Spammers started to hit GitHub?

https://github.com/quartzjer/TeleHash/issues/5

by bencevans • 14 years ago

44 48 14 years ago

github.com

buttscicles• 14 years ago

I noticed some spammers a couple of weeks ago, they occasionally create repositories too.

I'm not sure if there is a way to report them, there is nothing no the GH contact form.

Heliosmaster• 14 years ago

I'm quite confident a story on top of HN is a good way to reach them :D

sudhirj• 14 years ago

I suppose it is... it's not like it's some security hole that everyone is going to exploit. I'm sure they're already working on spam filtering and reporting.

kindahero• 14 years ago

No.. they have "contact" page and they are very quick and responsive.

https://github.com/contact

vidar• 14 years ago

This must have been a problem for some time, considering how popular GitHub is. There is no way around spam when running a popular service where the users can create their own content.

daGrevis• 14 years ago

What about old-good CAPTCHA? There are many ways, but all are annoying for normal users.

DizzyDoo• 14 years ago

Even the best captcha methods can be circumvented by farming them out to poorer countries for only pennies.

bencevans2• 14 years ago

Captchas just advertise that a service has a spam problem.

thejosh• 14 years ago

You can purchase 1000 captcha solves for $1.39 last time I checked.

CAPTCHA only security is fantastic for spammers.

donbronson• 14 years ago

using CAPTCHAs assumes the majority of people are spammers rather than real users. it's an alienating user experience and one that i hope goes away.

pooriaazimi3• 14 years ago

I used to quite like the idea of CAPTCHA, but in the past year (or couple of years), reCAPTCHA (easily the most popular CAPTCHA generator) has become sooooo bad that I involuntarily shudder even thinking about CAPTCHAs...

Thanks God for http://bugmenot.com!

beagle32• 14 years ago

Proper etiquette would be to let the github people know for a few days before you alert the whole world.

Have you notified them before posting this?

enneff• 14 years ago

Why? It's not like they're disclosing something sensitive, like a security vulnerability.

reitzensteinm• 14 years ago

This isn't a security flaw, it's just mundane crap that every web app goes through. They'll delete this today and tweak their filtering, and tomorrow the spammer will try again (or in twenty minutes, who am I kidding?).

I'm not sure why you say prior notification is proper etiquette in this circumstance. It's equivalent to pointing out a grammar mistake in a blog post. Not particularly interesting, but not malicious.

bencevans2• 14 years ago

I don't see any reason too I'm afraid. If it was a security vunerbillity I would have, as I have done before ... https://help.github.com/articles/responsible-disclosure-of-s... (Ben Evans - @bencevans)

beagle32• 14 years ago

Thanks for all the downvotes, guys!

I'm not talking about "responsible disclosure" and I'm not sure why people assumed I do.

If I see that a person has their fly open, I'd go and discretely alert them of that. Similarly, if someone has a note saying "I am stupid" taped to their back (which I think is a good analogy to what the spam on github is), I would do the same.

I wouldn't go shouting "hey, github has an 'I am stupid' sign taped on their back" in town square, which is what posting it on HN amounts to.

Gigablah• 14 years ago

Reported the blogspot link as a spam blog. Not sure about Google's response time on these things.

jpdoctor2• 14 years ago

Looks like git needs the equivalent of a downvote: Something like % git nuke https://github.com/quartzjer

dasil003• 14 years ago

git != github

jpdoctor2• 14 years ago

git = communication with github, but more importantly, many of the github clones are going to have the same problem.

a1k0n• 14 years ago

Even if your command made sense, quartzjer is not responsible; some spammer just added a spam issue to a legit project.

hk__2• 14 years ago

404 error.

mochizuki• 14 years ago

Google Cache http://webcache.googleusercontent.com/search?q=cache%3Ahttps...

pooriaazimi3• 14 years ago

Every time I mention this on HN, at least 15 people upvote it - which means they didn't know about it. So I feel obliged to repeat it again and again (as I usually use this method a few times every week and it's tremendously useful for me):

If you want to get Google's cached version of a webpage, just type

    cache:[url]
    e.g.: cache:https://github.com/quartzjer/TeleHash/issues/5

in the search bar and press return.

uxp• 14 years ago

*in Chrome's search bar.

I know, it's a petty technicality. Safari says it can't open the specified address, and Firefox doesn't understand the URL. I'm even more certain IE will explode if I was to try, but I can't at the moment. From what I remember, IE can't even parse a raw IP address without explicitly putting http:// in front of it.

ck2• 14 years ago

The amount of time and energy and cpu cycles wasted on spammers is truly a crime against humanity.

I still do not understand how it makes them money, I think it's just an endless chain of people falsely thinking others are successful with it so they try to do it too and the cycle continues.

xSwag2• 14 years ago

>I still do not understand how it makes them money

When I saw this post the page had 404d. However, the page was still active in the Google cache[1]

It is not just Github being targeted, a lot of other large websites with user generated content are also being spammed with this content[2][3]

The spammers are linking the content to blogspot blogs so that they can: 1. hide the referrer from their affiliate program (to prevent getting banned for spamming) 2. to utilize the temp increase in search engine rankings 3. save money on domains for one-off usage

Since the "live stream" is just a one-off game that will only be popular/trending for 1-3 days in which period the spammers will use a lot of macro scripts/bots to spam these websites. Believe it or not, even a "nofollow" link can give you an advantage in search rankings. They spam them to death in the "popular period" and then bank money from the affiliate program[4]

[1]http://webcache.googleusercontent.com/search?q=cache%3Ahttps... [2]http://shine.yahoo.com/author-blog-posts/watch-38-enjoy-flor... [3]http://webcache.googleusercontent.com/search?q=cache%3Awww.f... [4]http://www.officialtvstream.com.es/passport/signup.php?price...

sillysaurus• 14 years ago

They spam them to death in the "popular period" and then bank money from the affiliate program

If you had to speculate: How much money?

(I know, it all depends, etc. But I was just hoping to get a rough idea of the order of magnitude here.)

downandout• 14 years ago

Actually, in most cases, these reasons have little to do with it. For the most part, the pages are created on public sites because the links are spammed on social networks, and those networks quickly block postings with the same links over and over again. So, if you can create hundreds of different URLs with the same landing page, you can have hundreds of times the spam posts go through and not be blocked. Most of these guys don't bother with private domains because social networks will quickly issue a blanket block to all posts containing links to untrusted domains that have been reported to them for spam, but they will never issue a blanket block for a site like Github or Facebook. So the links last longer.

As to the specifics:

1) 1. hide the referrer from their affiliate program (to prevent getting banned for spamming). There are much easier and reliable ways to not only hide, but entirely change, the referer. See http://www.contentgeneration.org/cpa-redirector-2/

2)to utilize the temp increase in search engine rankings These sites aren't meant for that. Whether they link from the landing page straight to the affiliate link, or they go to a lander that is used to change the referer, they don't care about the search rankings of the links.

jhchabran• 14 years ago

They do make money out of it, not that much but they do. Most of the time, it's so small that we don't have a clue on why they do it. For sure there must be some sort of gold diggers trail spawning vocations, but they wouldn't do it if it wasn't profitable in some way.

The key idea is where do you live: if I'm living in a poor country where average salaries can vary from $50 to $400 per month, imagine how much I can make by send viagra spam by just sending emails to doing hard physical job ? For us it's not worth even doing it as a hobby. For some people, it's damn profitable, just take the case of Nigerian scammer, convincing someone to send him $500. He's doing that every day, if he can scam one "wealthy" person to do it once per month, it's damn profitable. Yeah, this isn't really a shiny way to make profit, but you may understand the motivation behind it.

pwg• 14 years ago

> I still do not understand how it makes them money,

It makes money from a pure economies of scale situation. When your marginal cost per "ad" is essentially zero, you can ship out a sufficiently large number of such ads that even the smallest percentage of recognition by the targets results in thousands or millions of return inquires/clicks/etc. I.e., if it cost $10 for 1 billion views, and only 0.0001% respond, that is 1000 responses. Effectively only costing one cent per response. If you make ten cents per response, you have made $100 on your $10 investment.

Couple that with the fact that a computer did the "work" and it is an easy money machine.

bdcravens• 14 years ago

Maybe not if you're living in an apartment in San Francisco. However, if you're in an Eastern Bloc country or India, a few hundred USD per month can radically change your life. So even abysmal returns to me would be success to someone else. When you're poor and looking at the prosperity of the West, you don't care if you break the Internet.

AshleysBrain• 14 years ago

All large sites get hammered by automatic/semi-automatic spam, and occasionally some leaks through. Is this surprising?

Zak• 14 years ago

All sites get hammered by automatic spam. If it gets indexed by google, or if anybody links to it, the spam bots will find it eventually.

It is not practical to operate any kind of website that allows users to post things without some form of spam protection. For small sites, email verification or text classification will do the job by itself. Traditional captchas are fairly ineffective, but written questions like "what color rhymes with true?" seem to work pretty well for smaller sites.

Bigger sites dealing with a larger volume of traffic almost always require regular human intervention, curated IP block lists, stealth banning and the like.

jeremymcanally• 14 years ago

We're aware of the problem. Just like any service like ours, we see a fair amount of spam repos, issues/comments, and, of course, Gists. We already expend a good bit of energy on handling it as it is, but we're always working on new ways to handle it. :)

driverdan2• 14 years ago

It'd be nice if gists had a link to report them as spam. Also, links in gists should be nofollow.

dutchbrit• 14 years ago

I don't understand spammers that target tech sites - especially the ones that add nofollows, techies know spam and don't click the shit. Waste of time, effort and money for the spamlords to be honest

thedufer• 14 years ago

As others have said, nofollows do give you help in search results, although not as much as otherwise. They're looking to rise in search results more than for legitimate clicks.

waffle_ss• 14 years ago

This is nothing new. If you watch the [new gist feed][1], for instance, you'll see plenty of it roll by.

[1] https://gist.github.com/gists

driverdan2• 14 years ago

What's especially interesting is that gists are allowed by github's robot.txt and none of the links are nofollow. That means every gist spammers create with links are helping their ranking.

Spammers started to hit GitHub?

Related Stories