5 ms·

I am honestly surprised how little SPAM there is on GitHub in general. Please don’t take that as a challenge! I’ve encountered a single instance. On a library

by donatj 4y ago

I am honestly surprised how little SPAM there is on GitHub in general. Please don’t take that as a challenge! I’ve encountered a single instance. On a library I maintain, I recently had a PR and a series of comments added on all my outstanding issues made by a person advertising their for-pay SaaS alternative. Every problem someone had “Just try my SaaS with this connector instead…” I hid the comments, closed the PR asking me to link it from my README, while chastising the person a little. Looking at the user’s profile/history he had done similar to many other related libraries. I reported the profile to GitHub and the whole profile was gone with all his comments and tickets in a matter of hours. I honestly feel a little bad about that resolution, here was a person who probably put a decent chunk of time into his SaaS and just made the mistake of advertising it in an obnoxiously intrusive manner. They had legit git repos, now gone. I could have seen a younger dumber myself in their shoes, especially as I literally built the same SaaS ten years ago, using my library, and didn’t get a single person to bite.

wccrawford 4y ago
I woke up to some huge spam threads from Github this morning. Someone figured out how to notify everyone in a major repo (at least, I think that's what happened), and others piled on with nonsense comments and even some very disgusting images. Sure, it's nice how little there is, but it's definitely there.
- nmstoker 4y ago
  Covered here: https://news.ycombinator.com/item?id=31627061 https://news.ycombinator.com/item?id=31627061
- Blackthorn 4y ago
  Seems like people have recently realized this is an attack vector. Starting May 31, I've received an immense amount of spam. GitHub, in their infinitesimal wisdom, make you log in to unsubscribe! Which of course I can't do on my phone. So I've taken to reporting their notifications as spam.
phil294 4y ago
yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves contain so many email addresses that are otherwise hidden from the platform. In a recent test of mine, out of 60 people that had their contact email hidden in their profile, I could still determine it by looking into commit authorships in at least some of their repositories. Why is noone targetting these? These are all active and often personal accounts, meant to not be discoverable. IMO there's also no point in remaining silent about this, it's only a matter of time until the spam starts coming in over this channel. I'm pretty certain some day GitHub will cloak commit emails by default.
- jhugo 4y ago
  > I'm pretty certain some day GitHub will cloak commit emails by default. GitHub modifying the commit would be incompatible with signed commits. Edit: I'm pretty sure it would also change the commit hash, making your history and GitHub's history divergent.
  - solarkraft 4y ago
    GitHub gives you an E-Mail address for commits through the web UI (see the E-Mail tab in settings), which you can just use for your local commits as well.
    - jhugo 4y ago
      Yes. That's a different thing from GH rewriting the commits as the comment I replied to suggested.
    - jwilk 4y ago
      Documented here: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address https://docs.github.com/en/account-and-profile/setting-up-an...
- mcpherrinm 4y ago
mtmail 4y ago
A HN recently complained about GitHub closing their account. The GitHub activity was similar: PR pointing to their product. Also 90% of HN comments were basically "interesting submission, also checkout <my url>". So the user was either dense or didn't understand that it is a kind of SPAM. Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can.
- indigochill 4y ago
  > Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can. I did 4 years at a startup where my job was essentially this (we were a small news startup and I lead a small team of mostly college interns sharing links to our news videos with bloggers). _However_, there is a very crucial step I've rarely seen followed in the wild, and that is _actually_ engage in the conversation. "Cool, here's a URL to my product" is spam. But actually investing time into a thoughtful comment (and first evaluating whether your product is actually a good fit for the problem) is not, IMO. "But I don't have time" is not a valid excuse here. If you don't have time to engage with your prospective customers and really understand their needs and where they're at, what are you doing communicating about your product? In my experience doing this, you'll still get a mix of people who receive it well and some who don't. Keep a list of both. Then you know who to follow up with and who to avoid so you don't develop an antagonistic relationship with them. Also, looking at the numbers, this didn't look like a particularly cost-effective approach to communication at the time. We were not at all playing a numbers game but were instead trying to build relationships with bloggers who would feel comfortable including our content where they believed it would genuinely contribute to their blog and their audience. Over time, maybe the time we invested up-front paid off. I left to other things before I got to assess that. On the other hand, we were basically developing relationships with unpaid "influencers" around 2008-2012, so maybe we were on to something (in any case, the startup sold to E.W. Scripps for ~$35 million in 2014 and is still part of their portfolio today).
  - bingohbangoh 4y ago
    Not saying you're wrong, but its very defeating to participate in online conversations and hope somebody sees the URL on your profile.
INTPenis 4y ago
Funny you should say that now because I just saw my first spam in a github issue thread yesterday. And there was no way to report it.
adamwathan 4y ago
We get an unbelievable amount of spam in the Tailwind CSS repo, especially in Discussions. Usually it’s people posting some Markov chain looking sentence to make it seem somewhat real, then a couple of hours later it is edited to add a link to some website.
Karliss 4y ago
I had completely opposite experience when I was actively participating in maintenance of medium size project. Waves of randomly generated pull requests and issues containing randomly inserted words with usernames that seemed to follow similar pattern. Dozens per day if not hour. Reported them countless times but there was no reaction from Github beside the initial automatic response, even after half a year those accounts where still there. Only thing that somewhat helped was limiting PR and issues to contributors for a week or so (which is bad for users). Afterwards it was possible to turn them back on for everyone. But after few months of silence the bots where back. The whole thing was slightly bizarre. And their goal was unclear. The messages never contained any actual ads or links. It looked like someone is trying to simulate real accounts behavior. Those accounts where doing similar thing to other real repositories and also making nonsensical activity in each others forks of real projects. Maybe the person was still testing how to avoid bot detection. Or maybe the goal was accumulating accounts which could later be used for selling stars.
- michaelbuckbee 4y ago
  A lot of filters for finding spam in systems look at values like the relationship between reports (for bad behavior) vs "good" contributions. Spammers will try to game the system by pushing out lots and lots of "good" contributions to then be able to sneak in the few really bad ones.

by donatj 4y ago

wccrawford 4y ago

I woke up to some huge spam threads from Github this morning. Someone figured out how to notify everyone in a major repo (at least, I think that's what happened), and others piled on with nonsense comments and even some very disgusting images. Sure, it's nice how little there is, but it's definitely there.

nmstoker 4y ago
Covered here: https://news.ycombinator.com/item?id=31627061 https://news.ycombinator.com/item?id=31627061
Blackthorn 4y ago
Seems like people have recently realized this is an attack vector. Starting May 31, I've received an immense amount of spam. GitHub, in their infinitesimal wisdom, make you log in to unsubscribe! Which of course I can't do on my phone. So I've taken to reporting their notifications as spam.

phil294 4y ago

yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves contain so many email addresses that are otherwise hidden from the platform. In a recent test of mine, out of 60 people that had their contact email hidden in their profile, I could still determine it by looking into commit authorships in at least some of their repositories. Why is noone targetting these? These are all active and often personal accounts, meant to not be discoverable. IMO there's also no point in remaining silent about this, it's only a matter of time until the spam starts coming in over this channel. I'm pretty certain some day GitHub will cloak commit emails by default.

jhugo 4y ago
> I'm pretty certain some day GitHub will cloak commit emails by default. GitHub modifying the commit would be incompatible with signed commits. Edit: I'm pretty sure it would also change the commit hash, making your history and GitHub's history divergent.
- solarkraft 4y ago
  GitHub gives you an E-Mail address for commits through the web UI (see the E-Mail tab in settings), which you can just use for your local commits as well.
  - jhugo 4y ago
    Yes. That's a different thing from GH rewriting the commits as the comment I replied to suggested.
  - jwilk 4y ago
    Documented here: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address https://docs.github.com/en/account-and-profile/setting-up-an...
mcpherrinm 4y ago

mtmail 4y ago

A HN recently complained about GitHub closing their account. The GitHub activity was similar: PR pointing to their product. Also 90% of HN comments were basically "interesting submission, also checkout <my url>". So the user was either dense or didn't understand that it is a kind of SPAM. Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can.

indigochill 4y ago
> Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can. I did 4 years at a startup where my job was essentially this (we were a small news startup and I lead a small team of mostly college interns sharing links to our news videos with bloggers). _However_, there is a very crucial step I've rarely seen followed in the wild, and that is _actually_ engage in the conversation. "Cool, here's a URL to my product" is spam. But actually investing time into a thoughtful comment (and first evaluating whether your product is actually a good fit for the problem) is not, IMO. "But I don't have time" is not a valid excuse here. If you don't have time to engage with your prospective customers and really understand their needs and where they're at, what are you doing communicating about your product? In my experience doing this, you'll still get a mix of people who receive it well and some who don't. Keep a list of both. Then you know who to follow up with and who to avoid so you don't develop an antagonistic relationship with them. Also, looking at the numbers, this didn't look like a particularly cost-effective approach to communication at the time. We were not at all playing a numbers game but were instead trying to build relationships with bloggers who would feel comfortable including our content where they believed it would genuinely contribute to their blog and their audience. Over time, maybe the time we invested up-front paid off. I left to other things before I got to assess that. On the other hand, we were basically developing relationships with unpaid "influencers" around 2008-2012, so maybe we were on to something (in any case, the startup sold to E.W. Scripps for ~$35 million in 2014 and is still part of their portfolio today).
- bingohbangoh 4y ago
  Not saying you're wrong, but its very defeating to participate in online conversations and hope somebody sees the URL on your profile.

INTPenis 4y ago

Funny you should say that now because I just saw my first spam in a github issue thread yesterday. And there was no way to report it.

adamwathan 4y ago

We get an unbelievable amount of spam in the Tailwind CSS repo, especially in Discussions. Usually it’s people posting some Markov chain looking sentence to make it seem somewhat real, then a couple of hours later it is edited to add a link to some website.

Karliss 4y ago

I had completely opposite experience when I was actively participating in maintenance of medium size project. Waves of randomly generated pull requests and issues containing randomly inserted words with usernames that seemed to follow similar pattern. Dozens per day if not hour. Reported them countless times but there was no reaction from Github beside the initial automatic response, even after half a year those accounts where still there. Only thing that somewhat helped was limiting PR and issues to contributors for a week or so (which is bad for users). Afterwards it was possible to turn them back on for everyone. But after few months of silence the bots where back. The whole thing was slightly bizarre. And their goal was unclear. The messages never contained any actual ads or links. It looked like someone is trying to simulate real accounts behavior. Those accounts where doing similar thing to other real repositories and also making nonsensical activity in each others forks of real projects. Maybe the person was still testing how to avoid bot detection. Or maybe the goal was accumulating accounts which could later be used for selling stars.

michaelbuckbee 4y ago
A lot of filters for finding spam in systems look at values like the relationship between reports (for bad behavior) vs "good" contributions. Spammers will try to game the system by pushing out lots and lots of "good" contributions to then be able to sneak in the few really bad ones.