Hacker News
24.3K subscribers
118K links
Top stories from https://news.ycombinator.com (with 100+ score)
Contribute to the development here: https://github.com/phil-r/hackernewsbot
Also check https://t.me/designer_news

Contacts: @philr
Download Telegram
The Metamorphosis of Prime Intellect (1994) (Score: 151+ in 22 hours)

Link: https://readhacker.news/s/6vvBm
Comments: https://readhacker.news/c/6vvBm
EasyTier – P2P mesh VPN written in Rust using Tokio (❄️ Score: 150+ in 5 days)

Link: https://readhacker.news/s/6vgAq
Comments: https://readhacker.news/c/6vgAq
DiffX – Next-Generation Extensible Diff Format (Score: 150+ in 4 hours)

Link: https://readhacker.news/s/6vyYj
Comments: https://readhacker.news/c/6vyYj
Ask HN: Has anybody built search on top of Anna's Archive? (Score: 150+ in 10 hours)

Link: https://readhacker.news/c/6vyUk

Wouldn't this basically give us Google Books and searchable Scihub at the same time?
What would it cost?
Ask HN: Startup getting spammed with PayPal disputes, what should we do? (Score: 155+ in 14 hours)

Link: https://readhacker.news/c/6vyUg

Longtime user posting from a new account out of an abundance of caution.
I founded an e-commerce marketplace startup. We use PayPal's Multiparty APIs (PayPal Commerce Platform) for checkout. For the 10 days, someone has been bombarding us with purchases that they later dispute. There's consistent pattern to it:
* They use an email address that has no footprint online, always from the same two domains
* They use an unverified PayPal account to pay
* They pay a low amount, not always the same, in a narrow range for a digital item
* All of the charges were disputed within a few hours
They're not doing this through our API. The purchase process requires a browser because of the way our payment form is configured. There's an amount of variation to each purchase that tells us they're automating a browser. Logs indicate that they're changing IP each time. The events come in bursts and seem to be spaced to avoid automated detection.
We added the typical mitigations to our network stack and code. A few are still slipping through. Logs indicate a high amount of bot traffic.
PayPal does not seem equipped to deal with this. Their support is always extremely slow, relies on canned responses, and to date has a very limited understanding of how their own Multiparty APIs work. Their phone support people will not talk with me, they see no indication that my PayPal account is affiliated with these purchases in any way. They want each of our sellers to contact them independently, which we know will result in disparate cases that don't tell the complete story or offer any assistance.
Has anyone encountered anything like this before? We're struggling to find the motive or intended outcome by the attacker(s). We're a small company with a niche audience, we've never had a conflict with anyone that got serious enough that we'd expect them to come after us like this.
Any thoughts and recommendations would be greatly appreciated. We feel like we are on our own here and are unsure of how to handle it.