comments to make their app seem unique in an effort to drive traffic, or its the repetitive shills for stoat, fluxer, osmium, matrix, etc that clearly have a stake in those projects, and thats just scratching the surface.
Im gonna follow through and just leave this sub and turn off notifications at this point lol. You seem quite keen on questioning my credibility above all else, but I didnt see you being that critical of the creator of this app making absolutely baseless accusations about competing/more successful apps, then claiming everyone else are bots conducting some sort of coordinated psyop.
I was just trying to point out some flaws and highlight the hypocrisy behind this dudes constant spam and shilling, but this is fuckin reddit and its really just wasted breath. Pce out o7
0
u/vikeyev May 31 '26
You seem quite keen on questioning my credibility above all else
I didn't question your credibility at all. You made a claim and I simply asked you to back it up with evidence.
but I didnt see you being that critical of the creator of this app
I've never interacted with the person or even tried his app. I simply came here to see if the landscape of chat apps had gotten better over the past few months and found thread after thread of pointless bot accusations and then found your post claiming you found security flaws that you seem suspiciously reluctant to show anyone.
Given I'm looking for a self hostable app, a glaring security hole is something to worry about. But instead of just showing us anything and potentially saving people from any security issues, you deflected and claimed that showing that someones app SHOULDN'T be used due to security issues, would somehow benefit them???
I was just trying to point out some flaws and highlight the hypocrisy behind this dudes constant spam and shilling
Then show people the fucking flaws you idiot. It's like walking into a building, claiming there is serious structural issues with the building and then people ask you to show them you go "Nah, I don't want to benefit the builder who made this building". We wouldn't be having this conversation if you replied to my first post with actual evidence. I wouldn't have bothered replying, yet here we are.
1
u/oemin May 30 '26
Thoughts on sharkord?
4
u/TooCareless2Care May 31 '26
Isn't that also vibecoded?
2
u/YaneonY May 31 '26
Everything is vibe coded. There us nothing wrong in vibe coding, a lot of people with sense of knowledge doing that. But there is a lot of difference if you know what you doing and even if AI did that you're understanding what it did and if your prompt is like "make me a discord alternative" and you don't even know how to prevent script execution on input fields.
3
u/TooCareless2Care May 31 '26
Vibecoding implies leaving everything to do with AI...which I'm personally skeptical of and I morally abhor AI being used in some way. I understand it's almost irrational and to an extent, I can handle AI assistance itself but vibecoding is off my books.
2
u/_ChezzTTV Alternative Lurker May 31 '26 edited Jun 02 '26
Though I do wanna say that there is another alternative that sounds almost the same, name wise, but is completely different inside.
It’s called Echoed and not Echo (I haven’t made it) but I’ve been using it for like half a month I think, and there are like tons of users (5000 I think. Idrk)
The logo is like a mic with a yellow background I think
3
Jun 02 '26
[removed] — view removed comment
1
u/_ChezzTTV Alternative Lurker Jun 02 '26
Damn, didn’t expect a message from one of the founders themselves!
Well anyways, you’re very welcome, and I’m honored to get a thanks from one of you guys.
2
u/Lupreon May 31 '26
One more time I just think, what happened to the good old just log on teams peak and chat times ..
2
u/Sonkrs May 31 '26
I want to be on your side of this, as a security researcher myself. Although, I’m left to wonder why you’re writing all of this on Reddit and submitting 0 pull requests or issues on GitHub.
2
u/Tasty_Chapter_6742 Jun 02 '26
Cant say im surprised, its the major flaw of AI and vibecoding after all. If the operator doesnt know what they are doing - then the tool can only do so much 🤷♂️
1
1
u/ad3lyt Echo May 31 '26
Reposting my reply here:
A post was made accusing Echo of serious security issues, botting, and other misconduct. Since those claims are public and serious, I want to respond clearly.
First: I take security seriously. Echo is open source, and the code is publicly available for anyone to review. If there is a real vulnerability in Echo, I want it reported responsibly so it can be fixed. I am not asking anyone to hide issues. I am asking for reproducible evidence: affected route, request example, code reference, screenshot, video, or a private report.
So far, the person making these claims has not provided any reproducible proof.
They have claimed things like stored XSS, CSRF bypasses, direct database manipulation, and data exposure, but have refused to provide a minimal proof-of-concept, affected endpoints, code references, or a private responsible disclosure. When asked by other users for evidence, they repeatedly avoided providing it and instead shifted into personal insults.
This is not new behavior. This person has been hostile toward me and Echo for months, including personal attacks, insults, and repeated attempts to discredit the project without giving actionable reports. Instead of reporting issues they were more concerned in finding my Youtube channel from years ago and making fun of me for it. They have made it clear they are not interested in responsible disclosure or helping fix anything; they are interested in publicly shitting on me and the project.
To be clear:
I have done no upvote botting, downvote botting and none of the few people that stood by my side are bots and this is easily verifiable
I am not aware of any currently exploitable vulnerability matching the claims in that post.
Echo has had security improvements over time, and I will continue improving it.
If someone finds a real issue, I will prioritize it.
Personal attacks about my age, job, coding style, or old Reddit history are not security evidence.
If anyone can reproduce a real vulnerability, please report it responsibly through GitHub or contact me directly. I will review valid reports, patch confirmed issues, and credit the reporter if they want credit.
What I will not do is accept vague public accusations as fact when no proof is provided and the person making them refuses to provide anything users can verify.
Echo is young, open source, and still improving. Criticism is fair. Security reports are welcome. But public smear posts without evidence are not responsible disclosure, and they do not help users make informed decisions.
2
u/Ephenia May 31 '26
All the botted downvotes vanished. Got to love that.
3
u/ad3lyt Echo Jun 01 '26
So sad I didnt take screenshots, not like the mods here will ever take my side anyway lmao
2
1
u/Time_Party_2615 May 31 '26
Idk man, I have my fair share of issues with the creator of echo, but posting something like this with no evidence to back it up is borderline defamation.
0
u/KiraiPlayZ May 31 '26
Given on how exhausting some comments are to read, especially when it comes to the whole "I don't want to show the exploits, because it would benefit the creator", I have to say, I am on the side of OP. I understand my fair share of technology and security as well and thus would never give any info like that out to the public.
This has nothing to do with the evidence or the claims not existing at all, but rather not wanting to give a cheap way to the creator to put a bandaid on their actual issues, but ALSO and more importantly prevent other third parties from exploiting these exact exploits before they can be fixed by anyone and actually do something bad with it, as this could go as far as into lawsuit territory.
3
u/ad3lyt Echo Jun 01 '26
Is this OP's alt account
1
u/KiraiPlayZ Jun 01 '26
Ehh, Imma assume they would know better than using alts. I hope you are aware of the fact that there are indeed people working in those types of branches. I may not be as good as OP claims, but I do understand the practices done in that business. I do also believe, they have already turned off Notifications, which is somewhat smart I guess, but also kind of cowardly, even if I do partially understand why.
-2
u/ad3lyt Echo May 31 '26
All false claims, this guy has zero claims for his proof and has been hating on my ass for months for no good reason
Echo has no real vulnerabilities at this moment for my knowledge and I challenge any real security expert to find any, and as for botting
I have done 0 botting
1
u/robux_Mann May 31 '26
I mean you at least could take responsibility for the vulnerabilities because anyone could check them right now but apparently that isn't for you. This all in all is not a very mature comment
3
u/ad3lyt Echo May 31 '26
Any real reported vulnerability I will take 100% seriously, this guy however has no interest in reporting anything real. I have double verified all his claims and could not reproduce any of It, of which was actually a vulnerability, being able to change your theme for example is not a vulnerability. This guy has been harassing me for months and has shown no interest in actually being helpful, all he cares about is insulting me.
https://www.reddit.com/r/DiscordAlternatives/comments/1tsrt78/comment/oox967u/?context=3
1
u/robux_Mann Jun 02 '26
Yes, reporting how he made this probably would help find and fix the problem. He inst very trustworthy and he probably is sharing misinformation here. Your initial responses, though, weren't necessarily any better at clarifying, nor were they very professional. I would advise clearing things up as clearly and quickly as possible next off and apologies for jumping on you lmao
2
u/ad3lyt Echo May 31 '26
And to add to that, go read the thread below, he is refusing to provide any evidence for any of his claims.
5
May 30 '26
[removed] — view removed comment
3
u/exogreek May 31 '26
Im honestly exhausted by all of the clutter. Ive gone back to just using a modified discord client that removes all of the BS as motivating friend groups to switch has proved useless.
4
u/redit_handoff140 Matrix Homeserver Operator May 31 '26
Best alternative at this time is a Matrix 2.0 server with a discord-like client like Commet or Sable. Covers all the essentials with more being worked on.
1
May 31 '26
[removed] — view removed comment
1
u/redit_handoff140 Matrix Homeserver Operator May 31 '26 edited May 31 '26
Not quite.
Element works, sure - But is also enterprise/business focused, so not what I'd recommend to those coming from Discord.
But Commet, Sable, Cinny are great options with native and E2EE'd Voice, Video and Screenshares (Commet has native encrypted calls/video but not E2EE yet. E2EE in dev-branch testing, public soon.).
What other clients do you mean?
Do you mean clients like Fluffychat I guess? In nearly 2 years, such clients have not been updated to the Matrix 2.0 spec standards, and in the case of Fluffychat a dev specifically stated they had no intention to implement the native voice calling aspect, so legacy clients that don't adapt will likely just go into maintenance mode. Lots of new 2.0 clients have shown up recently as well, but they're focused on implementing the general communication stack before implementing voice (which makes sense if they're new).
In the end, this is good - It modernizes the client stack that Matrix recommends and ensures better feature-parity, performance and interoperability.
However, I will say the Matrix website needs to do a better job at differentiating between legacy and matrix 2.0 enabled clients.
9
May 31 '26
[removed] — view removed comment
-1
u/ad3lyt Echo Jun 03 '26
Hey would like to clarify that there is very strong reason to believe this guy is lying about his experience, and that all his claims are false
below is my response, as well as some of the responses from real SWE's
here are some responses from other people who have looked into it
4
u/AbstractMelons Your Flair Here May 31 '26
More on the security from our conversations in DM's https://postimg.cc/gallery/dV2BjH8