I remember reporting someone for doxxing in github comments and I received a reply that they will investigate it 2 months after.

That’s where you send a C&D to their HQ, or post on social media.

The only two ways to reach such hostile corporations is via legal or a PR disaster.

Doxxing isn't against the law, at least in the US. No privacy rights, first amendment, all that jazz.

In the EU, you have a right to get all personal information about you deleted from any service, unless you are a person of the public.

That would be relevant enough here (and several Germans have successfully got courts to issue warrants for that, and got restraining actions against twitter users)

EU law does not extend to US entities that do not have a nexus in the EU.

I could not find, from a cursory review, any GitHub offices in the EU. Nor does an entity not investigating a doxxing claim in a timely manner make them "hostile", only apathetic.

> EU law does not extend to US entities that do not have a nexus in the EU.

I'd have agreed with you on that until last year, when the US decided that US law applies to foreign entities, even if they have never been in the US, never did business with US entities, never used USD, etc (the famous case w.r.t. 9/11 and Saudi Arabia which Obama vetoed).

That case legitimizes using national law against a foreign entity. And, just like in the Megaupload case, where the US seized assets of a German citizen in New Zealand, the EU could seize GitHub's assets remotely.

Such a situation has happened only once before, where an airplane of a foreign airline was seized to force the airline to issue a refund to a customer. In the same way, servers rented by GitHub could be seized, and, as argued above, enough cases exist to justify that.

Is it appropriate in this case? Probably not. Does the EU have a legal tool to enforce it? Yes.

Forgive me if I think the EU enforcing any terms with the US as humorous. Seizing US-based assets? Not in this political cycle.

> Seizing US-based assets? Not in this political cycle.

I’m not so sure. France seizing Google assets last year was quite a sign, and they’d likely be able to do so again.

Yes, the EU Commission and the German government are quite corrupt since Google, Uber, MS and co have outright bought them, but France, the EU Parliament and the courts would still fight in this case.

What about "Privacy Shield Framework"? EU is pretty serious when it comes to handling its' citizens personal data. Also, according to the EU law even storing personal data is regulated.

I reported a minor security issue once and it was fixed in a day or so.

Edit: Your first reminder email is already quite harsh ("STILL no response? [...] Come on!")... wouldn't be surprised if that pissed the assigned support worker off.

To be honest, like I said above that screenshot, that was my second reminder email, I didn't take a screenshot of the first one.

Really? I contacted GH support twice and they answered surprisingly quickly and humanly. I wondered how they could do that, given they're so big and with surely so many bogus emails coming in.

Yeah, my first contact with their support was excellent. My issue got explained within half an hour and it got resolved within an hour (IIRC).

The second was literally caused by a typo on my end, and it literally took 82 days and me asking some random GitHub employee on his AMA repository what to do when support ignores you to get it resolved.