Attempts to post the latest Trivy security incident have been marked [dead](news.ycombinator.com) |
Attempts to post the latest Trivy security incident have been marked [dead](news.ycombinator.com) |
6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].
Moderators didn't see these submissions or if we did, we didn't know why this project or incident was significant or important.
Now we've seen it, we've boosted the first submission of the incident onto the front page, and updated the URL and title to the most up-to-date/complete page about the incident.
The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots.
Big security stories often get republished, one might say reviewed and filtered. For this story I see
opensourcemalware.com - https://news.ycombinator.com/item?id=47449498
stepsecurity.io - https://news.ycombinator.com/item?id=47451081
arstechnica.com - https://news.ycombinator.com/item?id=47464996
and 4 others.
( Make need to turn on "showdead"; to see it in the 2024 they have similar posts .. )
Or: write a short blog post about it, and post that, on your (different) domain.
It's certainly worked. Lots of people have seen this and now have a slightly worse opinion of HN moderation.
What practices?
I feel like the answer to "What practices?" is obvious: "The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots."
‘flag’, if that’s what you mean, only sends a mathematical algorithm signal, that does not lead to mod attention. I flag posts that are dupes, irrelevant, low-effort, or are hard paywalled without a bypass link. This is often sufficient and is like sweeping cobwebs out of an ignored corner: it’s not worth getting upset about, just grab the broom and sweep it up and move on.
I email mods for issues that I think should be addressed to keep HN a better place than the voting/flag algorithms can solve without human assistance: guidelines violations like high-karma users insulting others, or patterns of behavior observed unflagged over time, or suspicion of voting rings; or technical issues with the xyz.com/subdomain detector that prevent self-linking detection from working, or with the auto-dead-ifier that’s the topic of this post, etc.
tl;dr nope, the mods monitor emails not flags