Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: YC companies scrape GitHub activity, send spam emails to users

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 278 posts

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#131

Post by cperciva »

6thbit wrote: post #124

I wish github could ammend the email of my commits to the private noreply address during push so they _never_ have any other email associated to them. May not be feasible due to the commit changing, confusing local branch and such? They have this other thing where they reject pushes for the 'known' emails you've told them you have, but kinda seems there should be a setting to do that for any email that is not your no…

If you change the email address, you change the commit hash. And yes, suddenly your local branches are orphaned.

Of course, there's nothing stopping you from using a git-only email address (nospam-6thbit@yourdomain) and routing that to /dev/null. GitHub can't change email addresses, but you can.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#133

Post by jonathanlydall »

ttoinou wrote: post #132

Couldn’t github replace all public commits author info email by a username@author.github.com email automagically ?

You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break.

GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#134

Post by oefrha »

Yes, startups, recruiting platforms, and students/“researchers” with stupid surveys for their worthless “research” spam me all the time by scraping the email from GitHub. I immediately trash the first two categories; I send a sternly-worded reply to the third category.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#136

Post by unfunco »

unfunco wrote: post #93

I also had unsolicited spam from Vincent Jiang of Aden, another YC company. Hi Daniel, I just came across your profile on social media and wondered if you'd be interested in joining our Discord community for AI agent development. Currently, we see that agents break, loop, get lost, hallucinate, and cost a fortune, and therefore built a space where developers can share challenges and insights.

…and more from Backdrop.

    Hi Daniel, I found your GitHub profile while searching for anthropic projects, and got your email from your profile.

    I'm part of an online program for builders called Backdrop Build, and I think that program would be a great fit given what you are building. We have a track for builders in AI like you, it's fully online/remote and costs nothing to participate. It also works if you have a day job, it's light on time and perfect for side projects!
And then another after I marked the first one as spam and ignored it.

    Checking in one last time to see if you have any questions about the program or the application. If it's not for you, all good - just ignore the email because I won't be pinging you again :)

   Joey from Backdrop
Both companies have guaranteed that I won't use their services nor procure them for any organisation I work for.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#137

Post by VorpalWay »

jonathanlydall wrote: post #133
ttoinou wrote: post #132

Couldn’t github replace all public commits author info email by a username@author.github.com email automagically ?

You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break. GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.

Which is why you should be careful to never use your actual email in git commits.

When I made a patch to the Linux kernel I did have to use a real email, since you have to send to their mailing list. I used a throwaway email for it, which I have since edited on my mail server config to forward to /dev/null (yes, I'm one of the weirdos still self hosting email in 2026). The amount of spam I got was insane, and not even developer relevant spam.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#138

Post by buellerbueller »

ting0 wrote: post #135

Change your email to something like: myemail+gh@mail.com (the "+gh" tag). You can put any tag/word there, and if you get spam from a company you'll be able to identify that it came from them scraping your GH. Then you can report it with certainty.

you can also autofilter that tag to route to spam

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#139

Post by VorpalWay »

BitsAndObjects wrote: post #120
input_sh wrote: post #57

Earlier quoted context omitted.

A simple regex filter will get rid of that. Now, if you use your own domain and have it configured as a catch-all, then you could do github@domain.tld.

I'm not saying I do this but if I were as smart as I think I am I would have given a Gmail example rather than the example you've given to avoid bots just looking up my website and starting to bypass my setup... ;) ;) ;) Also, spammers generally don't seem to be going to the effort to apply regex filters to the data they've scraped...

I self host email, and I have never gotten spam to any email "constructed" from the domain, other than random attempts to things like "accounting@domain.tld" etc.

But the email I used to interact with the Linux kernel mailing list I had to null route after a while, it got so much spam. I used a throwaway for just that purpose of course, so no big deal.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#140

Post by dewey »

progbits wrote: post #122
dewey wrote: post #18

This happens all the time, not really surprised as the GitHub API makes it pretty easy to extract valuable leads with real and confirmed email addresses.

I don't like this way of putting it, it's good the github API makes this easy as that makes it an useful. Should not try to imply this should be restricted just because of some bad actors. It's just going to annoy legit users and the bad ones will scrape anyway.

I'm just stating a fact, not implying anything. It's the good old saying with the sharp knife, it can be used for good and bad.
Post reply on HN