15 ms·

Tell HN: YC companies scrape GitHub activity, send spam emails to users

688 points by miki123211 8mo ago

Hi HN, I recently noticed that an YC company (Run ANywhere, W26) sent me the following email: From: Aditya <aditya@buildrunanywhere.org> Subject: Mikołaj, think you'd like this [snip] Hi Mikołaj, I found your GitHub and thought you might like what we're building. [snip] I have also received a deluge of similar emails from another AI company, Voice.AI (doesn't seem to be YC affiliated). These emails indicate that those companies scrape people's Github activity, and if they notice users contributing to repos in their field of business, send marketing emails to those users without receiving their consent. My guess is that they use commit metadata for this purpose. This includes recipients under the GDPR (AKA me). I've sent complaints to both organizations, no response so far. I have just contacted both Github and YC Ethics on this issue, I'll update here if I get a response.

neya 8mo ago
This is atleast fine as it's just spam, I got pulled into an actual scam and it never made it to the frontpage. https://news.ycombinator.com/item?id=45357205 https://news.ycombinator.com/item?id=45357205
- deleted 8mo ago
  [deleted]
- ChrisMarshallNY 8mo ago
  Looks like GH nuked it, though. Hope they didn’t get too many folks.
- nubinetwork 8mo ago
  That's a little creepier than the time I got an email from someone trying to push a new crypto coin to me because I contributed to OSS.
- medi8r 8mo ago
  But that is someone pretending to be YC which is sort of less interesting than a YC company doing something bad. Because phishers imitate legit companies all the time. Easy to get roped in and I sympathise, anyone is suseptable (today I almost clicked the phishing training email as it looked urgent and pushed the right buttons)
atfzl 8mo ago
[flagged]
- speedgoose 8mo ago
  Why would you promote spam?
- bilekas 8mo ago
  This is some next level spam posting. Not sure to be annoyed or impressed.
- RobotToaster 8mo ago
  I feel like spam is somewhat less offensive when it's for FOSS, assuming it isn't some faux FOSS freemium scam. It's about the only spam I wouldn't mind getting.
pscanf 8mo ago
I was also spammed (twice) by voice.ai. You mention GDPR, which also "applies" to me, though I wonder if what they're doing is actually illegal. I mean, after all, I'm putting my email on GitHub precisely to give people a way to contact me. Of course, I do that naïvely, assuming good faith, not expecting _companies_ to use it to spam me. So definitely what they're doing is, at the very least, in poor taste.
- zvqcMMV6Zcr 8mo ago
  Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? For last few years I saw they "try" to look legit, by claiming addresses are managed by some Hungarian/Spanish shell company, hoping no one will be able to afford pursuing infractions over borders.
  - KomoD 8mo ago
    > Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? A lawyer
  - RobotToaster 8mo ago
    There's probably a law against it, but I've always thought a legal company could make decent money taking cases like this in bulk for free, on the condition that they get to keep all the compensation, while the "client" still gets the satisfaction of punishing the offending party.
    - notpushkin 8mo ago
      That’s pretty much class action lawsuits!
    - rationalist 8mo ago
      On the U.S., only Attorneys General can go after violators of the CAN-SPAM Act. It needs to be modified like how individuals can go after telemarketers.
  - 8mo ago
ValentineC 8mo ago
> These emails indicate that those companies scrape people's Github activity, and if they notice users contributing to repos in their field of business, send marketing emails to those users without receiving their consent. My guess is that they use commit metadata for this purpose. There are likely marketing email datasets floating around the internet that contain email addresses scraped from commit metadata. I use a catchall with a specific Git client (not GitHub) email address, and found spam and phishing emails being sent there quite a few times.
- input_sh 8mo ago
  May not necessarily be from commit messages, there's at least one way simpler way: simply adding .gpg to the end of any user URL will return that user's public GPG key.
  - ValentineC 8mo ago
    I don't understand what you're suggesting. The public keys on GitHub are stripped of email addresses — I checked before replying.
armchairhacker 8mo ago
I remember this being discussed a while ago https://news.ycombinator.com/item?id=9332418 https://news.ycombinator.com/item?id=9332418 (11 years ago) https://news.ycombinator.com/item?id=20660624 https://news.ycombinator.com/item?id=20660624 (7 years ago) https://news.ycombinator.com/item?id=27855152 https://news.ycombinator.com/item?id=27855152 (5 years ago) https://news.ycombinator.com/item?id=30900237 https://news.ycombinator.com/item?id=30900237 (4 years ago) Seems it’s a reoccurring issue
ChrisMarshallNY 8mo ago
I’m not especially bothered by this [yet -AI is likely to make this worse]. It’s a fairly insignificant component of my spam catcher. At least, it’s a bit focused. Every day, I get deluged with hundreds of spam and scam emails, often because some knucklehead entered my email in a form (either accidentally, or as a throwaway red herring).
- Maxious 8mo ago
  Sure but these YC spammers are identifiable and have much more to lose https://www.ycombinator.com/ethics/ https://www.ycombinator.com/ethics/ > Some examples of ethical behavior we expect from founders are: > - Not spamming members of the community > To maintain our community, if we determine (in our sole discretion) that a founder has behaved unethically during or after YC, we will revoke their YC founder status. This includes access to all Y Combinator spaces, software, lists and events. All founders in a company may be held responsible for the unethical actions of a single co-founder or a company employee, depending on the circumstances.
  - RobotToaster 8mo ago
    Has this ever actually been enforced?
    - nerdsniper 8mo ago
      Just Medobed (S23). For lying to YC partners. Edit: Apparently "about a dozen companies"[0] have been booted for ethics violations. 0: https://techcrunch.com/2021/06/09/does-what-happens-at-yc-stay-at-yc/ https://techcrunch.com/2021/06/09/does-what-happens-at-yc-st...
  - ChrisMarshallNY 8mo ago
    > > - Not spamming members of the community Ah... but there's the rub. Define "the community." Do random GH accounts count as "members of the YC community"? Sorry, but unsolicited contact, much as I hates, HATESSSS it, is a classic component of any business, and has been, for many decades. I don't think it would be appropriate for a business organization to prohibit its members from engaging in "cold calling," of which, UCE is really an example. Using the YC branding/name, however, is a different matter.
kristoff_it 8mo ago
I have received over the years so much spam of this kind by multiple YC-funded companies that I now reflexively send to spam any email that mentions being YC-funded, regardless of how legitimate the email is.
- neya 8mo ago
  I don't blame you, the FOMO is real to the point even basic ChatGPT wrappers are getting funded these days, I guess.
  - jvwww 8mo ago
    I'm always interested to understand - what constitutes a basic ChatGPT wrapper? Is Legora, which is doing very well, a basic ChatGPT wrapper? Because if you don't view it as one, it certainly started as one.
- AznHisoka 8mo ago
  Same here, having YC attached to your name is not the flex you think it is, its even the opposite for me
  - ryandrake 8mo ago
    Their brand has been associated with hacking-around and gaining advantage via rule breaking for a while. Didn't their founder application at one point ask "Tell us about a time where you hacked some system for your advantage?" At this point, I think everyone knows they're signing up for dark patterns and questionable practices when they get involved.
    - Goronmon 8mo ago
      Their brand has been associated with hacking-around and gaining advantage via rule breaking for a while. Yup, this type of behavior is pretty much as I would expect and it's something I've seen since I first started posting here.
    - 8mo ago
koakuma-chan 8mo ago
I have been having the same experience. If you starred a GitHub repo, and they think that their product is similar, they will send you their spam. I condemn this! They should be ashamed!
- lyu07282 8mo ago
  After 25 years on the internet dealing with spam, it would never even occur to me to invest the energy to write a letter to the offending companies investor. But more power to them I'd say!
outloudvi 8mo ago
I usually check the "Received" header and report to the email service provider. Once in a while I receive a response saying the case is properly handled. These providers are the only ones that care about their reputation and thus may take some action. Investors? Nope.
- john_strinlai 8mo ago
  the problem is that the emails arent typically sent from the main domain. in this example, the email came from buildrunanywhere.org, which is just a parked domain. the real domain is runanywhere.ai, which they arent using for spam. so, once buildrunanywhere.org has their reputation burned from reports, they will simply register buildrunanywheres.org and start spamming again.
  - outloudvi 8mo ago
    These companys don't care about the reputation of their domains anymore at the moment they start to send spams. However, email senders (SendGrid, Mailgun etc.) care about the reputation of their IP addresses.
dewey 8mo ago
This happens all the time, not really surprised as the GitHub API makes it pretty easy to extract valuable leads with real and confirmed email addresses.
- tommoor 8mo ago
  Yea, been going on at least a decade
- progbits 8mo ago
  I don't like this way of putting it, it's good the github API makes this easy as that makes it an useful. Should not try to imply this should be restricted just because of some bad actors. It's just going to annoy legit users and the bad ones will scrape anyway.
  - dewey 8mo ago
    I'm just stating a fact, not implying anything. It's the good old saying with the sharp knife, it can be used for good and bad.
    - progbits 8mo ago
      Ok sorry I guess I read too much into it.
c16 8mo ago
Email address privacy is a feature offered by Github and replaces your day to day email: https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address https://docs.github.com/en/account-and-profile/how-tos/email...
- efreak 8mo ago
  Unfortunately if you don't start out using that, then your email address is already spread across the web. And back when I was looking at gitlab/bitbucket/etc for feature comparison, each forge used their own domain and couldn't be persuaded to combine commits from multiple addresses into your own profile (to be clear, that's not really necessary, but it does make it more difficult to find a commit created by someone when their commit address isn't the address associated with their account)
bakugo 8mo ago
This sounded familiar, so I checked my inbox and I did indeed receive a similar email from sanchitmonga@runanywheresdk.com earlier this month: > I came across your GitHub profile and thought you might be interested in what my team and I are building. We're developing an open source SDK that runs LLMs directly on-device. What's even more interesting is that both buildrunanywhere.org and runanywheresdk.com show a stock hostinger parking page when accessed in a browser. Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain. I guess I shouldn't be surprised given YC is going all in on AI and most AI companies are no better than the crypto scammers of yesteryear, but still.
- Imustaskforhelp 8mo ago
  I observed the same thing and it was only when you told me the main domain that I found their website. > Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain This is a really bad look on them. https://www.whatsmydns.net/domain-age?q=buildrunanywhere.org https://www.whatsmydns.net/domain-age?q=buildrunanywhere.org and https://www.whatsmydns.net/domain-age?q=runanywheresdk.com https://www.whatsmydns.net/domain-age?q=runanywheresdk.com Both these domain were registered only 36 days ago Their main domain had been around for 6 month (216 days) tho:- https://www.whatsmydns.net/domain-age?q=runanywhere.ai https://www.whatsmydns.net/domain-age?q=runanywhere.ai (I also couldn't see any post created by them on YC checking algolia from their website fwiw) Seeing their star history on their product, I see some few interesting observations[0] Their star history was almost horizontal between december and february until it got vertical all of a sudden. [0]:https://www.star-history.com/#runanywhere.ai/runanywhere.ai&RunanywhereAI/runanywhere-sdks&type=date&legend=top-left https://www.star-history.com/#runanywhere.ai/runanywhere.ai&... I looked through their linkedin and found this website owned by them as well https://www.openclawpi.com/ https://www.openclawpi.com/ and using the YC brand here as well. (registerered 26 days ago) This website looks fairly AI generated to me as well and there are some bugs within the original website as well which I am now incredibly more unsure of if generated by AI or not given the similarities between the two websites UI/UX as well.
- deleted 8mo ago
rlaabs 8mo ago
I've received the exact same email from the same company.
WhatsName 8mo ago
Doesn't YC have some code of conduct or legal/ethical guidelines? I would assume a legal and compliance department would have some major headache if documented cases of misconduct jeopardize later due diligence. I would not fund or aquire a company on the radar of national regulatory bodies for something as stupid as this.
- stevekemp 8mo ago
  It's not "spam", it's a "growth hack".
- thinkingtoilet 8mo ago
  Like every other VC firm, the only thing they care about is money. They can pretend to morals, but they will never sacrifice one for the other in any meaningful way.
- buellerbueller 8mo ago
  Imagine thinking in 2026 that an American tech company has ethics.
  - haute_cuisine 8mo ago
    Only free individual can have strong ethics. There are no free people in capitalism, money is debt after all. Think of applied pressure once you sign under VC money and amount of brainwashing / gaslighting. I sincerely hope my observation is wrong.
    - buellerbueller 8mo ago
      If you are going to go down that road: life is debt, and there is no true freedom. We are bound by the needs of our meat-containers, after all. I don't like unfettered capitalism, but when I consider economies that have existed over time, it certainly looks like constrained capitalism affords the most freedom.
- whalesalad 8mo ago
martinwoodward 8mo ago
Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental nature of Git makes this pretty easy for folks to scrape data from open source repositories. It's against our terms of service and those folks might want to talk with some lawyers about doing it - but as every Git commit contains your name and email address in the commit data it's not technically difficult even if it is unethical. From the early days we've added features to help users anonymise their email addresses for commits posted to GitHub. Basically, you configure your local Git client to use your 'no-reply' email address in commits and that still links back to your GitHub account when you push: https://docs.github.com/en/account-and-profile/reference/email-addresses-reference#your-noreply-email-address https://docs.github.com/en/account-and-profile/reference/ema... I think that's still probably the best route. We want to keep open source data as open as possible, so I don't think locking down API's etc is the right route. We do throttle API requests and scraping traffic, but then again there have been plenty of posts here over the years from people annoyed at hitting those limits so it's definitely a balancing act. Love to know what folks here think though.
- ayhanfuat 8mo ago
  I am also getting constant spam because apparently they can see who starred a repo (i.e. I see you starred repo x and we are doing something similar). I am not starring anything anymore.
- AznHisoka 8mo ago
  Maybe I am missing something, but can’t you simply not show the email address in a git commit? (Sincere question, not saying this is trivial. i am dumb and like to ask dumb questions even if might be embarassing) If someone wants to message someone, it goes through github notifications or github emails them Also banning an account doesnt seem like a heavy punishment, given they can simply move to gitlab, bitbucket etc
theturtletalks 8mo ago
General advice would be to mark the email as spam or junk and hopefully their email platform penalizes them, but this has been working less and less. Email has truly become pay to play now.
- suyash 8mo ago
  That's exactly what I've been doing with solicitation emails, reporting as SPAM on gmail.
- ergocoder 8mo ago
  We all use different domains for sending cold outreach. This isn't an amateur hour, come on.
nprateem 8mo ago
There's no reason to put your real email in git config unless you're signing, in which case repos should be private. I would have thought that was obvious.
scottydelta 8mo ago
YC is a proud investor in Flock, what YC Ethics thing are you talking about?
- cassonmars 8mo ago
  And Cluely
  - tasn 8mo ago
    Cluely is not YC.
    - fantasizr 8mo ago
      he might be thinking of chadIDE "the first brainrot ide"
  - insane_dreamer 8mo ago
    the same Cluely that's on IG? I thought that was a fictional satire.
- ls-a 8mo ago
  [flagged]
  - shrubble 8mo ago
    How would that even be legal? (Although I can't find such a startup with any kind of search engine)
    - akerl_ 8mo ago
      Why would it be illegal?
      - john_strinlai 8mo ago
        i am not sure of anywhere it is illegal. but areas i am familiar with can consider a negative reference to be defamation, thus anyone providing a negative reference should only do so if they are able to defend it (i.e. prove their statement is substantially true, or prove that the statement was honestly believed to be true and published with no malice or reckless disregard). seems risky, at least, to build a whole business around negative references that could potentially cross the line into defamation. but that type of thinking is probably why i am not rich.
keiferski 8mo ago
I've spent a lot of my career marketing to developers, and spamming their GitHub account might be top 1 or 2 worst marketing tactics you can use. Cold emailing rarely works by itself. Cold emailing developers via emails you pulled from their GitHub accounts? At that point, you're actively harming your brand, and may as well just send them spam diet pill ads.
- RandallBrown 8mo ago
  If someone took the time to look through my GitHub contributions then pitched me with a job relevant to that work I would absolutely consider them. That's exactly the kind of recruiter I would like to work with. If it's obviously just a bot scraping emails and sending generic job requests, that's very different.
  - devmor 8mo ago
    > If it's obviously just a bot scraping emails and sending generic job requests, that's very different. It's not even that nice. They scrape emails and send cold calls to try to get you to purchase their services.
  - jamesfinlayson 8mo ago
    Yeah this - I got one of these emails someone sniffing around my GitHub not that long ago and it wasn't immediately obvious that it was a scammy recruiter, so I responded to sound out if they were actually interested in one of my projects. Got the same generic response about let's work together on something so I didn't respond.
  - genxy 8mo ago
    Find everyone who starred this repo and did a PR against these 10 repos is within reach of all marketers now. I just told them how.
  - keiferski 8mo ago
    Yeah I mean as a marketing tactic to sell your product. An employer / recruiter offering you work this way is different.
BitsAndObjects 8mo ago
My solution to this is to use a Github-specific email address. All emails sent to that address which do not originate from GitHub are immediately reported as spam, marked read and deleted. I sometimes use different git/GitHub addresses depending on who I'm working for or specific projects so I can more accurately detect where data is being scraped from.
- BitsAndObjects 8mo ago
  N.B. Using service-specific emails is trivial - you don't need separate email accounts. Just use email aliases, e.g. "john.smith+github@gmail.com" -- which is an alias called "github" for "john.smith@gmail.com"
  - gus_massa 8mo ago
    Don't spammers have an automatic filter to cleanup that?
    - BitsAndObjects 8mo ago
      You'd have thought so, but no, in my experience this works very well. People doing this kind of spamming don't seem to be particularly bright, nor do they seem to spend any time/effort to clean up their scraped database.
      - gus_massa 8mo ago
        I expected the removal of the + in gmail to be at the level of script kiddies. Are spammers even at a lower level?
  - input_sh 8mo ago
    A simple regex filter will get rid of that. Now, if you use your own domain and have it configured as a catch-all, then you could do github@domain.tld.
    - 8mo ago
rodrigodlu 8mo ago
I did receive these kinds of emails as well. And I use a different email fromy priority email for GitHub commits since 4 years ago. So just stop with marketing slop please. Yes, I work with AI, and I'm becoming pretty good at it. But this doesn't mean I'm comfortable pushing AI slop into potential users and customers. I (and they) want to use AI to facilitate their processes, not to ingest slop content.
axegon_ 8mo ago
I've received several similar ones over the years. At this point, if I get an email from someone I don't know and it contains a link, chances are it's spam. I genuinely doubt github(or any other company for that matter) would do something about it. While I fully support GDPR, the truth is, few people are willing to take action knowing how much bureaucracy would be involved...
- dagi3d 8mo ago
  > how much bureaucracy would be involved... it varies from country to country, but filling a complaint on that matter is usually quite straightforward
j16sdiz 8mo ago
Over many years, I have got email from university for survey / research. This is not GitHub only, I have got a survey on how my experience interacting with folks on lkml
lordgrenville 8mo ago
Maybe a dumb question, but isn't this trivially solved with this .gitconfig? [user] name = lordgrenville email = <some_kind_of_id>+lordgrenville@users.noreply.github.com
- darknavi 8mo ago
  Sure, as long as you want to rewrite all of the history of all of your public repositories.
  - lordgrenville 8mo ago
    Oh yeah, I have always had this as it was pretty clear to me that the info in the email field is public.
- haute_cuisine 8mo ago
  Not all projects are hosted at github. You also might want to receve relevant mail from fellow developers.
  - lordgrenville 8mo ago
    Fair point. Pretty sure there is a way to have a few .gitconfig files, with the active one based on the remote URL domain, but it is more work.
- ktm5j 8mo ago
  Perhaps, but it doesn't change the fact that this is bad behavior for the company sending the email. Since YCombinator funded this company it makes sense that YC would want to know about how they are conducting business.
- edelbitter 8mo ago
  For commits you author. Kernel guidelines now have a more verbose section about tagging: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#tagging-people-requires-permission https://www.kernel.org/doc/html/latest/process/submitting-pa...
idoxer 8mo ago
I also received this shitty email 3 days ago
jacquesm 8mo ago
Sometimes they also scrape HN profiles, it is most irritating.
deleted 8mo ago
[deleted]
scosman 8mo ago
I’m also getting “saw you on GitHub” spam from voice.ai And they are using a different domain for the emails so the spam markers don’t hit their primary domain.
cyann 8mo ago
Got this spam today on my GitHub address, YC affiliated: From: henry@joincactuscompute.com Hey, I hope all is well with you, just reaching out as you seem to be interested in on-device speech models. Cactus is a low-latency AI engine for consumer devices like phones, Macs, wearables, Raspberry Pis, etc. We support transcription models like Whisper & Parakeet, benchmarks available in the attached GitHub repo. GitHub: https://github.com/cactus-compute/cactus https://github.com/cactus-compute/cactus We are keen to get your feedback, and star if feeling generous. Thanks a million
- ignoramous 8mo ago
  > star if feeling generous ... Thanks a million A 419 scam?
- mattpal21 8mo ago
  Atleast they didn't ask for stars lol, but great to see how fast they're iterating!
unfunco 8mo ago
I also had unsolicited spam from Vincent Jiang of Aden, another YC company. Hi Daniel, I just came across your profile on social media and wondered if you'd be interested in joining our Discord community for AI agent development. Currently, we see that agents break, loop, get lost, hallucinate, and cost a fortune, and therefore built a space where developers can share challenges and insights.
- foldr 8mo ago
  I had a similar one from that guy asking me to make open source PRs to some repo of theirs for, err, $25-50/hour. I replied explaining that senior software engineers in the UK aren’t quite as desperately poor as that, and got a canned response saying that they were looking forward to reviewing my PRs :D
  - shunia_huang 8mo ago
    Blows my mind that you guys are so expensive lol.
    - foldr 8mo ago
      SWE salaries in the UK are fairly unsurprising as they tend to be more or less in the range of other professional salaries. If they’re high from a worldwide point of view that’s just because most of us are in London and London is a high cost of living city.
- unfunco 8mo ago
  …and more from Backdrop. Hi Daniel, I found your GitHub profile while searching for anthropic projects, and got your email from your profile. I'm part of an online program for builders called Backdrop Build, and I think that program would be a great fit given what you are building. We have a track for builders in AI like you, it's fully online/remote and costs nothing to participate. It also works if you have a day job, it's light on time and perfect for side projects! And then another after I marked the first one as spam and ignored it. Checking in one last time to see if you have any questions about the program or the application. If it's not for you, all good - just ignore the email because I won't be pinging you again :) Joey from Backdrop Both companies have guaranteed that I won't use their services nor procure them for any organisation I work for.
callamdelaney 8mo ago
YC is basically advising their startups to engage in shitty business practices, like trying to hire UK staff for half the salary and expecting 7 day weeks.
- roryirvine 8mo ago
  Interesting - it tracks with personal experience. Honestly, I'd chalked it up as a one-off mistake by an inexperienced team (I had discussed my expected range in our first conversation, so found it odd that they they would waste their own time going through the hiring process only to make me such a stupidly low offer!) So is this something that they're actually being advised to do? What's the intention behind it?
ttul 8mo ago
Didn't AirBnB famously spam people in the Bay Area as a "guerilla tactic" to build the business in its early days? This kind of fast and loose behaviour seems standard.
hmokiguess 8mo ago
HN and YC walk a thin line between hacker culture and venture capitalist culture. I know it’s easy to think that because HN comes from YC them too are aligned with hacker culture, but no. YC is all cutthroat business.
- alexchantavy 8mo ago
  Partial agree. YC created HN, though the HN community is very much _unlike_ anything I've seen at YC. HN is deeply skeptical, technical, cynical, sarcastic. It's a great place to learn new things and I've loved it since I found it in 2012. The current startup climate (not just limited to YC) feels very AI bro YEAHHLETSFUCKINGGOO (and I say this as a founder myself having gone through YC recently in W25).
6thbit 8mo ago
I wish github could ammend the email of my commits to the private noreply address during push so they _never_ have any other email associated to them. May not be feasible due to the commit changing, confusing local branch and such? They have this other thing where they reject pushes for the 'known' emails you've told them you have, but kinda seems there should be a setting to do that for any email that is not your noreply private one. is that a feasible thing to ask for?
- cperciva 8mo ago
  If you change the email address, you change the commit hash. And yes, suddenly your local branches are orphaned. Of course, there's nothing stopping you from using a git-only email address (nospam-6thbit@yourdomain) and routing that to /dev/null. GitHub can't change email addresses, but you can.
- arcfour 8mo ago
  They literally have a setting to block pushes with any email other than the noreply one, lol.
  - 6thbit 8mo ago
    You'd think so, but no! They only do that if you set up that specific email on your account. Not if its 'any email other than the noreply one'. > When you push to GitHub, we’ll check the most recent commit. If the author email on that commit is a private email on your GitHub account, we will block the push and warn you about exposing your private email. Perhaps my usecase is niche, but I sometimes work with other git servers from the same machine with different emails and I don't want to set up all those on GH. Global settings don't help here, per-repo settings help but this doesn't come along when you clone a new one.
ttoinou 8mo ago
Couldn’t github replace all public commits author info email by a username@author.github.com email automagically ?
- jonathanlydall 8mo ago
  You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break. GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.
  - VorpalWay 8mo ago
    Which is why you should be careful to never use your actual email in git commits. When I made a patch to the Linux kernel I did have to use a real email, since you have to send to their mailing list. I used a throwaway email for it, which I have since edited on my mail server config to forward to /dev/null (yes, I'm one of the weirdos still self hosting email in 2026). The amount of spam I got was insane, and not even developer relevant spam.
    - miki123211 8mo ago
      This makes me wonder how the Linux kernel git system deals with GDPR data deletion requests. Are they even legally allowed to deny them?
- arcfour 8mo ago
  You have to configure your own Git client manually. But you can configure GitHub to block pushes from any email other than the no reply email GH generates for you.
oefrha 8mo ago
Yes, startups, recruiting platforms, and students/“researchers” with stupid surveys for their worthless “research” spam me all the time by scraping the email from GitHub. I immediately trash the first two categories; I send a sternly-worded reply to the third category.
ting0 8mo ago
Change your email to something like: myemail+gh@mail.com (the "+gh" tag). You can put any tag/word there, and if you get spam from a company you'll be able to identify that it came from them scraping your GH. Then you can report it with certainty.
- buellerbueller 8mo ago
  you can also autofilter that tag to route to spam
b8 8mo ago
Boundaries don't exist really in tech and especially with emails. I just filter out spam and block a good bit. People just ignore stuff now a days even people saying hi passing someone in the street (which I stopped doing)? My colleges spam filter catches a lot of them. Your email is presumably already in data dumps.
elwebmaster 8mo ago
Just got a SPAM email from a Github scraper while reading this thread: From: james@techglobal.website Quick note – your GitHub profile Hi X, I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. Profile: I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call. Regards, James If I had to guess, "James" is a North Korean looking to scam US clients, based on my experience with shady actors.
- max__dev 8mo ago
  Checked my spam after seeing this thread and found the same sender/email. Subject and signature are slightly changed. From: james@techglobal.website Brief note – Following up on your GitHub work Hi , I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. Profile: I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call. Best, James
- vintagedave 8mo ago
  I'm curious, what leads you to North Korean from that email? Is it that there's an anonymous team, which has a US "front"?
  - elwebmaster 8mo ago
    Yes, having a US "front" is how North Koreans pass the identity verifications at US companies looking for remote workers. I have personally spoken with numerous such individuals. Think about it, if you were a legitimite organization attempting to gain US presence would your first action be to SPAM individuals on Github or to register a business and submit a job post on LinkedIn?
malmeloo 8mo ago
Oh I'm getting so tired of this. Lately there appears to have been an uptick in this kind of marketing spam too, there's so many companies trying to advertise their AI products this way. At least it's a good indicator of which companies I should avoid at all costs, and it provides me with an email address I can use to direct my angry emotions towards. They're getting more aggressive at it too. Just yesterday I received an email from Alignerr (not YC affiliated I think) saying that my sign-up was complete and cheerfully welcoming me to their platform. I had never even heard of them. An automated "job opportunity!" email didn't arrive until 3 hours later, but by then I had already directed some angry words towards their support email. Other, even less respectable projects are also regularly enrolling my GitHub projects into their platforms, and I have to actively reach out to them to remove it. I'm so tired of this man. Can someone go and take away these organizations' ability to send emails?
coffeecoders 8mo ago
For me, its those Who's hiring or Who wants to get hired posts. I used a throwaway email once and got emails about SEO and AI projects. I don’t engage. I mark as spam, block the sender/domain, and move on.
an0malous 8mo ago
Ever wonder why YC has the "Describe a time you most successfully hacked some system to your advantage" question? It's because they select for founders that are willing to take advantage of legal gray areas. Airbnb repeatedly violated Craigslist terms of service and called it "growth hacking." Reddit stole content from Digg and faked users. OpenAI trains their models on copyrighted content.
pmdr 8mo ago
People here assume that YC is some kind of ethics benchmark for business. It's not.
jedberg 8mo ago
FYI, there are whole companies built around this concept. You tell them which repos are interesting to you, and they give you a list of people who interact with that repo. They also de-anonymize the users so you can find them on LinkedIn or elsewhere.
insane_dreamer 8mo ago
I get these types of emails daily -- never bothered to check whether they are YC or not as I don't read them; I can tell from the first sentence that it's not a company I know and am doing biz with and it goes directly into z-file. Most seem to have gotten my email address from LinkedIn, others from GH. Side note but the trick I learned, at least with gMail is not to delete the email (which doesn't prevent you from getting new ones), or even reporting as spam (which may or may not work), but instead dragging it into the Promotions tab, into which all future emails from that email address will automatically go. Promotions tab then acts as your Trash. The quickest way to get me to never do business with you is to send me spam.
apparent 8mo ago
Even before AI, I found it super annoying when I got spam from companies touting their YC cred. They're literally hurting their own brand, as well as YC's.
danbrooks 8mo ago
I got some emails like this from overseas developers looking to borrow my Linkedin to land a higher paying job.
jazzpush2 8mo ago
That's nothing. Former/current YC founders are also abusing BookFace. I did YC and now work at a frontier lab. I've received multiple spam-style emails from (mostly young) current founders tagging me and all other YC-alum at my place-of-work with the profiles of their friends for internship roles, referrals, etc.. Same girl has done it for like 5 different people.
suprjami 8mo ago
Big deal, so does every other company. If you're lonely just upload a few AI keywords to a repo. You'll get emails forever.
tom_m 8mo ago
Happens all the time.
mustaphah 8mo ago
Even worse, I got contacted through YC Jobs (workatastartup.com) with a message that was basically: "Star, fork, and submit PRs to our open-source repo and we'll review you for a contract." I immediately realize it's engagement farming + free labor. I said "No thanks." Got this reply: "(...) I'm looking forward to reviewing your PRs. Feel free to share me any of your questions. (...)" Apparently, no one read my reply - not even AI. They are automating this shit. It's sad that many fall for it (check their Github repo) --- Company: Aden (W20) Contact: Vincent Jiang, Founder Github: https://github.com/aden-hive/hive https://github.com/aden-hive/hive
- tock 8mo ago
  Yep I got the same message on workatastartup.com from Aden.
csense 8mo ago
I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place, such as commits in a public Github repo. I feel like if you don't want companies to cold-email you, you shouldn't make your email public. Github provides noreply email addresses for this purpose.
- 16B5775dTgZ 8mo ago
  That isn't how consent works, though. Scraping emails is also against the GitHub terms of service. If you don't know what jurisdiction the owner of the email address resides in, it may also be illegal. So whether it is scraping emails off a website or finding yourself on a private island with beautiful people "made available" to you, "consent" requires more than just having access.
- heikkilevanto 8mo ago
  > I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place I find it interesting that some fucking spammers think that just because they found out my email somewhere, they should be allowed to waste my time and resources for their shit. That is explicitly illegal here in EU. Unless I have clearly given you my consent, you are not allowed to spam me. Is informed consent really such a difficult concept to understand?
scirob 8mo ago
This sounds decently targeted, why is it so offensive? Email marketing is far more democratic than Superbowl ads, give a small company a chance it's not hard to build something without the Superbowl millions
LeoPanthera 8mo ago
They scrape "Show HN" as well. I got put on a list and continue to get spam to this day.
dathinab 8mo ago
As a side note unsolicited advertisement of this kind is illegal in Europe. And them claiming "they didn't know" can be dismissed given that many dev on GH have location information set. It also in general doesn't change anything. the law doesn't care if you know or didn't. Startups starting out their journey by committing crime is always a grate sign for their trustability.
mattpal21 8mo ago
Yo, I also got the email: """ Hi Matt, I found your GitHub and thought you might like what we're building. We're developing an open source SDK that runs LLMs directly on-device. We're getting about 45 tokens per second on iPhones, with support for Swift, Kotlin, React Native and Flutter. There's also a fully offline voice pipeline built in, so everything runs locally. We recently got into Y Combinator and are focused on expanding support to more edge devices and continuously improving performance. If you're curious, here's the repo: github.com/RunanywhereAI/runanywhere-sdks Feel free to reply to this email with any feedback or ideas you'd like to explore with on-device AI, or if you'd be interested in contributing. I'd love to hear your thoughts. Best, Aditya """ Just to share the entire email, I think it's pretty well written, I went ahead and talked to the team, they were very curious and took my feedback regarding their flutter sdks very seriously, and they seem to be great people. Also, just an fyi, I tried their sdks, it's great! and I've been loving their apps as well. I think their team is great, and I asked them for adding the rag implementation, they did it in less than week and it's pretty impressive. I think it's worth checking it out, It's easier to demean someone in public like that but might be worth checking.
ellieh 8mo ago
this happens to me so often that I wonder if it's something YC suggest people do
sieep 8mo ago
I consider any company funded by YC to be engaging in legally grey or fraudulent activity.
davidcollantes 8mo ago
I get spams referring my GitHub username from time to time too: https://netbros.com/1771535100/ https://netbros.com/1771535100/. I swear it has gotten worse the last year or two.
mattpal21 8mo ago
[dead]
deleted 8mo ago
[deleted]
NimrodKramer 8mo ago
[dead]
Rapzid 8mo ago
Bruh, they are probably using another YC company that provides this service.
dukeofharen 8mo ago
You can add Alignerr to the list as well.
dariubs 8mo ago
But is it ok to send email to your repos stargazers?
mattpal21 8mo ago
Also I found this gem in my inbox - not just YC companies :/ """ Hi there! I noticed you’re interested in on-device AI development and wanted to flag a new bounty program we just launched with Qualcomm. We’re looking for developers to build a local Android AI app (using the Nexa SDK). Since you're already exploring this space, I thought this might be an easy win for you. The Bounty at a glance: - Prizes: $6,500 cash pool + Flagship Snapdragon devices. - Perks: Direct partnership & marketing spotlight from Qualcomm (huge for visibility) - The Ask: Build a working Android AI app that runs locally. Registration is open now: https://sdk.nexa.ai/bounty https://sdk.nexa.ai/bounty I want to help you win. Once you register, please reply to this email. I’d be happy to advise on your ideas to increase your chances of winning. Or, if you have an existing project, I can guide you on how to port it to NexaSDK for the submission Best, Lynn @ Nexa AI """
JOHN3456 8mo ago
[dead]
JOHN34567 8mo ago
[dead]
deleted 8mo ago
[deleted]
nektro 8mo ago
first time I'm hearing that this is frowned upon. i usually ignore or politely decline
oldned 8mo ago
one thing we can do: - mark it as spam. if enough people do this it does have an impact. something GitHub can do: - offer an email address like [spam@github.com] so we can easily forward suspect TOS violations.
agcat 8mo ago
This is so weird and true. The most unfortunate thing is that a lot of these data enrichment platform where they encourage these workflows but its clear that end person doesn't appreciate it.
vexorkai 8mo ago
saw this and got paranoid about my own repos. checked the commit history and sure enough my personal email was plastered across years of commits. spent a couple hours hacking together a scanner — github.com/vexorkai/git-shield. runs locally, tells you which repos are leaking your email and how to fix it going forward. it's my own project fwiw, nothing fancy but it does the job.
deleted 8mo ago
[deleted]
mlhpdx 8mo ago
Does YC’s agreement with founders not include a clause requiring them to follow terms and conditions? I know it’s implicit, but making it explicit can help guide what would otherwise be misguided decisions.
ashutoshstark 8mo ago
[dead]

688 points by miki123211 8mo ago

neya 8mo ago

This is atleast fine as it's just spam, I got pulled into an actual scam and it never made it to the frontpage. https://news.ycombinator.com/item?id=45357205 https://news.ycombinator.com/item?id=45357205

deleted 8mo ago
[deleted]
ChrisMarshallNY 8mo ago
Looks like GH nuked it, though. Hope they didn’t get too many folks.
nubinetwork 8mo ago
That's a little creepier than the time I got an email from someone trying to push a new crypto coin to me because I contributed to OSS.
medi8r 8mo ago
But that is someone pretending to be YC which is sort of less interesting than a YC company doing something bad. Because phishers imitate legit companies all the time. Easy to get roped in and I sympathise, anyone is suseptable (today I almost clicked the phishing training email as it looked urgent and pushed the right buttons)

atfzl 8mo ago

[flagged]

speedgoose 8mo ago
Why would you promote spam?
bilekas 8mo ago
This is some next level spam posting. Not sure to be annoyed or impressed.
RobotToaster 8mo ago
I feel like spam is somewhat less offensive when it's for FOSS, assuming it isn't some faux FOSS freemium scam. It's about the only spam I wouldn't mind getting.

pscanf 8mo ago

I was also spammed (twice) by voice.ai. You mention GDPR, which also "applies" to me, though I wonder if what they're doing is actually illegal. I mean, after all, I'm putting my email on GitHub precisely to give people a way to contact me. Of course, I do that naïvely, assuming good faith, not expecting _companies_ to use it to spam me. So definitely what they're doing is, at the very least, in poor taste.

zvqcMMV6Zcr 8mo ago
Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? For last few years I saw they "try" to look legit, by claiming addresses are managed by some Hungarian/Spanish shell company, hoping no one will be able to afford pursuing infractions over borders.
- KomoD 8mo ago
  > Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? A lawyer
- RobotToaster 8mo ago
  There's probably a law against it, but I've always thought a legal company could make decent money taking cases like this in bulk for free, on the condition that they get to keep all the compensation, while the "client" still gets the satisfaction of punishing the offending party.
  - notpushkin 8mo ago
    That’s pretty much class action lawsuits!
  - rationalist 8mo ago
    On the U.S., only Attorneys General can go after violators of the CAN-SPAM Act. It needs to be modified like how individuals can go after telemarketers.
- 8mo ago

ValentineC 8mo ago

> These emails indicate that those companies scrape people's Github activity, and if they notice users contributing to repos in their field of business, send marketing emails to those users without receiving their consent. My guess is that they use commit metadata for this purpose. There are likely marketing email datasets floating around the internet that contain email addresses scraped from commit metadata. I use a catchall with a specific Git client (not GitHub) email address, and found spam and phishing emails being sent there quite a few times.

input_sh 8mo ago
May not necessarily be from commit messages, there's at least one way simpler way: simply adding .gpg to the end of any user URL will return that user's public GPG key.
- ValentineC 8mo ago
  I don't understand what you're suggesting. The public keys on GitHub are stripped of email addresses — I checked before replying.

armchairhacker 8mo ago

I remember this being discussed a while ago https://news.ycombinator.com/item?id=9332418 https://news.ycombinator.com/item?id=9332418 (11 years ago) https://news.ycombinator.com/item?id=20660624 https://news.ycombinator.com/item?id=20660624 (7 years ago) https://news.ycombinator.com/item?id=27855152 https://news.ycombinator.com/item?id=27855152 (5 years ago) https://news.ycombinator.com/item?id=30900237 https://news.ycombinator.com/item?id=30900237 (4 years ago) Seems it’s a reoccurring issue

ChrisMarshallNY 8mo ago

I’m not especially bothered by this [yet -AI is likely to make this worse]. It’s a fairly insignificant component of my spam catcher. At least, it’s a bit focused. Every day, I get deluged with hundreds of spam and scam emails, often because some knucklehead entered my email in a form (either accidentally, or as a throwaway red herring).

Maxious 8mo ago
Sure but these YC spammers are identifiable and have much more to lose https://www.ycombinator.com/ethics/ https://www.ycombinator.com/ethics/ > Some examples of ethical behavior we expect from founders are: > - Not spamming members of the community > To maintain our community, if we determine (in our sole discretion) that a founder has behaved unethically during or after YC, we will revoke their YC founder status. This includes access to all Y Combinator spaces, software, lists and events. All founders in a company may be held responsible for the unethical actions of a single co-founder or a company employee, depending on the circumstances.
- RobotToaster 8mo ago
  Has this ever actually been enforced?
  - nerdsniper 8mo ago
    Just Medobed (S23). For lying to YC partners. Edit: Apparently "about a dozen companies"[0] have been booted for ethics violations. 0: https://techcrunch.com/2021/06/09/does-what-happens-at-yc-stay-at-yc/ https://techcrunch.com/2021/06/09/does-what-happens-at-yc-st...
- ChrisMarshallNY 8mo ago
  > > - Not spamming members of the community Ah... but there's the rub. Define "the community." Do random GH accounts count as "members of the YC community"? Sorry, but unsolicited contact, much as I hates, HATESSSS it, is a classic component of any business, and has been, for many decades. I don't think it would be appropriate for a business organization to prohibit its members from engaging in "cold calling," of which, UCE is really an example. Using the YC branding/name, however, is a different matter.

kristoff_it 8mo ago

I have received over the years so much spam of this kind by multiple YC-funded companies that I now reflexively send to spam any email that mentions being YC-funded, regardless of how legitimate the email is.

neya 8mo ago
I don't blame you, the FOMO is real to the point even basic ChatGPT wrappers are getting funded these days, I guess.
- jvwww 8mo ago
  I'm always interested to understand - what constitutes a basic ChatGPT wrapper? Is Legora, which is doing very well, a basic ChatGPT wrapper? Because if you don't view it as one, it certainly started as one.
AznHisoka 8mo ago
Same here, having YC attached to your name is not the flex you think it is, its even the opposite for me
- ryandrake 8mo ago
  Their brand has been associated with hacking-around and gaining advantage via rule breaking for a while. Didn't their founder application at one point ask "Tell us about a time where you hacked some system for your advantage?" At this point, I think everyone knows they're signing up for dark patterns and questionable practices when they get involved.
  - Goronmon 8mo ago
    Their brand has been associated with hacking-around and gaining advantage via rule breaking for a while. Yup, this type of behavior is pretty much as I would expect and it's something I've seen since I first started posting here.
  - 8mo ago

koakuma-chan 8mo ago

I have been having the same experience. If you starred a GitHub repo, and they think that their product is similar, they will send you their spam. I condemn this! They should be ashamed!

lyu07282 8mo ago
After 25 years on the internet dealing with spam, it would never even occur to me to invest the energy to write a letter to the offending companies investor. But more power to them I'd say!

outloudvi 8mo ago

I usually check the "Received" header and report to the email service provider. Once in a while I receive a response saying the case is properly handled. These providers are the only ones that care about their reputation and thus may take some action. Investors? Nope.

john_strinlai 8mo ago
the problem is that the emails arent typically sent from the main domain. in this example, the email came from buildrunanywhere.org, which is just a parked domain. the real domain is runanywhere.ai, which they arent using for spam. so, once buildrunanywhere.org has their reputation burned from reports, they will simply register buildrunanywheres.org and start spamming again.
- outloudvi 8mo ago
  These companys don't care about the reputation of their domains anymore at the moment they start to send spams. However, email senders (SendGrid, Mailgun etc.) care about the reputation of their IP addresses.

dewey 8mo ago

This happens all the time, not really surprised as the GitHub API makes it pretty easy to extract valuable leads with real and confirmed email addresses.

tommoor 8mo ago
Yea, been going on at least a decade
progbits 8mo ago
I don't like this way of putting it, it's good the github API makes this easy as that makes it an useful. Should not try to imply this should be restricted just because of some bad actors. It's just going to annoy legit users and the bad ones will scrape anyway.
- dewey 8mo ago
  I'm just stating a fact, not implying anything. It's the good old saying with the sharp knife, it can be used for good and bad.
  - progbits 8mo ago
    Ok sorry I guess I read too much into it.

c16 8mo ago

Email address privacy is a feature offered by Github and replaces your day to day email: https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address https://docs.github.com/en/account-and-profile/how-tos/email...

efreak 8mo ago
Unfortunately if you don't start out using that, then your email address is already spread across the web. And back when I was looking at gitlab/bitbucket/etc for feature comparison, each forge used their own domain and couldn't be persuaded to combine commits from multiple addresses into your own profile (to be clear, that's not really necessary, but it does make it more difficult to find a commit created by someone when their commit address isn't the address associated with their account)

bakugo 8mo ago

This sounded familiar, so I checked my inbox and I did indeed receive a similar email from sanchitmonga@runanywheresdk.com earlier this month: > I came across your GitHub profile and thought you might be interested in what my team and I are building. We're developing an open source SDK that runs LLMs directly on-device. What's even more interesting is that both buildrunanywhere.org and runanywheresdk.com show a stock hostinger parking page when accessed in a browser. Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain. I guess I shouldn't be surprised given YC is going all in on AI and most AI companies are no better than the crypto scammers of yesteryear, but still.

Imustaskforhelp 8mo ago
I observed the same thing and it was only when you told me the main domain that I found their website. > Something tells me they're intentionally registering these "alternate" domains specifically for spam, to avoid tanking the email reputation of their main runanywhere.ai domain This is a really bad look on them. https://www.whatsmydns.net/domain-age?q=buildrunanywhere.org https://www.whatsmydns.net/domain-age?q=buildrunanywhere.org and https://www.whatsmydns.net/domain-age?q=runanywheresdk.com https://www.whatsmydns.net/domain-age?q=runanywheresdk.com Both these domain were registered only 36 days ago Their main domain had been around for 6 month (216 days) tho:- https://www.whatsmydns.net/domain-age?q=runanywhere.ai https://www.whatsmydns.net/domain-age?q=runanywhere.ai (I also couldn't see any post created by them on YC checking algolia from their website fwiw) Seeing their star history on their product, I see some few interesting observations[0] Their star history was almost horizontal between december and february until it got vertical all of a sudden. [0]:https://www.star-history.com/#runanywhere.ai/runanywhere.ai&RunanywhereAI/runanywhere-sdks&type=date&legend=top-left https://www.star-history.com/#runanywhere.ai/runanywhere.ai&... I looked through their linkedin and found this website owned by them as well https://www.openclawpi.com/ https://www.openclawpi.com/ and using the YC brand here as well. (registerered 26 days ago) This website looks fairly AI generated to me as well and there are some bugs within the original website as well which I am now incredibly more unsure of if generated by AI or not given the similarities between the two websites UI/UX as well.
deleted 8mo ago

rlaabs 8mo ago

I've received the exact same email from the same company.

WhatsName 8mo ago

Doesn't YC have some code of conduct or legal/ethical guidelines? I would assume a legal and compliance department would have some major headache if documented cases of misconduct jeopardize later due diligence. I would not fund or aquire a company on the radar of national regulatory bodies for something as stupid as this.

stevekemp 8mo ago
It's not "spam", it's a "growth hack".
thinkingtoilet 8mo ago
Like every other VC firm, the only thing they care about is money. They can pretend to morals, but they will never sacrifice one for the other in any meaningful way.
buellerbueller 8mo ago
Imagine thinking in 2026 that an American tech company has ethics.
- haute_cuisine 8mo ago
  Only free individual can have strong ethics. There are no free people in capitalism, money is debt after all. Think of applied pressure once you sign under VC money and amount of brainwashing / gaslighting. I sincerely hope my observation is wrong.
  - buellerbueller 8mo ago
    If you are going to go down that road: life is debt, and there is no true freedom. We are bound by the needs of our meat-containers, after all. I don't like unfettered capitalism, but when I consider economies that have existed over time, it certainly looks like constrained capitalism affords the most freedom.
whalesalad 8mo ago

martinwoodward 8mo ago

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental nature of Git makes this pretty easy for folks to scrape data from open source repositories. It's against our terms of service and those folks might want to talk with some lawyers about doing it - but as every Git commit contains your name and email address in the commit data it's not technically difficult even if it is unethical. From the early days we've added features to help users anonymise their email addresses for commits posted to GitHub. Basically, you configure your local Git client to use your 'no-reply' email address in commits and that still links back to your GitHub account when you push: https://docs.github.com/en/account-and-profile/reference/email-addresses-reference#your-noreply-email-address https://docs.github.com/en/account-and-profile/reference/ema... I think that's still probably the best route. We want to keep open source data as open as possible, so I don't think locking down API's etc is the right route. We do throttle API requests and scraping traffic, but then again there have been plenty of posts here over the years from people annoyed at hitting those limits so it's definitely a balancing act. Love to know what folks here think though.

ayhanfuat 8mo ago
I am also getting constant spam because apparently they can see who starred a repo (i.e. I see you starred repo x and we are doing something similar). I am not starring anything anymore.
AznHisoka 8mo ago
Maybe I am missing something, but can’t you simply not show the email address in a git commit? (Sincere question, not saying this is trivial. i am dumb and like to ask dumb questions even if might be embarassing) If someone wants to message someone, it goes through github notifications or github emails them Also banning an account doesnt seem like a heavy punishment, given they can simply move to gitlab, bitbucket etc

theturtletalks 8mo ago

General advice would be to mark the email as spam or junk and hopefully their email platform penalizes them, but this has been working less and less. Email has truly become pay to play now.

suyash 8mo ago
That's exactly what I've been doing with solicitation emails, reporting as SPAM on gmail.
ergocoder 8mo ago
We all use different domains for sending cold outreach. This isn't an amateur hour, come on.

nprateem 8mo ago

There's no reason to put your real email in git config unless you're signing, in which case repos should be private. I would have thought that was obvious.

scottydelta 8mo ago

YC is a proud investor in Flock, what YC Ethics thing are you talking about?

cassonmars 8mo ago
And Cluely
- tasn 8mo ago
  Cluely is not YC.
  - fantasizr 8mo ago
    he might be thinking of chadIDE "the first brainrot ide"
- insane_dreamer 8mo ago
  the same Cluely that's on IG? I thought that was a fictional satire.
ls-a 8mo ago
[flagged]
- shrubble 8mo ago
  How would that even be legal? (Although I can't find such a startup with any kind of search engine)
  - akerl_ 8mo ago
    Why would it be illegal?
    - john_strinlai 8mo ago
      i am not sure of anywhere it is illegal. but areas i am familiar with can consider a negative reference to be defamation, thus anyone providing a negative reference should only do so if they are able to defend it (i.e. prove their statement is substantially true, or prove that the statement was honestly believed to be true and published with no malice or reckless disregard). seems risky, at least, to build a whole business around negative references that could potentially cross the line into defamation. but that type of thinking is probably why i am not rich.

keiferski 8mo ago

I've spent a lot of my career marketing to developers, and spamming their GitHub account might be top 1 or 2 worst marketing tactics you can use. Cold emailing rarely works by itself. Cold emailing developers via emails you pulled from their GitHub accounts? At that point, you're actively harming your brand, and may as well just send them spam diet pill ads.

RandallBrown 8mo ago
If someone took the time to look through my GitHub contributions then pitched me with a job relevant to that work I would absolutely consider them. That's exactly the kind of recruiter I would like to work with. If it's obviously just a bot scraping emails and sending generic job requests, that's very different.
- devmor 8mo ago
  > If it's obviously just a bot scraping emails and sending generic job requests, that's very different. It's not even that nice. They scrape emails and send cold calls to try to get you to purchase their services.
- jamesfinlayson 8mo ago
  Yeah this - I got one of these emails someone sniffing around my GitHub not that long ago and it wasn't immediately obvious that it was a scammy recruiter, so I responded to sound out if they were actually interested in one of my projects. Got the same generic response about let's work together on something so I didn't respond.
- genxy 8mo ago
  Find everyone who starred this repo and did a PR against these 10 repos is within reach of all marketers now. I just told them how.
- keiferski 8mo ago
  Yeah I mean as a marketing tactic to sell your product. An employer / recruiter offering you work this way is different.

BitsAndObjects 8mo ago

My solution to this is to use a Github-specific email address. All emails sent to that address which do not originate from GitHub are immediately reported as spam, marked read and deleted. I sometimes use different git/GitHub addresses depending on who I'm working for or specific projects so I can more accurately detect where data is being scraped from.

BitsAndObjects 8mo ago
N.B. Using service-specific emails is trivial - you don't need separate email accounts. Just use email aliases, e.g. "john.smith+github@gmail.com" -- which is an alias called "github" for "john.smith@gmail.com"
- gus_massa 8mo ago
  Don't spammers have an automatic filter to cleanup that?
  - BitsAndObjects 8mo ago
    You'd have thought so, but no, in my experience this works very well. People doing this kind of spamming don't seem to be particularly bright, nor do they seem to spend any time/effort to clean up their scraped database.
    - gus_massa 8mo ago
      I expected the removal of the + in gmail to be at the level of script kiddies. Are spammers even at a lower level?
- input_sh 8mo ago
  A simple regex filter will get rid of that. Now, if you use your own domain and have it configured as a catch-all, then you could do github@domain.tld.
  - 8mo ago

rodrigodlu 8mo ago

I did receive these kinds of emails as well. And I use a different email fromy priority email for GitHub commits since 4 years ago. So just stop with marketing slop please. Yes, I work with AI, and I'm becoming pretty good at it. But this doesn't mean I'm comfortable pushing AI slop into potential users and customers. I (and they) want to use AI to facilitate their processes, not to ingest slop content.

axegon_ 8mo ago

I've received several similar ones over the years. At this point, if I get an email from someone I don't know and it contains a link, chances are it's spam. I genuinely doubt github(or any other company for that matter) would do something about it. While I fully support GDPR, the truth is, few people are willing to take action knowing how much bureaucracy would be involved...

dagi3d 8mo ago
> how much bureaucracy would be involved... it varies from country to country, but filling a complaint on that matter is usually quite straightforward

j16sdiz 8mo ago

Over many years, I have got email from university for survey / research. This is not GitHub only, I have got a survey on how my experience interacting with folks on lkml

lordgrenville 8mo ago

Maybe a dumb question, but isn't this trivially solved with this .gitconfig? [user] name = lordgrenville email = <some_kind_of_id>+lordgrenville@users.noreply.github.com

darknavi 8mo ago
Sure, as long as you want to rewrite all of the history of all of your public repositories.
- lordgrenville 8mo ago
  Oh yeah, I have always had this as it was pretty clear to me that the info in the email field is public.
haute_cuisine 8mo ago
Not all projects are hosted at github. You also might want to receve relevant mail from fellow developers.
- lordgrenville 8mo ago
  Fair point. Pretty sure there is a way to have a few .gitconfig files, with the active one based on the remote URL domain, but it is more work.
ktm5j 8mo ago
Perhaps, but it doesn't change the fact that this is bad behavior for the company sending the email. Since YCombinator funded this company it makes sense that YC would want to know about how they are conducting business.
edelbitter 8mo ago
For commits you author. Kernel guidelines now have a more verbose section about tagging: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#tagging-people-requires-permission https://www.kernel.org/doc/html/latest/process/submitting-pa...

idoxer 8mo ago

I also received this shitty email 3 days ago

jacquesm 8mo ago

Sometimes they also scrape HN profiles, it is most irritating.

deleted 8mo ago

[deleted]

scosman 8mo ago

I’m also getting “saw you on GitHub” spam from voice.ai And they are using a different domain for the emails so the spam markers don’t hit their primary domain.

cyann 8mo ago

Got this spam today on my GitHub address, YC affiliated: From: henry@joincactuscompute.com Hey, I hope all is well with you, just reaching out as you seem to be interested in on-device speech models. Cactus is a low-latency AI engine for consumer devices like phones, Macs, wearables, Raspberry Pis, etc. We support transcription models like Whisper & Parakeet, benchmarks available in the attached GitHub repo. GitHub: https://github.com/cactus-compute/cactus https://github.com/cactus-compute/cactus We are keen to get your feedback, and star if feeling generous. Thanks a million

ignoramous 8mo ago
> star if feeling generous ... Thanks a million A 419 scam?
mattpal21 8mo ago
Atleast they didn't ask for stars lol, but great to see how fast they're iterating!

unfunco 8mo ago

I also had unsolicited spam from Vincent Jiang of Aden, another YC company. Hi Daniel, I just came across your profile on social media and wondered if you'd be interested in joining our Discord community for AI agent development. Currently, we see that agents break, loop, get lost, hallucinate, and cost a fortune, and therefore built a space where developers can share challenges and insights.

foldr 8mo ago
I had a similar one from that guy asking me to make open source PRs to some repo of theirs for, err, $25-50/hour. I replied explaining that senior software engineers in the UK aren’t quite as desperately poor as that, and got a canned response saying that they were looking forward to reviewing my PRs :D
- shunia_huang 8mo ago
  Blows my mind that you guys are so expensive lol.
  - foldr 8mo ago
    SWE salaries in the UK are fairly unsurprising as they tend to be more or less in the range of other professional salaries. If they’re high from a worldwide point of view that’s just because most of us are in London and London is a high cost of living city.
unfunco 8mo ago
…and more from Backdrop. Hi Daniel, I found your GitHub profile while searching for anthropic projects, and got your email from your profile. I'm part of an online program for builders called Backdrop Build, and I think that program would be a great fit given what you are building. We have a track for builders in AI like you, it's fully online/remote and costs nothing to participate. It also works if you have a day job, it's light on time and perfect for side projects! And then another after I marked the first one as spam and ignored it. Checking in one last time to see if you have any questions about the program or the application. If it's not for you, all good - just ignore the email because I won't be pinging you again :) Joey from Backdrop Both companies have guaranteed that I won't use their services nor procure them for any organisation I work for.

callamdelaney 8mo ago

YC is basically advising their startups to engage in shitty business practices, like trying to hire UK staff for half the salary and expecting 7 day weeks.

roryirvine 8mo ago
Interesting - it tracks with personal experience. Honestly, I'd chalked it up as a one-off mistake by an inexperienced team (I had discussed my expected range in our first conversation, so found it odd that they they would waste their own time going through the hiring process only to make me such a stupidly low offer!) So is this something that they're actually being advised to do? What's the intention behind it?

ttul 8mo ago

Didn't AirBnB famously spam people in the Bay Area as a "guerilla tactic" to build the business in its early days? This kind of fast and loose behaviour seems standard.

hmokiguess 8mo ago

HN and YC walk a thin line between hacker culture and venture capitalist culture. I know it’s easy to think that because HN comes from YC them too are aligned with hacker culture, but no. YC is all cutthroat business.

alexchantavy 8mo ago
Partial agree. YC created HN, though the HN community is very much _unlike_ anything I've seen at YC. HN is deeply skeptical, technical, cynical, sarcastic. It's a great place to learn new things and I've loved it since I found it in 2012. The current startup climate (not just limited to YC) feels very AI bro YEAHHLETSFUCKINGGOO (and I say this as a founder myself having gone through YC recently in W25).

6thbit 8mo ago

I wish github could ammend the email of my commits to the private noreply address during push so they _never_ have any other email associated to them. May not be feasible due to the commit changing, confusing local branch and such? They have this other thing where they reject pushes for the 'known' emails you've told them you have, but kinda seems there should be a setting to do that for any email that is not your noreply private one. is that a feasible thing to ask for?

cperciva 8mo ago
If you change the email address, you change the commit hash. And yes, suddenly your local branches are orphaned. Of course, there's nothing stopping you from using a git-only email address (nospam-6thbit@yourdomain) and routing that to /dev/null. GitHub can't change email addresses, but you can.
arcfour 8mo ago
They literally have a setting to block pushes with any email other than the noreply one, lol.
- 6thbit 8mo ago
  You'd think so, but no! They only do that if you set up that specific email on your account. Not if its 'any email other than the noreply one'. > When you push to GitHub, we’ll check the most recent commit. If the author email on that commit is a private email on your GitHub account, we will block the push and warn you about exposing your private email. Perhaps my usecase is niche, but I sometimes work with other git servers from the same machine with different emails and I don't want to set up all those on GH. Global settings don't help here, per-repo settings help but this doesn't come along when you clone a new one.

ttoinou 8mo ago

Couldn’t github replace all public commits author info email by a username@author.github.com email automagically ?

jonathanlydall 8mo ago
You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break. GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.
- VorpalWay 8mo ago
  Which is why you should be careful to never use your actual email in git commits. When I made a patch to the Linux kernel I did have to use a real email, since you have to send to their mailing list. I used a throwaway email for it, which I have since edited on my mail server config to forward to /dev/null (yes, I'm one of the weirdos still self hosting email in 2026). The amount of spam I got was insane, and not even developer relevant spam.
  - miki123211 8mo ago
    This makes me wonder how the Linux kernel git system deals with GDPR data deletion requests. Are they even legally allowed to deny them?
arcfour 8mo ago
You have to configure your own Git client manually. But you can configure GitHub to block pushes from any email other than the no reply email GH generates for you.

oefrha 8mo ago

Yes, startups, recruiting platforms, and students/“researchers” with stupid surveys for their worthless “research” spam me all the time by scraping the email from GitHub. I immediately trash the first two categories; I send a sternly-worded reply to the third category.

ting0 8mo ago

Change your email to something like: myemail+gh@mail.com (the "+gh" tag). You can put any tag/word there, and if you get spam from a company you'll be able to identify that it came from them scraping your GH. Then you can report it with certainty.

buellerbueller 8mo ago
you can also autofilter that tag to route to spam

b8 8mo ago

Boundaries don't exist really in tech and especially with emails. I just filter out spam and block a good bit. People just ignore stuff now a days even people saying hi passing someone in the street (which I stopped doing)? My colleges spam filter catches a lot of them. Your email is presumably already in data dumps.

elwebmaster 8mo ago

Just got a SPAM email from a Github scraper while reading this thread: From: james@techglobal.website Quick note – your GitHub profile Hi X, I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. Profile: I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call. Regards, James If I had to guess, "James" is a North Korean looking to scam US clients, based on my experience with shady actors.

max__dev 8mo ago
Checked my spam after seeing this thread and found the same sender/email. Subject and signature are slightly changed. From: james@techglobal.website Brief note – Following up on your GitHub work Hi , I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. Profile: I run a technical team (full-stack, cloud, DevOps) that delivers for clients. We're looking to work with an engineer based in the US on client-facing coordination—discovery, requirements, alignment—while we handle delivery. If that might be relevant, I'd be glad to set up a short call. Best, James
vintagedave 8mo ago
I'm curious, what leads you to North Korean from that email? Is it that there's an anonymous team, which has a US "front"?
- elwebmaster 8mo ago
  Yes, having a US "front" is how North Koreans pass the identity verifications at US companies looking for remote workers. I have personally spoken with numerous such individuals. Think about it, if you were a legitimite organization attempting to gain US presence would your first action be to SPAM individuals on Github or to register a business and submit a job post on LinkedIn?

malmeloo 8mo ago

Oh I'm getting so tired of this. Lately there appears to have been an uptick in this kind of marketing spam too, there's so many companies trying to advertise their AI products this way. At least it's a good indicator of which companies I should avoid at all costs, and it provides me with an email address I can use to direct my angry emotions towards. They're getting more aggressive at it too. Just yesterday I received an email from Alignerr (not YC affiliated I think) saying that my sign-up was complete and cheerfully welcoming me to their platform. I had never even heard of them. An automated "job opportunity!" email didn't arrive until 3 hours later, but by then I had already directed some angry words towards their support email. Other, even less respectable projects are also regularly enrolling my GitHub projects into their platforms, and I have to actively reach out to them to remove it. I'm so tired of this man. Can someone go and take away these organizations' ability to send emails?

coffeecoders 8mo ago

For me, its those Who's hiring or Who wants to get hired posts. I used a throwaway email once and got emails about SEO and AI projects. I don’t engage. I mark as spam, block the sender/domain, and move on.

an0malous 8mo ago

Ever wonder why YC has the "Describe a time you most successfully hacked some system to your advantage" question? It's because they select for founders that are willing to take advantage of legal gray areas. Airbnb repeatedly violated Craigslist terms of service and called it "growth hacking." Reddit stole content from Digg and faked users. OpenAI trains their models on copyrighted content.

pmdr 8mo ago

People here assume that YC is some kind of ethics benchmark for business. It's not.

jedberg 8mo ago

FYI, there are whole companies built around this concept. You tell them which repos are interesting to you, and they give you a list of people who interact with that repo. They also de-anonymize the users so you can find them on LinkedIn or elsewhere.

insane_dreamer 8mo ago

I get these types of emails daily -- never bothered to check whether they are YC or not as I don't read them; I can tell from the first sentence that it's not a company I know and am doing biz with and it goes directly into z-file. Most seem to have gotten my email address from LinkedIn, others from GH. Side note but the trick I learned, at least with gMail is not to delete the email (which doesn't prevent you from getting new ones), or even reporting as spam (which may or may not work), but instead dragging it into the Promotions tab, into which all future emails from that email address will automatically go. Promotions tab then acts as your Trash. The quickest way to get me to never do business with you is to send me spam.

apparent 8mo ago

Even before AI, I found it super annoying when I got spam from companies touting their YC cred. They're literally hurting their own brand, as well as YC's.

danbrooks 8mo ago

I got some emails like this from overseas developers looking to borrow my Linkedin to land a higher paying job.

jazzpush2 8mo ago

That's nothing. Former/current YC founders are also abusing BookFace. I did YC and now work at a frontier lab. I've received multiple spam-style emails from (mostly young) current founders tagging me and all other YC-alum at my place-of-work with the profiles of their friends for internship roles, referrals, etc.. Same girl has done it for like 5 different people.

suprjami 8mo ago

Big deal, so does every other company. If you're lonely just upload a few AI keywords to a repo. You'll get emails forever.

tom_m 8mo ago

Happens all the time.

mustaphah 8mo ago

Even worse, I got contacted through YC Jobs (workatastartup.com) with a message that was basically: "Star, fork, and submit PRs to our open-source repo and we'll review you for a contract." I immediately realize it's engagement farming + free labor. I said "No thanks." Got this reply: "(...) I'm looking forward to reviewing your PRs. Feel free to share me any of your questions. (...)" Apparently, no one read my reply - not even AI. They are automating this shit. It's sad that many fall for it (check their Github repo) --- Company: Aden (W20) Contact: Vincent Jiang, Founder Github: https://github.com/aden-hive/hive https://github.com/aden-hive/hive

tock 8mo ago
Yep I got the same message on workatastartup.com from Aden.

csense 8mo ago

I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place, such as commits in a public Github repo. I feel like if you don't want companies to cold-email you, you shouldn't make your email public. Github provides noreply email addresses for this purpose.

16B5775dTgZ 8mo ago
That isn't how consent works, though. Scraping emails is also against the GitHub terms of service. If you don't know what jurisdiction the owner of the email address resides in, it may also be illegal. So whether it is scraping emails off a website or finding yourself on a private island with beautiful people "made available" to you, "consent" requires more than just having access.
heikkilevanto 8mo ago
> I find it interesting that a substantial number of people seem to think it's wrong or unethical to cold-email someone about a potential recruitment or business opportunity if they post their email in a public place I find it interesting that some fucking spammers think that just because they found out my email somewhere, they should be allowed to waste my time and resources for their shit. That is explicitly illegal here in EU. Unless I have clearly given you my consent, you are not allowed to spam me. Is informed consent really such a difficult concept to understand?

scirob 8mo ago

This sounds decently targeted, why is it so offensive? Email marketing is far more democratic than Superbowl ads, give a small company a chance it's not hard to build something without the Superbowl millions

LeoPanthera 8mo ago

They scrape "Show HN" as well. I got put on a list and continue to get spam to this day.

dathinab 8mo ago

As a side note unsolicited advertisement of this kind is illegal in Europe. And them claiming "they didn't know" can be dismissed given that many dev on GH have location information set. It also in general doesn't change anything. the law doesn't care if you know or didn't. Startups starting out their journey by committing crime is always a grate sign for their trustability.

mattpal21 8mo ago

Yo, I also got the email: """ Hi Matt, I found your GitHub and thought you might like what we're building. We're developing an open source SDK that runs LLMs directly on-device. We're getting about 45 tokens per second on iPhones, with support for Swift, Kotlin, React Native and Flutter. There's also a fully offline voice pipeline built in, so everything runs locally. We recently got into Y Combinator and are focused on expanding support to more edge devices and continuously improving performance. If you're curious, here's the repo: github.com/RunanywhereAI/runanywhere-sdks Feel free to reply to this email with any feedback or ideas you'd like to explore with on-device AI, or if you'd be interested in contributing. I'd love to hear your thoughts. Best, Aditya """ Just to share the entire email, I think it's pretty well written, I went ahead and talked to the team, they were very curious and took my feedback regarding their flutter sdks very seriously, and they seem to be great people. Also, just an fyi, I tried their sdks, it's great! and I've been loving their apps as well. I think their team is great, and I asked them for adding the rag implementation, they did it in less than week and it's pretty impressive. I think it's worth checking it out, It's easier to demean someone in public like that but might be worth checking.

ellieh 8mo ago

this happens to me so often that I wonder if it's something YC suggest people do

sieep 8mo ago

I consider any company funded by YC to be engaging in legally grey or fraudulent activity.

davidcollantes 8mo ago

I get spams referring my GitHub username from time to time too: https://netbros.com/1771535100/ https://netbros.com/1771535100/. I swear it has gotten worse the last year or two.

mattpal21 8mo ago

[dead]

deleted 8mo ago

[deleted]

NimrodKramer 8mo ago

[dead]

Rapzid 8mo ago

Bruh, they are probably using another YC company that provides this service.

dukeofharen 8mo ago

You can add Alignerr to the list as well.

dariubs 8mo ago

But is it ok to send email to your repos stargazers?

mattpal21 8mo ago

Also I found this gem in my inbox - not just YC companies :/ """ Hi there! I noticed you’re interested in on-device AI development and wanted to flag a new bounty program we just launched with Qualcomm. We’re looking for developers to build a local Android AI app (using the Nexa SDK). Since you're already exploring this space, I thought this might be an easy win for you. The Bounty at a glance: - Prizes: $6,500 cash pool + Flagship Snapdragon devices. - Perks: Direct partnership & marketing spotlight from Qualcomm (huge for visibility) - The Ask: Build a working Android AI app that runs locally. Registration is open now: https://sdk.nexa.ai/bounty https://sdk.nexa.ai/bounty I want to help you win. Once you register, please reply to this email. I’d be happy to advise on your ideas to increase your chances of winning. Or, if you have an existing project, I can guide you on how to port it to NexaSDK for the submission Best, Lynn @ Nexa AI """

JOHN3456 8mo ago

[dead]

JOHN34567 8mo ago

[dead]

deleted 8mo ago

[deleted]

nektro 8mo ago

first time I'm hearing that this is frowned upon. i usually ignore or politely decline

oldned 8mo ago

one thing we can do: - mark it as spam. if enough people do this it does have an impact. something GitHub can do: - offer an email address like [spam@github.com] so we can easily forward suspect TOS violations.

agcat 8mo ago

This is so weird and true. The most unfortunate thing is that a lot of these data enrichment platform where they encourage these workflows but its clear that end person doesn't appreciate it.

vexorkai 8mo ago

saw this and got paranoid about my own repos. checked the commit history and sure enough my personal email was plastered across years of commits. spent a couple hours hacking together a scanner — github.com/vexorkai/git-shield. runs locally, tells you which repos are leaking your email and how to fix it going forward. it's my own project fwiw, nothing fancy but it does the job.

deleted 8mo ago

[deleted]

mlhpdx 8mo ago

Does YC’s agreement with founders not include a clause requiring them to follow terms and conditions? I know it’s implicit, but making it explicit can help guide what would otherwise be misguided decisions.

ashutoshstark 8mo ago

[dead]