8 ms·

GitHub Spam

161 points by bl4ckneon 3y ago

jruohonen 3y ago
[flagged]
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
jessriedel 3y ago
I had a disreputable eBay seller use a similar trick: The Apple product they sold turned out to be counterfeit (unbeknownst to them, they claimed), so they took down the original eBay listing. For some reason, eBay prohibits you from leaving feedback for sellers on orders from listings that are taken down in this way. So this seller still has like 99.7% positive feedback and continues operating even though they at best wasted the time of dozens/hundreds of people who received counterfeit goods and either didn't notice or had to fight for a refund.
- tomjakubowski 3y ago
  Did the seller refund you?
  - hobofan 3y ago
    What does it matter?
  - jessriedel 3y ago
    The seller tried to only refund half the purchase amount because I didn't have the original box it was sent in. (I threw the box away before I realized the item was counterfeit.) I had to appeal his partial refund to eBay, who agreed with me that if someone sells you counterfeit crap they have to fully refund you even without the box. After exchanging several emails with the seller, it was clear that he believed that as long as he gave refunds when people sent everything back to him in mint condition, he had done nothing wrong and did not deserve to have his reputation damaged. The problem with that, obviously, is that he wasted the time of dozens/hundreds of people, and defrauded people who did not notice the item was counterfeit. (People only got refunds if they noticed and requested; they were not automatically told they could get one, as an honest seller would have done.) Under the current system, sellers face little incentive to make sure they aren't unwittingly acting as a fence for stolen/counterfeit good. Without reputational hits, they only have to reimburse buyers for the purchase price, not for the time wasted, and many/most buyers won't bother to return it anyways.
- tiew9Vii 3y ago
  Had an eBay seller sell me refurbished hard drives as brand new. I purchased new Western Digital Red 5k, they sent refurbished 10k enterprise drives with 5k stickers. High 99% feedback, large numbers marked as sold. Ok contacting the seller saying I got refurbished drive with the reported drive stats I got abusive phone calls saying they have my address, they don’t sell fakes, they are going to come to my house and teach me a lesson calling the drive fakes. Turned out the registered address was 2000 km away at some random suburban residential address, the person on the phone had broken English phoning from a Thai phone number so I wasn’t to worried about that and laughed it off and said good luck. I contacted eBay, left a poor review saying received fake goods, got threats of violence from the seller. eBay refunded my money and a week later my review was removed for the seller to continue scamming customers which must be many by the items sold and number of reviews. I ignore positive reviews now. They are curated so not worth any substance if bad reviews get removed.
  - gusgus01 3y ago
    Funny enough that sounds really similar to the actions of the CEO and others at Ebay: https://www.reuters.com/world/us/ex-ebay-exec-heading-prison-harassing-couple-behind-newsletter-2022-09-29/ https://www.reuters.com/world/us/ex-ebay-exec-heading-prison... So it's not that surprising that they allow it on their platform.
  - asdefghyk 3y ago
    RE "......the person on the phone had broken English phoning from a Thai phone number......" Probably a person that works at the hard drive factory IN Thialand. Hard drive capacity reduced in this way when part of the drive has a problem. Maybe its a warranty return. I would complain directly to Western Digital . If the problem was detected at factory, most likely it never would have had a 10K sticker put on ....
  - deleted 3y ago
    [deleted]
  - crtasm 3y ago
    Fraud and threats - they deserve to be reported to the police. This is also a reminder it's good that I don't give my phone number to anyone on ebay.
- _puk 3y ago
  I've had similar on Amazon.. Next day delivery.. you pay, it ships, then delivery estimate gets an "oops you're delivery had a problem and has been rescheduled for 6 weeks in the future". Can't refund as it has been shipped, and the original listing disappears after a couple of days "listing not found", so no feedback possible either.
  - at_compile_time 3y ago
    The last thing I bought on Amazon was a potato peeler. Instead of the quality European peeler I paid for, I received a cheap Chinese peeler that bent the first time I tried it. No returns allowed because the item was considered "dangerous". You'd think that a consistent customer would be worth more than $30, but apparently not to Amazon. They wouldn't make it right so I shop elsewhere now.
    - latchkey 3y ago
      > No returns allowed because the item was considered "dangerous". If you have prime, talk to customer support until you get the answer you want to hear. In general, they have been extremely supportive of all the various issues I've run across, but then again, I buy a lot of stuff from there.
      - crtasm 3y ago
        Why is a paid membership required to speak to customer support at a shop?
        latchkey 3y ago
        I don’t think that it is required. But generally, frequent customers at any shop, get better service. Then again, there is costco too. That is a paid membership for support.
        crtasm 3y ago
        I only ask because your post begins "if you have prime". Resolving a situation where a different, cheap, unusable item is delivered is absolute basic customer service which was paid for when GP bought it, regardless of how frequent/premium of a customer they are. You can't shop at costco without being a member, I don't see how that's related.
- Mistletoe 3y ago
  The ridiculous thing I learned recently is that negative EBay feedback falls off after 12 months. Helped explain why I keep buying things from 100% positive feedback sellers and receiving broken junk…
- nirvdrum 3y ago
  It sounds like Facebook Marketplace. I bought counterfeit AirPods Max. They showed up as legitimate in the phone so I thought they were good, but they were fake. Before I realized what happened the seller blocked me, which apparently prevents leaving feedback. I contacted Facebook about the fraud that went into a black hole. I had found someone else scammed by the same seller and I was annoyed enough to go to the police. The police called it a civil matter and refused to do anything. Obviously I didn’t have the seller’s real name so I couldn’t pursue that angle. I saw from another Facebook account that the seller is still hawking counterfeit goods. So, I guess that’s effectively legal.
  - themoonisachees 3y ago
    Sale of counterfeit goods is a crime in most jurisdictions, it's just that the police are useless in all of them.
  - pierat 3y ago
    > The police called it a civil matter and refused to do anything. You're a "little guy". You're not "business", "landlord", or government".. So your actual rights don't matter. Put it differently, the very pigs who are hired to do "law and order" explicitly told you that your rights don't matter.
Sparkyte 3y ago
Internet is 5% useful important stuff and 95% spam. When a more intelligent organism finds our planet they will be so confused why we wasted so much digital space on senseless spam.
- thedaly 3y ago
  Space, CPU cycles, attention. So much waste
- ta8645 3y ago
  Isn't that about the same percentages for life before the internet? At least for rich people, who have their basic needs met without worry.
  - dv_dt 3y ago
    See Sturgeons law, and discussion about Rudyard Kipling https://en.wikipedia.org/wiki/Sturgeon's_law https://en.wikipedia.org/wiki/Sturgeon's_law
- ben_w 3y ago
  The prisoners' dilemma would probably explain it: not enough risk that the spammers get negative reputations.
- crazygringo 3y ago
  I think a more intelligent organism will understand perfectly that it is explained as the inevitable result of combining virtually free message-sending with simple economic self-interest, and why there are no perfect solutions to it (at least not yet).
  - aspenmayer 3y ago
    Capitalism is the crisis? https://en.wikipedia.org/wiki/Capitalist_Realism https://en.wikipedia.org/wiki/Capitalist_Realism
    - 3y ago
albertzeyer 3y ago
On those simple ideas to fix it: I don't think it's simple. Once you do simple heuristics, the other side will start doing it just a little bit more sophisticated, to get around the simple heuristics. So, then you improve the heuristics to catch the spammer. And again, the spammers get around that improved tests as well. And so on. In the end, you end up with similar spam filter methods as we also have for mails and probably as other social networks have as well. But this is far from simple. I don't think having a huge number of hand-crafted heuristics is really a good solution. I think it should be machine learning model which you train and it does it all automatically without too much false positives (and also not too much false negatives).
- mschuster91 3y ago
  The fix isn't ever more heuristics - that is an uphill battle that can't ever be won. The fix is following the money and disconnecting the bad actors' ISPs from the Internet. There was a time when abuse@<isp-domain.tld> emails were honored and administrators actually took notice of what came in, but these days are long since gone - ISPs simply don't want to spend the money, and so the cost of abuse is externalized to society at large. ETA: Also, a fix would be to have a human with more than ten seconds time take a look at even 1% of spam reports. Spammers are lazy, they always use the same template, so if you have a human actually looking into the template and then routing every match to /dev/null, it's far more effective. Like... I can do this on Twitter for every new variation of some scam, why can't Twitter do it on its own?!
  - arp242 3y ago
    Do you really want ISPs to be in the business of deciding what should and should not be on the internet though? That sort of thing typically doesn't work too well. Deciding what is or isn't a "scam" is really a job for the independent judiciary. But getting a ruling is difficult and time-consuming, and also largely pointless because a new website can be created almost instantly, and there are many foreign ISPs where you can't get a ruling at all. I don't really disagree with your basic premise that "disconnecting the bad actors' ISPs from the Internet" is the ideal solution, but this is far more difficult than your comment implies – almost impossible with how the internet currently works.
iBotPeaches 3y ago
I concur - I saw the React Native repo getting spammed with hundreds of similar issues/prs. So many unique usernames and such a cumbersome process to report a painfully obvious spam account. I hit the limit of open abuse reports you could have. My attempt to help was ended - I was only 4 accounts in. Thought I would get creative and add comments to one of my existing reports of the other 10 or so spam accounts. The tickets were closed and only the main account was deleted - not the others mentioned in the ticket. So I gave up.
- vdaea 3y ago
  [flagged]
- firtoz 3y ago
  I find it so ironic that you have a cap on abuse reports...
deleted 3y ago
[deleted]
mschuster91 3y ago
God, these crypto "airdrop" scams annoy me... it's just as bad on Twitter. I'm active in Community Notes and the inbox is like 1/3rd far-right conspiracies, 1/3rd other politics, and 1/3rd of zkSync scam alerts - never figured out what zkSync is or if that itself is some scam, it wouldn't surprise me. Some of these are even able to fake the target URL - the Tweet Card shows them going to "starknet [.] io", but hover over the link and it will actually point to "reward - zksync [.] club". I wonder what the fuck is going on at Twitter that they're unable to spot and hammer down on this.
- fwip 3y ago
  Well, Twitter fired many of their competent employees, and most of the rest left. The remaining workers are incredibly overworked and understaffed.
- techdragon 3y ago
  Lack of available staff, and a CEO who is probably mostly focused on finding some way to salvage advertising and has no time to spare on thinking about anything else because the advertising situation is just abysmally dire… I mean I think fully a quarter of the community notes I see directly on things in my timeline (not people sharing screenshots of particularly funny/interesting community notes) are people putting community notes on overpriced drop shipping scammers. The advertising situation seems completely doomed and when the CEO was picked to remedy that and the owner is in a nebulous executive role as “product owner” and simultaneously a hyper emotionally invested product user (based on credible reports and the publicly verifiable behaviour)… what can she really do besides do a good enough job for long enough that it won’t seem weird when she quits/takes another position.
- Jhsto 3y ago
  The reason that zkSync and Starknet are targeted is that neither have run an "airdrop" or token distribution scheme, and both are rather well known projects in the scene. It's a bit pity for them.
arp242 3y ago
I have never experienced this kind of spam, and authors GitHub does not seem especially notable. But they are involved in cryptocurrency stuff. I guess that's why they were tagged in these threads. I think this says more about crypto grift than anything else. It's not "GitHub spam" so much as "cryptocurrency spam". Or: "cryptocurrency and associated grift and scams makes everything worse, part 151"
rvz 3y ago
> With the rise of generative AI and ChatGPT being able to write endless variations of 1 spam template to bypass the similarity check I just proposed above, content moderation will continue to be an uphill battle. It most likely will get even harder! Thanks to LLMs, the spam issue will get even worse on Github.
- echelon 3y ago
  > Thanks to LLMs, the spam issue will get even worse on Github. I think we'll quickly develop NLP/LLM filters for this. And while that may lead to an arms race, we'll likely simultaneously develop distributed systems for credibility attestation. We already rely on professional networks. We'll just grow all the more robust and capable along these lines. I'm actually extremely excited for automated systems that increase the signal. We've been in a noise trough for a while, and now we have means of filtering it. Edit: I don't necessarily refer to anything cryptocurrency related. We can build distributed networks of trust like the semantic web tried with PGP and FOAF, though I'm sure there are valuable tools and lessons we can borrow from the crypto folks' algorithms and research.
  - ftmch 3y ago
    Even though this post is about cryptocurrency spam, decentralized cryptocurrency networks could have a solution to this spam problem with so called Soulbound Tokens.
deleted 3y ago
[deleted]
paulproteus 3y ago
Since LLMs model language, does anyone know of any LLM products/libraries that are spam detectors?
- malfist 3y ago
  Would probably be way too expensive and probably not any better than the current generation of spam detection
  - selcuka 3y ago
    > Would probably be way too expensive Using OpenAI GPT-4, sure. On the other hand, running a small, fine-tuned LLM shouldn't be that resource intensive. It may not be any better than the current generation of spam detection, but it will not require rule updates, at least not that frequently.
    - jerbear4328 3y ago
      Why even use an LLM? A classifier is perfectly suited for this kind of thing, and they aren't new. As far as I can tell, this is what is often used in the real world, and is incredibly cheap compared to an LLM, so GitHub/$OTHER_PLATFORM could totally run it on everything posted. They could even use a classifier as a first filtering step, then run a smarter model on flagged comments. (Then let a human double-check, right? Right?)
- ben_w 3y ago
  With a sample size of 2 because I've not tried before and it's late here, gpt-4-1106-preview seems to work OK at this just by asking for a probability. Though you will need to post-process the response because it says the usual blah blah blah ${number} blah blah reason blah.
  - firtoz 3y ago
    It will be so expensive :( But btw now you can enforce function calling and json responses
Animats 3y ago
Github/Microsoft could sue the beneficiary of the spam. It's clear who that is. Binance is in legal trouble with the SEC right now.[1] Send this to the SEC lawyers going after Binance. You can find out who they are from SEC litigation announcements. If Binance can identify someone else to blame, they have a big incentive to do the work. [1] https://www.reuters.com/legal/binance-heads-court-seeking-dismissal-sec-fraud-lawsuit-2024-01-19/ https://www.reuters.com/legal/binance-heads-court-seeking-di...
- gear54rus 3y ago
  What proof is there that binance did this?
  - TobyTheDog123 3y ago
    I don't think that's what the commenter is claiming. I think they want to be able to sue the companies who indirectly benefit from this kind of spam, which is pretty ridiculous. However, crypto has become such a menace to society that it's time that governments do something about it, if they even can at this point.
    - Animats 3y ago
      > I think they want to be able to sue the companies who indirectly benefit from this kind of spam, which is pretty ridiculous. There's the legal concept of an implicit or implied conspiracy. Usually comes up in antitrust law, where sellers raise prices at about the same time without actually getting together to talk about it.[1][2] It's a difficult area of law. [1] https://scholarship.law.wm.edu/cgi/viewcontent.cgi?article=2837&context=facpubs https://scholarship.law.wm.edu/cgi/viewcontent.cgi?article=2... [2] https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=2444&context=lcp https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article...
    - gear54rus 3y ago
      Shall we sue banks for being mentioned in some scammy same-day loan ad too? Wouldn't that be a sight. One person's menace is another person's salvation :)
quantumwoke 3y ago
It's not just issues either. Fake repo spam is terrible as well, usually some form of credentials or cryptocurrency theft software. GitHub really needs to implement moderation, and fast.
zdw 3y ago
Ah, this is actual spam as comments... I have a different problems - Github's notification settings are far too coarse, and if you're either subscribed to lot of repos, or have a lot of actions happening on those repos the flood of email messages you get on every comment or action a person or a CI process takes is just unmanageable. All I want is "If someone (ie, not a bot) specifically tags me on a PR where the CI is passing, send email once". This granularity unfortunately doesn't seem to be possible - that said, I would love to be wrong about this. I ended up turning off Github's email notifications for this reason, as the signal to noise is horrible.
- kypro 3y ago
  I have the exact same problem, but I assumed I was too stupid to work out how to configure Github to stop this and didn't want to waste any more time trying to work it out so I just turned the emails off. I work for a fairly large org with lots of Github repos which I occasionally contribute to and there seems to be no way to configure emails alerts in a manageable way – I must either get an email for everything or ignore everything. And ignoring everything is obviously preferable when the signal to noise is this bad.
  - zdw 3y ago
    Sounds like the same problem! I'm working at a large org, was involved in setting up lots of repos, therefore I end up getting pinged on so many of them that I'm no longer directly working on or directly interested in. There's also not a bulk method anywhere (that I can find) in Github that can deal with unsubscribing or changing settings on many repos at the same time.
- rob 3y ago
  Try having a generic username on there where everybody @s you as a shorthand for the real person's username and you end up getting notified. Or added to random repos and removed minutes later, but still getting the notification. :)
  - mtlynch 3y ago
ronnier 3y ago
Also github pages and "app" pages are used to distribute scam dating site spam on social media platforms. The bad actors try to use the domain reputation of github to evade detection. It's extremely bad and seems to be out of control on github. Another thing, men, please, PLEASE, stop falling for these scams. No, beautiful women will not message you at random and show interest in you. Even unattractive ones won't. Please stop falling for these scams. Tell everyone you know to stop falling for these. If a random woman messages you to meet for sex, it's a scam. Do not fall for it, it will seem real and authentic, it's not. If you send nudes they will extort you out of money.
- itake 3y ago
  > If a random woman messages you to meet for sex, it's a scam. definitely not always a scam haha
  - ronnier 3y ago
    Yeah of course not always, but the vast majority of it is.
  - nerdponx 3y ago
    Unless you are a male sex worker or in some kind of niche hookup community, it's a scam. Even on a dating site, it's probably a scam unless you are exceptionally attractive.
    - basil-rash 3y ago
      An HN-ism if I’ve ever seen one. Women like sex, just as much as men (if not more so). Sure not every popup about “hot singles in your area” is legit, but women on dating sites messaging you with the goal of a quick night is definitely a thing. And I’m certainly not exceptionally attractive.
dkarras 3y ago
Same thing happens on Twitter. I login every week or so and my notifications are full of NFT scams. People tag me with an image and "new mint dropped!!!1" post, by the time I see it the tag is deleted but notification is still there.
- latchkey 3y ago
  Block the word "nft".
  - steve_rambo 3y ago
    That would present a problem if anyone mentions nftables, the main command to manage your firewall is named `nft` https://wiki.archlinux.org/title/nftables https://wiki.archlinux.org/title/nftables
    - firtoz 3y ago
      At this point it's easier to rename the command
SadCordDrone 3y ago
My first question is - are these spams fishing for direct victims, or some dirty SEO trick?
- csande17 3y ago
  If it was an SEO trick, you'd think they wouldn't bother at-mentioning people. Usually SEO stuff tries to fly under the radar so it can stay online, and visible to search engines, for as long as possible. (Like the classic technique of spamming generic "nice post!" comments on WordPress blogs with your profile URL set to the spam site.)
thatxliner 3y ago
I got the exact same comment on one of my repos as well
fxtentacle 3y ago
In my opinion, the fix should be to make it expensive to post spam. For example, every legitimate user of my open source project is probably fine with paying $1 to file an issue report. So I'd like to have a user setting that says "don't let anyone contact me unless they pay for it".

GitHub Spam

161 points by bl4ckneon 3y ago

jruohonen 3y ago

[flagged]

deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

jessriedel 3y ago

I had a disreputable eBay seller use a similar trick: The Apple product they sold turned out to be counterfeit (unbeknownst to them, they claimed), so they took down the original eBay listing. For some reason, eBay prohibits you from leaving feedback for sellers on orders from listings that are taken down in this way. So this seller still has like 99.7% positive feedback and continues operating even though they at best wasted the time of dozens/hundreds of people who received counterfeit goods and either didn't notice or had to fight for a refund.

tomjakubowski 3y ago
Did the seller refund you?
- hobofan 3y ago
  What does it matter?
- jessriedel 3y ago
  The seller tried to only refund half the purchase amount because I didn't have the original box it was sent in. (I threw the box away before I realized the item was counterfeit.) I had to appeal his partial refund to eBay, who agreed with me that if someone sells you counterfeit crap they have to fully refund you even without the box. After exchanging several emails with the seller, it was clear that he believed that as long as he gave refunds when people sent everything back to him in mint condition, he had done nothing wrong and did not deserve to have his reputation damaged. The problem with that, obviously, is that he wasted the time of dozens/hundreds of people, and defrauded people who did not notice the item was counterfeit. (People only got refunds if they noticed and requested; they were not automatically told they could get one, as an honest seller would have done.) Under the current system, sellers face little incentive to make sure they aren't unwittingly acting as a fence for stolen/counterfeit good. Without reputational hits, they only have to reimburse buyers for the purchase price, not for the time wasted, and many/most buyers won't bother to return it anyways.
tiew9Vii 3y ago
Had an eBay seller sell me refurbished hard drives as brand new. I purchased new Western Digital Red 5k, they sent refurbished 10k enterprise drives with 5k stickers. High 99% feedback, large numbers marked as sold. Ok contacting the seller saying I got refurbished drive with the reported drive stats I got abusive phone calls saying they have my address, they don’t sell fakes, they are going to come to my house and teach me a lesson calling the drive fakes. Turned out the registered address was 2000 km away at some random suburban residential address, the person on the phone had broken English phoning from a Thai phone number so I wasn’t to worried about that and laughed it off and said good luck. I contacted eBay, left a poor review saying received fake goods, got threats of violence from the seller. eBay refunded my money and a week later my review was removed for the seller to continue scamming customers which must be many by the items sold and number of reviews. I ignore positive reviews now. They are curated so not worth any substance if bad reviews get removed.
- gusgus01 3y ago
  Funny enough that sounds really similar to the actions of the CEO and others at Ebay: https://www.reuters.com/world/us/ex-ebay-exec-heading-prison-harassing-couple-behind-newsletter-2022-09-29/ https://www.reuters.com/world/us/ex-ebay-exec-heading-prison... So it's not that surprising that they allow it on their platform.
- asdefghyk 3y ago
  RE "......the person on the phone had broken English phoning from a Thai phone number......" Probably a person that works at the hard drive factory IN Thialand. Hard drive capacity reduced in this way when part of the drive has a problem. Maybe its a warranty return. I would complain directly to Western Digital . If the problem was detected at factory, most likely it never would have had a 10K sticker put on ....
- deleted 3y ago
  [deleted]
- crtasm 3y ago
  Fraud and threats - they deserve to be reported to the police. This is also a reminder it's good that I don't give my phone number to anyone on ebay.
_puk 3y ago
I've had similar on Amazon.. Next day delivery.. you pay, it ships, then delivery estimate gets an "oops you're delivery had a problem and has been rescheduled for 6 weeks in the future". Can't refund as it has been shipped, and the original listing disappears after a couple of days "listing not found", so no feedback possible either.
- at_compile_time 3y ago
  The last thing I bought on Amazon was a potato peeler. Instead of the quality European peeler I paid for, I received a cheap Chinese peeler that bent the first time I tried it. No returns allowed because the item was considered "dangerous". You'd think that a consistent customer would be worth more than $30, but apparently not to Amazon. They wouldn't make it right so I shop elsewhere now.
  - latchkey 3y ago
    > No returns allowed because the item was considered "dangerous". If you have prime, talk to customer support until you get the answer you want to hear. In general, they have been extremely supportive of all the various issues I've run across, but then again, I buy a lot of stuff from there.
    - crtasm 3y ago
      Why is a paid membership required to speak to customer support at a shop?
      - latchkey 3y ago
        I don’t think that it is required. But generally, frequent customers at any shop, get better service. Then again, there is costco too. That is a paid membership for support.
        crtasm 3y ago
        I only ask because your post begins "if you have prime". Resolving a situation where a different, cheap, unusable item is delivered is absolute basic customer service which was paid for when GP bought it, regardless of how frequent/premium of a customer they are. You can't shop at costco without being a member, I don't see how that's related.
Mistletoe 3y ago
The ridiculous thing I learned recently is that negative EBay feedback falls off after 12 months. Helped explain why I keep buying things from 100% positive feedback sellers and receiving broken junk…
nirvdrum 3y ago
It sounds like Facebook Marketplace. I bought counterfeit AirPods Max. They showed up as legitimate in the phone so I thought they were good, but they were fake. Before I realized what happened the seller blocked me, which apparently prevents leaving feedback. I contacted Facebook about the fraud that went into a black hole. I had found someone else scammed by the same seller and I was annoyed enough to go to the police. The police called it a civil matter and refused to do anything. Obviously I didn’t have the seller’s real name so I couldn’t pursue that angle. I saw from another Facebook account that the seller is still hawking counterfeit goods. So, I guess that’s effectively legal.
- themoonisachees 3y ago
  Sale of counterfeit goods is a crime in most jurisdictions, it's just that the police are useless in all of them.
- pierat 3y ago
  > The police called it a civil matter and refused to do anything. You're a "little guy". You're not "business", "landlord", or government".. So your actual rights don't matter. Put it differently, the very pigs who are hired to do "law and order" explicitly told you that your rights don't matter.

Sparkyte 3y ago

Internet is 5% useful important stuff and 95% spam. When a more intelligent organism finds our planet they will be so confused why we wasted so much digital space on senseless spam.

thedaly 3y ago
Space, CPU cycles, attention. So much waste
ta8645 3y ago
Isn't that about the same percentages for life before the internet? At least for rich people, who have their basic needs met without worry.
- dv_dt 3y ago
  See Sturgeons law, and discussion about Rudyard Kipling https://en.wikipedia.org/wiki/Sturgeon's_law https://en.wikipedia.org/wiki/Sturgeon's_law
ben_w 3y ago
The prisoners' dilemma would probably explain it: not enough risk that the spammers get negative reputations.
crazygringo 3y ago
I think a more intelligent organism will understand perfectly that it is explained as the inevitable result of combining virtually free message-sending with simple economic self-interest, and why there are no perfect solutions to it (at least not yet).
- aspenmayer 3y ago
  Capitalism is the crisis? https://en.wikipedia.org/wiki/Capitalist_Realism https://en.wikipedia.org/wiki/Capitalist_Realism
  - 3y ago

albertzeyer 3y ago

On those simple ideas to fix it: I don't think it's simple. Once you do simple heuristics, the other side will start doing it just a little bit more sophisticated, to get around the simple heuristics. So, then you improve the heuristics to catch the spammer. And again, the spammers get around that improved tests as well. And so on. In the end, you end up with similar spam filter methods as we also have for mails and probably as other social networks have as well. But this is far from simple. I don't think having a huge number of hand-crafted heuristics is really a good solution. I think it should be machine learning model which you train and it does it all automatically without too much false positives (and also not too much false negatives).

mschuster91 3y ago
The fix isn't ever more heuristics - that is an uphill battle that can't ever be won. The fix is following the money and disconnecting the bad actors' ISPs from the Internet. There was a time when abuse@<isp-domain.tld> emails were honored and administrators actually took notice of what came in, but these days are long since gone - ISPs simply don't want to spend the money, and so the cost of abuse is externalized to society at large. ETA: Also, a fix would be to have a human with more than ten seconds time take a look at even 1% of spam reports. Spammers are lazy, they always use the same template, so if you have a human actually looking into the template and then routing every match to /dev/null, it's far more effective. Like... I can do this on Twitter for every new variation of some scam, why can't Twitter do it on its own?!
- arp242 3y ago
  Do you really want ISPs to be in the business of deciding what should and should not be on the internet though? That sort of thing typically doesn't work too well. Deciding what is or isn't a "scam" is really a job for the independent judiciary. But getting a ruling is difficult and time-consuming, and also largely pointless because a new website can be created almost instantly, and there are many foreign ISPs where you can't get a ruling at all. I don't really disagree with your basic premise that "disconnecting the bad actors' ISPs from the Internet" is the ideal solution, but this is far more difficult than your comment implies – almost impossible with how the internet currently works.

iBotPeaches 3y ago

I concur - I saw the React Native repo getting spammed with hundreds of similar issues/prs. So many unique usernames and such a cumbersome process to report a painfully obvious spam account. I hit the limit of open abuse reports you could have. My attempt to help was ended - I was only 4 accounts in. Thought I would get creative and add comments to one of my existing reports of the other 10 or so spam accounts. The tickets were closed and only the main account was deleted - not the others mentioned in the ticket. So I gave up.

vdaea 3y ago
[flagged]
firtoz 3y ago
I find it so ironic that you have a cap on abuse reports...

deleted 3y ago

[deleted]

mschuster91 3y ago

God, these crypto "airdrop" scams annoy me... it's just as bad on Twitter. I'm active in Community Notes and the inbox is like 1/3rd far-right conspiracies, 1/3rd other politics, and 1/3rd of zkSync scam alerts - never figured out what zkSync is or if that itself is some scam, it wouldn't surprise me. Some of these are even able to fake the target URL - the Tweet Card shows them going to "starknet [.] io", but hover over the link and it will actually point to "reward - zksync [.] club". I wonder what the fuck is going on at Twitter that they're unable to spot and hammer down on this.

fwip 3y ago
Well, Twitter fired many of their competent employees, and most of the rest left. The remaining workers are incredibly overworked and understaffed.
techdragon 3y ago
Lack of available staff, and a CEO who is probably mostly focused on finding some way to salvage advertising and has no time to spare on thinking about anything else because the advertising situation is just abysmally dire… I mean I think fully a quarter of the community notes I see directly on things in my timeline (not people sharing screenshots of particularly funny/interesting community notes) are people putting community notes on overpriced drop shipping scammers. The advertising situation seems completely doomed and when the CEO was picked to remedy that and the owner is in a nebulous executive role as “product owner” and simultaneously a hyper emotionally invested product user (based on credible reports and the publicly verifiable behaviour)… what can she really do besides do a good enough job for long enough that it won’t seem weird when she quits/takes another position.
Jhsto 3y ago
The reason that zkSync and Starknet are targeted is that neither have run an "airdrop" or token distribution scheme, and both are rather well known projects in the scene. It's a bit pity for them.

arp242 3y ago

I have never experienced this kind of spam, and authors GitHub does not seem especially notable. But they are involved in cryptocurrency stuff. I guess that's why they were tagged in these threads. I think this says more about crypto grift than anything else. It's not "GitHub spam" so much as "cryptocurrency spam". Or: "cryptocurrency and associated grift and scams makes everything worse, part 151"

rvz 3y ago

> With the rise of generative AI and ChatGPT being able to write endless variations of 1 spam template to bypass the similarity check I just proposed above, content moderation will continue to be an uphill battle. It most likely will get even harder! Thanks to LLMs, the spam issue will get even worse on Github.

echelon 3y ago
> Thanks to LLMs, the spam issue will get even worse on Github. I think we'll quickly develop NLP/LLM filters for this. And while that may lead to an arms race, we'll likely simultaneously develop distributed systems for credibility attestation. We already rely on professional networks. We'll just grow all the more robust and capable along these lines. I'm actually extremely excited for automated systems that increase the signal. We've been in a noise trough for a while, and now we have means of filtering it. Edit: I don't necessarily refer to anything cryptocurrency related. We can build distributed networks of trust like the semantic web tried with PGP and FOAF, though I'm sure there are valuable tools and lessons we can borrow from the crypto folks' algorithms and research.
- ftmch 3y ago
  Even though this post is about cryptocurrency spam, decentralized cryptocurrency networks could have a solution to this spam problem with so called Soulbound Tokens.

deleted 3y ago

[deleted]

paulproteus 3y ago

Since LLMs model language, does anyone know of any LLM products/libraries that are spam detectors?

malfist 3y ago
Would probably be way too expensive and probably not any better than the current generation of spam detection
- selcuka 3y ago
  > Would probably be way too expensive Using OpenAI GPT-4, sure. On the other hand, running a small, fine-tuned LLM shouldn't be that resource intensive. It may not be any better than the current generation of spam detection, but it will not require rule updates, at least not that frequently.
  - jerbear4328 3y ago
    Why even use an LLM? A classifier is perfectly suited for this kind of thing, and they aren't new. As far as I can tell, this is what is often used in the real world, and is incredibly cheap compared to an LLM, so GitHub/$OTHER_PLATFORM could totally run it on everything posted. They could even use a classifier as a first filtering step, then run a smarter model on flagged comments. (Then let a human double-check, right? Right?)
ben_w 3y ago
With a sample size of 2 because I've not tried before and it's late here, gpt-4-1106-preview seems to work OK at this just by asking for a probability. Though you will need to post-process the response because it says the usual blah blah blah ${number} blah blah reason blah.
- firtoz 3y ago
  It will be so expensive :( But btw now you can enforce function calling and json responses

Animats 3y ago

Github/Microsoft could sue the beneficiary of the spam. It's clear who that is. Binance is in legal trouble with the SEC right now.[1] Send this to the SEC lawyers going after Binance. You can find out who they are from SEC litigation announcements. If Binance can identify someone else to blame, they have a big incentive to do the work. [1] https://www.reuters.com/legal/binance-heads-court-seeking-dismissal-sec-fraud-lawsuit-2024-01-19/ https://www.reuters.com/legal/binance-heads-court-seeking-di...

gear54rus 3y ago
What proof is there that binance did this?
- TobyTheDog123 3y ago
  I don't think that's what the commenter is claiming. I think they want to be able to sue the companies who indirectly benefit from this kind of spam, which is pretty ridiculous. However, crypto has become such a menace to society that it's time that governments do something about it, if they even can at this point.
  - Animats 3y ago
    > I think they want to be able to sue the companies who indirectly benefit from this kind of spam, which is pretty ridiculous. There's the legal concept of an implicit or implied conspiracy. Usually comes up in antitrust law, where sellers raise prices at about the same time without actually getting together to talk about it.[1][2] It's a difficult area of law. [1] https://scholarship.law.wm.edu/cgi/viewcontent.cgi?article=2837&context=facpubs https://scholarship.law.wm.edu/cgi/viewcontent.cgi?article=2... [2] https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=2444&context=lcp https://scholarship.law.duke.edu/cgi/viewcontent.cgi?article...
  - gear54rus 3y ago
    Shall we sue banks for being mentioned in some scammy same-day loan ad too? Wouldn't that be a sight. One person's menace is another person's salvation :)

quantumwoke 3y ago

It's not just issues either. Fake repo spam is terrible as well, usually some form of credentials or cryptocurrency theft software. GitHub really needs to implement moderation, and fast.

zdw 3y ago

Ah, this is actual spam as comments... I have a different problems - Github's notification settings are far too coarse, and if you're either subscribed to lot of repos, or have a lot of actions happening on those repos the flood of email messages you get on every comment or action a person or a CI process takes is just unmanageable. All I want is "If someone (ie, not a bot) specifically tags me on a PR where the CI is passing, send email once". This granularity unfortunately doesn't seem to be possible - that said, I would love to be wrong about this. I ended up turning off Github's email notifications for this reason, as the signal to noise is horrible.

kypro 3y ago
I have the exact same problem, but I assumed I was too stupid to work out how to configure Github to stop this and didn't want to waste any more time trying to work it out so I just turned the emails off. I work for a fairly large org with lots of Github repos which I occasionally contribute to and there seems to be no way to configure emails alerts in a manageable way – I must either get an email for everything or ignore everything. And ignoring everything is obviously preferable when the signal to noise is this bad.
- zdw 3y ago
  Sounds like the same problem! I'm working at a large org, was involved in setting up lots of repos, therefore I end up getting pinged on so many of them that I'm no longer directly working on or directly interested in. There's also not a bulk method anywhere (that I can find) in Github that can deal with unsubscribing or changing settings on many repos at the same time.
rob 3y ago
Try having a generic username on there where everybody @s you as a shorthand for the real person's username and you end up getting notified. Or added to random repos and removed minutes later, but still getting the notification. :)
- mtlynch 3y ago

ronnier 3y ago

Also github pages and "app" pages are used to distribute scam dating site spam on social media platforms. The bad actors try to use the domain reputation of github to evade detection. It's extremely bad and seems to be out of control on github. Another thing, men, please, PLEASE, stop falling for these scams. No, beautiful women will not message you at random and show interest in you. Even unattractive ones won't. Please stop falling for these scams. Tell everyone you know to stop falling for these. If a random woman messages you to meet for sex, it's a scam. Do not fall for it, it will seem real and authentic, it's not. If you send nudes they will extort you out of money.

itake 3y ago
> If a random woman messages you to meet for sex, it's a scam. definitely not always a scam haha
- ronnier 3y ago
  Yeah of course not always, but the vast majority of it is.
- nerdponx 3y ago
  Unless you are a male sex worker or in some kind of niche hookup community, it's a scam. Even on a dating site, it's probably a scam unless you are exceptionally attractive.
  - basil-rash 3y ago
    An HN-ism if I’ve ever seen one. Women like sex, just as much as men (if not more so). Sure not every popup about “hot singles in your area” is legit, but women on dating sites messaging you with the goal of a quick night is definitely a thing. And I’m certainly not exceptionally attractive.

dkarras 3y ago

Same thing happens on Twitter. I login every week or so and my notifications are full of NFT scams. People tag me with an image and "new mint dropped!!!1" post, by the time I see it the tag is deleted but notification is still there.

latchkey 3y ago
Block the word "nft".
- steve_rambo 3y ago
  That would present a problem if anyone mentions nftables, the main command to manage your firewall is named `nft` https://wiki.archlinux.org/title/nftables https://wiki.archlinux.org/title/nftables
  - firtoz 3y ago
    At this point it's easier to rename the command

SadCordDrone 3y ago

My first question is - are these spams fishing for direct victims, or some dirty SEO trick?

csande17 3y ago
If it was an SEO trick, you'd think they wouldn't bother at-mentioning people. Usually SEO stuff tries to fly under the radar so it can stay online, and visible to search engines, for as long as possible. (Like the classic technique of spamming generic "nice post!" comments on WordPress blogs with your profile URL set to the spam site.)

thatxliner 3y ago

I got the exact same comment on one of my repos as well

fxtentacle 3y ago

In my opinion, the fix should be to make it expensive to post spam. For example, every legitimate user of my open source project is probably fine with paying $1 to file an issue report. So I'd like to have a user setting that says "don't let anyone contact me unless they pay for it".