Hacker News Reader

Comment by phil294 | Hacker News Reader

yes, but what baffles me is that any spam, if ever, is directed at GitHub accounts directly, be it issues or contact addresses. The repositories themselves contain so many email addresses that are otherwise hidden from the platform. In a recent test of mine, out of 60 people that had their contact email hidden in their profile, I could still determine it by looking into commit authorships in at least some of their repositories. Why is noone targetting these? These are all active and often personal accounts, meant to not be discoverable.

IMO there's also no point in remaining silent about this, it's only a matter of time until the spam starts coming in over this channel. I'm pretty certain some day GitHub will cloak commit emails by default.

View on HN

I have some email addresses only used to make commits. I have had a number of recruiters use that email address. So definitely somebody is looking at them.

You can’t cloak email addresses that are part of the commit itself. If you can access the raw repo, you can access the raw email address.

GitHub already offers an email cloaking mechanism but you have to set it up in your local git config in place of your regular email.

You'd think by now some recruiters would've figured out the best way to find people who knows X is to search for commits in X and look at the attached email

At least the recruiters who figured that out for me came with higher quality messages and offers.

I dread the day when the London recruiter spam mills figure this out...

Sadly there are vendors now that'll resell that info to recruiters so they can e.g. look at your linkedin and the tool will match it to their github and grab the email from a database built partially with commit emails.

20 or so recruiters over the last 3 years have contacted my github commit address.

When I was a recruiter, I was using recruiting software that scanned GitHub for email addresses back in 2014.

> I'm pretty certain some day GitHub will cloak commit emails by default.

GitHub modifying the commit would be incompatible with signed commits.

Edit: I'm pretty sure it would also change the commit hash, making your history and GitHub's history divergent.

GitHub gives you an E-Mail address for commits through the web UI (see the E-Mail tab in settings), which you can just use for your local commits as well.

Documented here:

https://docs.github.com/en/account-and-profile/setting-up-an...

Yes. That's a different thing from GH rewriting the commits as the comment I replied to suggested.

> Why is noone targetting these?

They're by definition clever people who spend time trying not to be contacted. What's the likely outcome of spamming them? 0.01% responding? Fewer?

* out of 60 people, I could determine it in about 90% of cases

...Is what I actually meant to write, this was a typo and the comment is locked now. :/

Reply on news.ycombinator.com