Epic Games Github Email Storm (~60 mil emails sent) [Mini tech news]

[trag1c]

Spoiler

Kind of tech news, kind of not so I'll just stick this in general discussion unless mods feel like its a better fit in tech news. There's also no article to associate with this so in the spoiler I have a screenshot from my inbox last night to provide some proof.
 

https://github.com/EpicGames/Signup/pull/24#issuecomment-1146720882 (Link to the Pull Request)
https://en.wikipedia.org/wiki/Email_storm (Managed to get a Wikipedia entry already lol)

 

Summary:

A kid named Rohith Sreedharan managed to find a new(ish, technically this happened before with the Microsoft GitHub org) way to create an email storm. This fellow attempted to push a bogus pull request (submit new code to UE) to the Epic Games repositories to try to get some contribution history (Tried changing like 3 words in a readme), and in doing so he tagged everyone associated with the epic games org which includes anyone who joined the org to view the source code of the Unreal Engine. This caused around 400k people to get notifications from GitHub about this pull request. This also had the side affect of subscribing everyone to the comment thread of the pull request. Unfortunately the unsubscribe link in the email notifications didn't actually unsubscribe the user from the pull request so people received upwards of 150 emails (I think have around 160 in my inbox). Assuming that everyone received 150 emails, that's 60 million emails that GitHub had to send out last night. It appears that there was also another attempt made later on by another person but that got shutdown pretty quick (only like 10 notifications)

 

My thoughts:

I honestly don't know whether to call this kid a legend or piss for brains (possibly both). I am assuming the kid is trying to get a career in software development since he has school projects on his Github. He probably thought that he could make some bogus commits to projects to try to say he has contributed to complex and large projects such as Unreal Engine. But he made the fatal flaw of tagging an entire organization rather than just the people who review pull requests. This is one PR that's probably not going to help his career aspects lol.

 

Another thought I have is, why would GitHub allow notifications to be sent to 400k people...I can't think of a good reason to allow for tagging an entire org in such a manner. This is also partially a problem with the way Epic hides their code. In order to view the source of Unreal you have to join the Epic Games organization on GitHub which now allows you to be tagged as part of the org. This entire setup is a recipe for disaster since you might be able to use such a setup to DDOS GitHub using GitHub lol

[Levent]

That kid is playing the dumb kid card on twitter, I am not buying it.

[trag1c]

13 minutes ago, Levent said:

That kid is playing the dumb kid card on twitter, I am not buying it.

I don't know if I would attribute the whole thing to malice, the PR was definitely a bullshit contribution but I don't know if the tagging of the entire organization had the intent he was seeking. 

[wasab]

I have only gotten around 7 emails. However the very first one had me mentally perturbed. It was a naked man showing an image of a particular part of his anatomy.

[AnonymousGuy]

I love email bombs at my company.  Watching the rage build and spread as waves across timezones.

[trag1c]

3 hours ago, wasab said:

I have only gotten around 7 emails. However the very first one had me mentally perturbed. It was a naked man showing an image of a particular part of his anatomy.

Ah yes, seen that interesting photo... 

 

For me that was in a separate thread of notification emails, there was another group of at least 150 emails.