Hacker News Reader

Comment by 3np | Hacker News Reader

...It's public, what is GitHub supposed to do about it? Hide currently public views behind a signup-wall? And how much would that actually achieve in practice? Should they start requiring phone number validation and ID for signups?

I suggest using a fake, or at least a dedicated, e-mail address for commit messages. If you are talking about the e-mail in your GH profile, you can mark it as private in settings. Or use their built-in function to mask it (they will replace it with an address under their domain and forward incomings to you).

There are many valid complaints about GitHub but with regards to this I think they've done what they can already. If you don't want spam to your address, don't put it in public. It will be scraped.

OP put their e-mail in cleartext, unobfuscated, in their profile. The blame is on part of the spammers. Countermeasures should be done by OP (and their e-mail host), not by GH.

View on HN

> OP put their e-mail in cleartext, unobfuscated, in their profile. The blame is on part of the spammers. Countermeasures should be done by OP (and their e-mail host), not by GH.

According Github's site policies [0], they've explicitly outlawed this type of behavior meaning it's their responsibility to police and enforce this by punishing users on their platform who they find to be engaging in it:

"You may not use information from the Service (whether scraped, collected through our API, or obtained otherwise) for spamming purposes, including for the purposes of sending unsolicited emails to users"

[0] https://docs.github.com/en/site-policy/acceptable-use-polici...

If you publish your email on your profile, aren't all emails basically solicited? What other purpose might posting your email on your profile have other than for people to reach out without you explicitly asking for it?

If you want to be selective in what people email you about, you can always move your email to your personal readme with further restrictions.

"People reaching out" is fine. "Automated bulk email" is not.

> It's public, what is GitHub supposed to do about it?

What thought processes went into asking this question? You are the person who commented on this same topic that "scraping and processing e-mail addresses associated with GH handles could be a regulatory violation without even sending anything[...] It's certainly against GH ToS".

To state what should be the obvious here: when GitHub goes through the effort of writing an acceptable use policy, and I have evidence that certain users/orgs are sending out spam despite that, then I expect GitHub to, you know, actually investigate and do something about it using the leverage that they have, e.g. by ultimately suspending the accounts of the spammers if they don't knock it off.

> I suggest using a fake, or at least a dedicated, e-mail address for commit messages.

I'm not talking about commit messages.

> If you are talking about the e-mail in your GH profile, you can mark it as private in settings.

That's the default. I have deliberately gone through the effort to make it public so that people who are making acceptable use of GitHub can use it for what it's there for—not for people who aren't to abuse it.

> There are many valid complaints about GitHub but with regards to this I think they've done what they can already.

Bullshit. To set up an intake form for people to report abuse and then never act on reports of abuse is not doing "what they can". (If nothing else, then take the damn form down so I can cut my losses at the time I've wasted dealing with the initial receipt of the spammy stuff and I don't additionally waste even more time reporting it on the belief that they're going to act on it and so that it to save other people time in the long run.)

Consider that a malicious party could send spam posing to be someone else, in order to have their account taken down. Really proving that is possible (assuming the sender has done proper setup of their DNS records or utilizing cryptographic signatures) but resources in verifying that is going beyond what I think we can expect.

Regardless, even if Github did take the sender account down and you removed it from your profile, your e-mail address is most likely on lists used to send spam not linkable to GH accounts and will continue being so for a long time moving forward. Whomever you're reporting is just a drip in that ocean.

Spam is frustrating and illegal but you're barking up the wrong tree.

> Consider that a malicious party could send spam posing to be someone else, in order to have their account taken down.

Yeah, that could happen—under two conditions: (a) if that's what actually happened here, and (b) if GitHub's process for handling abuse reports were so bad that they went from receipt of abuse report to immediate suspension. But neither of those are relevant to anything being discussed here—only to contrarians with but-what-if imaginations.

> your e-mail address is most likely on lists used to send spam not linkable to GH accounts and will continue being so for a long time moving forward. Whomever you're reporting is just a drip in that ocean.

I know how big the ocean is, thanks, and you make a lot of assumptions. Consequently, you have no idea what you're talking about (which makes your un-self-aware remark about "barking up the wrong tree" doubly annoying).

Every commit I author is signed with a single-purpose email address tied to the repo that I'm committing to. The email address I have listed on my GitHub profile is a different address further still. I have received close to zero spam to any of the addresses I've signed commits with. (I'm pretty sure it's actually zero.) Meanwhile, a substantial chunk of all spam I've received across all sources is from dum-dums scraping the address listed on my GitHub profile page and trying to promote their junk. It used to be close to a majority, which only changed due to a recent (COVID-era) uptick of spam coming from other sources—and because I took my profile down by deleting my account. But even most of the non-GitHub-originating spam is obvious spam that already automatically gets flagged and filtered accordingly.

> Spam is frustrating and illegal but you're barking up the wrong tree.

I'm going to repeat what I said before: my expectation is that GitHub takes their own acceptable use policy and reports of abuse seriously. Want to go into detail how that constitutes "barking up the wrong tree"?

I can only conclude by the contradiction between your general position in your your reply to me and your comments elsewhere about GitHub ToS violations that you're mostly here to argue, though, so don't be particularly surprised to find that this is my last response to you.

GitHub are free to forbid something on their platform without being on the hook for consistently enforcing it and processing every abuse request. They have made no promises to do so AFAIK. I see no contradiction there.

Generally, I do not think that platforms should be regulated (as has been proposed in some places) to be legally responsible for all actions of users on their platforms.

Separately from all that, if you expect fairness, individual attention, and consistency from Microsoft, I stand by my case that you are barking up the wrong tree.

Reply on news.ycombinator.com