Someone used some tricks to make his name appearing in my repo's Used by section

[louislam]

Select Topic Area

Product Feedback

Body

@akirataguchi115 This guy added my repo in his go.mod. And now his name shows in my repo, but my repo is not a library or dependency, so there is only him in the list which is a bit wired.

https://github.com/akirataguchi115/akirataguchi115/blob/go.mod#L3605

github.com/louislam/uptime-kuma v0.0.0-20230404081326-be7d3f6142f4 // indirect

My suggestions:

1. Allow to hide Used by section
2. Check the dependencies are valid before adding to Used by? Since my repo is Javascript, adding as golang is impossible I think.

Someone already commented on his commit:
akirataguchi115/akirataguchi115@e7cf62c#commitcomment-123925345

[louislam]

cc: @SkwalExe

Since you commented on his commit.

[akirataguchi115]

I think one way to fix this is disabling packages from your repository:

edit: We should patch this somehow. Don't know if disabling the importing of lang x package from lang y project would fix the issue. Importing JavaScript packages inside Go might not be possible but I'm pretty sure it's possible on other language mixups. 🦄

[louislam]

I don't think so. I have never enabled this.

[SkwalExe]

Disabling the "Used By" feature is impossible.

It can be abused, for example @akirataguchi115 by changing his username or repo's name could display arbitrary text on the uptime kuma's github page, which is a huge issue.

I have added a message about this on my readme one or two days ago, because I managed to put my profile on the official bash mirror repo. It is only a matter of time before starting to see people abusing this feature.

As a repo maintainer, you could try to put your own profile under the "used by" section of your repos so no one else can be directly shown.

[akirataguchi115]

I agree this should be fixed. I'll take a look at the workarounds others have used when I get home from the pub.

[sheeit]

@akirataguchi115 you have a repo with a go.mod file that requires ~6000 repositories. Why did you do this?

[akirataguchi115]

Good question!

[akirataguchi115]

Somehow EbookFoundations has evaded the Used By hack. I remember putting myself in the homepage couple of months ago but they seem to have fixed this on their own now. Maybe ask how they solved it from one of the maintainers: https://github.com/EbookFoundation/free-programming-books ?

[SkwalExe]

Well you are still on their page.

There is just a bug where the "used by" section sometimes doesn't appear when you load the repo for the first time in your browser.

[akirataguchi115]

Ohh that's true my bad completely forgot to spam refresh after the first load. Here should be a more valid example where I am not on the front page but should be: https://github.com/CyC2018/CS-Notes .

[SkwalExe]

This repo is not in your go.mod.

[akirataguchi115]

Ahhhh my bad again, sorry! :( I thought I added 5000 most starred repos but I guess that one's fairly fresh. Good catch from your side. I guess we can conclude now that there's no apparent way of disabling this.

[Jenesius]

I Have the same problem with https://github.com/Jenesius/vue-modal.
I found this package in the Ethernet:

Maybe GitHub parse the npm(package store for Node) and adds all packages that link to my repository.

In result my /network/dependets looks like:

I think this was not done intentionally by the user, but simply a packet parsing error.

[akirataguchi115]

What was the error here? What was the intended behavior?

[Jenesius]

@akirataguchi115 I hope that when You will visit my package the field "UsedBy" will be disapled correct.

Now GitHub take info(count dep) from just first package.

This is a problem not related to you, I just stated such a problem. When support answers me, I will share with you

[akirataguchi115]

Ohh now I see! This seems definitely like a problem. Could you open up another discussion in this organization? 🦄

[Jenesius]

Maybe for some one it can be usefull: docs