search

jagrosh / GiveawayBot

🎉 Hold giveaways quickly and easily on your Discord server!
https://giveawaybot.party
Apache License 2.0
660 stars 311 forks source link

Automatic delivery of voucher/text to winners #198

Open Octolus opened 2 years ago

Octolus commented 2 years ago

I am hosting multiple giveaways in multiple Discord Servers.

My idea is that there should be an option to deliver the prizes automatically to the user and if the user does not have DM's enabled. You can announce it in a separate channel, i.e #giveaway-winners and tag them with an oauth URL.

After they oauth authorize, they will be able to claim the voucher/or whatever text we want to add.

Unless you can add a option to re-pick winner if DM's are NOT open :) which again would be absolutely nuts.

This is very handy for me and many others who are giving away game codes, licenses and vouchers. Allowing us to host tons of giveaways, schedule them without dealing with delivery of each winner.

If anyone could make a modification for this, I would also sponsor it.

Octolus commented 2 years ago

ps; if the idea gets declined I am looking for a bot dev who can assist in adding such a feature.

Monkyofwar commented 2 years ago

This would have so many complications and issues and thus is why it will not be developed here on giveaway bot.

Hackers and such just would not work. think about how many giveaways there are 20,507 atm and if just even half do this the bot needs to store all that information just would not work correctly

Octolus commented 2 years ago

This would have so many complications and issues and thus is why it will not be developed here on giveaway bot.

Hackers and such just would not work. think about how many giveaways there are 20,507 atm and if just even half do this the bot needs to store all that information just would not work correctly

I mean it could be a Premium feature for the bot or a self-host version. I wouldn't see any security concerns with it unless the bot or database got hacked - which is unlikely. Nor would it take much space. It's vouchers with some instructions...

All it would have to do would be pull the prize, and send it to the user. If the user has DM's closed, pick a new winner.

Monkyofwar commented 2 years ago

This would have so many complications and issues and thus is why it will not be developed here on giveaway bot. Hackers and such just would not work. think about how many giveaways there are 20,507 atm and if just even half do this the bot needs to store all that information just would not work correctly

I mean it could be a Premium feature for the bot or a self-host version. I wouldn't see any security concerns with it unless the bot or database got hacked - which is unlikely. Nor would it take much space. It's vouchers with some instructions...

All it would have to do would be pull the prize, and send it to the user. If the user has DM's closed, pick a new winner.

As ive stated it will not be developed on this bot. if you would like this feature you need to look elsewhere

Octolus commented 2 years ago

This would have so many complications and issues and thus is why it will not be developed here on giveaway bot. Hackers and such just would not work. think about how many giveaways there are 20,507 atm and if just even half do this the bot needs to store all that information just would not work correctly

I mean it could be a Premium feature for the bot or a self-host version. I wouldn't see any security concerns with it unless the bot or database got hacked - which is unlikely. Nor would it take much space. It's vouchers with some instructions... All it would have to do would be pull the prize, and send it to the user. If the user has DM's closed, pick a new winner.

As ive stated it will not be developed on this bot. if you would like this feature you need to look elsewhere

Struggle to see any legitimate reason not to do it. Curious if @jagrosh has a response.

jagrosh commented 2 years ago

This feature has been requested on many occasions for a very long time, so it's actually a bit surprising that I was unable to find any other issues on this repo about it; I guess all of the other times it has been mentioned has been via Discord.

Anyway, there are several reasons as to why the bot doesn't store and automatically deliver the prizes:

Safety/Security of the Database

While GiveawayBot has never been hacked (which I doubt will ever happen), storing the prizes - specifically things like plaintext redeemable codes and such - would create a much higher incentive for attackers to try to breach the system. Since this is a hobby project and not a company-run endeavor, it could end up being a significant cost (time and/or money) to mitigate a larger quantity of attacks.

Trust in the Developer

I (the developer) have full access to the bot. Now, I wouldn't actually do this, but if I were to so choose, I could browse the database and extract any data there. If the bot stored prizes, I would also be able to view those, which would undoubtedly make some people uneasy about providing the prizes to the bot. Just as I am skeptical about other software, I expect others to be skeptical about GiveawayBot, so I try to maintain as much transparency as possible (like how the the bot is fully open-source) and try to avoid situations that would make users feel uncomfortable.

Scope of Data Storage

Presently, once a giveaway ends, GiveawayBot does not store any data about the giveaway anymore. Storing the prizes would mean that data about the giveaway would need to be kept for some length of time after the giveaway ends, potentially indefinitely (depending on implementation). The data that would need to be kept is relatively small, so this isn't a huge problem, but it would be a paradigm change in the approach to storing giveaway data.

Functionality of Rerolls

When a giveaway is "rerolled," all that is happening is a new winner is being randomly picked from the list of entrants. Rerolling isn't "replacing" the original winners; its generally up to the giveaway host to decide what is meant by rerolling a giveaway. This becomes an issue for prize distribution, especially if a giveaway has multiple winners. If the prize is delivered immediately, then a giveaway can't feasibly be rerolled, as the previous winners already have the prize. If the prize requires redemption, then how would the bot know which winner should no longer be able to redeem their prize? I'm not saying these problems are impossible to solve, but it's not a trivial solution.

DMs are Problematic

Delivering prizes via DM is problematic for several reasons.

  1. The first (and already mentioned a few times in this thread) is that many users have their DMs closed. This would add complication to the ending logic (might need to keep re-selecting winners again and again until a valid DM can be sent). This could also lead to some users unknowingly not being effectively entered, as if they won they would automatically get passed over.
  2. DMs are commonly used by fake giveaway scams and malware. Knowing that GiveawayBot will never DM you makes it much clearer to users that if they get some random DM saying they won Nitro, that it's fake and/or a scam. Additionally, as Discord works to automate detection of these kinds of messages, it would become increasingly likely that GiveawayBot would get (temporary) bans as some messages would likely get flagged.
  3. The ratelimits for DMs are very strict. All DM channels share a common ratelimit (unless things have changed since the last time I looked into this). This means that as the bot grows, it would eventually reach a point where too many giveaways are ending and it can't keep up with sending out the prizes. Also, Discord has a very negative stance towards unsolicited DMs; while these wouldn't be entirely unsolicited (as the user had entered the giveaway), the time difference between entering and a winner being drawn could be an issue.

An OAuth2 Redemption Site would be Problematic

One idea beyond DMs would be by creating redemption links. Instead of sending a message with a prize in a DM, the winner message would provide a redemption link. The URL would be visible to everyone, but the site would require "logging in with Discord" so that only the winner could actually view the prize. While this would avoid some of the shortcomings of DMs (and provide more information, like if the prize was actually viewed), there are still a lot of issues with this approach:

  1. This would be a significant project with a lot of development time needed. Unlike adding a feature to the existing bot, this is a much larger-scale project that would require an entire new site to be built from the ground up, and then also have the corresponding components integrated into the bot.
  2. Opening a public site like this (that interfaces directly with the prizes in some capacity) would require a lot of safety nets against attacks and attempts to either steal data or crash the site. As the bot stands right now, no users interface directly with the bot's hardware; all communications with the bot are via Discord interactions (or a static website that is hosted by GitHub and loads data dynamically from Discord).

A Redemption Command

This would probably be the best option in terms of delivery method, as it would not rely on DMs, it would provide the feedback to know if a prize has been claimed, and it would not require building a new site and exposing it to the public internet. That being said, this could still be complicated for users (especially if a server admin has not correctly set up the permissions and the integration settings on the bot).

Anyway...

To summarize, while I think that this would be a nice feature to have, there are a plethora of hurdles in the way of it happening. Most of these boil down to either security concerns or development time, and would require major redesigns in existing features as well. I agree that this would save a lot of time for servers running a lot of giveaways, but at this time I'm not sure that this perk is worth the risks and development time.

Something that I think is far more likely to happen is the development of a tool that facilitates prize delivery, but doesn't interact with the prizes directly. For example, the bot could automatically create a private thread off the giveaway and add the winners to it. The host (or other admins) would still have to distribute the prizes, but interacting with the winners would be easier and wouldn't always require DM interaction. A solution like this (or any that helped improve the end-of-giveaway flow) are much more likely to happen since they don't have the previously-mentioned problems.