Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH...
6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].
Please just email us (hn@ycombinator.com) when something like this happens.
Moderators didn't see these submissions or if we did, we didn't know why this project or incident was significant or important.
Now we've seen it, we've boosted the first submission of the incident onto the front page, and updated the URL and title to the most up-to-date/complete page about the incident.
The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots.
Oh that's clever. Use the spambot ring to promote the story so that the story gets marked dead because of that! Instead of hiding the news, use the botnet to promote it and use the system against itself.
I've noticed some HN posts get a higher-than-average number of replies from LLM bots. I've wondered if this has a downranking effect due to the upvote/comment ratio, and whether people might be using bots to do this intentionally. Alternatively it could just be that the bots "like" certain keywords more than others.
There is no report button. If you want the mods to make the site less xyz, email them a link to the xyz that you came across and say you want less of xyz, either specifically and/or generally. Let them decide how to respond; that’s not your problem, no need to invest effort in it.
‘flag’, if that’s what you mean, only sends a mathematical algorithm signal, that does not lead to mod attention. I flag posts that are dupes, irrelevant, low-effort, or are hard paywalled without a bypass link. This is often sufficient and is like sweeping cobwebs out of an ignored corner: it’s not worth getting upset about, just grab the broom and sweep it up and move on.
I email mods for issues that I think should be addressed to keep HN a better place than the voting/flag algorithms can solve without human assistance: guidelines violations like high-karma users insulting others, or patterns of behavior observed unflagged over time, or suspicion of voting rings; or technical issues with the xyz.com/subdomain detector that prevent self-linking detection from working, or with the auto-dead-ifier that’s the topic of this post, etc.
People tend not to attribute random spam filter breakdowns to the humans moderating content, other than when a specific person suffers over it and takes especial umbrage. It’s more likely that people who visit the story will now have a slightly worse opinion of OP, which sucks because OP is using a poor method to make a good report of a meaningful problem that needed solving. Methods matter! This meeting should have been an email.
Are you asking them to be specific about what they dislike or something?
I feel like the answer to "What practices?" is obvious: "The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots."
I was wondering what “moderation practices” related to this story they thought warranted people having a worse opinion of HN moderation? It's unlikely they were referring to automated spam filters.
I did not see it but I was not affected since I had pinned the tag and used a cool down; practices whose value I reminded my coworkers of with this post.
Pinning the tag will not save you - the tags were force-pushed. The cooldown probably did save you but you should check for the indicators of compromise listed on the security advisory page.
6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].