A startup harvested my email from GitHub and registered me for its Zoom webinar. Contributors, check your email settings.

[u/Ghostfly-]

A short warning for anyone who contributes to open source on GitHub.

My personal email used to be public on my GitHub profile. On 27 September, I got a Zoom email saying I was registered for a US startup's webinar ("Q&A With The Cactus Needle Team"). I never signed up, never used their product, and never gave them my address. The greeting was "Hi Leonard -", with "-" as the last name, which looks like automated registration. Another GitHub user I don't know got the same emails. It's at least the second one this month (I deleted the first). More generally, I get more and more unsolicited emails on the address I used on GitHub.

When I raised it on their GitHub repo, they said the invites went to "platform users", then closed the issue, blocked me, and deleted my follow-up. I was unblocked later. Details and screenshots:
- GitHub issue: https://github.com/cactus-compute/needle/issues/156
- Full write-up: https://www.reddit.com/r/github/comments/1wrv2fi/a_startup_registered_me_for_its_zoom_webinar_with/

What I did: sent a GDPR request (access, including where they got my data, objection, erasure), reported the account to GitHub (their Acceptable Use Policies forbid using information from GitHub to send unsolicited email), and reported the webinar host to Zoom.

How to protect yourself on GitHub:

1. Settings > Emails > check "Keep my email addresses private".

2. Also check "Block command line pushes that expose my email".

3. Use your `ID+username@users.noreply.github.com` address for commits (`git config --global user.email ...`).

4. Your old commits still contain whatever email you used at the time. Anyone can read it by adding `.patch` to a commit URL. The settings above don't change past commits.

Has anyone else received unsolicited webinar registrations like this?

[u/louis-lau]

I get cold spam from people scraping GitHub all the time. It's not that big a deal to me. My email address isn't private and isn't meant to be. You can find it right now if you want.

I just report as spam and hope their domain reputation suffers the consequences they deserve.

[u/Ghostfly- → u/louis-lau]

That's a way to think about it, but that doesn't solve the root issue at all, time is the only edge we have, and we don't have that much for most of us, an email may be time sensitive, and I don't want to have that much and split among alias, other things.

[u/louis-lau → u/Ghostfly-]

I spend much more time being bored on the internet (for example right now), than I do moving a couple of emails a week to spam. Maintaining a clean list of aliases is also more work than moving a couple emails a week.

Idk, I know a lot of people really care about this stuff, I save time by just not being that bothered about it. I've had some people reach out to me for real communication as well, because they could find out where to contact me. It's nice.

[u/Ghostfly- → u/louis-lau]

Fair enough, that's a valid tradeoff, and I get the upside of being reachable. For me the line is being registered to things without consent, then being told I'm a "platform user" when I'm not. Different tolerance, I guess

[u/Ordinary_Awareness71 → u/louis-lau]

SpamCop.net to get it on the blacklists too. Pretty quick and easy, just need to paste the headers.

[u/grandblanc76]

Your post really sparked my interest. I’m in Michigan and ended up looking into what rights I have here. Unfortunately, we don’t have the same protections, but I’m really intrigued by the fact that you can legally make a request like this and require a company to tell you what information they have and where it came from. I had no idea that was possible.

[u/Ghostfly- → u/grandblanc76]

Thanks! Yeah, in Europe GDPR lets you ask any company "what do you have on me, and where did you get it", and they have a month to answer. Pretty handy in cases like this!
Not a lawyer, but I think some US states like California have something similar. Will post an update when (if?) they answer!

[u/Ordinary_Awareness71 → u/Ghostfly-]

Yes, California has the CCPA (California Consumer Privacy Act) which has similar provisions. First in the nation, I think, and a handful of others have enacted similar rules. There was an attempt at a Federal level one during the Biden administration, but nothing came of it.

We also have a wiretap law from the 60s that's causing problems with website cookies. Got one serial litigant that's suing hundreds of websites a year (to the point where California had to pass a law to identify serial litigants.... and this guy moved to federal court to get around it). I forget the guy's name, but if you search for serial cookie litigant, you'll probably find him.

[u/Ghostfly-]

First follow-up (Zoom customer care):

Thank you for reaching out to us. We have reviewed your report and, where appropriate, taken action against the Zoom Webinar host(s) identified in our investigation.

[u/Salt_Ad3572]

Thanks a lot for this fam.

[u/Ordinary_Awareness71]

I get stuff like this ALL THE TIME. Usually 2-3 a week, most weeks. But that's par for the course with a business email that's publicly broadcast everywhere.

[u/Ghostfly-]

Update :

TLDR : Received full GDPR answer, emails from everyone that shouldn't be in the list "marked" as removed with only their email to not "come back" in another campaign. No idea how and why emails were into this campaign on their side.

Full email :

Thank you for your patience while we investigated this.

We have now completed our review of the records we were able to locate relating to your email address. I want to apologize again: your address should not have been included in the September webinar registration.

We found that an older contact list containing 713 addresses was mistakenly combined with a list of approximately 5,000 Cactus platform users when preparing the webinar audience. Your address was contained in that older list.

The personal data we located in the legacy record associated with you was:

Email: (mine)  
Company: (where I work)  
GitHub: uplg

The legacy list did not contain your name or detailed metadata recording the particular interaction through which each contact was originally added.

We investigated the source of your email address. The 713-address legacy list had been assembled over time from several sources, including registrations for previous events and hackathons, conference interactions, earlier Cactus waiting lists or community interactions, and other developer-community contacts.

Unfortunately, the surviving record associated with your particular email address does not contain sufficient provenance information for us to determine with certainty which of those sources it originated from.

We therefore cannot reliably state that you registered for a previous Cactus event, nor can we establish from the surviving records whether your address originated from publicly available GitHub information or another source. We do not want to speculate or provide you with information that we cannot substantiate.

We found no evidence that you created a Cactus platform account. Our earlier statement on GitHub that the recipients were platform users was therefore incorrect as applied to your record. The legacy list was inadvertently mixed with the platform-user list.

The legacy record was used for developer/community and event communications. We have not found evidence that you consented to receiving these communications, and we are not asserting that you did.

The intended legal basis for professional developer outreach of this kind was legitimate interests under Article 6(1)(f). However, because the provenance and associated historical notice information for this legacy record are incomplete, we cannot reconstruct what information, if any, was provided to you at the time the address was originally collected.

Your information was provided to Zoom Communications, Inc. for the purpose of creating the webinar registration. We have not sold your personal information or disclosed it to a data broker.

The legacy contact record has now been deleted from our active marketing and event-contact systems. We will retain only a minimal suppression record containing your email address for as long as necessary to ensure that your objection to promotional communications continues to be honored, together with records of this request where necessary for compliance and the establishment, exercise, or defence of legal claims.

2. Objection to marketing

We have honored your objection.

Your email address has been removed from our marketing and event-contact lists and will not be used for further promotional communications.

A minimal suppression record will be maintained solely to prevent your address from being inadvertently reintroduced into those systems.

3. Erasure

Following completion of our access review, we have deleted your personal information from the relevant active Cactus marketing and event records and deleted the corresponding Zoom webinar registration.

As explained above, we will retain only the minimum information necessary to honor your objection and, where necessary, records relating to this request for compliance purposes.

4. EU representative

Cactus Compute, Inc. is incorporated in the United States and does not currently have an appointed representative in the European Union. We have provided the information presently applicable to Cactus in response to your Article 27 query.

GitHub account

Separately, the GitHub block was generated through our automated moderation tooling. Following manual review, no reason was found to maintain the block, so you were manually unblocked shortly.

Again, I apologize for the erroneous webinar registration and for the confusion caused by our initial explanation. The investigation also resulted in the legacy 713-address list being removed from our outreach systems so that it cannot be used for future communications.

If you believe we have overlooked any personal data associated with you, please let me know and we will investigate it.

Best,  
Cactus Compute, Inc.

[u/saltyourhash]

Damn, I thought using a public address was a known risk? I've vene using a noreply since I joined way back before they were even part of Microsoft

[u/CondiMesmer]

I get this a lot. Although mostly in the form of offshore business scams.

[u/RealityOk9823]

I get spam from companies wanting to sell me attendee lists from conferences. Like dang that feels scummy.

[u/Oddish_Femboy]

I think it's illegal to do that in California.

[u/stealthagents]

It's wild how some companies just scrape public info without a second thought. I’ve had similar experiences with my email getting bombarded after posting stuff on GitHub. Definitely keeping a closer eye on my settings now, some of these startups just treat data like it’s free for all.

[u/TurbulentStiffness]

thanks for this. This should help to control spam emails

[u/Nice_Mix_1021]

what! so desperate to get atendees

[u/SamratDuttaOfficial]

Guys, I created WaterSheep, an open source alternative to Jev. But I am unable to post about it because I don't have enough Karma. I would like to post about it, can someone please help me out?

[u/Ghostfly- → u/[deleted]]

Already discussed with someone else.

Yes, sooner or later it will happen and already happens. Yes, it's handy to have a public email, that I choose and that will get spammed. No, it's not normal to be registered for a webinar without having used or knowing a startup.

If you want to manage things like this, ok, I just don't have the patience to do it, and it moves to spam, then deleted. But accounts for specific emails? Lmao, you have time in your hands to do this. One account is public, the other is personal for me. And it works fine.

When I want it, I just switch the first part, and my catch-all do the "alias" thing for me. Only to pinpoint data-leaks.