GitHub is forcing me to change my username, and will not tell me why

http://nerderati.com/2018/03/09/github-is-forcing-me-to-change-my-username/

by jperras • 8 years ago

79 65 8 years ago

ronilan2• 8 years ago

Joel, I can’t speak for github, so I’ll speak for myself.

I think the account name has a potential to cause public confusion. This may result in negative consequences to github, the github community and the public itself.

This is immaterial to you. Let it go.

(For anyone who likes analogies, it’s like having a “dummy corpse” on the front lawn, left over from halloween).

jperras12• 8 years ago

I can understand that.

what I can't understand is why https://github.com/hacker is okay. Or why https://github.com/blackhat is also an account. Or https://github.com/virus.

Unless each one of those accounts is also being changed/removed, and I'm simply the first one to point this out.

ronilan2• 8 years ago

That is an excellent question, for this case and a lot of other similar ones (banned, removed etc.)

I’ll rephrase the question: in a set of things that I consider to be similar why is one handled differently that the others?

And the answer arises from the question: the sets are based on a different criteria.

I don’t know what criteria github uses, but, I know that external input usually groups sets differently.

Put simpler - maybe someone complied?

(Analogy, “dummy corpse””, skeleton” and “sheet ghost” may seem similar on haloween night, but may get different reaction from the public)

thekaleb2• 8 years ago

The username is malware. Github does not namespace user profiles, so the link to the account would be https://github.com/malware . There is no Github user with the name "about". If you go to https://github.com/about it is not a profile page, but a page describing github itself. I assume that github may want to make a page describing malware.

sschueller• 8 years ago

Seems like a stupid move from github not to prefix usernames from the beginning or at least start doing it later like linkedin did.

It is very possible that one day there will be another URL they need which belongs to a large account that can not be renamed just like that.

bentruyman• 8 years ago

Seems like a stupid move? This is a pretty common pattern and we rarely ever hear of stories like this.

aylmao3• 8 years ago

They can always prefix their page urls instead, especially if it's not something too important.

hartator• 8 years ago

I don't think I'll follow Linkedin lead on software design.

thekaleb2• 8 years ago

I do like the medium.com approach of the usernames as /@username similar to the apache user dirs /~username

unethical_ban• 8 years ago

Github seems pretty open about stuff, so they should be honest about their eff up.

cabaalis2• 8 years ago

This is my bet, they are trying to namespace their site. They may not have EULA rule they can cite, so hand-wave security and confidentiality.

bpicolo• 8 years ago

They don't need a specific EULA for this. They can terminate your account at any time, for any reason [0]. The downside of them giving easy, memorable /paths is that you're subject to this sort of thing on occasion.

Yelp has something even more uncomfortable to maintain - custom subdomains [1]

[0] https://help.github.com/articles/github-terms-of-service/#m-...

[1] https://food.yelp.com/

jperras12• 8 years ago

Oh, not a bad hypothesis! I hadn't thought about that.

jperras12• 8 years ago

If my username is preventing them from creating a /malware page, I'd have no problem at all with that explanation; their lack of namespacing is convenient, but can cause these problems to occur.

But why hide behind the shroud of "privacy and security" if that is the case? I'd happily relinquish (not that I have much choice in the matter) the name if it was a namespace clash.

plexicle• 8 years ago

Perhaps because they aren't ready to announce what they're working on yet? Just one of a few examples I can think of why they don't owe you a reason.

It sucks that they're making you change your name and it's obviously inconvenient. They've at least offered some kind of compensation.

It looks like you lucked out that there's no activity or repositories linked to it that would break from the change.

This seems like a lot of fuss for nothing.

Gaelan• 8 years ago

This is almost certainly the answer. The author is overthinking this.

jperras12• 8 years ago

This is almost certainly the answer.

I agree. I just wanted to know! But, as the replies on this post have shown, the only thing you get for asking questions that you don't have the answer to is vitriol and ridicule on HN.

I write technical posts that require lots of experimentation, time and research, and no one gives a shit. I write a rant-y blog post on Friday night about something trivial that I found frustrating and suddenly I'm a moron with an IQ the size of my shoe that is a waste of human life.

Hacker News is a fucked up place.

ProAm• 8 years ago

That makes sense but why cant they tell him that? It's innocent and easy enough to explain and for the user to accept.

ddebernardy2• 8 years ago

Is it too much to ask the article's author to assume the bloody obvious?

I just want to know why.

I'd wager more than a few people at Github are scratching their heads, wondering if the article's author's IQ is higher than a shoe size.

nostalgeek4• 8 years ago

Any sane company would use something like

domain.com/user/foo or user.domain.com/foo or even a different domain for user accounts. Github put themselves into that position.

zokier• 8 years ago

Github put themselves into that position.

Does it matter now?

alex_g• 8 years ago

Sounds like a plausible reason, but what about: https://github.com/privacy https://github.com/faq https://github.com/software

zimbatm• 8 years ago

It reminds me of the list of names that all SaaS companies should reserve project I did a while ago. Maybe I should add "malware" on it :)

https://zimbatm.github.io/hostnames-and-usernames-to-reserve...

provost• 8 years ago

What a great list! I’d recommend adding “secure” too.

jperras12• 8 years ago

Ah, great list!

ehPReth• 8 years ago

The "CA ownership verification" ones are a bit excessive.. 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' are the currently permitted localparts for domain validation. (From 3.2.2.4.4 of https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...). It was more 'CAs make up their own scheme' in the past though but thankfully that's been reigned in.

gsich• 8 years ago

Seems like 100% of Githubs problem. Solution: either use /github/about or /profile/name

Or just tell him and be done with it.

techsupporter• 8 years ago

Even before I got halfway through the article, I knew I'd see the ever-present "due to privacy and security concerns" garbage.

If a company is contacting a customer, don't play that line. Be honest. If the reason why you can't be honest is due to embarrassment, don't phrase it as a request. Mealy-mouthed language about empty, unverifiable platitudes is not only pointless, it's insulting in a technical context.

pobo• 8 years ago

One year free subscription is not that bad, you know~ But thanks for writing this interesting incident.

jwildeboer• 8 years ago

So they are working on an (updated?) internal blacklist of usernames IMHO. Seems annoying but not nefarious. I would shrug, take the offer, find a new username and move on.

iNerdier• 8 years ago

Isn't the logical solution to this prefixing user urls with something like /u/ or /user/? Off the top of my head I can think of reddit doing this but I suppose for github the downside of this is it would break a huge number of existing links. One of those slightly un-winnable situations unless you think of it from the start I suppose.

aylmao3• 8 years ago

I think unprefixed user urls was the right decision; I love GitHub URLs and how easy to manually type they are. I can imagine user urls are typed more often than info page urls.

Also, they could always just prefix their pages instead. (ie, github.com/about/xxx, github.com/info/xxx).

EthanHeilman• 8 years ago

I really hope they don't prefix user urls. Github is one of the only sites I can navigate by just typing in the name of url. It also makes git tasks at the command line easier.

urda2• 8 years ago

This reads like a "play stupid games, win stupid prizes" kind of situation. Why would you ever want to name yourself malware, let alone to use it "with the intent of working on some new open source stuff"? From both a professional and personal point of view that's an asinine decision.

I'm going to have to side with GitHub on this one.

EDIT: Not really sure why downvotes (-2 at time of this edit update) are heading my way here, mind chiming in and contributing to the conversation then?

aylmao3• 8 years ago

Especially if the account is hardly used, like he describes on the post itself. Looks like he was just holding the name because it was cool.

I agree, it's a bummer that they're taking that cool username away, but it's not surprising or wrong.

EDIT: as of writing this comment the account has 0 repos, 1 starred repo, and 1 follower.

zamalek• 8 years ago

Not really sure why downvotes

The HN rules ask that you don't discuss these, even if they are cowardly. Corrective upvotes will occur (and have occurred here).

jperras12• 8 years ago

Why would you ever want to name yourself malware, let alone to use it "with the intent of working on some new open source stuff"?

Why not? What about the (currently in use) github user names such as `hacker` or `virus`?

The whole point of the account was to publish things that I didn't deem worthy of my other accounts. Having a terrible name was kind of the point.

urda2• 8 years ago

Why not? What about the (currently in use) github user names such as `hacker` or `virus`?

Not sure, but I wouldn't be shocked if they are at risk themselves, those aren't exactly great either. I'm also not GitHub, nor do I care if they end up getting in trouble for those names either.

The whole point of the account was to publish things that I didn't deem worthy of my other accounts.

Then you shouldn't really be concerned what is or isn't your GitHub username then.

Having a terrible name was kind of the point.

And thus "play stupid games, win stupid prizes" ended up being the result. QED.

mdekkers2• 8 years ago

Not really sure why downvotes

Perhaps because your post comes across as mostly subjective value judgements, with a sprinkling of holier-then-thou between the lines?

andyczerwonka• 8 years ago

I think if you use the username malware, I think you should expect this kind of stuff. It's not atypical for a company like that to have references to malware that might interfere with your username.

Techonomicon2• 8 years ago

Github is totally within their right to hold this close to their vest for whatever reason, I don't see the big deal with it.

Where does the line get drawn the OP asks? I'm unsure, but I believe in Github to make a smart call there. Not every situation is a slippery slope to facism / dictatorships, and I'm unsure why many things nowadays are described with this sort of notion attached to them.

Definitely feel like I wasted time reading this whole thing, and now wasted time posting, and now I'm sad.

nostalgeek4• 8 years ago

Github is totally within their right to hold this close to their vest for whatever reason, I don't see the big deal with it.

True, but github could have avoided this kind of issue all together by putting all accounts under a different namespace or domain. In fact that's what they should do now to be "future proof". I don't understand why would any business think that domain.com/username is the right thing to do.

Techonomicon2• 8 years ago

Yea, since you know how to make the perfect products, perhaps you should just take githubs money.

Edit: To clarify, looking back it's simple to just make such assumptions. But many popular sites have existed off of this model which github holds such as facebook, twitter, myspace back in the day IIRC. I'm not saying Github made the perfect decision at the time, but they didn't make a foolish one necesarily given the landscape of how user based sites have existed.

eyjafjallajokul• 8 years ago

Hindsight is always 20-20. This is the way at least two major websites (Twitter, Facebook) work, and it appears to have more customer benefit than not.

skynetv2• 8 years ago

it seems like too much fuss over a small request for a product that the author is not paying for. Github seems to have made a polite request and offering one year free service on his professional account. is there a reason to even post about it? moreover, the username is not just a regular username, it has special connotations on how others perceive it.

barcadad• 8 years ago

Seriously? This guy spent far too many words wasted speculating about something that is transparently obvious. https://github.com/malware speaks for itself. The Github rep should have said - "Dude, name yourself malware and you're surprised stuff like this happens? Try changing your name to NULL and see how that works out for you."

asdsa5325• 8 years ago

https://github.com/null is a user.

I'm not sure I understand your comment. I could not find github's username blacklist, so I don't think it's "transparently obvious", but if there is a blacklist feel free to share it.

arno1• 8 years ago

Probably someone very rich wants to buy that account. Otherwise they would have told you it is for their very nice future product.

paxys• 8 years ago

Why is everyone looking for reasons be outraged all the time? Github don't owe you an explanation for asking to change your username for whatever reason (even though it is obvious in this case) on a free service that you have been using.

jperras12• 8 years ago

Who said I'm outraged? If you read the post I made, and the emails I sent, I do believe I come across as measured. At most, slightly frustrated.

This doesn't outrage me in the slightest.

Github don't owe you an explanation for asking to change your username for whatever reason (even though it is obvious in this case) on a free service that you have been using.

Of course they don't owe me an explanation. But does that stop me from trying to figure it out with a public blog post?

And what if I had been a paying user for the `malware` account? Would that suddenly make this forced name change not okay? I've paid Github probably north of $1,000 over the lifetime of my personal account. Would that make a difference?

duckqlz• 8 years ago

have you thought of using "ma1ware"?

jperras12• 8 years ago

Not really. I don't particularly care about the name "malware" at all, to be honest, so I'll probably go with something in a different direction.

lsiebert• 8 years ago

Some other possibilities as to why off the top of my head:

Github has been served with a confidential court order, warrant etc that requires this.

Github has a confidential contract with a large company or government entity and they are requiring this as part of that contract.

A piece of existing malware in the wild points to this address for a possible command and control server or verification that it's in a VM or whatever, and they want to deal with it, like that guy that registered those nonsense urls.

jperras12• 8 years ago

All good hypotheses.

Github has been served with a confidential court order, warrant etc that requires this.

I thought of this, but figured since the account was essentially bare of public activity it was low probability.

Github has a confidential contract with a large company or government entity and they are requiring this as part of that contract.

An interesting idea!

A piece of existing malware in the wild points to this address for a possible command and control server or verification that it's in a VM or whatever, and they want to deal with it, like that guy that registered those nonsense urls.

Very possible, although putting 'malware' in your CnC endpoint name might not be the brightest of ideas :)

butz• 8 years ago

Try some from this list: https://www.xkcd.com/1963/

GitHub is forcing me to change my username, and will not tell me why

Related Stories