Hacker News Reader

It doesn’t really fix the “vulnerability” though? Some other jerk can open a new PR and tag everyone again. Or just tag @EpicGames/developers elsewhere, no PR needed.

View on HN

Looks like they dealt with the tag too as https://github.com/orgs/EpicGames/teams/developers is showing not found

It's "secret". You need to be in it to see it.

Teams can be secret. This might be a secret team to begin with? Anyway, I highly doubt they deleted the team since it’s used as an authorization mechanism.

Ah that makes perfect sense, thanks!

The team is still there, only members can see it.

The thing that gets me, as discussed in this thread, is that the solution is often just super easy. Literally just pop up a modal when the recipient list is above 1,000 users that says “You’re about to send this to X,000 users, Are You Sure?”

Would have totally avoided this situation.

Adding that check to every incoming comment in a large scale system and adding the previously nonexistent interactive UI for it is far from “super easy”. This is not a Todo MVC. There must be a thousand higher impact stories that are better targets of engineering time (unless this form of trolling become a new pastime).

In addition, there are lots of actually malicious skids you can’t stop by asking nicely.

Or: show ‘x users’ behind the @group in a greyish label.

Reply on news.ycombinator.com