eBay settles for $56M over orchestrated harassment campaign against newsletter couple

·1 views

eBay has agreed to a $56 million settlement stemming from a systematic harassment campaign its employees conducted against a Massachusetts couple who ran an e-commerce newsletter. The campaign, which included sending disturbing packages and hiring private investigators to surveil the victims, was allegedly ordered by senior eBay executives who viewed the newsletter as a threat. The targeted individuals were Ina and David Steiner, publishers of EcommerceBytes, a publication that had published critical coverage of eBay. The settlement resolves civil claims brought by the couple, who endured months of psychological torment orchestrated by people working for one of the world's largest online marketplaces.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kubernetes Shifts from Ingress to Gateway API: What Engineers Need to Know

The Kubernetes ecosystem is moving away from the traditional Ingress API toward the newer Gateway API, marking a significant change in how traffic routing and load balancing are managed. The Ingress API's rigid, monolithic design struggles to support multi-cluster and multi-tenant environments, while the Gateway API introduces a modular architecture with components like Gateways, HTTPRoutes, and TCPRoutes. However, the transition poses real challenges, including configuration complexity and a lack of mature documentation and tooling. Organizations that delay migration risk missing out on advanced capabilities such as traffic mirroring and canary deployments. Community collaboration and open-source contributions are seen as key to bridging the knowledge gap and accelerating adoption.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to build an embedded Shopify app in PHP Symfony without official docs

A developer has published a detailed technical guide on building an embedded Shopify app using Symfony 7.4 and PHP 8.5, based on a real app called StockPilot that passed Shopify's review process. Because Shopify's official documentation primarily supports Node.js, PHP developers have lacked a clear reference for implementing the platform's authentication model. The guide explains how embedded apps run inside admin.shopify.com as cross-origin iframes, making traditional PHP sessions unusable and requiring JWT-based session tokens issued by Shopify's App Bridge instead. It covers key security steps including HMAC signature verification, audience and domain claim validation, and a deliberate clock-skew leeway to prevent false token expiry errors. The article also details the OAuth token exchange flow that converts a session token into an offline access token needed to make authenticated Shopify API calls.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why LLM Apps Need Inline Validation Built In From Day One

A developer building an AI-powered app called Slooster learned the hard way that traditional software testing methods fail when large language models are involved, as LLMs can produce inconsistent or nonsensical outputs even from identical prompts. During a staging demo, prompts that had reliably returned real vendor data for weeks suddenly produced placeholder text like 'Vendor A' and 'Vendor B.' To address this, the developer built an inline validation layer with automatic retries that catches bad outputs before users see them. The system uses two layers of checks: a structural schema validator and a secondary AI prompt that evaluates whether the output is semantically meaningful and meets the original criteria. The key lesson is that validation must be continuous, configurable, and built into the application from the start, not treated as an afterthought.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why GitHub Actions workflows should pin dependencies by SHA, not tags

Git tags used in GitHub Actions workflows are mutable pointers that repository owners can silently redirect to different code at any time, posing a supply-chain security risk. Pinning an action to a specific commit SHA ensures the exact audited code runs every time, regardless of upstream changes. Developers should resolve each SHA themselves using the GitHub API rather than copying values from third-party sources, to establish genuine verification. Adding a version comment alongside the SHA, such as '# v4', allows tools like Dependabot to continue offering update pull requests, preventing pinned references from quietly going stale. For actions published on rolling branches, SHA pinning still applies, but teams must actively monitor and bump those references when upstream fixes are released.

0 comments Read more at DEV Community