5 ms·

I'm one of the affected users. My initial reaction was that I had absolutely no idea that this site even existed. While this is publicly facing data, it might

by r3bl 10y ago

I'm one of the affected users. My initial reaction was that I had absolutely no idea that this site even existed. While this is publicly facing data, it might explain some situations that I experience, such as people sending me generic recruitment emails to my old email address (the one leaked here, that hasn't been on my GitHub page for months now) filled with the name of the GitHub repository with the most stars and telling me how they liked my code in that repository (even though the most popular one on my profile is not software-related at all). Mini ask HN to those whose email address is public on GitHub: How frequently do you get these kinds of recruitment emails?

proaralyst 10y ago
Fairly regularly. On the address leaked too.
perryh2 10y ago
If you haven't already, change the email to some "noreply" address in the commits you author and add that to your GitHub profile so they can be attributed to you. I've built a similar scraper for recruiters as a source for talent leads when I used to work at a big company.
- cyphar 10y ago
  I don't see why people have such a huge issue with email being in public commits. I maintain a large project (runC) and sign all of my commit with my company email -- which makes noreply.github.whatever not a viable option. Not to mention that sometimes I get useful emails rather than recruiter spam, and I got my current job from using my email in commits (my employer approached me). But for those who care, the best solution would be if GitHub didn't show emails in their webui or APIs -- you have to clone the repo to get the information. That makes it prohibitively expensive to scrape every repo on GitHub (so you'd have to narrow down what repos you're interested in).
Kpourdeilami 10y ago
I once cloned a .NET repo to my Github and ever since I keep getting emails from recruiters about .NET job opportunities despite not having .NET (and things related to .NET) listed as one of my skills anywhere else
- roblabla 10y ago
  Heh. I made a PR to a haskell project with lots of stars (pandoc) and since that I've gotten a few mails about Haskell opportunities. Even though a simple two character change to pandoc is my only Haskell experience...
avar 10y ago
Maybe one a month. Usually "We saw your profile on GitHub which matches <our vague search criteria> and would you be interested in <hackathon/conference/somesuchthing>?". To hijack your comment for my own follow-up question. I'm in the EU (Netherlands). Many of these mails are clearly mass E-Mails with just my name as a template sent by some US-based company, they'll include an unsubscribe link for future E-Mails, but aren't unsolicited mass-marketing E-Mails like these illegal in the EU, and if so would it be worthwhile reporting them, and who to?
- chris_7 10y ago
  Flag as spam with your email provider would be a good start.
- pavel_lishin 10y ago
  If they don't follow the CAN-SPAM regulations, they're illegal in the US as well.
shurcooL 10y ago
My email is public on my GitHub profile (it's the same as my git author email, which is also public) for the last few years, and I don't have a huge problem with spam. I get a couple emails occasionally (a few every month), and they're easy to say "no thanks" to. What made the most positive difference was deleting my LinkedIn account, I was getting way more spam there (via its own messaging system, not via email) that was very unpleasant.
- alexandrerond 10y ago
  Well I'm puzzled because my email is not public on my Github profile and I don't recall it ever was :S
  - Eun 10y ago
    Maybe your profile is private, your commits aren't. Your email in the commits can be scanned easy as well.
    - alexandrerond 10y ago
      I thought so, but then they would have other emails too, and I don't see why they'd tag it as "primary" if they'd gone those lengths..
johnnydoebk 10y ago
>> How frequently do you get these kinds of recruitment emails? I'm actively contributing to popular projects, have more than a dozen of followers, and my email is public but I have never received any recruitment emails. It's a pity.
- r3bl 10y ago
  I have ~450 contributions in the last year, ~100 followers, my email address is public, and I have two mildly popular repositories (with a couple of hundred stars). I wish they were useful, but most of them are automated and when you follow up, you usually get greeted by an email stating that they're looking for someone with completely different background than you have. You might be lucky not to receive them. I feel like, if I were looking for a job, I would have more luck with "Who wants to be hired" threads posted here on a monthly basis.
  - chris_7 10y ago
    I don't understand how you can use that thread unless you're currently unemployed. Is the hope just that no one else at your company reads it?
    - r3bl 10y ago
      > ...if I were looking for a job... I didn't use it, and probably won't any time soon, but once I start looking for a job, I feel like my chances are much higher with that thread than with the emails I get from people who purchased the services this company is offering.
      - chris_7 10y ago
        I get that, but how do you prevent your current company from seeing the post and identifying you?
        r3bl 10y ago
        Well, luckily, my contract does have a clause stating that any party needs to let the other party know in advance that they are leaving the position / getting fired, so I will not have a problem with that.
midwestcode 10y ago
Regularly to the public email listed, I just set mine to private, didn't even realize it was public...
jlarocco 10y ago
I don't think I've ever received a recruitment email due to my email being public on GitHub. They probably get caught in the spam filter. Also, people using GitHub should know better than to call this a leak. If it was public on GitHub, it's public on the internet.
philbo 10y ago
Maybe once every 2 or 3 months I get an email from a recruiter, and it gets immediately marked as spam. Far more frequently though, I get emails from people asking interesting questions either about one of my projects or about something they're doing that is similar to one of my projects. I consider the (very low) cost of recruiter spam to be a price worth paying to enable those other interactions.
gt2 10y ago
Up to 5 times per month here.
cycomachead 10y ago
Maybe 5-6 a month? Sometimes a bit more. (Excluding one company who would spam me all the time but stopped.) But my resume is public, my email is my screenname@gmail so it's not like anyone has a hard time guessing who I am. I also recently graduated from Berkeley - so I have no doubt that with a simple search things could rank me as being possibly looking for a job. Then again, there's no way in hell I'm a "Senior Blah Blah", so I would guess a decent amount of the emails I get have been from scraping. (I always gave real recruiters a better email address.)
stevekemp 10y ago
I created a (semi) popular application using C++ & Lua. I used to get automated recruitment mails as a result of that every few weeks. But then I created a github organization and moved the repositories beneath that instead of under my own login - and at that point the mails ceased, immediately. I wonder if the crawlers just assumed "Organisation == Company". It was an unexpected benefit anyway. The only downside is those online sites where they rank your popularity/skills in different languages now only consider my personal repositories and I'm not longer in the top 5% of C++ coders. I can live with that!

by r3bl 10y ago

proaralyst 10y ago

Fairly regularly. On the address leaked too.

perryh2 10y ago

If you haven't already, change the email to some "noreply" address in the commits you author and add that to your GitHub profile so they can be attributed to you. I've built a similar scraper for recruiters as a source for talent leads when I used to work at a big company.

cyphar 10y ago
I don't see why people have such a huge issue with email being in public commits. I maintain a large project (runC) and sign all of my commit with my company email -- which makes noreply.github.whatever not a viable option. Not to mention that sometimes I get useful emails rather than recruiter spam, and I got my current job from using my email in commits (my employer approached me). But for those who care, the best solution would be if GitHub didn't show emails in their webui or APIs -- you have to clone the repo to get the information. That makes it prohibitively expensive to scrape every repo on GitHub (so you'd have to narrow down what repos you're interested in).

Kpourdeilami 10y ago

I once cloned a .NET repo to my Github and ever since I keep getting emails from recruiters about .NET job opportunities despite not having .NET (and things related to .NET) listed as one of my skills anywhere else

roblabla 10y ago
Heh. I made a PR to a haskell project with lots of stars (pandoc) and since that I've gotten a few mails about Haskell opportunities. Even though a simple two character change to pandoc is my only Haskell experience...

avar 10y ago

Maybe one a month. Usually "We saw your profile on GitHub which matches <our vague search criteria> and would you be interested in <hackathon/conference/somesuchthing>?". To hijack your comment for my own follow-up question. I'm in the EU (Netherlands). Many of these mails are clearly mass E-Mails with just my name as a template sent by some US-based company, they'll include an unsubscribe link for future E-Mails, but aren't unsolicited mass-marketing E-Mails like these illegal in the EU, and if so would it be worthwhile reporting them, and who to?

chris_7 10y ago
Flag as spam with your email provider would be a good start.
pavel_lishin 10y ago
If they don't follow the CAN-SPAM regulations, they're illegal in the US as well.

shurcooL 10y ago

My email is public on my GitHub profile (it's the same as my git author email, which is also public) for the last few years, and I don't have a huge problem with spam. I get a couple emails occasionally (a few every month), and they're easy to say "no thanks" to. What made the most positive difference was deleting my LinkedIn account, I was getting way more spam there (via its own messaging system, not via email) that was very unpleasant.

alexandrerond 10y ago
Well I'm puzzled because my email is not public on my Github profile and I don't recall it ever was :S
- Eun 10y ago
  Maybe your profile is private, your commits aren't. Your email in the commits can be scanned easy as well.
  - alexandrerond 10y ago
    I thought so, but then they would have other emails too, and I don't see why they'd tag it as "primary" if they'd gone those lengths..

johnnydoebk 10y ago

>> How frequently do you get these kinds of recruitment emails? I'm actively contributing to popular projects, have more than a dozen of followers, and my email is public but I have never received any recruitment emails. It's a pity.

r3bl 10y ago
I have ~450 contributions in the last year, ~100 followers, my email address is public, and I have two mildly popular repositories (with a couple of hundred stars). I wish they were useful, but most of them are automated and when you follow up, you usually get greeted by an email stating that they're looking for someone with completely different background than you have. You might be lucky not to receive them. I feel like, if I were looking for a job, I would have more luck with "Who wants to be hired" threads posted here on a monthly basis.
- chris_7 10y ago
  I don't understand how you can use that thread unless you're currently unemployed. Is the hope just that no one else at your company reads it?
  - r3bl 10y ago
    > ...if I were looking for a job... I didn't use it, and probably won't any time soon, but once I start looking for a job, I feel like my chances are much higher with that thread than with the emails I get from people who purchased the services this company is offering.
    - chris_7 10y ago
      I get that, but how do you prevent your current company from seeing the post and identifying you?
      - r3bl 10y ago
        Well, luckily, my contract does have a clause stating that any party needs to let the other party know in advance that they are leaving the position / getting fired, so I will not have a problem with that.

midwestcode 10y ago

Regularly to the public email listed, I just set mine to private, didn't even realize it was public...

jlarocco 10y ago

I don't think I've ever received a recruitment email due to my email being public on GitHub. They probably get caught in the spam filter. Also, people using GitHub should know better than to call this a leak. If it was public on GitHub, it's public on the internet.

philbo 10y ago

Maybe once every 2 or 3 months I get an email from a recruiter, and it gets immediately marked as spam. Far more frequently though, I get emails from people asking interesting questions either about one of my projects or about something they're doing that is similar to one of my projects. I consider the (very low) cost of recruiter spam to be a price worth paying to enable those other interactions.

gt2 10y ago

Up to 5 times per month here.

cycomachead 10y ago

Maybe 5-6 a month? Sometimes a bit more. (Excluding one company who would spam me all the time but stopped.) But my resume is public, my email is my screenname@gmail so it's not like anyone has a hard time guessing who I am. I also recently graduated from Berkeley - so I have no doubt that with a simple search things could rank me as being possibly looking for a job. Then again, there's no way in hell I'm a "Senior Blah Blah", so I would guess a decent amount of the emails I get have been from scraping. (I always gave real recruiters a better email address.)

stevekemp 10y ago

I created a (semi) popular application using C++ & Lua. I used to get automated recruitment mails as a result of that every few weeks. But then I created a github organization and moved the repositories beneath that instead of under my own login - and at that point the mails ceased, immediately. I wonder if the crawlers just assumed "Organisation == Company". It was an unexpected benefit anyway. The only downside is those online sites where they rank your popularity/skills in different languages now only consider my personal repositories and I'm not longer in the top 5% of C++ coders. I can live with that!