22 ms·
GitHub user sends notification to 400k users
- cturhan 4y agoThat’s not the kiddo’s fault. GitHub should have a feature when you tag a group, it should show how many people will be notified and ask for confirmation. Anyone will be afraid if they see a warning like “This message will notify 400k people. Are you sure?”
- ALittleLight 4y agoWhy would GitHub let a random person notify 400k people? Maybe I'm not fully understanding this. I've never really looked into limits around @'ing people. Could I just open a random PR and @EpicGames/developers to notify 400k people just to annoy them? Why doesn't this happen non-stop?
- spinaltap 4y agoSomething like this should have happened 5 years ago. I'm surprised it took so long. It's a proof that github users are generally good citizens.
- version_five 4y agoCan someone please explain this? How did he send it to 400k people?
- adamnemecek 4y agoBy doing “ @EpicGames/developers”
- version_five 4y agoThanks
- zamalek 4y agoSo, essentially, open another pointless PR and @ them again.
- shhsshs 4y agoDoes @EpicGames/developers really have 400k users? That seems like a lot of developers.
- thejosh 4y agoYes, to get access to their repositories you have to be granted access. It's source available, not opensource.
- mumblemumble 4y agoUnreal Engine is a very popular project.
- deleted 4y ago[deleted]
- shakna 4y agoTo access things like Unreal, Epic required you join the GitHub org. So there's that many people as part of it.
- tony 4y agoThe toothpaste is out of the tube - notifications are going to be scrutinized more in the future, from this point on. I got the email. And about 20+ responses to that email. Every person who replies to that issue triggers another 400k emails. Personally, my email client is crashing. EpicGames, as a GitHub org is an outlier, it's basically an SSO for Unreal Engine. I forgot I was even a member of it.
- seba_dos1 4y agoIt must be hard for GitHub servers, but which e-mail client is crashing from about 100 short, text-only messages received in an hour?
- tony 4y agoIrrelevant to the topic.
- pwython 4y agoOutlook 2003?
- blibble 4y agomy outlook 365 (or whatever it's called this week) at work can barely handle moving 100 without locking up
- mike256 4y agoMost probably Outlook! Imho the worst e-mail client on earth with a massive base of absolutely blind fanboys in almost every company...
- frosted-flakes 4y agoWhich Outlook? There are several different email clients with that name.
- nabakin 4y ago
- wilde 4y agoAnd the unsubscribe feature doesn’t even work.
- jffry 4y agoI used the "mute" conversation feature in GMail which at least stopped it from dinging me with notifications
- dvt 4y agoYou can leave the team on GitHub.
- boondaburrah 4y agoDoes that not also cause you to lose source code access? That's kind of a problem for people who need this for work.
- iuri1 4y agoThis assumes the sole purpose of that team is to get spammed
- quickthrower2 4y agoAh yes, the non working unsubscribes of SaaS and social media companies. I prefer the straight up mailchimp type marketing campaigns with one click to unsubscribe
- gabeio 4y agoIt does but each comment adds 400k emails to the queue before you, so all of the comments that happened before you unsubscribed are already queued. I unsubscribed and it did eventually stop.
- innocenat 4y agoI was sleeping and the constant new mails notification woke me. By then it was too late to unsubscribe as the topics was already locked, but I was only on like 60-70th mails.
- adamnemecek 4y agoHere’s the link https://github.com/EpicGames/Signup/pull/24#issuecomment-1146718968 https://github.com/EpicGames/Signup/pull/24#issuecomment-114...
- boondaburrah 4y agoThis is at least the second time this has happened. I even have a "wallet incident" folder in gmail for this.
- schappim 4y agoAnd this is how it ended: EpicGames locked as spam and limited conversation to collaborators now [1]. [1] https://files.littlebird.com.au/Shared-Image-2022-06-05-12-13-08.png https://files.littlebird.com.au/Shared-Image-2022-06-05-12-1...
- oefrha 4y agoIt doesn’t really fix the “vulnerability” though? Some other jerk can open a new PR and tag everyone again. Or just tag @EpicGames/developers elsewhere, no PR needed.
- SOLAR_FIELDS 4y agoThe thing that gets me, as discussed in this thread, is that the solution is often just super easy. Literally just pop up a modal when the recipient list is above 1,000 users that says “You’re about to send this to X,000 users, Are You Sure?” Would have totally avoided this situation.
- oefrha 4y agoAdding that check to every incoming comment in a large scale system and adding the previously nonexistent interactive UI for it is far from “super easy”. This is not a Todo MVC. There must be a thousand higher impact stories that are better targets of engineering time (unless this form of trolling become a new pastime). In addition, there are lots of actually malicious skids you can’t stop by asking nicely.
- weejewel 4y agoOr: show ‘x users’ behind the @group in a greyish label.
- zamadatix 4y agoLooks like they dealt with the tag too as https://github.com/orgs/EpicGames/teams/developers https://github.com/orgs/EpicGames/teams/developers is showing not found
- deleted 4y ago[deleted]
- stephenyeargin 4y agoAnd sadly, the party is over.
- smcleod 4y agoAnyone could have done this by mistake, all it'd take is being a bit tired and @ing the wrong group. The question is - why doesn't the platform warn you that you're going to send notifications to a large number of people in the same way that many email clients do?
- microtherion 4y agoOr in the way that `rn` used to do when posting to Usenet: > This program posts news to thousands of machines throughout the entire civilized world. Your message will cost the net hundreds if not thousands of dollars to send everywhere. Please be sure you know what you are doing.
- gnufied 4y agoYeah not sure why calls for getting the poster banned from Github - https://github.com/EpicGames/Signup/pull/24#issuecomment-1146720322 https://github.com/EpicGames/Signup/pull/24#issuecomment-114... . Seems bit excessive, murphy's law applies. Also the poster is essentially a kid. I would hold my judgement before flaming him fwiw.
- smcleod 4y agoRegardless of the mass notification or a bad quality PR - you don't just remove someone from a major internet platform like this, it's an inhumane response to someone making a mistake. Not to mention it's just a notification, who really cares unless it happens all the time which is just more of an argument to fix the platform behaviour. Some people are so high and mighty.
- woojoo666 4y agoIf it's possible for somebody to unintentionally piss off hundreds of thousands of people, that's not the person's fault. It's the system's. The internet allows proliferation of information at scale and speeds that can be disasterous if left unchecked
- 4y ago
- jmcgough 4y agoMy freshman class (~4000) at university was sent an email by administrators via the freshman class mailing list. Someone replied, which lead to their email being sent to the entire mailing list... another email asking to be removed from the mailing list, etc, suddenly everyone was hit by a deluge of hundreds of emails asking to be removed. Getting real flashbacks to that from the snarky / annoyed comments on this :)
- saghm 4y agoI had this happen at my job maybe six months ago? It was surreal because I'm young enough that I knew the trope from TV shows and stuff from the late 90s/early 2000s of people not knowing when to use "reply" instead of "reply all" but never actually had to deal with it by the time I grew up and starting working. The only thing more amusing than all of the people replying asking to be taken off the list is all the people who reply to tell everyone else to stop replying, as if that would solve the problem instead of making it worse.
- Dylan16807 4y ago> The only thing more amusing than all of the people replying asking to be taken off the list is all the people who reply to tell everyone else to stop replying, as if that would solve the problem instead of making it worse. There's a very good chance that those replies are reducing the flood, assuming they're nowhere near a majority.
- YPPH 4y agoWhen we migrated from on-premises Microsoft Exchange to Office 365, the default "reply" button in OWA was switched from reply-to-one to "reply all". After the CEO sent the first all-staff email on the new platform, we had at least three highly regrettable replies copied to the whole organisation, including one disclosing very confidential information intended only for the CEO.
- isoprophlex 4y agoHehe when I was an intern working on a big chemical industry site someone also accidentally reply-alled a plant-wide safety mailing list. This quickly started a similar deluge of mails until someone high up the chain of command all-caps yelled "NO MORE REPLYING ON THIS MAIL, OR IT WILL BE AN HR VISIT FOR YOU" Good times
- amozoss 4y agoMaybe they were an intern
- chupasaurus 4y agoNot an Epic employee.
- wiseowise 4y agoOP can barely type, if that’s the case - I cannot imagine how bad are Epic’s hiring practices.
- truncate 4y agoHaha, like how the top two HN posts right now are: - GitHub user sends notification to 400000 users - How to stop USPS junk mail
- bozhark 4y agoThe algorithm at work
- deleted 4y ago[deleted]
- fortran77 4y agoI don't get this comment on github: > Lock it. Lock it now. This is the friendliest message I'm going to send, while I look for ways to get OP banned from Github for gross social misconduct. I imagine that "owner of bots universe" might be enough to get that account tagged as a bot, who knows how many communities across however many repositories that person just bothered across all of Github. Wasn't the message send as in innocent mistake? Why is this man adding fuel to the fire (sharpening his pitchfork?). Did I miss something about this?
- x86_64Ubuntu 4y agoHe's not adding fuel to the fire, he understands what is happening and is trying to convey the urgency to the owners of the repo.
- oddity 4y agoEvery large org I've ever been at has had someone reply-all to a company-wide mailing list and then promptly spawn a flood of more company-wide reply-alls. Slack's @channel/@here has made this even worse. On a good day, people have a laugh, tell them not to do it again, and we all move on. The only difference here is that it's in public on github. I suspect there's some psychological phenomenon that convinces people that norms expected of them have somehow been broken because of the chaos.
- they4kman 4y agoThe triggering comment was this > Perfect for gorgeous looks, can push asap @EpicGames/artv2-admin @EpicGames/developers @EpicTeamAdmin The entire diff of the PR is: diff --git a/README.md b/README.md index b0b4f5d..61b95bb 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,18 @@ # Epic Games +<div align="center"> + <img src="https://cdn2.unrealengine.com/Epic+Games+Node%2Fxlarge_whitetext_blackback_epiclogo_504x512_1529964470588-503x512-ac795e81c54b27aaa2e196456dd307bfe4ca3ca4.jpg" width="20%" min-width="100px" /> +</div> + Unreal Engine is now [free](https://www.unrealengine.com/blog/ue4-is-free)! -To access our repositories, sign up for a free account at [UnrealEngine.com](https://www.unrealengine.com) and register your GitHub ID using [these instructions](https://www.unrealengine.com/ue4-on-github). +To gain access for our repositories, sign up a free account on [UnrealEngine.com](https://www.unrealengine.com) and register your GitHub ID using [these instructions](https://www.unrealengine.com/ue4-on-github). -After that, you can find our repositories here: +After that, you may able to find our repositories here: * [Unreal Engine](https://github.com/EpicGames/UnrealEngine) * [Unreal Tournament](https://github.com/EpicGames/UnrealTournament) (Note that you must be signed into GitHub for these links to work.) + +Have Fun !!
- antoineMoPa 4y agoFun fact: at some point I wrote @param in a PR comment, talking about a parameter's doc. I only realized after posting that there was an actual user named @param.
- bityard 4y agoI have a two-letter github username and get tagged accidentally all the time. Also invitations to private repos.
- bdn_ 4y agoI am @3x and I get ~10 notifications a day of people mentioning me in PRs and issues. Whenever anyone writes the name of a file containing `@3x`, which is commonly used for hi-res assets, I get a notification. I quickly learned to turn off email notifications!
- chime 4y agoI had to turn off my paypal.me because I naively picked a number for a username and people kept putting that number in the send-to-username field and sent me free money, which they always tried to refund later, getting me stuck dealing with PayPal's customer service through no fault of mine. I would explain to them that I didn't ask for the money, I do not want to keep the money, and I am not accusing the sender of scamming. Sometimes I was able to refund instantly but depending on the sender and payment method, PayPal had to get involved for weeks of back and forth.
- avgcorrection 4y agoJust goes to show that you should always quote code with backticks.
- antoineMoPa 4y agoDoes tagging you automatically invite you to private repos?
- rzzzt 4y ago
- cy_overlord 4y agoGitHub testing social media feature
- flotwig 4y agoApproximately 61,761,765 emails sent, if we figure 1 email per comment per member. Nice!
- pixl97 4y agoBedlam DL3 please stand up.
- pdpi 4y agoMe too!
- nop_slide 4y agoThere are quite a few other, uh, interesting PRs for that repo. https://github.com/EpicGames/Signup/pulls https://github.com/EpicGames/Signup/pulls https://github.com/EpicGames/Signup/pull/10/files https://github.com/EpicGames/Signup/pull/10/files https://github.com/EpicGames/Signup/pull/18/files https://github.com/EpicGames/Signup/pull/18/files What is going on?
- moneywoes 4y agoLooks like one of those youtube comment scams that target teenagers
- ushakov 4y agoHacktoberfest flashbacks intensifies https://blog.domenic.me/hacktoberfest/ https://blog.domenic.me/hacktoberfest/
- iuri1 4y agoThis is truly "Epic": https://github.com/EpicGames/Signup/pull/18#pullrequestreview-995968989 https://github.com/EpicGames/Signup/pull/18#pullrequestrevie...
- gruez 4y agoLooking at the content of the OP and the PRs you linked, my first thought is "Is it Hacktoberfest[1] already?". I mean, seriously, what's up with the such low quality PRs? Is it common to have people spamming repos with trivial changes absent some sort of incentive? [1] https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_request_spam/ https://www.theregister.com/2020/10/01/digitalocean_hacktobe...
- ushakov 4y agoprobably for resume? “Contributed quality improvements to Epic Games Unreal Engine” luckily, GitHub makes it terribly easy to verify how much and what you actually contributed
- 4y ago
- gitgud 4y agoCan you only tag organisations who have worked on the repository? That would make sense I suppose...
- dandongus 4y agocan someone explain how this isn't the intended behavior?
- charcircuit 4y agoIt may be intended behavior, but for a trivial change like this to easily, without warning, mass ping ~400k users that is not desirable behavior. The submitter thought he was pinging developers of the project, but instead pinged mostly people who do not handle accepting upstream changes. Discord for examples handles mass pings by showing you a warning dialog saying you are about to ping X many people and if you are sure you want to do that.
- rgoulter 4y agoSending email notifications to 400,000 users for unimportant things is antisocial. (If 0.1% of those users then reply on the thread, it'd be another 400 comments sent to all 400,000 recipients). I don't think anyone sits down and thinks the intentional behaviour should be "we should make it easy for someone to send a notification email to 400,000 people". That would clearly be annoying. I think the behaviour is accidental, arising from "notifying all people in a team is useful".
- Ansil849 4y ago> Sending email notifications to 400,000 users for unimportant things is antisocial. What about requiring people to join a specific team to access the source for no apparent reason? In other words, how are the conditions which led to the creation of this inflated team not antisocial as well?
- chii 4y ago> a specific team to access the source for no apparent reason? it isn't for no apparent reason - it's to accept the terms of the agreement for access to the unreal source code.
- 4y ago
- moneywoes 4y agoLegend
- mixmasteralan 4y agoLargest code review ever?
- iuri1 4y agohttps://github.com/nerual https://github.com/nerual deserves a peace nobel
- datalopers 4y agowhat did this user do?
- vpzom 4y agothey're the one that locked the issue
- deleted 4y ago[deleted]
- zinclozenge 4y agoI muted it via gmail after trying to unsubscribe.
- cjk 4y agoI was on the receiving end of this. The notifications continued to pour in for another few minutes after I unsubscribed from the thread, totaling 104 by the time the madness stopped.
- deleted 4y ago[deleted]
- fellellor 4y agoUnsubscribeNotificationWorker has been queued. :)
- markus_zhang 4y agoIs there a warning when someone @ a huge number of users? Actually if one is never supposed to send notification to a large group, what's the point of creating such a group? I assume that maybe there is some admin value but then again the admin will trigger a notification storm, no?
- chupasaurus 4y agoThere isn't IIRC. And yeah, an ability to calling out public (semi-public in this case) groups is plain stupid. Even when you documented it [0] [0] https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#mentioning-people-and-teams https://docs.github.com/en/get-started/writing-on-github/get...
- faustomorales 4y agoSeems like an innocent enough mistake. Remind me of when I once helped organize a volunteer hackathon with people from different companies. We created a Slack organization just for the occasion. At the end of the event, I was supposed to ask all attendees to delete all the data we had given them before they went home. The message I posted to #general (the channel everyone in a Slack organization is required to be in) with @everyone tagged was something to the effect of: "Thank you everyone for contributing to our shared mission. When you are done with your work today, please delete all the data from your machines. Hope we see each other again soon!" Slack gave me a dire warning that my message would send notifications to so many people across so many time zones. This didn't surprise me because attendees came from various countries for the event. So I dismissed it. But I had accidentally sent it to my company's Slack organization instead of the hackathon-specific one. I didn't realize it until a co-worker sent me a private message asking why I had just tried to fire everyone at our company.
- macintux 4y agoOuch. I try to not mix work and personal content on the same laptop, I’ve seen too many glitches (although usually not quite that embarrassing). Slack has been my one exception (although only on my phone). Thanks for the valuable reminder.
- Ansil849 4y ago> I try to not mix work and personal content on the same laptop It's kind of jaw dropping to me at how this is still not the norm and how people gratuitously mix personal and work content on the same devices, both mobile and desktop.
- Stratoscope 4y agoI remember when I worked at an Alphabet company and they offered the option of using your personal phone to sign in to work stuff. (It wasn't Slack, it was one of the seventeen different chat systems they had going at the time.) There was a teensy-weensy little caveat: Google IT could wipe your personal device at any time! No thanks.
- srinathkrishna 4y agoI empathize with that kid - his intentions were probably good but I'm pretty sure he didn't know this would have sent email notifications. Even if he had known, kid wouldn't have known that it is a bad bad thing. :D Kid probably was creating a PR to brag tomorrow in school!
- charcircuit 4y ago>he didn't know this would have sent email notifications Even if it sent push notifications to everyone's browser and phone that doesn't seem much better. When you type an @ it gives you are description of a group and the description makes it clear that it's not the people related to reviewing his PR. He was just trying to send as many notifications as possible to try and get people to look at what he did.
- sidjor 4y agoOr may be it was a graded task. Wondering why he was trying to get it merged asap.
- ansible 4y ago> ... his intentions were probably good ... Are we looking at the same pull request? https://github.com/EpicGames/Signup/pull/24/commits/4e531d5c5e60ea600cfb51492367ec11d888f422 https://github.com/EpicGames/Signup/pull/24/commits/4e531d5c... That's ... a super crap PR, hovering near trollish behavior territory.
- Gigachad 4y agoIt's apparently a young person who submitted it. I think most of us who were that age with github available submitted some crap PRs. I remember I submitted some low quality PRs that just changed comment formatting/typos on some large repos. Not trolling, just trying to contribute in some way and get my name in the project without having enough skills for a real PR.
- bithaze 4y ago> just changed comment formatting/typos I'd call those minor (valid, of course) changes, not low quality changes like what led to this post.
- srrkk 4y agoDo not miss out on the essential contribution to Unreal Engine that the first line of the PR here makes: https://github.com/EpicGames/Signup/pull/18/files https://github.com/EpicGames/Signup/pull/18/files
- wheresmycraisin 4y ago
- deleted 4y ago[deleted]
- Kronopath 4y agoAfter unsuccessfully trying to unsubscribe, I acted quickly and made a Gmail filter to auto-trash any emails with that exact subject line. Here's hoping there's a postmortem at GitHub about this.
- zamadatix 4y agoI'm mostly surprised the group got to 400,000 before this happened.
- deleted 4y ago[deleted]
- Karliss 4y agoWell, this isn't the first time something like this happened. Last time I wanted to try out Unreal engine things where much worse, I received a notification (every?) time someone forked the UnrealEngine repository. Not only that I was automatically subscribed to the notifications of those forks. That was in 2016. Size of group was probably smaller than 400k at that time, not sure if notifications and autosubscribe went every fork->every member but plenty of people where complaining about it. From the dates it lasted at least for 2 days if not week and I think ended up leaving the group before it got fixed. After searching about it a bit more found a post from 2016 where Unreal is giving their Users instructions how to configure Github for receiving less spam from their gigantic group https://forums.unrealengine.com/t/github-notification-spam-and-disabling-auto-watch-on-unrealengine-github-forks/69975/8 https://forums.unrealengine.com/t/github-notification-spam-a...
- Ansil849 4y agoI'm confused. Can someone explain why the Epic Games developers team has close to 400k members?
- landr0id 4y agoThey require you to acknowledge some terms that grant you access to the Unreal Engine source code. They grant it by adding you to their GitHub org which has the engine source code as a private repo.
- md224 4y agoMaybe it's just me but this seems like a misuse of GitHub orgs...
- Angius 4y agoSeeing how there's no other way, well...
- chupasaurus 4y agoAn org and the team was opened to join in March 2015 4 months before the "secret" team functionality was added. No one cared for 7 years!
- olingern 4y agoYeah, seems like a silly way to grant access
- Gigachad 4y agoIs it? How else do you selectively grant access to a repo? Orgs are the normal way, it's just not normal to have a project which is proprietary and somewhat private but available to 400k people. Github just needs to rethink how tagging all users works and a way to prevent this.
- joshxyz 4y agoDamn I can't wait until somebody does that on tradingview's GitHub org.
- keyle 4y agoMy phone started going off like crazy with emails every 20 seconds :) What's so perfect, is the PR is complete horse shite. Trying to get something on the resume.
- alexb_ 4y agoMaybe this is annoying, but at least this came from something innocuous. A scammer could have very well used this to do something much worse - be thankful it was a mistake that did this! From what it looks like it's a brand new coder. I hope he sticks with it, because this will be one hell of a story he can tell...
- thrownawayalre 4y agoInnocent mistake. The kid is barely 18. The emotion and stress resulting from mistakenly sending a notification to 400,000 is likely overwhelming. Now his real name is going to stay at the center of the internet for a while thanks to being 1st on HN. I would definitely not have coped well with that much internet attention at his age. Some Github replies are more immature than the initial action and I hope he does not receive any threat. I hope the Epic developers reach out to him nicely with constructive feedback and maybe a thanks for his well-meaning PR.
- pigbearpig 4y agoI disagree, the PR is some pointless wordsmithing and then to comment "Verify the pull request and merge asap" is a bit ridiculous. Also, no one is going to care in a day.
- rcfox 4y ago> Also, no one is going to care in a day. You should ask Sumit Bhatia about that. ;)
- inb4_cancelled 4y agoWhat did the guy do?
- dmix 4y ago> An email requesting system access went out to all employees . It triggered a reply to all frenzy that resulted in my blackberry pinging constantly for over an hour with people replying-to-all asking to be removed from the distribution list. Even Mike Lazaridis replied to all asking this to be stopped. Then as different parts of the globe started work, they would reply to all. Classic evening. I think system admins eventually shut down the frenzy at server level. Some of the replies were hilarious though. I think I still have some screenshots somewhere. https://www.reddit.com/r/uwaterloo/comments/qstmls/sumit_bhatia_blackberry/?utm_source=share&utm_medium=ios_app&utm_name=iossmf https://www.reddit.com/r/uwaterloo/comments/qstmls/sumit_bha...
- Rolpa 4y agoI was in the affected group. Quite fun when my phone's notification sound is this: https://youtu.be/vVobKsbtdfI https://youtu.be/vVobKsbtdfI meow meow meow meooow
- fastball 4y agoSomething like this happened at my university a number of years ago. There was a side entrance that was ostensibly for usage by people with bikes (as it was part of the bike storage area), but it was much more convenient than the main entrance and all you had to do to get access was ask at the security desk. So anyway basically everyone on this campus with 10k+ students and more staff had access to the side entrance. What everyone didn't know was that when you were granted access to this entrance, you were also added to the "bike storage mailing list". Long story short, at some point someone accidentally sent a message to the entire mailing list of ~100k people, which kicked off a long string off people reply-all'ing asking to be taken off said mailing list ("I don't even own a bike why am I on this mailing list"), which caused even more people to reply ("stop reply-all'ing for the love of god!"). I think there were 500 emails in my inbox from that by the end of the day.
- pacetherace 4y agoI graduated 8 years ago and I check my university mailing address only for such useless but funny mail threads. haha
- ALittleLight 4y agoReply-all "Unsubscribe"
- jalino23 4y agoI don't get how this is a big deal? don't people just ignore notifs? so what if you get notified. just ignore it.
- romanovcode 4y agoOh the humanity! Nobody even reads these notifications since most who work using GH get like 20+ a day.
- brundolf 4y agoSlightly OT, but it's always been weird to me how Epic requires you to add yourself to their organization on GitHub before you can access the Unreal source. I don't see how it serves any real authentication purpose; anyone can get added to it, and anyway, it's not like the code is secret when 400k people are on there Am I missing something?
- sverhagen 4y agoI got curious and just found PR #20, which made me think this scheme gives Epic a way to hitch onto GitHub's management of export controls. I.e., if you're in a country to which US companies aren't allowed to disclose software, GitHub likely has this figured out, and by Epic requiring a GitHub account, they don't have to figure out all the rules and regulations themselves (again).
- brundolf 4y agoInteresting. I'm sure it's still trivial for people in those countries to still get the code, but maybe it's sufficiently distanced from Epic's reasonable ability to control things that they're in the clear legally?
- vineyardmike 4y agoYeah, epic not being able to share is unrelated to you being able to receive. It means someone else is breaking a rule/law.
- Angius 4y agoIt's not really authentication. Rather, a way of saying "yeah, I agree to the terms yadda yadda". Seeing how there's no other way of handling it right now, they're using what tools they have
- krick 4y agoI honestly don't see what's the big deal, and, if anything, why this isn't grossly abused all the time. I mean, that's just how Github works, isn't it? Anyone can tag anyone, uh, yeah, ok, whatever. Looks like an intended feature to me. Does Github have problems with sending 400k notifications at once? Doesn't look like that, but if it did, I guess they shouldn't have implemented such a feature, or allowed 400k users to sign up. Someone sent you, or 10, or 400k people a message they are not interested in? Well, yeah, I guess that's pretty much the essence of internet messaging (or human communication in general), it happens to everyone daily. So, what's the problem?
- Gigachad 4y agoIt's somewhat unique because of the odd situation the UE org is in. It isn't an internal company org, you get invited after accepting their terms and conditions which grants you access to the source code. Which means literally anyone can join this org and then ping 400k users. I'm not sure there is any other org/repo which this is possible. Yes it is expected behavior but its the scale and particular nature here that has turned expected behavior in to a dangerous tool.
- bspammer 4y agoWhat’s stopping someone from tagging everyone with “buy the hot new $SCAM cryptocurrency”? I’m amazed this wasn’t abused before.
- rickreynoldssf 4y agoYou would think, there'd be some sanity checks on GitHib's side to make sure this kind of thing doesn't happen, but no... it's not even going to question 400k notifications. ᕕ( ᐛ )ᕗ
- peterkelly 4y agoThe problem here is that GitHub allows this - anyone could have taken advantage of it. I don't know if the guy did it deliberately or accidentally, but that's beside the point. GitHub are in effect operating a spam relay by permitting anyone to email 400k people. I don't know what the solution is - whether it's limiting team sizes, or adding restrictions that only org admins can trigger such notifications when there are so many members. But if the underlying problem is not fixed, this will happen again.
- AmogusHayrettin 4y agoHe did a little trolling' by a mistake. i hope nobody hates him for that.
- a-dub 4y agoi don't understand all the drama. i have one whole extra thread in my inbox and it's actually rather entertaining to read. there are lots of real travesties in this world, this is not one of them.
- Gigachad 4y agoSome people have their email set to live ping which would make it much more annoying. I imagine it also cost a small fortune for Github to send this many emails.
- avl999 4y ago> Some people have their email set to live ping which would make it much more annoying. That sounds like a "those people" problem. We don't hold people who use door knobs to account for the sake of a small number of people who like to lick door knobs and then get sick. > I imagine it also cost a small fortune for Github to send this many emails. That sounds like a problem for Github for not implementing any kind of checks and balances on their perfectly open feature if for some reason sending emails is expensive for them.
- yakaccount4 4y agoThe problem is that GitHub's default subscription behavior is terrible. Unless the repo is mine or my account is directly @'d I shouldn't receive anything.
- noahtallen 4y agoI don’t necessarily agree. For example, I work in some OSS projects where the core maintainers are in a GH group, and the group is just pinged if their feedback is needed on a decision/conversation/PR. Only a couple dozen people in the group, and it gets maybe 3-4 notifications a day. Easy to ignore if I’m not needed. It seems like teams of 400k people aren’t quite within the spirit of the intended feature!
- ericls 4y agoWow, epic games has that many devs on GitHub?
- Gigachad 4y agoNo, anyone is allowed to join the org and see the source code after accepting a T&C. The org is just used to grant permission / acknowledge you accepted the terms.
- quadrifoliate 4y agoThe only notable thing here IMO is the lack of limits imposed by GitHub on notifications. Apparently a random tag of `@microsoft` in the comments was enough to notify 4000 people [1] as well. I have no idea why the user is even being mentioned in this headline. I haven't used GitHub in a while, and am unfamiliar with orgs and subgroups, but tagging a developer subgroup on a PR seems...a reasonable thing for a new contributor to do? How is it their fault that the developer subgroup has been hijacked by this organization to mean "Anyone who has ever signed the Terms of Service To View Our Code"? The correct thing for Epic Games to do here would be to rename the group to `@EpicGames/terms-of-service-signatories`, and restrict `@EpicGames/developers` to people who have requested access to open a PR. Assuming that people should magically know not to mention `@EpicGames/developers` in their PRs because Epic is doing some ToS shenanigans is preposterous. I guess I'll be looking carefully at mentions the next time I have to use this social network [2] masquerading poorly as a code review tool to submit a pull request. ---------------------------------------- [1] https://github.com/EpicGames/Signup/pull/24#issuecomment-1146722197 https://github.com/EpicGames/Signup/pull/24#issuecomment-114... [2] Looking at the profile of the contributor making the PR tells me that GitHub has apparently decided to let their users independently rediscover the experience of SuperWall on Facebook circa 2007.
- spullara 4y agoI agree. EpicGames and to some extent Github is at fault here.
- EugeneOZ 4y agoPeople who blame that kid are ridiculous. People who are asking to punish him somehow are pathetic. There should be no way to send any non-premoderated information to 400k people (from the system that has some trust and is unlikely to be filtered) - “spam” is the most innocent thing that might happen. It's just a fly you should ignore. Political, religious, and radical extremist groups could use it for a much more dangerous impact. If it so incredibly easy to send a message to 400k users, malicious actors could find some more sophisticated ways to get an audience of millions of users for their needs.
- 4y ago
- trinovantes 4y agoIt's pretty weird that GitHub allows issues to be disabled but not pull requests What if you just want to host open source code without any of the noise from the social network?
- octoberfranklin 4y agoThe noise is sort of the point of github, unfortunately. I think "mirror" repositories don't let you open PRs though.
- YPPH 4y agoSomeone else has intentionally submitted another. https://github.com/EpicGames/Signup/pull/26 https://github.com/EpicGames/Signup/pull/26
- LEARAX 4y agoI believe the notification did not get sent out for the first PR until a comment was posted on it (the PR was opened 2 days ago). I think the top commenter on this thread (Rob) may not realize his comment is the one that is triggering the first wave of notifications, based on his choice of sound effect.
- plus 4y agoNSFW warning: Someone has commented on this PR with goatse. Do not click at work.
- beefsack 4y agoI just opened the email, didn't need to see that. The image embedded and rendered in Gmail.
- sharno 4y agoAnother one was opened after the first issue was closed: https://github.com/EpicGames/Signup/pull/26#issue-1260958786 https://github.com/EpicGames/Signup/pull/26#issue-1260958786
- wolverine876 4y agoI think my most cringe-inducing story (of this kind) is receiving an 'is this thing working?' email test from a sender, identified by name, at a professional sports team (probably you've heard of the team). I didn't know the sender and had no work or business connection to the team - they seemed to have sent it to everyone in their customer database, which I guess is > 1 million. I felt so bad for the sender. (And also for whoever made that possible!) Come to think of it, I don't recall any reply-all responses, so they must have effectively bcc'd everyone at least. Thank goodness! I can't even imagine ...
- Bolkan 4y agoHow do you see how many people get notified by a mention
- FpUser 4y agoHa! I was curious why did I get 50 notifications out of blue
- deleted 4y ago[deleted]
- fellellor 4y agoThe worst part was that even unsubscribe to the thread does nothing and I kept on getting emails. However, this was fixed for me by creating a new email address and pointing all epic organisation emails to that one. … I wonder why unsubscribe didn’t work.
- tobyhinloopen 4y agoMaybe the emails were already scheduled
- StillBored 4y agoThis at tagging thing is sorta dumb anyway. Its a bandaid on the lack of reasonable user notification add/remove controls. I made the mistake a few months back of saying something like "and if you use our @corp.com email address the internal filter does X", and the stupid "chat" program proceeded to ignore the .com part and notify the entire company of a small tech discussion on my team. Cute.
- TeamMCS 4y agoMan it's still ongoing, and now the trolls have discovered it. The original thread somehow managed to crash my iphone due to the sheer number of replies. Amazing GH even made this possible. Not sure if there's also a data leak, I notice my email was CCed, not BCCed. Now they've managed to email nearly half a million people, this could go on for ages as idiots keep responding to the original chains. Wonder if EpicGames should temporarily mark their account as private till this gets sorted out. Glad I'm not the guy at the end of the phone trying to sort this car crash out.
- deleted 4y ago[deleted]
- bobobob420 4y agoI can scroll the entire thread on my iphone pretty easily. Those 50 replies crashed your iphone? Or am i missing something
- iuri1 4y agoYou're probably still experiencing pull request #26 which was an actual trolling.
- planb 4y agoSo apparently https://github.com/orgs/EpicGames/teams/developers https://github.com/orgs/EpicGames/teams/developers is a private group where anyone who wants to see the Unreal Engine source code has to join. Do you have to be a member of a group to send out notifications for mentions? If so, this guy did nothing wrong (besides the useless PR and his "fix this asap" attitude) - it's Epic misusing a GitHub feature. Sending notifications for mentions of _your_ team sounds like the reasonable default.
- unfunco 4y agoGitHub has a public option for repositories which would have allowed anyone to see the source code, but instead EpicGames wanted to collect more private information on anyone that wanted to see the source code, and now they have a PR problem because of it.
- rahkiin 4y agoThey wanted a signed ToS because it is only ‘source available’. Maybe GitHub just was not the best way to make a large readonky non-open source codebase available
- deleted 4y ago[deleted]
- WA 4y agoThere have been more PRs created with the same tagging and apparently, you can’t unsubscribe from individual PR notifications or taggings of organizations. That is what this is all about. See: https://github.com/EpicGames/Signup/pull/26 https://github.com/EpicGames/Signup/pull/26
- beefsack 4y agoThere was another PR created in the repo tagging the same group which someone posted a shock porn image to, which happened to embed and display in Gmail when I opened the notification email. Pretty sure this is going to provoke a response.
- nykolasz 4y agoPoor kid and a good lesson learned. Hope he doesn't get demotivated because of it. It reminds me of the old "everyone@company" email threads that would flood everyone.
- coffeeblack 4y agoIf group messages are possible, somebody will use them accidentally. Welcome to the internet.
- lizardactivist 4y agoInnocent mistake. The people in that thread who wants his head seem to be the kind who are always on the prowl for a victim to blame for something.
- blitzar 4y agoIts great to see a corporate mail server crash thanks to accidentally sending an email to the @all mailing list Followed by the Reply-all "Please unsubscribe me" crowd. Followed by the Reply-all "Out of office reply" infinite loop as out of office replies respond to the out of office replies.
- Szpadel 4y agoI think this is why auto-replys are usually send only something like once per day per email or something. Not sure if that's any standard behavior
- sockmeistr 4y agoThere's an RFC: https://www.rfc-editor.org/rfc/rfc3834 https://www.rfc-editor.org/rfc/rfc3834
- pmlnr 4y agoBedlam DL3 https://techcommunity.microsoft.com/t5/exchange-team-blog/me-too/ba-p/610643 https://techcommunity.microsoft.com/t5/exchange-team-blog/me...
- kappuchino 4y agoAnecdotal: I participated in the reddit secret santa back in ... 2012?! and we all "won" a certificate from guinness records. Except ... that you still had to buy it as a physical copy. And so some poor marketing person from guinness sent this email to all the participants - no bcc, not even cc. And then the frist person replied. Another. And another. It was a party. So guinness issued an apology (and hopefully didn't fire the person). And we got the certificates - as far as i remember - just for shipping and handling. Yay. Years later, people on the list still write to "all" - its a weird group, with secret giving in common but nothing else. I wonder if anyone from this list is lurking here ...
- iuri1 4y agoDid they sent the bonus certificate for participating in the biggest e-mail spam list as well?
- kappuchino 4y agoNo, but maybe GitHub can issue one now :-)
- waiseristy 4y agoJust got goatse’d by the second email chain, don’t open these! Christ almighty get your shit together epic
- usr1106 4y agoDo we have any estimates how many emails github sends every day? 400k might be a rather unnoticable increase on a global level? Edit: Of course if dozens or even hundreds of replies "Why am I on this list?", "Please (do what I say not what do) stop replying" go to 400k again then it gets "interesting". Could not see from the submission or discussion whether that happened. I think it should not happen by default or what kind of Reply-To: those messages have?
- Shadonototra 4y agoThat's what happen when you want to make github looks like the next Instagram with stories and stuff You attract the wrong users Core users end up moving away from you, that's what i did when they added the stories shit
- turbojerry 4y agoMy first thought was github had been hacked and came here to check what was going on,thanks adamnemecek for clearing the matter up for me.
- kalium-xyz 4y agoI just got the emails
- ProfXponent 4y ago
- baggiponte 4y agoI don’t really get how the notification to 400k people was sent :/
- ng12 4y agoBecause it's ridiculous. That "developers" GitHub group has 400k people in it.
- yunohn 4y ago> This is the friendliest message I'm going to send, while I look for ways to get OP banned from Github for gross social misconduct Wow, what an overreaction.
- Havoc 4y agoPretty wild that there isn't a countermeasure in place by default. Has nobody at github/microsoft experienced a Reply All email chain yet?
- jonathantf2 4y agoLooks like the OP is an 18 year old, this is a mistake that anyone could have made and it's certainly not their fault. Scrolling through the comments, some of the behaviour by other users is absolutely appauling. Shout out to this user: https://github.com/EpicGames/Signup/pull/24#issuecomment-1146720322 https://github.com/EpicGames/Signup/pull/24#issuecomment-114... for the worst possible response to an accident like this.
- vletal 4y agoCzech TV has a rather useful app which sends notifications about critical events, such as crises, election results, major government decisions... Once they accidentally sent a rubbish message with a bunch of non alphanumeric characters and a curse word right in the middle of it.
- emeraldd 4y agoWe use slack internally where I work. There is a somewhat unwritten rule that you should not use @here or equivalent as a general user. There are a few cases where it's ok to if you really have something for everyone in the channel ( Aka don't run this it's broken type stuff ...) so some channels leave @here enabled. Still, I go From mildly amused to feeling sorry for the unsuspecting newbie who didn't look at the size of the channel and think: Do 4k people really need to hear about my problem?