Live data from Hacker News

GitHub user sends notification to 400k users

github.com

111–120 of 468 posts

Re: GitHub user sends notification to 400k users

#111
Maybe this is annoying, but at least this came from something innocuous. A scammer could have very well used this to do something much worse - be thankful it was a mistake that did this!

From what it looks like it's a brand new coder. I hope he sticks with it, because this will be one hell of a story he can tell...

Re: GitHub user sends notification to 400k users

#113
post #14
post #5

The toothpaste is out of the tube - notifications are going to be scrutinized more in the future, from this point on. I got the email. And about 20+ responses to that email. Every person who replies to that issue triggers another 400k emails. Personally, my email client is crashing. EpicGames, as a GitHub org is an outlier, it's basically an SSO for Unreal Engine. I forgot I was even a member of it.

There was a thundering herd e-mail at Amazon about 10 years ago that I’ve heard stories about. It went on for days. There’s a funny internal talk with lots of data about it, maybe it’s on YouTube by now…

When i worked at the NIH, a couple times an entire institute was accidentally cc'd instead of bcc'd on an email, and for weeks after the chain would continue, consisting only of people writing "please stop responding to this chain". I don't know what you do for that...

Re: GitHub user sends notification to 400k users

#114

Seems like an innocent enough mistake. Remind me of when I once helped organize a volunteer hackathon with people from different companies. We created a Slack organization just for the occasion. At the end of the event, I was supposed to ask all attendees to delete all the data we had given them before they went home. The message I posted to #general (the channel everyone in a Slack organization is required to be in)…

Mission accomplished; now delete your machines.

Re: GitHub user sends notification to 400k users

#115

I'm confused. Can someone explain why the Epic Games developers team has close to 400k members?

They require you to acknowledge some terms that grant you access to the Unreal Engine source code. They grant it by adding you to their GitHub org which has the engine source code as a private repo.

Re: GitHub user sends notification to 400k users

#116
post #62
post #5

The toothpaste is out of the tube - notifications are going to be scrutinized more in the future, from this point on. I got the email. And about 20+ responses to that email. Every person who replies to that issue triggers another 400k emails. Personally, my email client is crashing. EpicGames, as a GitHub org is an outlier, it's basically an SSO for Unreal Engine. I forgot I was even a member of it.

friendly reminder: 400k is an apertif for a competently configured production postfix server. its about 14 seconds of mail, and about 8 seconds optimized at hw and filesystem level. the real issue here is shitty projects from shitty companies.

Yes but that’s on top of what GitHub is already sending, plus it must be multiplied by the number of comments left on top of that. It feels like 35 straight minutes of 100% usage isn’t great on any system. It presumably sent 61 million emails.

Re: GitHub user sends notification to 400k users

#119
post #34

Earlier quoted context omitted.

It doesn’t really fix the “vulnerability” though? Some other jerk can open a new PR and tag everyone again. Or just tag @EpicGames/developers elsewhere, no PR needed.

Looks like they dealt with the tag too as https://github.com/orgs/EpicGames/teams/developers is showing not found

Teams can be secret. This might be a secret team to begin with? Anyway, I highly doubt they deleted the team since it’s used as an authorization mechanism.
Post reply on HN