Comment by donatj | Hacker News Reader

Comment by donatj | Hacker News Reader

Parent Full thread

I am honestly surprised how little SPAM there is on GitHub in general. Please don’t take that as a challenge!

I’ve encountered a single instance. On a library I maintain, I recently had a PR and a series of comments added on all my outstanding issues made by a person advertising their for-pay SaaS alternative. Every problem someone had “Just try my SaaS with this connector instead…”

I hid the comments, closed the PR asking me to link it from my README, while chastising the person a little. Looking at the user’s profile/history he had done similar to many other related libraries. I reported the profile to GitHub and the whole profile was gone with all his comments and tickets in a matter of hours.

I honestly feel a little bad about that resolution, here was a person who probably put a decent chunk of time into his SaaS and just made the mistake of advertising it in an obnoxiously intrusive manner. They had legit git repos, now gone. I could have seen a younger dumber myself in their shoes, especially as I literally built the same SaaS ten years ago, using my library, and didn’t get a single person to bite.

A HN recently complained about GitHub closing their account. The GitHub activity was similar: PR pointing to their product. Also 90% of HN comments were basically "interesting submission, also checkout <my url>". So the user was either dense or didn't understand that it is a kind of SPAM. Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can.

> Maybe too much beginner advise for solo startup founders is 'hussle' as in: place your URL anywhere you can.

I did 4 years at a startup where my job was essentially this (we were a small news startup and I lead a small team of mostly college interns sharing links to our news videos with bloggers). _However_, there is a very crucial step I've rarely seen followed in the wild, and that is _actually_ engage in the conversation. "Cool, here's a URL to my product" is spam. But actually investing time into a thoughtful comment (and first evaluating whether your product is actually a good fit for the problem) is not, IMO.

"But I don't have time" is not a valid excuse here. If you don't have time to engage with your prospective customers and really understand their needs and where they're at, what are you doing communicating about your product?

In my experience doing this, you'll still get a mix of people who receive it well and some who don't. Keep a list of both. Then you know who to follow up with and who to avoid so you don't develop an antagonistic relationship with them.

Also, looking at the numbers, this didn't look like a particularly cost-effective approach to communication at the time. We were not at all playing a numbers game but were instead trying to build relationships with bloggers who would feel comfortable including our content where they believed it would genuinely contribute to their blog and their audience. Over time, maybe the time we invested up-front paid off. I left to other things before I got to assess that.

On the other hand, we were basically developing relationships with unpaid "influencers" around 2008-2012, so maybe we were on to something (in any case, the startup sold to E.W. Scripps for ~$35 million in 2014 and is still part of their portfolio today).

Not saying you're wrong, but its very defeating to participate in online conversations and hope somebody sees the URL on your profile.

When I was doing this we'd still link the URL in the content of our reply. But it would be part of a natural reply that engaged with the surrounding conversation, not just mindless copy-paste spam like "Nice, btw check out my video: <link>"

We get an unbelievable amount of spam in the Tailwind CSS repo, especially in Discussions. Usually it’s people posting some Markov chain looking sentence to make it seem somewhat real, then a couple of hours later it is edited to add a link to some website.

yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves contain so many email addresses that are otherwise hidden from the platform. In a recent test of mine, out of 60 people that had their contact email hidden in their profile, I could still determine it by looking into commit authorships in at least some of their repositories. Why is noone targetting these? These are all active and often personal accounts, meant to not be discoverable.

IMO there's also no point in remaining silent about this, it's only a matter of time until the spam starts coming in over this channel. I'm pretty certain some day GitHub will cloak commit emails by default.

I have some email addresses only used to make commits. I have had a number of recruiters use that email address. So definitely somebody is looking at them.

You can’t cloak email addresses that are part of the commit itself. If you can access the raw repo, you can access the raw email address.

GitHub already offers an email cloaking mechanism but you have to set it up in your local git config in place of your regular email.

When I was a recruiter, I was using recruiting software that scanned GitHub for email addresses back in 2014.

You'd think by now some recruiters would've figured out the best way to find people who knows X is to search for commits in X and look at the attached email

At least the recruiters who figured that out for me came with higher quality messages and offers.

I dread the day when the London recruiter spam mills figure this out...

Sadly there are vendors now that'll resell that info to recruiters so they can e.g. look at your linkedin and the tool will match it to their github and grab the email from a database built partially with commit emails.

20 or so recruiters over the last 3 years have contacted my github commit address.

> I'm pretty certain some day GitHub will cloak commit emails by default.

GitHub modifying the commit would be incompatible with signed commits.

Edit: I'm pretty sure it would also change the commit hash, making your history and GitHub's history divergent.

GitHub gives you an E-Mail address for commits through the web UI (see the E-Mail tab in settings), which you can just use for your local commits as well.

Documented here:

https://docs.github.com/en/account-and-profile/setting-up-an...

Yes. That's a different thing from GH rewriting the commits as the comment I replied to suggested.

> Why is noone targetting these?

They're by definition clever people who spend time trying not to be contacted. What's the likely outcome of spamming them? 0.01% responding? Fewer?

* out of 60 people, I could determine it in about 90% of cases

...Is what I actually meant to write, this was a typo and the comment is locked now. :/

I had completely opposite experience when I was actively participating in maintenance of medium size project. Waves of randomly generated pull requests and issues containing randomly inserted words with usernames that seemed to follow similar pattern. Dozens per day if not hour. Reported them countless times but there was no reaction from Github beside the initial automatic response, even after half a year those accounts where still there.

Only thing that somewhat helped was limiting PR and issues to contributors for a week or so (which is bad for users). Afterwards it was possible to turn them back on for everyone. But after few months of silence the bots where back.

The whole thing was slightly bizarre. And their goal was unclear. The messages never contained any actual ads or links. It looked like someone is trying to simulate real accounts behavior. Those accounts where doing similar thing to other real repositories and also making nonsensical activity in each others forks of real projects. Maybe the person was still testing how to avoid bot detection. Or maybe the goal was accumulating accounts which could later be used for selling stars.

A lot of filters for finding spam in systems look at values like the relationship between reports (for bad behavior) vs "good" contributions. Spammers will try to game the system by pushing out lots and lots of "good" contributions to then be able to sneak in the few really bad ones.

Funny you should say that now because I just saw my first spam in a github issue thread yesterday. And there was no way to report it.

I woke up to some huge spam threads from Github this morning. Someone figured out how to notify everyone in a major repo (at least, I think that's what happened), and others piled on with nonsense comments and even some very disgusting images.

Sure, it's nice how little there is, but it's definitely there.

Seems like people have recently realized this is an attack vector. Starting May 31, I've received an immense amount of spam. GitHub, in their infinitesimal wisdom, make you log in to unsubscribe! Which of course I can't do on my phone. So I've taken to reporting their notifications as spam.

Covered here:

https://news.ycombinator.com/item?id=31627061

Reply on news.ycombinator.com