GitHub has not removed malicious imitation software after 3 weeks

(successfulsoftware.net)

172 points | by hermitcrab 3 hours ago ago

73 comments

  • hermitcrab 2 hours ago

    Author of the post here. Github finally took the offending page down approximately 10 minutes after the post appeared on the front page of HN. Total coincidence. I'm sure!

    Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.

    And it seems they are able to do things very quickly, when they want to. Bastards.

    • koolba 2 hours ago

      > Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.

      This also works for Google support.

      > And it seems they are able to do things very quickly, when they want to. Bastards.

      I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.

      It was already a problem before agents could automatically perform these actions.

      And it’s not something you can really automate on their end either. At least not the judgement call on the removal. Imagine if there was a fully automated process and it inadvertently took down a legit project.

      • debugnik 2 hours ago

        > I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.

        Stalling in the hope that reporters won't escalate, instead of allocating a tiny bit of their billions in profit to hiring for this, is malicious in my book.

        • amdsn an hour ago

          I had several small requests for moderation (deleting and banning spammers posting spam/crypto scam issues/PRs in my repos and ones I contribute to) answered within a day earlier this year after more than a decade of never needing to request moderation. I'm not defending GH here as it's obviously unacceptable that the OP's issue took this long, but they definitely do or at least did have mods. I would guess they need a lot more of them if something this serious went unaddressed, or maybe the ones I interacted with are now gone and have not been backfilled.

        • ktm5j 24 minutes ago

          I mean.. for better or worse, this is how corporate America works. Hiring to solve a problem that's not costing them money (and solving it doesn't make money) is probably not going to happen, especially with the current state of the economy. They have more of an obligation to make money for their investors than they do anything else, that's just how it works.

          • hyperhello 21 minutes ago

            If we have no way to strike back, they will simply suck every drop of blood out the way you use every part of the buffalo. There is no way to escape Microsoft when they just buy everything and turn it into part of their garbage moat.

          • ruined 22 minutes ago

            how does anyone expect to solve AI alignment when we can't even solve corporate alignment

            • ktm5j 17 minutes ago

              Life sure ain't perfect.. not much you can do about that sometimes.

        • majorchord 2 hours ago

          Can you provide evidence of these claims?

          • csomar 2 hours ago

            I mean we are in the thread of evidence right now?

            • veverkap an hour ago

              GitHub support is full of amazing, hard working people.

              It is also comically understaffed. This is not because they can't find people to work - it's not given the budget necessary.

              • nikanj an hour ago

                They might be amazing and hard working, but that doesn’t free them from the yoke of policy and script

      • elAhmo an hour ago

        It is a problem they could solve if they want to. They have billions of profits per quarter.

        They just don't want to. Not malicious, just ignorant and disrespectful of their users.

      • alightsoul an hour ago

        YouTube already does it autonomously with seemingly no legal consequences for them because you agree to it in their tos

      • rkagerer an hour ago

        I’m sure they are swamped with such requests

        Then maybe they should be growing their customer support capacity along with their business. It drives me crazy how big companies have normalized cutting those departments down to anemic proportions. Especially those where you're a paying customer.

      • vkou 17 minutes ago

        > I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.

        Handling these requests at whatever scale they operate is their responsibility.

        Nobody held a gun to their head and forced them to take on all of their customers.

      • dogleash an hour ago

        >I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.

        It's malice from whoever is responsible for under-staffing. It's also malice to prioritize the squeaky wheel for optics; it's intentional to reduce the spread of the knowledge of how unresponsive they are.

    • elAhmo an hour ago

      Describes pretty much any of the big companies. For example, I have seen numerous times people got their account locked on Google, or their app stuck in limbo at Apple, and then after post becomes viral all problems get solved.

      • latexr an hour ago

        Apple in particular is mocked because they explicitly say (used to say?) “going to the press doesn’t help”, but they’ve shown time and again that it’s the most effective way to get them to take action.

    • zamalek 20 minutes ago

      For this specific case, a DMCA would have gotten you a much faster take down. As far as I can tell it's automated. Sure, they could appeal it but then the malware nature of it would be in the crosshairs of the reviewer.

      Not excusing their slow response, though.

    • ajmurmann 2 hours ago

      It might not be a willingness issue as much as a bandwidth issue.

      • post-it 2 hours ago

        Bandwidth can be bought with money, of which Microsoft made an extra $133.7 billion this year.

        • ajmurmann 2 hours ago

          We know that coding agents have been pushing GH to its limits. Scaling is hard - especially staff. Maybe they aren't trying to scale support but I think it's reasonable to give them the benefit of doubt here, given what we know publicly

          • cwillu 2 hours ago

            Microsoft is not some plucky upstart company with 12 employees and an unexpectedly popular product. We do not, in fact, need to give them the benefit of the doubt here.

          • dualvariable an hour ago

            Having "hackers" on this site giving the benefit of doubt to companies clearing hundreds of billions of dollars in revenue per year will never cease to stop being ironic to me...

            • ChickeNES a few seconds ago

              On the site run by a VC firm? Why is that a shock? Besides, hacker does not mean being a kneejerking reactionary against corporations.

          • veverkap an hour ago

            They aren't trying to scale support. If anything, they are trying to throw AI at the problem. The support team is understaffed and overwhelmed.

          • iAMkenough 2 hours ago

            That’s a self-inflicted issue they should have properly planned for.

          • cj 2 hours ago

            You’re saying this is a problem money can’t solve?

            There’s no need for benefit of the doubt when it comes to the level of support provided by tech companies.

            Bad support by tech companies is a conscious profit-preserving choice.

        • whateveracct an hour ago

          They have to dump all that free cash into data centers, sorry

        • kstrauser 2 hours ago

          Never thought I'd see the day when Microsoft is elite.

        • NobodyNada 2 hours ago

          Sounds like they can afford elite customer support.

      • iAMkenough 2 hours ago

        Good thing HN provided them some bandwidth to do their jobs.

      • cyanydeez 2 hours ago

        unwilling to provide proper support?

        Just seems like a silly rational response to the same problem.

      • locknitpicker 2 hours ago

        Yes,evidently bandwidth from HN unblocks takedown requests of malicious content.

        • ajmurmann 2 hours ago

          Prioritization and escalation exists in most companies. I guarantee you that once an issue hits the HN front page, even engineers who might have totally different talks will get involved. (Never worked at GH or have talked to anyone there in years but this is how everything works pretty much everywhere)

          • toomuchtodo 2 hours ago

            The public shaming will continue until the internal incentives improve. Make sure to drop that HN thread link into the internal task tracker y'all. Don't forget to report to journalists if the severity warrants it (Brian Krebs, 404media, etc).

            "Show me the incentive and I'll show you the outcome."

    • monster_truck an hour ago

      They're generally extremely quick about this if you ping ~anyone on the security team with the offending url and a link to the real repo. There is a long ongoing game of cat & mouse against malware in repackaged things like first party windows utilities to leverage the signed binaries.

    • alightsoul an hour ago

      This was not my experience at all. Someone on the bitchat android commented with a virus, reported it and was taken down 2 hours later

    • kachnuv_ocasek 43 minutes ago

      Hacker News saves the day once again!

    • ButlerianJihad 40 minutes ago

      > need to get on the front page of HN

      > ping ~anyone on the security team

      > HN provided them some bandwidth

      > also works for Google support

      > answered within a day earlier this year

      > no reaction otherwise. It's still online.

      > app stuck in limbo at Apple

      https://en.wikipedia.org/wiki/Cargo_cult_programming

      > given what we know publicly

      > thread of evidence

      https://en.wikipedia.org/wiki/Anecdotal_evidence

    • nikanj an hour ago

      Same goes for all companies bigger than a startup. The first line of support is AI, the second line is clueless, and the third level is powerless. HN is the only way to reach a human with both ability and willingness to help

    • hsuduebc2 2 hours ago

      Just send DMCA if you want their attention, they act harshly and quickly. Even when it's false one.

  • nixgeek an hour ago

    I see OP edited their post claiming getting to HN's front helped.

    I think the likelihood GitHub did something within 10 minutes of a post appearing on HN's front page is approximately zero.

    Nobody in GitHub Trust & Safety is sat there watching HN.

    An executive or communications professional who might have heard it got on HN, or seen it appear in a tool monitoring Microsoft and GitHub's mentions across the internet, and who then flagged the post, Trust & Safety would probably spend *more than 10 minutes* noticing the email or Teams message, then trying to find the right ticket internally. Then after locating the ticket you still have to investigate the facts, discuss, and click buttons to ban/delete the user.

    It's (much) more likely this sat in a queue until someone got to it and the timing of it being on HN is a complete coincidence.

    • hyperhello 17 minutes ago

      It’s not a coincidence if they had already found the problem, wrote up the solution, primed it for action, and then it sat in some “management queue” for essentially forever, until someone called someone with a go.

    • hermitcrab 43 minutes ago

      It's a hell of a coincidence.

  • OCTAGRAM an hour ago

    I recently found "free" version of Lossless Scaling on GitHub. The release installer is definitely malware. It took GitHub 3 days to shutdown malware distribution. Category of my ticket was malware report, not copyright infringe

    • hermitcrab 42 minutes ago

      Author here. I initially reported it as an imitation. A few days later I added evidence that it was malware.

  • icemanvault 13 minutes ago

    These kinds of imitation attacks seem to be getting more common. It’s not just random malware anymore — some of them are getting surprisingly polished and even use the real product name and logo. Interesting (and a bit sad) how visibility on HN seems to speed things up on GitHub’s side.

  • Havoc 2 hours ago

    They’re presumably too busy with keeping availability above nine sixes

  • wingerlang an hour ago

    If GitHub staff is still reading this thread, maybe you can take down https://screenmemory.github.io/ as well. I reported it 4 weeks ago, ticket ID 4703161

  • bananamogul an hour ago
  • joshuat 2 hours ago

    Not exactly the same, but I've noticed a pretty sizable uptick in the number of spam/scam PR comments being left on GitHub (and a longer delay before they're removed after report).

    Not the worst thing in the world, they're easy to spot, but I'd like to see GitHub invest more time in protecting their users from falling victim to these bad actors.

  • msalihb an hour ago

    I found a page that serving e-books I've purchased on github. It is a bit bad feeling

  • MBCook an hour ago

    What do you know. Apple’s “never run to the media it never helps anything” rule works just as well with GitHub.

  • revexos 36 minutes ago

    Seems like they don't even care

  • kg 2 hours ago

    In the future just issue a DMCA takedown right away for cases like this, IMO.

  • hannob an hour ago

    Welcome to the club!

    There's an impersonation profile of me on Github (username happyhannob). I've reported it a while ago, received the same automated message, and no reaction otherwise. It's still online.

    I guess you can't expect basic fraud prevention from a company currently building the future with AI...

  • jay73763 2 hours ago

    why would anyone host commercial binary software on github or any other third party domain?

    • hermitcrab 2 hours ago

      Pirates and crackers generally don't host stuff on their own domains. They don't want to pay for the bandwidth and they don't want to be traced.

      • sgskinner 2 hours ago

        I think they’re alluding to OP not hosting their own downloads.

        • hermitcrab an hour ago

          I am the OP. I host my own downloads on my own domain and nowhere else. Only the malicious imitation is hosted on Github.

  • someonebaggy 2 hours ago

    If it's your software send a DMCA. They have a legally required timeframe to process those. If it's open source, however, then you don't have any valid DMCA claim.

    • hnlmorg 2 hours ago

      That’s not how open source works.

      Open source code is still copyrighted. What the license defines is rights that people have in distributing that code. If an unofficial repository is using open source code to ship malware, and the license that software had didn’t allow that, then the unofficial repository is still breaking copyright law despite the code being open source.

      • someonebaggy an hour ago

        There's no open source license that prohibits derivative works that are malware.

        • whateveracct an hour ago

          i think it's in the spirit of it, which is enough for a DMCA lol

          • someonebaggy 44 minutes ago

            Um no, you have to send it about an actual copyright violation, not just because you don't like something.

            It's not illegal to send an incorrect one by mistake but GitHub probably won't process it. It's illegal to send an incorrect one intentionally. Now that it's been pointed out to you that making malware isn't a copyright violation, it's intentional if you send a DMCA anyway.

      • NewJazz 2 hours ago

        Also open source license doesn't grant use of trademarks, but I'm not sure that means DMCA applies.

    • 93po 2 hours ago

      Code can be open source while the name and logos are copyrighted and still enforceable via DMCA