Hacker News Reader

>I notice that the getsymbol tool on Github has 214 stars ...

Analysis of which accounts starred it prior to publicity is probably a worthwhile endeavor. If there's any commonality with other obscure projects, that may be an indicator those accounts could be puppets.

View on HN

Unfortunately that opens up a whole new can of worms. There are already sites that guess how fake amazon reviews are, maybe we need something similar for github.

I hope an analysis like you proposed could yield some insights to patterns or maybe even enough data to do some machine learning on.

But how do I trust the tool that guesses how compromised a repo is?

You post it to HN and claim that it's safe. If you aren't proven wrong in the next 2 hours, it probably is.

Reply on news.ycombinator.com