undefined | Better HN

0 pointsLuker881y ago0 comments

@people who write github scanners for updates and security issues (dependabot and the like)

Can we start including a blacklist of emails and names of contributors (with reasons/links to discussions)?

I can't track them and I don't want them in my projects.

Might not be very helpful as it is easy to create new identities, but I see no reason to make it easier for them. Also, I might approach differently someone with lots of contributions to known projects than a new account, so it still helps.

0 comments

arp2421y ago

It takes a minute to create a new email address. And you can change or fake an email address on a git commit trivially. You, too, can writing code as anyone you want by just doing "git commit --author='Joe Biden <icecream@whitehouse.gov>'". On the internet nobody knows you're Joe Biden.

nine_k1y ago

You can write a rather simple GitHub action that would do that: look at a PR and reject / close it if you don't like it for some reason. AFAIK open-source projects have a free quota of actions.

OTOH sticking to the same email for more than one exploit might be not as wise for a malicious agent.

the84721y ago

github already suspended the account

j / k navigate · click thread line to collapse