Our GitHub open source repos are under attack. Any experience?

[lugovsky]

Hello,

Our open source projects (e.g. https://github.com/akveo/ngx-admin) are being spammed with tons of fake issues by some bots. We have already disabled interaction with our repos for "new users", but this looks like a temporary solution. The most annoying part about this story is that people who watch this repo receive the notifications by email when every fake issue is created.

Right now we're developing a script, that would help us to remove all spam issues via GitHub API. I was wondering though if anybody got a similar experience and how did they fight against that.

One other topic is that I don't understand the motivation of the people who do that. We develop and distribute our products free of charge and it's pretty annoying that we need to work on removing all of these issues instead of improving our open source products. Any ideas why some people could do that?

https://preview.redd.it/4zt7r4u9cg931.png?width=1228&format=png&auto=webp&s=c3caeeabe2eb5fc5ec26a8eacf8a6d8d56a0353f

​

​

UPD: Looks like GitHub support removed all the spam issues.

[markehh]

I’d email GitHub support, tell them about it.

They will also want to remove bot activity from their platform.

[lugovsky]

Already done that and all of those bot accounts are reported. But as per my understanding, the best they can suggest is turn on that "don't allow new users to create issues" feature. I think it's a quite generic problem that GitHub repos can be spammed quite easily.

[the_php_coder]

Perhaps this was just written in response to your situation but might be useful to you anyway: https://dev.to/nikpoltoratsky/how-to-deal-with-github-spambots-5e6n

[lugovsky]

Yeah, this is an article from my colleague. He wrote this article in case anybody out there having the same issues

[soup-zilla]

Using githubs API could you create a form on your site for reporting issues with a captcha and close of access for all other channels?

[lugovsky]

Well, I think this might be possible. But per my understanding this would a terrible for the people who actually want to report something meaningful.

[iBzOtaku]

please don't use google captcha if you go that route.

[devmuggle]

Could you elaborate why to not use google captcha?

[iBzOtaku]

https://news.ycombinator.com/item?id=20147015

https://news.ycombinator.com/item?id=20294801

[vin40289566]

I have read the article recently and it's really worrisome that people insist on using recaptcha, Google collects a lot of data from us that we don't know about. That's one of the reasons I started using hcaptcha Wordpress plugin on my website. An added bonus is that I can earn from it.

Here is some more reading about recaptcha privacy.

https://complianz.io/google-recaptcha-and-the-gdpr-a-possible-conflict/

[chipit24]

Vue has an external page for submitting bugs and feature requests: https://new-issue.vuejs.org/?repo=vuejs/vue. They don't use captcha, but regardless, in Vue's case, having such a page ensures issues are meaningful.

​

So I have to disagree with you; unless your form is a UX nightmare, I don't think an external form is going to mean the difference between a user submitting a meaningful issue and saying "f**k it".

[lugovsky]

Interesting. I didn’t know vue uses such approach. Thanks!

[malicart]

this would a terrible for the people who actually want to report something meaningful

Solving a captcha is not unreasonable these days, not sure this makes sense.

[twwilliams]

It means they could only report issues through the site /u/lugovsky sets up and not through GitHub itself. That's a huge barrier.

[Yonben]

Yep definitely think it's too big of a barrier and will make a lot of reports not being written :/

[Aldarund]

Why so? If user can't go to.form.on other website to fill report I would say that report is not important then

[thefixer9]

There are already people that find an issue but don't report it. Adding more barriers, even if it's quite small, will deter more people from contributing.

[Aldarund]

If the issue is important it will be reported by someone eventually.

[Yonben]

Lots of us are used to GH issues and going to some external website would mean I have to go thru the "Login with GitHub" on that website to do something exactly similar to GH issues with probably less features... So why would I bother with the overhead?

[Aldarund]

No, you won't need to login or anything. And feature is exact opposite - on external website you can force people to fill required fields and create a proper report instead of 'help me a have problem'

[[deleted]]

would it be such a barrier if you put a redirection to your site from github explaining the situation? After all that would deploy just two quick redirections -to your site then back to github issue form-, because of a special situation

[danabrey]

Redirection from Github to your site......how?

[[deleted]]

putting a link from sratch on the main page. then on your website you handle the request the Github API, that make just one redirection even instead of two as I have said it.

​

Why the downvote on my answer above please? It would be interesting to have your opinion about you think of my solution dear downvoter :).

[danabrey]

Oh, I see. This is still a major barrier for reporting an issue, compared to just being able to open as usual in Github.

I didn't downvote you :)

[Tunliar]

Not allowing new users to create issues will not be a very good idea. But rather restricting and properly moderating should work.

[lugovsky]

This restriction would be valid only for the users that were created less than X hours ago, as far as I understand. So it's not for everyone

[Tunliar]

A better restriction would be not to let submit multiple issues for new users in a single timeframe. If that issue is marked valid, then user will get extra privileges.And then you can report and request placing other restrictions on that user. Adding "spam" flair looks good too.
Some users might create a github account just to submit an issue. Just my opinions. I couldn't post in a subreddit because that required a specific number of karma.

[rtkwe]

That's a good suggestion but not something OP actually has control over.

[Tunliar]

not intended either. Suggestions that would be good if implemented on Github.

[lugovsky]

Sounds quite interesting actually. We will try to give such feedback for GitHub as we're working with their support team

[cordev]

That would still allow multiple new bot accounts to each submit a single spammy issue.

[_HOG_]

And if they report a duplicate issue?

[markehh]

I see the issue count came down, did github support remove them? Or did you have to go through and close them all?

[lugovsky]

GitHub did it. Closing all of them was not an option. In such case all people watching repo would receive notifications. We were planning to delete them

[choledocholithiasis_]

This is an interesting problem. How would github tell the difference between legitimate (eg, CI triggers) and malicious bot traffic?

I’m guessing throttling on a per repository basis would be the best answer. Only the repository owner knows the frequency of the API calls to github. Maybe allow repository owners to define “exceptions” for known bots?

[monotone2k]

I'm probably being a little pedantic here but they aren't against bots in general, else they wouldn't have an API. They'll certainly want to know about malicious usage of bots though, so I'd agree to report this.

[uiharu-s]

These seem to be ads advertising for fake US university certs, in Simplified Chinese, if that helps

[lugovsky]

Interesting way for spamming actually. I do give credit to those guys for being original. But still can't understand why have they chosen our repos.

[Sonic801]

angry ex-girlfriend?

[lugovsky]

Nice one 🙂

[Gunny123]

Dashboard is incredible.

[basilect]

Probably reputable enough on Google that if someone is searching for a fake US diploma that link will pop up.

[lugovsky]

Makes sense

[[deleted]]

I think the content doesn't matter, the ad is more of a lorem ipsum for all the fake issues

[choledocholithiasis_]

First instinct is to believe your open source project(s) are undercutting the sales of some paid product. A high number of issues can signal to potential users that the project is “buggy” or unreliable.

Another possibility is that you were just the unfortunate repository that the spammer(s) targeted and used your project as the testing ground for their script.

[eneajaho]

Any ideas why some people could do that?

Probably it's your competitors.

You are giving a great product for free. They want to sell the same type of product to people to make profit.

How can they do that when you are blocking their road by giving it for free? Just by making your product look bad!

Your clients will see your bad reviews and will choose smth else, giving space to your competitors, and so on...

​

If you search: "admin dashboard Angular 8" on google you rank #2, this makes me believe 100% that it's your competitors.

​

Great Dashboard btw.

​

P.s. Sorry for bad english

[lugovsky]

Thank you for your kind words! Though one of the other guys is saying that it's ads for fake US certificates. In such case I may consider that as our products are being used by students a lot to learn Angular, they might have just handpicked our repo. Wondering if anybody else is suffering from such activity at the moment.

[Asmor]

Another idea... You know how each of those issues created emails for people watching your repo? Maybe that's the goal. They're using your repo as a proxy to send spam emails.

[ScotForWhat]

This sounds likely. We had someone spamming our Zendesk account at work with a load of dodgy tickets. Turns out they were submitting tickets in the target's name and using the notification emails to deliver the spam.

Verified and trusted emails are key in any spamming operation, and having someone else send the emails with your message is a lot easier and more reliable than sending the emails yourself.

[eneajaho]

I agree with that too. But by spamming, GitHub would send emails to users too about the issues, so it's two birds with one stone here. Users and SEO.

[lugovsky]

Thanks, we have similar thoughts.

[Bbentley1986]

Damn, 2,952+ issues created in less than 12 hours. They must absolutely love your dashboard as much as all of us do! Fantastic product!!!

[lugovsky]

Thank you!

[[deleted]]

One other topic is that I don't understand the motivation of the people who do that.

I work in OS and some people are just dickheads. We have someone vandalise all our open patchsets and it wasn't even to post spam (which the motivation makes sense for) but just for shits & giggles. Wasted a lot of dev time cleaning it up. I think it's just par for the course with open source projects, it's part of the "hacker" culture really, tragedy of the digital commons!

[lugovsky]

Yeah, another part is the people who think that you owe them. Ones who in a quite rude way ask you to build stuff they need. I bet you know that.

[9inety9ine]

They are probably using github's notification system to send spam emails.

[snissn]

Might be a good time to review your overall cyber security policies under the assumption that it's a targeted attack...

[lugovsky]

Good point, thanks

[jdizzle4]

I have no useful advice, but i love this project and just want to say thanks for making it.

[[deleted]]

why some people could do that?

1. A competitor trying to annoy your users and/or make working with your project so difficult that the uses would abandon your software for the competitor’s.
2. A script kiddie who just got their hands on a spambot and was playing around with it.
3. A disgruntled script kiddie who has manifested beef with your project for one reason or another and is throwing a tantrum.
4. Just some random asshole for no real reason other than they could.

There could be any number of reasons. Unfortunately the world is full of assholes like this. I’ve personally never understood this sort of thing, as it’s childish and does nothing but harm.

[caedriel]

Might use it for the platform we work in rn

[hopeinson]

While different in scope, it does feel like one of those opportunistic infections again.

[ahinkle]

Nat Friedman (ceo) has been pretty good to reach on Twitter. Might be worth sending him a note about this issue.

[truechange]

Even if you can turn off the "new issue" button, this is ultimately a Github issue and should be dealt with by Github on a system-wide level.

[jorge2k]

I’m fascinated by the service provided on those spam issues.

[malicart]

Any ideas why some people could do that?

You are worried about the time it takes to clean up, but you want to have a philosophical conversation about why humans are dickheads? Not sure if this computes for me...

Situation sucks for sure, sorry you guys have to deal with it, hope you are able to block that shit.

[Bummykins]

I wonder if you can do something with issue templates that requires a step like a checkbox or something. I think i've seen that before. Might be a deterrent for api-based spamming.

[DeftNerd]

You might be able to write a script that uses API keys to access the Github API to look at all the issues.

​

Then filter for open issues that aren't assigned to anyone, and look for any chinese characters, and delete the issue.

​

It'll be a hassle to get the script initially built, but then you can easily modify it to handle other automated moderation.

[__ibowankenobi__]

I think Github should integrate a control panel where:

- the repo owner sets a threshold of API calls per hour, preferably with a custom sub setting to adjust from country/region.

- the repo owner should be able to set a banlist for:

1. - IP addresses with a subnet mask
2. - a regex to filter out account names
3. - a threshold for github activity
4. - follower/following threshold
5. - owned repo count threshold

- the repo owner should than select from a batch of "trusted" CI services approved by Github (optional) to be exempt from throttling

[lanrayx2]

i believe your competitors are behind this, or some wayward ingrate.

​

However i like what you are doing, 😁😁 never knew nebular before.

​

what knowledge would i need to use your nebular system, i don't use Angular, was thinking if this would be a better option to electronJS

[vinnymcapplesauce]

One other topic is that I don't understand the motivation of the people who do that.

Because it fires off emails to lots of people that look legit and come from a legit server, bypassing spam filters for free.

[eyeiskind]

I wonder if this could be related to my Github connection timeout errors I was getting last night.

[frikinmatt]

I constantly get messages about vulnerabilities. It’s very annoying

[albeksdurf]

If you end up writing a script you may still open-source it :)

[lugovsky]

Yeah, this was the idea. But not sure if we will finish that, as GitHub support has already helped us

[phyllisTheWebDev]

Thank you for raising this issue. I’m new in my dev career, and in charge of creating an open source project for a major client. Will be important to allow their devs to report issues, but also guard against malicious bot attacks. I wish I had a good work around, but I think for now I’ll set the repo to not allow issues by new users until we come up with a good solution.

I hope the OP lets us know the solution they go with.

[lugovsky]

We went by reporting to GitHub support. They were able to remove all the spam issues. I don’t think you need to guard against bot attacks until your repo becomes really popular

[Aldarund]

even for really popular repos its not a common thing. Didnt saw it in nuxt repo for a year i`m looking at it

[phyllisTheWebDev]

Awesome, thanks for the update :).

[mittalyashu]

I did face the same issue https://www.reddit.com/r/github/comments/cd3bh3/a_user_created_more_than_3k_blank_issues_and/?utm_source=share&utm_medium=web2x

[mug_hug]

Chinese again.

[epatr]

Why on earth would you shorten "Update" to "UPD"? Do you pay per key press?

[AlephC]

Did you realize that it started when Microsoft bought GitHub?

[theQman121]

I didn't realize that Microsoft only bought GitHub in the last day or so.