4 ms·
yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves cont
by phil294 4y ago
yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves contain so many email addresses that are otherwise hidden from the platform. In a recent test of mine, out of 60 people that had their contact email hidden in their profile, I could still determine it by looking into commit authorships in at least some of their repositories. Why is noone targetting these? These are all active and often personal accounts, meant to not be discoverable.
IMO there's also no point in remaining silent about this, it's only a matter of time until the spam starts coming in over this channel. I'm pretty certain some day GitHub will cloak commit emails by default.
- jhugo 4y ago> I'm pretty certain some day GitHub will cloak commit emails by default. GitHub modifying the commit would be incompatible with signed commits. Edit: I'm pretty sure it would also change the commit hash, making your history and GitHub's history divergent.
- solarkraft 4y agoGitHub gives you an E-Mail address for commits through the web UI (see the E-Mail tab in settings), which you can just use for your local commits as well.
- jhugo 4y agoYes. That's a different thing from GH rewriting the commits as the comment I replied to suggested.
- jwilk 4y agoDocumented here: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address https://docs.github.com/en/account-and-profile/setting-up-an...
- mcpherrinm 4y agoI have some email addresses only used to make commits. I have had a number of recruiters use that email address. So definitely somebody is looking at them.
- wonderbore 4y agoYou can’t cloak email addresses that are part of the commit itself. If you can access the raw repo, you can access the raw email address. GitHub already offers an email cloaking mechanism but you have to set it up in your local git config in place of your regular email.
- trinovantes 4y agoYou'd think by now some recruiters would've figured out the best way to find people who knows X is to search for commits in X and look at the attached email
- ascar 4y agoAt least the recruiters who figured that out for me came with higher quality messages and offers. I dread the day when the London recruiter spam mills figure this out...
- Macha 4y agoSadly there are vendors now that'll resell that info to recruiters so they can e.g. look at your linkedin and the tool will match it to their github and grab the email from a database built partially with commit emails. 20 or so recruiters over the last 3 years have contacted my github commit address.
- devoutsalsa 4y agoWhen I was a recruiter, I was using recruiting software that scanned GitHub for email addresses back in 2014.
- viraptor 4y ago> Why is noone targetting these? They're by definition clever people who spend time trying not to be contacted. What's the likely outcome of spamming them? 0.01% responding? Fewer?
- phil294 4y ago* out of 60 people, I could determine it in about 90% of cases ...Is what I actually meant to write, this was a typo and the comment is locked now. :/