Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: YC companies scrape GitHub activity, send spam emails to users

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 278 posts

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#111

Post by eli »

retlehs wrote: post #108
martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

I’ve made over five reports for this exact spam scenario, and never once have y’all acted on them. I have a hard time believing you ban spam accounts that clearly violate your ToS. I even wrote about a specific example of a YC company spamming me from my GitHub email at https://benword.com/dont-tolerate-unsolicited-spam

How would you know whether the account that did the scraping was banned?

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#112

Post by retlehs »

eli wrote: post #111
retlehs wrote: post #108

Earlier quoted context omitted.

I’ve made over five reports for this exact spam scenario, and never once have y’all acted on them. I have a hard time believing you ban spam accounts that clearly violate your ToS. I even wrote about a specific example of a YC company spamming me from my GitHub email at https://benword.com/dont-tolerate-unsolicited-spam

How would you know whether the account that did the scraping was banned?

By visiting the account and noticing that it still has activity long after the report.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#113

Post by nerdsniper »

trympet wrote: post #76
martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

Nice, thank you Martin. How do you punish the fraudsters? Do you send them to prison over CFAA violation terms of service?

> CFAA violation terms of service

This would be a gross miscarriage of justice and bringing successful action under this theory would do widespread harm by expanding the definition of the CFAA.

Just because a company can take some nuclear action, doesn't mean they should.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#114

Post by nerdsniper »

RobotToaster wrote: post #28
Maxious wrote: post #22

Earlier quoted context omitted.

Sure but these YC spammers are identifiable and have much more to lose https://www.ycombinator.com/ethics/ > Some examples of ethical behavior we expect from founders are: > - Not spamming members of the community > To maintain our community, if we determine (in our sole discretion) that a founder has behaved unethically during or after YC, we will revoke their YC founder status. This includes access to all Y Combina…

Has this ever actually been enforced?

Just Medobed (S23). For lying to YC partners.

Edit: Apparently "about a dozen companies"[0] have been booted for ethics violations.

0: https://techcrunch.com/2021/06/09/does-what-happens-at-yc-st...

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#116

Post by john_strinlai »

nerdsniper wrote: post #110
john_strinlai wrote: post #101

Earlier quoted context omitted.

> There are many definitions of illegal (criminal, civil, regulatory, the much much looser “license to operate” as used in chemical industry, etc). yes, but i am not sure why this matters here. i am not aware of negative references, in general, being illegal under any of those definitions of illegal. no one would say regular speech is illegal just because it can be subject to a defamation lawsuit. same logic. but i a…

https://www.law.cornell.edu/uscode/text/15/1681d It's more than just "subject to a defamation lawsuit" (including class action lawsuits). Although for me, even if it were "just that", I'd still call it "potentially illegal". Rather, they'd potentially face FTC penalties and CFPB enforcement actions under 15 U.S.C. section 1681d(a), (b). This law would likely classify such a company as falling under laws pertaining to…

ah, okay. so the hypothetical company may potentially be doing something illegal (the "investigative consumer report" part). good to know! that makes sense, and i was unaware of that.

i stand corrected in the hypothetical "bad reference aggregator company" scenario.

>YCombinator partners are on the record[3] supporting the idea of their startups sometimes doing illegal things.

interesting, thanks for surfacing that up! i wont pretend to be surprised, though.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#117

Post by martinwoodward »

trympet wrote: post #76
martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

Nice, thank you Martin. How do you punish the fraudsters? Do you send them to prison over CFAA violation terms of service?

I kinda wish I had that much power. There would certainly be less people in the world listening to their phones without headphones..

Usually starts with contacting them over email reminding them of the terms of service and warning them to stop. Then their account might get deactivated and they need to write and promise to not be naughty again. If they ignore that then the account gets removed.

There are a bunch of automated checks that are running all the time as well and will take automated action that then gets later reviewed by humans. At lot of times the process is fast-tracked.

The off-platform 'let's scrape a bunch of data and then spam nice people' is the hardest to police. Linking those mails to an offending GitHub account is hard and very manual, also anyone can send emails saying they are someone they are not and because of that anyone can deny they sent the mail and they'll usually blame a rogue agency they where working with etc.

I probably shouldn't say it, but the public shame that comes from being mentioned on social, in hacker news etc. That stops people who want to be treated as legitimate from doing that sort of thing and helps educate the wider community around what is and isn't acceptable behaviour - that is why it's good to see this thread and see the issue getting attention.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#118

Post by john_strinlai »

laserlight wrote: post #107
john_strinlai wrote: post #92

Earlier quoted context omitted.

i dont believe that it is illegal to provide a negative reference in the UK, as long as it is honest, factual, and provided in good faith. from gov.uk: >" If you think you’ve been given an unfair or misleading reference, you may be able to claim damages in court. Your previous employer must be able to back up the reference, such as by supplying examples of warning letters. You must be able to show that: - it’s mislea…

Providing a negative reference is totally different than gathering negative references and selling them. The former could be legal while the latter could be illegal.

for sure!

in my comment, i was speaking more generally than i should have, and that (obviously, in hindsight) caused some confusion between the specific case of the hypothetical company, and the general case of an employer providing a negative reference. my bad -- and it is too late to edit to provide clarification.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#120

Post by BitsAndObjects »

input_sh wrote: post #57
BitsAndObjects wrote: post #47

Earlier quoted context omitted.

N.B. Using service-specific emails is trivial - you don't need separate email accounts. Just use email aliases, e.g. "john.smith+github@gmail.com" -- which is an alias called "github" for "john.smith@gmail.com"

A simple regex filter will get rid of that. Now, if you use your own domain and have it configured as a catch-all, then you could do github@domain.tld.

I'm not saying I do this but if I were as smart as I think I am I would have given a Gmail example rather than the example you've given to avoid bots just looking up my website and starting to bypass my setup... ;) ;) ;)

Also, spammers generally don't seem to be going to the effort to apply regex filters to the data they've scraped...

Post reply on HN