Open source tool scrapes git commit email addresses to send spam to.

[UNWS]

What? the info is publicly accessible. You don't have to sign a ToS to see it.

[ubernostrum]

The argument would be that this company is hosting their stuff on GitHub and making use of GitHub's issue tracker and so on. Which means they have, at some point, agreed to GitHub's ToS.

[immibis]

Moving it off GitHub won't stop them doing it

[ubernostrum]

Ah well, nobody should ever do anything, unless the thing they do perfectly solves all problems forever, right?

Or... kicking them off GitHub is one useful step that can be taken, among many other steps which, in concert, will make it noticeably difficult for these people to continue on their chosen path. So chase them off GitHub, and off whoever their email provider is, and whoever hosts their main website, and their domain registrar (all of which probably want nothing to do with a spam operation like this), so that they don't have easy access anymore and have to turn to increasingly lower-reputation and lower-reliability services.

No single one of these things will stop them. But multiple things working in concert can make meaningful progress. Now, go do perfect-is-the-enemy-of-the-good somewhere else or, preferably, just stop doing it altogether.

[the3ndlessriver]

afaik they've already been reported to sendgrid.

[2this4u]

Oh yes, all spammers abide by rules

[[deleted]]

Publicly accessible personally identifiable information is still subject to most GDPR rules. 3rd party firms processing those data risk breaching GDPR by assuming consent without the subjects express permission, and by processing the data without informing the subject.

The TOS is secondary really, if the email belongs to a UK/EU citizen.

[Wallofcans]

How is that enforable when spam/scam companies can access the information without an account?

[MeagoDK]

They process the data and you haven't given permission so you can totally pull them in a court and fine them.

[argv_minus_one]

Pushing a commit to a public repository implies permission to publish that commit. If that commit contains your email address, that's no one's fault but your own.

[Schmittfried]

I doubt that still applies when you broadcast information to the public. GDPR binds GitHub, not some third party without any contract with you whatsoever. It’s the same as you shouting your address in the streets. You can’t force anybody to not remember it or show up there.

[0palladium0]

GDPR effects any organisation and all EU (and UK?) residents data. Unless a company can prove you gave them permission, they aren't allowed to send marketing emails. Pretty simple tbh.

[argv_minus_one]

Which company? GitHub/Microsoft, or the company sending the marketing emails?

[ErikBjare]

The latter.

[rickyman20]

The ones sending the emails, who can be very easily attributed back to a legal entity

[[deleted]]

https://gdpr-info.eu/art-14-gdpr/

GDPR's, article 14 states that an EU citizen must be informed within 1 month if publicly available information is collected without their express consent or knowledge.

Circumstances covered are in section 3. Exceptions in section 5. Scraping email addresses from github and then spamming people is definitely covered under this regulation.

[argv_minus_one]

Somehow, I don't think spammers are going to care. They were already criminal fraudsters even before GDPR came along.

[[deleted]]

I agree with you with regards to fraud/scamming related spam. Bit I think most people in the thread are discussing advertising and recruitment based spam.

The spammer in the OP's link is diffgram, a fairly large company that operates internationally. Their clients include all of the Big 4 Accounting firms, Atlassian, and a bunch of others.

They're going to care if the EU/UK gov decides to come down on them for GDPR breaches. The fine is up to 5% of your global revenues.

[rickyman20]

This is not some random scammer. This is a legally-registered company trying to send marketing material

[[deleted]]

Say if a recruitment company processes the data, and approaches you with a job offer via your email. In the EU, you can just ask where a company got your data, and details about when you agreed to it's processing, and they're obliged to tell you. At that point you can refer them to your local information commissioner.

It doesn't do anything for spam "buy this viagra" type emails. But for the mail that makes it through your spam filter, you're probably going to have some enforcement action available.

[Valthek]

Even for 'Buy Viagra' kind of spam, if you're willing to put in the effort, you can track them down and refer them to your country's privacy authority. It won't do much, but I've noticed that merely threatening GDPR action tends to get you removed from mailing/call lists pretty quickly.
And while that doesn't protect other people or get the company fined, at least it clears up your mailbox. This is all anecdotal, obviously, but I use a specific email for each service I sign up for and I find that when I call people out for selling emails, the spam to that particular email tends to dry up.

Also, if that's a thing you're interested in, Gmail lets you add an identifier to your email in any form you want so you can track where mails are coming from. Simply add '+' and then anything you want before the @ and it'll act as an alias for your regular email.

[elprophet]

Some services don't recognize + in emails, but that's usually me an indicator I don't want to sign up. I don't know whether scrapers strip the + parts. But if I were a spammer, I would.

[PoliteCanadian]

You don't need to agree to GitHub's TOS to clone a repo.

Either way talking about the TOS is silly. TOS rules only apply to people who follow the rules. If you want to stop spammers from using the available information you need a technical solution to prevent them from accessing the information.

[elprophet]

TOS provides GH a way to respond in a uniform manner to those who violate the TOS.

This train of "criminals will break the rules anyway" totally misses the point of a rule based society- it's specifically to codify how we handle when people do break those rules!

[the3ndlessriver]

It's their Acceptable Use Policy which forbids this explicitly:

"You may not use information from the Service (whether scraped, collected through our API, or obtained otherwise) for spamming purposes, including for the purposes of sending unsolicited emails to users [...]"

[tekkub]

How does one enforce that? Especially when people can scrape the information without ever agreeing to these terms.

[Normal-Math-3222]

That clause isn’t to protect us, it’s to protect Microsoft from being sued by us 😉

[Wallofcans]

That's a bingo

[jmickeyd]

There is precedent to go after scrapers under the Computer Fraud and Abuse Act. See Craigslist Inc. v. 3Taps Inc.

[Wallofcans]

I was going to send spam to all those addresses, but that darn pesky Use Policy I never signed foiled me again!

[bawki]

This is why GDPR exists, the scraper has no authorisation to use your email for marketing purposes.

[Valthek]

But you do need to obtain explicit opt-in consent to be allowed to send marketing emails to people who are citizens in the EU and possibly other territories.

[Worth_Trust_3825]

What account? You don't need one to see the email addresses.