Tea.xyz causes a flood of spam pull requests to open source projects | Hacker News Reader

Tea.xyz causes a flood of spam pull requests to open source projects

github.com

46 pointsdvt16 comments

Tea seems well intentioned but ultimately is going to suffer the same fate as every crypto project: abuse by bad faith actors.

Idea: GitHub should let you filter/block PRs that add or modify certain files. Set up the filter and forget about it, no need to close each PR.

Github should consider this a coordinated spam effort, and (shadow)ban accounts which create PRs consisting of only a `mikotea9` or `tea.yaml` file

Well first, the file is usually called `tea.yaml` - and the other PRs show that. Not sure why this guy named his file mikotea9...

I agree in cases like this GitHub should take action, but in general it would be nice to let people set their own filters as it allows maintainers to prevent abuse more specific to their project, instead of letting GitHub themselves chase things around, and makes it easy to fix the next major spam event that comes around.

This stuff is pretty similar to the Hacktoberfest incident. Well intentioned projects/events being misused.

That is almost certainly possible with github actions.

Yes, you could set one up to auto-close Pars based on certain filters. Would be nice to prevent them from being opened in the first place.

Here's a workflow I created to do just that. https://github.com/michaelessiet/tea.yaml-pr-workflow/blob/m...

Looks like it's caused over 300+ spam pull requests to random projects:

https://github.com/search?q=tea.yaml&type=pullrequests

[dupe]

Bunch more discussion here: https://news.ycombinator.com/item?id=39510756

I wholeheartedly agree that the problems Tea mentions do need to be solved, I maintain several large-ish OSS projects; it's not easy, takes a lot of effort.

Unfortunely, anything with crypto kinda just flops. Crypto was a decent idea, but there were too many uneducated people who didn't know what it was, and now it's turned into this dumpster fire.

I think another problem is also how no crypto project actually explains how it helps. Sure, I'm all in if I can earn some money for maintaing my OSS, but how does that work? What are the details? Literally every crypto thing just does some hand-waving and says, "don't worry 'bout it, it'll just work magically, trust me".

Bingo. Where does the money come from? So developers just sign up to get paid and it magically appears somehow?

This doesn’t make any sense from the start.

You were more optimistic about crypto than I was. Every project I see try to use it just seems to scream either grift or naïveté. It doesn’t surprise me one bit that the immediate thing that happened was a bunch of people wanting free “money” tried to get it without any actual work.

When the stuff was announced, I liked the concept of being able to just like send someone money, sort of like wiring but way easier.

What I didn't like is that only maybe 3 people out of 200 people really knew what was going on. 100 of those people were people screaming that it was good, "haters just gonna hate". 90 of those people are marketing people who use magic words[0] to say that the product is good. And the remaining 7 are clueless investors.

[0]: <https://mourner.github.io/bullshit.js/>

> For now we will remove ghost from the listing.

This is really funny. The temporary solution is to blacklist a particular project!

It's as bad as being banned from entering North Korea.

Of course it’s crypto.

> This is why people hate on crypto.

Someone makes a project designed to somehow pay contributors with crypto with no thought to the consequences. And it shows how to do it using other people’s projects.

So immediately grifters try to register themselves as owners of various projects wasting everyone’s time, and then gives a half assed non-apology saying “we were only trying to help”.

This approach was doomed from the start.

Reply on news.ycombinator.com