Thread

GitHub has not removed malicious imitation software after 3 weeks

279 points · 119 comments · hermitcrab

hermitcrab · 1790267696 · focus · HN ↗
Author of the post here. Github finally took the offending page down approximately 10 minutes after the post appeared on the front page of HN. Total coincidence. I'm sure!
Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.
And it seems they are able to do things very quickly, when they want to. Bastards.
1. koolba · 1790268882 · focus · HN ↗
  > Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.
  This also works for Google support.
  > And it seems they are able to do things very quickly, when they want to. Bastards.
  I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
  It was already a problem before agents could automatically perform these actions.
  And it’s not something you can really automate on their end either. At least not the judgement call on the removal. Imagine if there was a fully automated process and it inadvertently took down a legit project.
  1. debugnik · 1790269406 · focus · HN ↗
    > I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
    Stalling in the hope that reporters won't escalate, instead of allocating a tiny bit of their billions in profit to hiring for this, is malicious in my book.
    majorchord · 1790269765 · focus · HN ↗
    Can you provide evidence of these claims?
    csomar · 1790270181 · focus · HN ↗
    I mean we are in the thread of evidence right now?
    veverkap · 1790270982 · focus · HN ↗
    GitHub support is full of amazing, hard working people.
    It is also comically understaffed. This is not because they can't find people to work - it's not given the budget necessary.
    nikanj · 1790271819 · focus · HN ↗
    They might be amazing and hard working, but that doesn’t free them from the yoke of policy and script
    amdsn · 1790270487 · focus · HN ↗
    I had several small requests for moderation (deleting and banning spammers posting spam/crypto scam issues/PRs in my repos and ones I contribute to) answered within a day earlier this year after more than a decade of never needing to request moderation. I'm not defending GH here as it's obviously unacceptable that the OP's issue took this long, but they definitely do or at least did have mods. I would guess they need a lot more of them if something this serious went unaddressed, or maybe the ones I interacted with are now gone and have not been backfilled.
    ktm5j · 1790274324 · focus · HN ↗
    I mean.. for better or worse, this is how corporate America works. Hiring to solve a problem that's not costing them money (and solving it doesn't make money) is probably not going to happen, especially with the current state of the economy. They have more of an obligation to make money for their investors than they do anything else, that's just how it works.
    ruined · 1790274445 · focus · HN ↗
    how does anyone expect to solve AI alignment when we can't even solve corporate alignment
    ktm5j · 1790274738 · focus · HN ↗
    Life sure ain't perfect.. not much you can do about that sometimes.
    hyperhello · 1790274500 · focus · HN ↗
    If we have no way to strike back, they will simply suck every drop of blood out the way you use every part of the buffalo. There is no way to escape Microsoft when they just buy everything and turn it into part of their garbage moat.
    Paracompact · 1790276401 · focus · HN ↗
    > They have more of an obligation to make money for their investors than they do anything else, that's just how it works
    Where does this myth come from, and how does it survive? It's either an excuse for parasitic corporatism, or an expression of learned helplessness. Nobody has been successfully sued for prioritizing the long-term health and reputation of a company over self-starving quarterly profit.
    Is there a perverse incentive toward the latter anyway? Yes. But it mostly serves current leadership, who are evaluated and paid on short horizons, at the expense of the long-term investors who own most of the equity.
    ktm5j · 1790276611 · focus · HN ↗
    Definitely not a myth, friend. Read this article from Harvard Business School: <a href="https://online.hbs.edu/blog/post/fiduciary-duty-to-investors" rel="nofollow">https://online.hbs.edu/blog/post/fiduciary-duty-to-investors
    "Accepting funding from investors puts you in a fiduciary role in which you’re responsible for managing their money and putting their needs above your own"
    usefulcat · 1790278338 · focus · HN ↗
    Where on that page is there anything to indicate that hiring more QA or mods would be so bad as to be considered a breach of fiduciary duty? That seems like a pretty big exaggeration, at best.
    This behavior is a matter of incentives, not obligations. No need to apologize for them.
    "Fiduciary duty" does not mean "pursue profit to the exclusion of all other considerations".
    mindcrime · 1790278695 · focus · HN ↗
    The reality is "it's complicated". But the strongest form of this - that "companies must maximize profits over ALL over concerns NO MATTER WHAT" is basically a myth. See:
    <a href="https://corpgov.law.harvard.edu/2012/06/26/the-shareholder-value-myth/" rel="nofollow">https://corpgov.law.harvard.edu/2012/06/26/the-shareholder-v...
    <a href="https://www.legislate.ai/blog/does-the-law-require-public-companies-to-maximise-shareholder-value" rel="nofollow">https://www.legislate.ai/blog/does-the-law-require-public-co...
    <a href="https://lawreview.law.ucdavis.edu/archives/56/5/end-shareholder-wealth-maximization" rel="nofollow">https://lawreview.law.ucdavis.edu/archives/56/5/end-sharehol...
    <a href="https://news.ycombinator.com/item?id=20325023">https://news.ycombinator.com/item?id=20325023
    <a href="https://en.wikipedia.org/wiki/Shareholder_value" rel="nofollow">https://en.wikipedia.org/wiki/Shareholder_value
    So yeah, "fiduciary duty" is a real thing, but that's not quite the same thing as saying that every single decision has to be focused on nothing but profit maximization.
    [deleted] · 1790280516 · focus · HN ↗
    [deleted]
    ktm5j · 1790280937 · focus · HN ↗
    So you think making bad business decisions is holding up to fiduciary duty? You can't throw money at every problem that you'd like to solve, calling that malice is silly was the point I was trying to make.
    joe_the_user · 1790283679 · focus · HN ↗
    Neglecting all other ethical duties beside profits is so close to malice it takes ...an, ah, expert, to tell you the differences and how important they are.
    And this neglecting all duties besides profits thing is real, it is institutionalized by decisions of investors, by managers hired by investors, by regulators "captured" by investors and so-forth. It is the norm. But that doesn't it's a legal or ethical that a given manager or employee has, at least not currently.
    applfanboysbgon · 1790285154 · focus · HN ↗
    Paying staff to avoid distributing literal malware on your platform is not a bad business decision. And even if it was - yes, bad business decisions are within the scope of fiduciary duty. Have you ever seen someone successfully sued under this clause for making a bad business decision, in your life? Fiduciary duty is more like, you can't take the money and run or pay your nephew a $10,000,000 salary to play ping pong in the office. As long as you're not doing something clearly, intentionally harmful to the business and investors, you're clear.
    ktm5j · 1790336898 · focus · HN ↗
    They are paying people to do that. What I said was that hiring more probably won't happen in this economy.
    mindcrime · 1790298025 · focus · HN ↗
    > So you think making bad business decisions is holding up to fiduciary duty?
    I didn't say anything remotely like that, so I'm going to assume you're not trying to have a good faith discussion here, and decline to participate any further. Have a nice day.
    ktm5j · 1790336586 · focus · HN ↗
    You're the one jumping all over what I said, I'm trying to explain what I said since you seem to have such a problem with it. Wow.
    tripletao · 1790278803 · focus · HN ↗
    Nothing in that article says you're obligated to maximize profit, and you're not:
    > To quote the U.S. Supreme Court opinion in the recent Hobby Lobby case: “Modern corporate law does not require for-profit corporations to pursue profit at the expense of everything else, and many do not.”
    <a href="https://www.nytimes.com/roomfordebate/2015/04/16/what-are-corporations-obligations-to-shareholders/corporations-dont-have-to-maximize-profits" rel="nofollow">https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...
    Executives are free to pursue near-term profit at the expense of everything else if they choose, and the shareholders are free to replace them if they don't. That's a choice by those executives or shareholders though, not an obligation.
    ktm5j · 1790280179 · focus · HN ↗
    I said it's their biggest priority, not their only priority... solving a problem that doesn't cost money and the solution doesn't make money is bottom of the barrel. Come on guys, be real.
    usefulcat · 1790282140 · focus · HN ↗
    FWIW I totally agree with that. What I (and several others) disagree with is the idea that the concept of fiduciary duty confers an obligation to pursue profit at the expense of all else.
    Is there an incentive to do that? Yes, or at least it's obviously quite possible. But is there an obligation? No.
    Relative to the comment you were responding to, it sounded like you were defending the idea that an obligation exists.
    The distinction matters because if such an obligation did exist it would effectively excuse a lot of bad behavior.
    tripletao · 1790283497 · focus · HN ↗
    You used the word "obligation", not "priority". That's simply not correct, and it transfers responsibility from the people making these decisions to whatever nebulous system would enforce that "obligation".
    If you look at the case law for fiduciary responsibility, then you'll find that executives have a strong obligation against self-dealing (decisions that clearly benefit them at the expense of the shareholder), but not much else. The "business judgment rule" makes it generally lawful for executives to make decisions that you, the shareholders, the judge, or anyone else might consider to be bad business judgment. It couldn't really be otherwise, since the difference between wasteful spending and a wise investment in the company's reputation might be unclear even decades later.
    If shareholders disagree with an executive's business judgment, then their remedy is to fire that executive. That remedy has nothing specific to "making money"--the shareholders are just as free to fire a CEO for excessive attention to profit as insufficient.
    ktm5j · 1790343455 · focus · HN ↗
    You are nitpicking over semantics in a way that provides no value. For example, you have an obligation to pay your bills, otherwise bad things happen. There's nothing wrong with my choice of words.
    tripletao · 1790364322 · focus · HN ↗
    I am legally obligated to pay my bills. If I don't, then my creditor can sue me and I will lose. If I still refuse to pay, then the state will enforce the court's judgment, if necessary with tasers and guns (like by physically seizing my property, or by locking me up for civil contempt if I try to conceal my property).
    You linked an article about fiduciary responsibility, and that's also a legal obligation. If I'm an executive and I route contracts to a vendor that I own for personal gain, then the shareholders can sue me and I will lose. The state will likewise enforce that judgment, if necessary with physical force.
    If I'm an executive and I choose to spend too much money (in someone's opinion) auditing a git hosting site for malware, then the possibility that I'll get sued for that and lose is zero. That's the "business judgment rule", which is a legal term of art that you can search. The shareholders might fire me, but only in the same way they could fire me for anything.
    The financial incentives are obviously as you say, but the difference between "things I do because the state will physically punish me if I don't" and "things I do because I want a high-paying job" is valuable to me. I could probably make more money than I do now if I worked for a payday lender or an online casino, but I don't think that obligates me to do so.
    mistrial9 · 1790277739 · focus · HN ↗
    many readers here have not experienced a standard of customer support that was common decades ago. Google in particular created a new standard for ignoring the customer on a large scale, in my own experiences. Secondly, the customer paid money to a company for service, while an emergent business form does not take money from the customer directly, blurring the definition of customer.
    I strongly agree that failure to stand for consumer rights is both learned helplessness and an apologist cooperator psychology. CA Voter here.
    usefulcat · 1790278153 · focus · HN ↗
    > They have more of an obligation to make money for their investors
    "Obligation" is the wrong word. Should be "incentive".
  2. elAhmo · 1790271018 · focus · HN ↗
    It is a problem they could solve if they want to. They have billions of profits per quarter.
    They just don't want to. Not malicious, just ignorant and disrespectful of their users.
  3. rkagerer · 1790271540 · focus · HN ↗
    I’m sure they are swamped with such requests
    Then maybe they should be growing their customer support capacity along with their business. It drives me crazy how big companies have normalized cutting those departments down to anemic proportions. Especially those where you're a paying customer.
    someonebaggy · 1790276599 · focus · HN ↗
    Remember when Google lost a lawsuit for defaming a business in their AI search results?
  4. dogleash · 1790271671 · focus · HN ↗
    >I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
    It's malice from whoever is responsible for under-staffing. It's also malice to prioritize the squeaky wheel for optics; it's intentional to reduce the spread of the knowledge of how unresponsive they are.
  5. alightsoul · 1790272504 · focus · HN ↗
    YouTube already does it autonomously with seemingly no legal consequences for them because you agree to it in their tos
    nullc · 1790282731 · focus · HN ↗
    YouTube also totally fails to remove obvious fraud videos, even ones they mark verified. (If someone takes over a verified channel and renames it, they keep the verified flag). -- also with no legal consequences.
  6. vkou · 1790274697 · focus · HN ↗
    > I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
    Handling these requests at whatever scale they operate is their responsibility.
    Nobody held a gun to their head and forced them to take on all of their customers.
  7. rcleveng · 1790306003 · focus · HN ↗
    Unfortunately this is very true. It often takes someone pretty high up on the food chain to see it on HN, X, or get an email/LinkedIn message asking about something for it to become a priority.
    I don't see that changing for any of the large companies unfortunately, anytime soon.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.