7 ms·

GitHub bans organizations without warning or explanation

130 points by siamese_puff 3y ago

All organizations on my account have now been hidden from public view with no explanation, no response from Github after over a week and a massive red banner on every page I visit that says "Several of your organizations have been flagged. Because of that, these organizations are hidden from the public. If you believe this is a mistake, please contact support to have your organizations’ statuses reviewed." It doesn't even state which organizations are problematic and why. What is this shit Github? Have other people encountered this? I have literally no controversial organizations on my profile. https://x.com/RyanSchachte/status/1757417511451259350?s=20

deleted 3y ago
[deleted]
dhimmel 3y ago
Many of my organizations were flagged on 2024-02-12 and hidden. Saga via a tweet thread at <https://twitter.com/dhimmel/status/1757034659895021838 https://twitter.com/dhimmel/status/1757034659895021838>. Apparently the cause was that I interacted with code that GH detected as malicious. The weird thing was that GH left this supposedly malicious code as publicly visible in multiple personal repos while hiding my unrelated organizations. These organizations were home to highly used scholarly software, research projects, and datasets. I started getting emails from users like: > I was looking at a manubot issue and found out that the repo vanished from the internet. What happened? I got the situation resolved through my contact at GitHub, but still no response via the GH support ticket after 2 weeks. Seems like GitHub is shooting themselves in the foot. Strange.
photoGrant 3y ago
They did the same accidentally to the co-founder https://twitter.com/defunkt/status/1754610843361362360 https://twitter.com/defunkt/status/1754610843361362360 Once I'd seen that, I doubled down on my self hosted GitLab and never looked back. GitHub can be a mirror for public good, but it's no castle I want to be a prisoner of.
- arcfour 3y ago
  I love GitLab, but the amount of serious security vulnerabilities (multiple RCEs!) make me quite nervous about the idea of self-hosting it. How do other people deal with this? Are there any competitive alternatives that have a better security record?
- siamese_puff 3y ago
  I definitely plan on migrating. Absolutely ridiculous
  - deleted 3y ago
    [deleted]
- YetAnotherNick 3y ago
  Wow, I really hate the github's response here. They admitted that it shouldn't have been banned but provided no explanation. Mistakes do happen but being not open about it removes any benefit of doubt and portrays fucking up is normal part of operation for them.
  - deleted 3y ago
    [deleted]
- leros 3y ago
  This is how I do it. Everything is in GitLab and I mirror a few repos to GitHub for public consumption and issue tracking.
- binsquare 3y ago
  That's astonishingly terrible, has GitHub gone public to address the issue? Can't seem to find GitHub's response in what happened
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
lakomen 3y ago
I had that happen as well a few years ago. Running my own gitea server since then but I heard there was some drama around it so it got forked to forgejo. Gitlab was just too unfriendly when I wanted some help and wanted too many resources vs gogs at that time. Because too many are on github it's too big to fail and if you want to report a big you need an account there. I wish I could go completely without it.
superkuh 3y ago
This is typical microsoft behavior. They're too big to care. Their policies are designed around avoiding bad press that could impact their bottom line, not making things work for human persons. It was inevitable ever since github sold out.
sshine 3y ago
I've used GitHub for years knowing that Microsoft owning it, they're headed for a place I won't like. I just haven't experienced that until now. I've been trying out sr.ht and codeberg.org. Sadly the product is nowhere near GitHub.
- atmosx 3y ago
  My understanding is that sr.ht doesn't allow a user without an account to collaborate with a user that has one. So effectively _all_ developers must pay for the privilege to "work" on a project.
  - shiomiru 3y ago
    > My understanding is that sr.ht doesn't allow a user without an account to collaborate with a user that has one. So effectively _all_ developers must pay for the privilege to "work" on a project. That is a misunderstanding: sr.ht only costs money if you host your projects there. Since the official supported workflow is email-based, you don't even need a sr.ht account (paid or otherwise) to submit patches.
- herbst 3y ago
  I just installed gitea and never looked back. Lightweight, does all I need and full control. Microsoft killing the place was very foreseeable
  - sshine 3y ago
    Gitea just has way too many security vulnerabilities for me to confidently run an open instance: https://www.cvedetails.com/vulnerability-list/vendor_id-19185/product_id-49829/Gitea-Gitea.html?page=1&order=1&trc=33&sha=c86adb63705a678a26817f8aed4c8075124ab0d6 https://www.cvedetails.com/vulnerability-list/vendor_id-1918... I don't think that a modern git web front-end needs to either look ugly and lack basic features, or be a security vulnerability, or be run by a gigantic corporation. It just happens that you can only choose between those right now. I really wish there were something as nice as GitHub, self-hosted, with a better security model.
YaBa 3y ago
Use locally installed Gitea. I only use Github for public forks and nothing else. Personal projects are all on private Gitea.
- quickslowdown 3y ago
  Not to add to the noise, but I've switched to Forgejo. It was very easy to migrate (as Forgejo is just a fork of Gitea, even has references to Gitea in a lot of places, like env variable names), and I've been very happy with it for the past ~6 months.
  - remram 3y ago
    What is changed in Forgejo compared to Gitea? If the only difference is the name, Gitea is a better name.
    - Macha 3y ago
      Gitea have moved the product from a community governed product to an open core one and handed over the gitea.com domain to a hosted services vendor
      - remram 3y ago
        My question was: what did Forgejo do? If the software is still developed in Gitea's repository, and all Forgejo does is download the source from gitea.com, rename it, and post it on forgejo.org... how does that help the users? If there exists some Gitea features that are not available open source ("open core")... how does having Forgejo help? Unless they provide those features, the situation remains unchanged. Until they do, what is there to applaud, and what's the point of switching?
        k8svet 3y ago
        Luckily Forgejo has a blog with a days-old blog post that spells this out. The winds are clearly blowing in Forgejo's direction despite some doubt from me, early on.
jjmarr 3y ago
Now is a great time to switch to Gerrit.
- remram 3y ago
  As far as I'm concerned, the first platform to get federated merge requests will win it all.
  - simfree 3y ago
    Federated merge requests, wiki, issues and such would be a killer feature. I want to see all this data for all of the forks that are relatively close together from a single pane of glass. This would make collaborating and uplifting code back to the main branch much easier for small free software projects.
  - ukuina 3y ago
    Can you elaborate on what that means and how it improves repos?
    - foolswisdom 3y ago
      Currently, if a repo is on github, and you develop a patch on a fork on gitlab, you can't just click a button to open a pr, the way you could of both upstream and fork were using the same provider. Federated PRs would be the capability for one provider to "talk" to another to be able to pull your patch from the other provider.
    - remram 3y ago
      Being able to host software on my own instance, without requiring everybody else to sign up there to contribute. I like to self-host, but I don't want to be sysadmin to a public service, and deal with account deletion, password resets, ...
  - cimnine 3y ago
    Have a look at GitLab's plans then: https://docs.gitlab.com/ee/architecture/blueprints/activity_pub/index.html https://docs.gitlab.com/ee/architecture/blueprints/activity_... Edit: Better link
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
Are you sharing a link to that tweet here or is this your Tell HN: story?
- remram 3y ago
  If you click on their profile here on HN you will see the name matches.
deleted 3y ago
[deleted]
siamese_puff 3y ago
Update: After HN post, GitHub emailed me instantly telling me their algorithm mistakenly banned me and they can’t tell me why or which organizations were affected.
- atmosx 3y ago
  Reassuring.
- remram 3y ago
  Are you still migrating away?
  - siamese_puff 3y ago
    I'm going to self-host Gitea, which has been on my todo list for awhile.
- MathMonkeyMan 3y ago
  They can tell you, but they don't have to.
  - unixfox 3y ago
    They can't tell it because that would make the life easier to spammers.
    - amerkhalid 3y ago
      Not an excuse to not explain what happened. If they want to maintain trust, they should give some explanation.
      - lamontcg 3y ago
        We need some kind of anti-kafka internet bill of rights which forces platforms to disclose why you've been banned at a granular level of detail. This would make their job harder to keep up with spammers/abuse and might cut into their profits, but I royally don't give any fucks about that.
darvid 3y ago
my account of 10 years also got permab& recently for "ToS violation" (support was relatively responsive, granted after a few nudges, and unbanned after ~weekend of downtime, but it was frustrating - the reason was "suspicious login(s)" but literally nothing in the access logs out of the ordinary that I could find on my end, and much like OP and others, they could not give me any more details)
Havoc 3y ago
Just under 9 hours to fix from posting. HN seems to becoming more and more of a help desk. I miss the old days where companies had actual support
RecycledEle 3y ago
Spammers have reason to target GitHub: GitHub is listed on many resumes, so it's worth money. The problem comes when social engineering spammers are investigated. They blame others, and get those others delisted from GitHub. I suspect that, like eBay, CraigsList, SpamHaus, and (R)eddit, GitHub's spam fighters are now completely coned by the spammers so that they only shut down honest people.
notemaker 3y ago
Automated account suspension is anti-consumerist for the % of false positives. And since that % likely is low, companies get away with ridiculous processes for recovering your account. I recently encountered this with Apple (https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket/ https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...). After 2 months I'm still fighting them to recover some of my devices.
- mdekkers 3y ago
  Take them to whatever the Swedish equivalent of the small claims court is. You are in the EU, the court will have a field day.

130 points by siamese_puff 3y ago

deleted 3y ago

[deleted]

dhimmel 3y ago

Many of my organizations were flagged on 2024-02-12 and hidden. Saga via a tweet thread at <https://twitter.com/dhimmel/status/1757034659895021838 https://twitter.com/dhimmel/status/1757034659895021838>. Apparently the cause was that I interacted with code that GH detected as malicious. The weird thing was that GH left this supposedly malicious code as publicly visible in multiple personal repos while hiding my unrelated organizations. These organizations were home to highly used scholarly software, research projects, and datasets. I started getting emails from users like: > I was looking at a manubot issue and found out that the repo vanished from the internet. What happened? I got the situation resolved through my contact at GitHub, but still no response via the GH support ticket after 2 weeks. Seems like GitHub is shooting themselves in the foot. Strange.

photoGrant 3y ago

They did the same accidentally to the co-founder https://twitter.com/defunkt/status/1754610843361362360 https://twitter.com/defunkt/status/1754610843361362360 Once I'd seen that, I doubled down on my self hosted GitLab and never looked back. GitHub can be a mirror for public good, but it's no castle I want to be a prisoner of.

arcfour 3y ago
I love GitLab, but the amount of serious security vulnerabilities (multiple RCEs!) make me quite nervous about the idea of self-hosting it. How do other people deal with this? Are there any competitive alternatives that have a better security record?
siamese_puff 3y ago
I definitely plan on migrating. Absolutely ridiculous
- deleted 3y ago
  [deleted]
YetAnotherNick 3y ago
Wow, I really hate the github's response here. They admitted that it shouldn't have been banned but provided no explanation. Mistakes do happen but being not open about it removes any benefit of doubt and portrays fucking up is normal part of operation for them.
- deleted 3y ago
  [deleted]
leros 3y ago
This is how I do it. Everything is in GitLab and I mirror a few repos to GitHub for public consumption and issue tracking.
binsquare 3y ago
That's astonishingly terrible, has GitHub gone public to address the issue? Can't seem to find GitHub's response in what happened

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

lakomen 3y ago

I had that happen as well a few years ago. Running my own gitea server since then but I heard there was some drama around it so it got forked to forgejo. Gitlab was just too unfriendly when I wanted some help and wanted too many resources vs gogs at that time. Because too many are on github it's too big to fail and if you want to report a big you need an account there. I wish I could go completely without it.

superkuh 3y ago

This is typical microsoft behavior. They're too big to care. Their policies are designed around avoiding bad press that could impact their bottom line, not making things work for human persons. It was inevitable ever since github sold out.

sshine 3y ago

I've used GitHub for years knowing that Microsoft owning it, they're headed for a place I won't like. I just haven't experienced that until now. I've been trying out sr.ht and codeberg.org. Sadly the product is nowhere near GitHub.

atmosx 3y ago
My understanding is that sr.ht doesn't allow a user without an account to collaborate with a user that has one. So effectively _all_ developers must pay for the privilege to "work" on a project.
- shiomiru 3y ago
  > My understanding is that sr.ht doesn't allow a user without an account to collaborate with a user that has one. So effectively _all_ developers must pay for the privilege to "work" on a project. That is a misunderstanding: sr.ht only costs money if you host your projects there. Since the official supported workflow is email-based, you don't even need a sr.ht account (paid or otherwise) to submit patches.
herbst 3y ago
I just installed gitea and never looked back. Lightweight, does all I need and full control. Microsoft killing the place was very foreseeable
- sshine 3y ago
  Gitea just has way too many security vulnerabilities for me to confidently run an open instance: https://www.cvedetails.com/vulnerability-list/vendor_id-19185/product_id-49829/Gitea-Gitea.html?page=1&order=1&trc=33&sha=c86adb63705a678a26817f8aed4c8075124ab0d6 https://www.cvedetails.com/vulnerability-list/vendor_id-1918... I don't think that a modern git web front-end needs to either look ugly and lack basic features, or be a security vulnerability, or be run by a gigantic corporation. It just happens that you can only choose between those right now. I really wish there were something as nice as GitHub, self-hosted, with a better security model.

YaBa 3y ago

Use locally installed Gitea. I only use Github for public forks and nothing else. Personal projects are all on private Gitea.

quickslowdown 3y ago
Not to add to the noise, but I've switched to Forgejo. It was very easy to migrate (as Forgejo is just a fork of Gitea, even has references to Gitea in a lot of places, like env variable names), and I've been very happy with it for the past ~6 months.
- remram 3y ago
  What is changed in Forgejo compared to Gitea? If the only difference is the name, Gitea is a better name.
  - Macha 3y ago
    Gitea have moved the product from a community governed product to an open core one and handed over the gitea.com domain to a hosted services vendor
    - remram 3y ago
      My question was: what did Forgejo do? If the software is still developed in Gitea's repository, and all Forgejo does is download the source from gitea.com, rename it, and post it on forgejo.org... how does that help the users? If there exists some Gitea features that are not available open source ("open core")... how does having Forgejo help? Unless they provide those features, the situation remains unchanged. Until they do, what is there to applaud, and what's the point of switching?
      - k8svet 3y ago
        Luckily Forgejo has a blog with a days-old blog post that spells this out. The winds are clearly blowing in Forgejo's direction despite some doubt from me, early on.

jjmarr 3y ago

Now is a great time to switch to Gerrit.

remram 3y ago
As far as I'm concerned, the first platform to get federated merge requests will win it all.
- simfree 3y ago
  Federated merge requests, wiki, issues and such would be a killer feature. I want to see all this data for all of the forks that are relatively close together from a single pane of glass. This would make collaborating and uplifting code back to the main branch much easier for small free software projects.
- ukuina 3y ago
  Can you elaborate on what that means and how it improves repos?
  - foolswisdom 3y ago
    Currently, if a repo is on github, and you develop a patch on a fork on gitlab, you can't just click a button to open a pr, the way you could of both upstream and fork were using the same provider. Federated PRs would be the capability for one provider to "talk" to another to be able to pull your patch from the other provider.
  - remram 3y ago
    Being able to host software on my own instance, without requiring everybody else to sign up there to contribute. I like to self-host, but I don't want to be sysadmin to a public service, and deal with account deletion, password resets, ...
- cimnine 3y ago
  Have a look at GitLab's plans then: https://docs.gitlab.com/ee/architecture/blueprints/activity_pub/index.html https://docs.gitlab.com/ee/architecture/blueprints/activity_... Edit: Better link

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

Are you sharing a link to that tweet here or is this your Tell HN: story?

remram 3y ago
If you click on their profile here on HN you will see the name matches.

deleted 3y ago

[deleted]

siamese_puff 3y ago

Update: After HN post, GitHub emailed me instantly telling me their algorithm mistakenly banned me and they can’t tell me why or which organizations were affected.

atmosx 3y ago
Reassuring.
remram 3y ago
Are you still migrating away?
- siamese_puff 3y ago
  I'm going to self-host Gitea, which has been on my todo list for awhile.
MathMonkeyMan 3y ago
They can tell you, but they don't have to.
- unixfox 3y ago
  They can't tell it because that would make the life easier to spammers.
  - amerkhalid 3y ago
    Not an excuse to not explain what happened. If they want to maintain trust, they should give some explanation.
    - lamontcg 3y ago
      We need some kind of anti-kafka internet bill of rights which forces platforms to disclose why you've been banned at a granular level of detail. This would make their job harder to keep up with spammers/abuse and might cut into their profits, but I royally don't give any fucks about that.

darvid 3y ago

my account of 10 years also got permab& recently for "ToS violation" (support was relatively responsive, granted after a few nudges, and unbanned after ~weekend of downtime, but it was frustrating - the reason was "suspicious login(s)" but literally nothing in the access logs out of the ordinary that I could find on my end, and much like OP and others, they could not give me any more details)

Havoc 3y ago

Just under 9 hours to fix from posting. HN seems to becoming more and more of a help desk. I miss the old days where companies had actual support

RecycledEle 3y ago

Spammers have reason to target GitHub: GitHub is listed on many resumes, so it's worth money. The problem comes when social engineering spammers are investigated. They blame others, and get those others delisted from GitHub. I suspect that, like eBay, CraigsList, SpamHaus, and (R)eddit, GitHub's spam fighters are now completely coned by the spammers so that they only shut down honest people.

notemaker 3y ago

Automated account suspension is anti-consumerist for the % of false positives. And since that % likely is low, companies get away with ridiculous processes for recovering your account. I recently encountered this with Apple (https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket/ https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...). After 2 months I'm still fighting them to recover some of my devices.

mdekkers 3y ago
Take them to whatever the Swedish equivalent of the small claims court is. You are in the EU, the court will have a field day.