On 17 October 2026, u/HackTheDev posted “Be cautious of trolls posting misleading websites that deliberately spread misinformation!” on r/dcts. He named dcts.exposed, said the facts here are “completely wrong, made up or rely on very old, outdated topics,” quoted one sentence about DMs, complained about the r/dcts member count, and wrote that answering the rest “would end up in a cat and mouse game.” This page is the rest.
Rechecked against the live site and GitHub on 18 October 2026. Every URL below is public. If a Reddit page login-walls a scraper, the same post is in Arctic Shift as JSON.
All of these websites were made using AI and are factural either completely wrong, made up or rely on very old, outdated topics from weeks/months ago in the case of DCTS.
DCTS is about self-hosting and self-hosted only. This means its technically impossible to “hold the keys” to anyone’s DMs. In fact, encryption keys cannot be viewed at all since encryption is done locally on your computer using the desktop client or android app.
Or the statement that the r/dcts subreddit only has about 108 members when they probably looked at the “weekly visitors” number, as the subreddit actually has 2600 members.
There are just way too many statements that are wrong and since this would end up in a cat and mouse game i decided to not to answer them as they are non-sense anyway.
r/dcts post, 17 Oct 2026 · Arctic Shift snapshot · cross-post r/discord_alternatives (5 subscribers that day)
This site printed ~108 / ~100 members for r/dcts. That number is wrong. HackTheDev is right that the subreddit is on the order of 2,600 members. We are striking the old figure everywhere it appeared.
On a phone, swipe the table sideways.
| When | Count | Where that number is written |
|---|---|---|
| 16 Sep 2026 | 2,600 (his words); 2,597 in the post metadata | “The subreddit is barely a year old and has 2600 members!” · Arctic Shift subreddit_subscribers 2597 on the same post |
| 17 Oct 2026 | 2,600 (his words); 2,613 in the post metadata | The troll warning itself: “the subreddit actually has 2600 members.” Arctic Shift recorded subreddit_subscribers 2613 on that post. |
| 18 Oct 2026 | 2,613 | Later the same weekend, another r/dcts post still carried 2613 in Arctic Shift. |
A wrong subscriber count is a wrong subscriber count. It does not empty package.json, delete the comparison table, or rewrite the threat model. Those files are still there. He used the one number we got wrong as a reason to skip the rest.
The line he quoted from this site, on the founder page, comes after the GIF-API perma-ban writeup:
Instant ban, then a public post naming people, guessing at future paywalls, and calling the other side childish. This is the temperament that would hold the keys to your members’ DMs.
That sentence is about the person you would have to trust as an instance operator. He replied as if it were a claim that he, personally, can open every E2EE key on every self-hosted box from his couch.
His own files already describe who holds power on a DCTS instance.
The official README still advertises a Public Instance and a Discord invite in the same header row as the docs. “Self-hosted only” is the lore. The product listing still points people at a server he runs.
README.md (live, 18 Oct 2026): “Reddit · Discord · Public Instance · …” · chat.network-z.com
The server has full authority
Users trust instances they connect to.
Compromised instance … Mitigations … None. Responsibility lies within the instance operator.
Non-Goals … protect against malicious instance operators
Private-key theft is listed as a user attack. The writeup says a stolen key lets an attacker “read encrypted DMs or authenticate with it,” and ends with “Further testing is needed!”
Because of that i recommend using the desktop client to anyone wanting to use DCTS for more than just trying it out.
… a bad actor could modify their server and or web client code to catch keys, modify messages and more. Thats why encryption can only be fully trusted and be done by the desktop client …
Only works if the public key of you and the receiver is known to the server. … Messages sent with the web client wont be encrypted.
He published the attack. The operator of the instance you join can ship a modified web client. Web DMs are unencrypted. E2EE needs public keys sitting on that server. “Technically impossible to hold the keys” is his marketing voice talking over his own README.
dcts-client-shipping README.md
to be able to sync they are also stored on the server, but everything encrypted
u/HackTheDev, 9 Sep 2026, r/dcts comment
Channels arent encrypted because it doesnt make any sense for public channels or possible staff channels if staff change every now and then.
u/HackTheDev, 22 Jul 2026, r/dcts comment
As of right now its not possible for you to change your password in case you forget it when trying to log-in. You will need to reach out to an instance admin for them to change it for you.
docs/Lore/Technical overview.md, which also says the database stores “reports, dms, and much more.”
Self-hosting moves the keys to whoever runs that instance. The founder page is about handing a community to the person who writes the smear table, the CLA, and “fuck around and find out.” His reply never touched that.
He said the rest of this site is made up or stale, then declined to name those statements. Here is a live check from 18 October 2026, the day after his post. These are still on dcts.community or in the shipping repo.
On a phone, swipe the table sideways.
| What this site said | Still there on 18 Oct 2026? | Click it |
|---|---|---|
| Homepage “trustworthy” row is a smear sheet: Stoat deception / CSAM / incompetence, Fluxer “Possibly vibe coded,” Spacebar mismanagement and reading DMs, all cited to r/dcts. | Yes. Same links, same cells. | dcts.community comparison table · CSAM post · deceptive tactics · “Possibly vibe coded” |
| “No ego, misleading reports or FOMO tactics!” | Yes, still on features.html, under Fairness. | features.html |
| “screensharing up to theoretical 4k@60fps” | Yes. | features.html |
Empty license and empty author in package.json |
Yes. Version 1.3.3.4, both fields still "". |
package.json |
@hackthedev/dsync-pay and @hackthedev/dsync-shop |
Yes, still dependencies. | package.json |
| E2EE DMs happened because “it was thought to be cool.” Development “can seem pretty random.” | Yes. | About DCTS.md |
| CLA, “Dont work on stuff randomly,” pre-approved PRs only, AI “should be avoided” | Yes. | CONTRIBUTING.md |
| “there arent any known instances yet” and the client still is not fully complete, so federation can wait | Yes, still in the live Principles doc. | docs.dcts.community/Lore/Principles (the GitHub file Principles.md 404s; the VitePress page is still served) |
| Public instance plus Discord invite in the README | Yes. | README.md |
| Password changes go through an instance admin | Yes. | Technical overview.md |
Weeks-old and months-old are still current when the maintainer leaves the page up. A comparison table that calls a rival a CSAM story is not a “topic from weeks ago.” It is the current marketing site.
Some of the original gotchas on this site are stale. We are marking them the same way we marked the member count.
Ultimate-Testimonial-Slider.css and hero-nature backgrounds.discord.js listed in package.json dependencies.discord.js ^14.27.0 on the root package. On 16 July 2026 he described the Discord bridge as “an actual ‘bot’ made with discord.js and runs as a plugin in DCTS.” commentCorrecting a subscriber count and a typo is maintenance. The CLA, the smear table, and the threat model are still there. He chose the two lines that looked easiest, called the rest non-sense, and posted screenshots.
He says a dedicated group bought domains including slop.business and dcts.exposed to spread misinformation, and that the owner is u/dingustani. He cites this comment as proof the websites were “made using AI.”
The comment he linked is u/dingustani writing:
the truth is the truth, regardless of tools used to display it
i write all my reddit posts by hand
That is a sentence about Reddit posts. It does not make license: "" disappear. It does not un-publish the Stoat CSAM footnote. Naming a username is easier than opening package.json.
He also built r/discord_alternatives after a ban from r/DiscordAlternatives, then cross-posted the troll warning there. Arctic Shift recorded 5 subscribers on that cross-post. Critical thinking, as he put it at the end of the r/dcts thread, starts with the files.
features.html still sells “No ego.” The public comments are the product notes. A sample from summer 2026, all from u/HackTheDev, all clickable:
spamin hate comments about me all day doesnt make you seem better. please seek mental help
20 Jul 2026, r/DiscordAlternatives
please seek professional help.
20 Jul 2026, r/DiscordAlternatives
… then cry about it when being called out calling people mean. this is beyond pathetic.
20 Jul 2026, same thread, comment, which then pastes his Stoat/Spacebar smear links again
Maybe seek professional help.
20 Jul 2026, r/DiscordAlternatives
ur really mad for that ban huh. get some mental health help
17 Jul 2026, r/DiscordAlternatives
stoat is trash. they barely did shit in years, have ego issues that go so far that they didnt remove csam right away because they insisted on an official email and more bullshit
20 Jul 2026, r/DiscordAlternatives
And yes, maybe it seems rude, but there is a saying “you get what you give”, aka fuck around and find out. im not the type of person to sugar coat things.
18 Jul 2026, on his own subreddit, r/dcts
… its beyond pathetic.
that being said, go back to the place where you came from, i dont want people like you to be part of a community thats genuinely trying to actually improve the internet.
18 Jul 2026, same thread, r/dcts
stay mad
18 Jul 2026, r/DiscordAlternatives
The older GIF-API writeup is still on the founder page: instant perma-ban, then “scummy,” then “childish.” That is the same week he told people on r/dcts to seek mental help and to go back where they came from. The troll warning asks readers to treat this site as the harassment.
He wrote that answering the rest of the claims would be a cat-and-mouse game, so he would not do it. The files do not move when he posts a warning. The comparison table is still a list of his own threads. The threat model still says the server has full authority. The license field is still empty. r/dcts has about 2,600 members, and that is now written on this site with the old figure struck through.
If a line here goes stale, the next edit will strike it and cite the new file. Posting “non-sense anyway” is how you avoid opening your own README.