Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: YC companies scrape GitHub activity, send spam emails to users

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 278 posts

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#161

Post by dent9 »

AznHisoka wrote: post #37
martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

Maybe I am missing something, but can’t you simply not show the email address in a git commit? (Sincere question, not saying this is trivial. i am dumb and like to ask dumb questions even if might be embarassing) If someone wants to message someone, it goes through github notifications or github emails them Also banning an account doesnt seem like a heavy punishment, given they can simply move to gitlab, bitbucket et…

You should be using the email address "username@no.reply.github.com" or similar

There's never been an obligation to use a real email address for git

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#162

Post by miki123211 »

AznHisoka wrote: post #37
martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

Maybe I am missing something, but can’t you simply not show the email address in a git commit? (Sincere question, not saying this is trivial. i am dumb and like to ask dumb questions even if might be embarassing) If someone wants to message someone, it goes through github notifications or github emails them Also banning an account doesnt seem like a heavy punishment, given they can simply move to gitlab, bitbucket et…

Git commits are identified by a hash of their entire contents[1]. The way hashes work, if you change even one bit, the hash becomes completely different. Every commit contains the email address of the committer and the hash of the parent commit. If the email address in even one commit is changed or removed, that changes its hash, which in turn requires you to update its children, changing their hashes etc. So, updating a commit from n years ago requires you to update all commits that have been made since. By default, git will refuse to pull from such an updated repository, as commits are considered immutable once pushed.

[1] In practice, it's a bit more complicated. Merkle trees are involved, so it's hashes of hashes of hashes instead of hashing a multi-gigabyte blob on each commit, but that's a performance optimization that doesn't affect semantics much.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#163

Post by blobbers »

martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

Scrape once, spam forever.

I think it's pretty clear you need to use an anonymization scheme in the way commits are handled so that it links back to your github account and the email addresses are kept private.

Privacy centric companies like Apple do this for users offering hashed emails, on a per login basis.

I'm sure this would not work in a world of scraping, but having that kind of ability to figure out bad actors would be nice. You could require authenticated users for certain kinds of requests, and block user information from non-authenticated requests.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#164

Post by hedora »

retlehs wrote: post #112
eli wrote: post #111

Earlier quoted context omitted.

How would you know whether the account that did the scraping was banned?

By visiting the account and noticing that it still has activity long after the report.

How do you propose GH take action without risking taking down legitimate projects due to brigades of false reports?

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#165

Post by miki123211 »

VorpalWay wrote: post #137
jonathanlydall wrote: post #133

Earlier quoted context omitted.

You can’t change anything about a commit without breaking the chain of SHA hashes in the commits, which causes pulls to break. GitHub hides the emails on their web UI, but nothing stops people from pulling the repository with a Git client and looking at the emails in the commit log after doing so.

Which is why you should be careful to never use your actual email in git commits. When I made a patch to the Linux kernel I did have to use a real email, since you have to send to their mailing list. I used a throwaway email for it, which I have since edited on my mail server config to forward to /dev/null (yes, I'm one of the weirdos still self hosting email in 2026). The amount of spam I got was insane, and not eve…

This makes me wonder how the Linux kernel git system deals with GDPR data deletion requests. Are they even legally allowed to deny them?

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#166

Post by miki123211 »

zvqcMMV6Zcr wrote: post #12
pscanf wrote: post #5

I was also spammed (twice) by voice.ai. You mention GDPR, which also "applies" to me, though I wonder if what they're doing is actually illegal. I mean, after all, I'm putting my email on GitHub precisely to give people a way to contact me. Of course, I do that naïvely, assuming good faith, not expecting _companies_ to use it to spam me. So definitely what they're doing is, at the very least, in poor taste.

Is there any company that will take my money to solve GDPR issues? And by solve I mean sue the spammers? For last few years I saw they "try" to look legit, by claiming addresses are managed by some Hungarian/Spanish shell company, hoping no one will be able to afford pursuing infractions over borders.

This is hard, because private right of action in Europe is often very limited, and the damages are low.

THe US basically has a "private police force" for certain laws, notably the ADA. Many people are against this, I personally think it's a great idea and something countries should be doing a lot more of of.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#167

Post by shimman »

hedora wrote: post #164
retlehs wrote: post #112

Earlier quoted context omitted.

By visiting the account and noticing that it still has activity long after the report.

How do you propose GH take action without risking taking down legitimate projects due to brigades of false reports?

That they use some of their trillion dollar marketshare to solve it, why are you acting like this is a hard problem? It's not. They're just too cheap and greedy to do anything about it.

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#168

Post by blibble »

martinwoodward wrote: post #31

Martin from GitHub here. This type of behaviour is explicitly against the GitHub terms of service, when we catch the accounts doing this we can (and do) take action against those accounts including banning the accounts. It's a game of whack-a-mole for sure, and it's not just start-ups that take part in this sketchy behaviour to be honest. I've been plenty of examples in my time across the board. The fundamental natur…

> it's not technically difficult even if it is unethical.

kettle, pot, black?

I received the following offical spam last week from GitHub:

> Build AI agents with the new GitHub Copilot SDK

despite never granting consent for marketing material

(and yes, there's a GDPR complaint now working its way through the national regulator)

Re: Tell HN: YC companies scrape GitHub activity, send spam emails to users

#169

Post by an0malous »

Ever wonder why YC has the "Describe a time you most successfully hacked some system to your advantage" question? It's because they select for founders that are willing to take advantage of legal gray areas. Airbnb repeatedly violated Craigslist terms of service and called it "growth hacking." Reddit stole content from Digg and faked users. OpenAI trains their models on copyrighted content.
Post reply on HN