GitHub ignores malware disguised as Easy Data Transform for 23 days
GitHub has not removed malicious imitation software after 3 weeks
Andy Brice of Easy Data Transform reported a GitHub repository impersonating his product with its name and logo on August 31. A colleague found the Mac .dmg file flagged by VirusTotal and its background image rewritten to tell users to ignore malware warnings. Brice sent that evidence on September 10. By September 23, GitHub support had sent nothing beyond its original automated reply.
23 days without a reponse. This is pisspoor. Do better Github.
- hermitcrab
Author of the post here. Github finally took the offending page down approximately 10 minutes after the post appeared on the front page of HN. Total coincidence. I'm sure!
Moral of the story. If you want even the most basic level of support from Github, you need to get on the front page of HN first.
And it seems they are able to do things very quickly, when they want to. Bastards.
- wingerlang
If GitHub staff is still reading this thread, maybe you can take down https://screenmemory.github.io/ as well. I reported it 4 weeks ago, ticket ID 4703161
- OCTAGRAM
I recently found "free" version of Lossless Scaling on GitHub. The release installer is definitely malware. It took GitHub 3 days to shutdown malware distribution. Category of my ticket was malware report, not copyright infringe
- Havoc
They’re presumably too busy with keeping availability above nine sixes
- bananamogul
Three weeks? Try almost three years:
https://lowendbox.com/blog/will-github-ever-remove-this-null...
- tgsovlerkhgsel
Lack of moderation is an issue everywhere, because there are few consequences for the platforms.
Booking.com kept a clearly fraudulent listing (images clearly stolen from another Booking.com listing with mirroring + some filters) fully online for at least two days (I got distracted and stopped taking daily screenshots after that). I just got a response that they've taken it down almost 10 days after I had initially reported it (although I think they marked it as not bookable some time before that).
- joshuat
Not exactly the same, but I've noticed a pretty sizable uptick in the number of spam/scam PR comments being left on GitHub (and a longer delay before they're removed after report).
Not the worst thing in the world, they're easy to spot, but I'd like to see GitHub invest more time in protecting their users from falling victim to these bad actors.
- kelnos
If they were using your logo, you could have sent a DMCA takedown notice. That would have likely gotten a faster, more serious response.