Thread

GitHub has not removed malicious imitation software after 3 weeks

279 points · 119 comments · hermitcrab

hermitcrab · 1790267696 · focus · HN ↗
Author of the post here. Github finally took the offending page down approximately 10 minutes after the post appeared on the front page of HN. Total coincidence. I'm sure!
Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.
And it seems they are able to do things very quickly, when they want to. Bastards.
1. koolba · 1790268882 · focus · HN ↗
  > Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.
  This also works for Google support.
  > And it seems they are able to do things very quickly, when they want to. Bastards.
  I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
  It was already a problem before agents could automatically perform these actions.
  And it’s not something you can really automate on their end either. At least not the judgement call on the removal. Imagine if there was a fully automated process and it inadvertently took down a legit project.
  1. debugnik · 1790269406 · focus · HN ↗
    > I wouldn’t chalk any of this up to malicious intent. I’m sure they are swamped with such requests.
    Stalling in the hope that reporters won't escalate, instead of allocating a tiny bit of their billions in profit to hiring for this, is malicious in my book.
    ktm5j · 1790274324 · focus · HN ↗
    I mean.. for better or worse, this is how corporate America works. Hiring to solve a problem that's not costing them money (and solving it doesn't make money) is probably not going to happen, especially with the current state of the economy. They have more of an obligation to make money for their investors than they do anything else, that's just how it works.
    Paracompact · 1790276401 · focus · HN ↗
    > They have more of an obligation to make money for their investors than they do anything else, that's just how it works
    Where does this myth come from, and how does it survive? It's either an excuse for parasitic corporatism, or an expression of learned helplessness. Nobody has been successfully sued for prioritizing the long-term health and reputation of a company over self-starving quarterly profit.
    Is there a perverse incentive toward the latter anyway? Yes. But it mostly serves current leadership, who are evaluated and paid on short horizons, at the expense of the long-term investors who own most of the equity.
    ktm5j · 1790276611 · focus · HN ↗
    Definitely not a myth, friend. Read this article from Harvard Business School: <a href="https://online.hbs.edu/blog/post/fiduciary-duty-to-investors" rel="nofollow">https://online.hbs.edu/blog/post/fiduciary-duty-to-investors
    "Accepting funding from investors puts you in a fiduciary role in which you’re responsible for managing their money and putting their needs above your own"
    tripletao · 1790278803 · focus · HN ↗
    Nothing in that article says you're obligated to maximize profit, and you're not:
    > To quote the U.S. Supreme Court opinion in the recent Hobby Lobby case: “Modern corporate law does not require for-profit corporations to pursue profit at the expense of everything else, and many do not.”
    <a href="https://www.nytimes.com/roomfordebate/2015/04/16/what-are-corporations-obligations-to-shareholders/corporations-dont-have-to-maximize-profits" rel="nofollow">https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...
    Executives are free to pursue near-term profit at the expense of everything else if they choose, and the shareholders are free to replace them if they don't. That's a choice by those executives or shareholders though, not an obligation.
    ktm5j · 1790280179 · focus · HN ↗
    I said it's their biggest priority, not their only priority... solving a problem that doesn't cost money and the solution doesn't make money is bottom of the barrel. Come on guys, be real.
    tripletao · 1790283497 · focus · HN ↗
    You used the word "obligation", not "priority". That's simply not correct, and it transfers responsibility from the people making these decisions to whatever nebulous system would enforce that "obligation".
    If you look at the case law for fiduciary responsibility, then you'll find that executives have a strong obligation against self-dealing (decisions that clearly benefit them at the expense of the shareholder), but not much else. The "business judgment rule" makes it generally lawful for executives to make decisions that you, the shareholders, the judge, or anyone else might consider to be bad business judgment. It couldn't really be otherwise, since the difference between wasteful spending and a wise investment in the company's reputation might be unclear even decades later.
    If shareholders disagree with an executive's business judgment, then their remedy is to fire that executive. That remedy has nothing specific to "making money"--the shareholders are just as free to fire a CEO for excessive attention to profit as insufficient.
    ktm5j · 1790343455 · focus · HN ↗
    You are nitpicking over semantics in a way that provides no value. For example, you have an obligation to pay your bills, otherwise bad things happen. There's nothing wrong with my choice of words.
    tripletao · 1790364322 · focus · HN ↗
    I am legally obligated to pay my bills. If I don't, then my creditor can sue me and I will lose. If I still refuse to pay, then the state will enforce the court's judgment, if necessary with tasers and guns (like by physically seizing my property, or by locking me up for civil contempt if I try to conceal my property).
    You linked an article about fiduciary responsibility, and that's also a legal obligation. If I'm an executive and I route contracts to a vendor that I own for personal gain, then the shareholders can sue me and I will lose. The state will likewise enforce that judgment, if necessary with physical force.
    If I'm an executive and I choose to spend too much money (in someone's opinion) auditing a git hosting site for malware, then the possibility that I'll get sued for that and lose is zero. That's the "business judgment rule", which is a legal term of art that you can search. The shareholders might fire me, but only in the same way they could fire me for anything.
    The financial incentives are obviously as you say, but the difference between "things I do because the state will physically punish me if I don't" and "things I do because I want a high-paying job" is valuable to me. I could probably make more money than I do now if I worked for a payday lender or an online casino, but I don't think that obligates me to do so.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.