News for hackers. Stuff that matters.

A comment on Tell HN: YC companies scrape GitHub activity, send spam emails to users. Parent comment

Re:Tell HN: YC companies scrape GitHub activity, send spam e... by david_allison on Thursday February 26, 2026 @02:11PM (#47170622)
They already do[0]

    [email protected]
this includes a unique ID which survives account renames, and the name of the GitHub account at the time.

[0] https://docs.github.com/en/account-and-profile/reference/ema...

[ Parent | on HN ]
Re:Tell HN: YC companies scrape GitHub activity, send spam e... by blobbers on Thursday February 26, 2026 @03:02PM (#47171270)
How does the spammer get through this then?
[ Parent | on HN ]
Re:Tell HN: YC companies scrape GitHub activity, send spam e... by bstsb on Thursday February 26, 2026 @04:47PM (#47172414)
they don't. it's an optional process, and many users don't change their git config to use the provided email
[ Parent | on HN ]
Re:Tell HN: YC companies scrape GitHub activity, send spam e... by david_allison on Thursday February 26, 2026 @06:06PM (#47173437)
If used/implemented correctly, they don't.

* This is an optional feature via git config, with a further GitHub setting to reject commits pushed using your personal email address.

* If the GitHub setting is disabled, some GitHub-generated commits/fixups use your personal email (e.g. squash merge in the GitHub UI).

* I use my personal email in file-level copyright headers, even if the commits use the GitHub noreply email.

* I have my personal email on my GitHub profile, visible to logged in users.

[ Parent | on HN ]