Show HN: my weekend project, Gumroad • Hacker News Board

Re: Show HN: my weekend project, Gumroad

#111

Post by ojilles » Mon, Apr 04, 2011, 5:24 PM UTC

pixeloution wrote: post #89

jasonlotito wrote: post #81

Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content) I'm really interested if Stripe is aware of what you are doing and fine with it.

PCI compliance is only an issue if he's storing CC data.

I'm no expert, but I don't think this is true. I've witnessed a few payment systems being implemented, and just having this data pass through your system you need to adhere to some compliance rules (which are softer vs. actually storing the data though).

Re: Show HN: my weekend project, Gumroad

#112

Post by MikeCampo » Mon, Apr 04, 2011, 5:24 PM UTC

bhousel wrote: post #5

Clickable: https://gumroad.appspot.com/l/jxrvbk

Please let us know if someone pays for that :D

Re: Show HN: my weekend project, Gumroad

#113

Post by ericd » Mon, Apr 04, 2011, 5:26 PM UTC

louismg wrote: post #96

sahillavingia wrote: post #90

Earlier quoted context omitted.

Awesome! I'm doing Net 60 as that's what Stripe does. The CC data is safe, but of course there's no reinforcement on-site. I'll add something.

Net 60 days? I would assume that users expect near real-time if PayPal is the back end. 60 days sounds way too long.

I'd assume it's at least partly to deal with fraud.

Re: Show HN: my weekend project, Gumroad

#114

Post by tlrobinson » Mon, Apr 04, 2011, 5:26 PM UTC

I already dislike URL shorteners, there's no way I'm going to give my credit card info to one.

Re: Show HN: my weekend project, Gumroad

#115

Post by [deleted] » Mon, Apr 04, 2011, 5:29 PM UTC

sahillavingia wrote: post #40

retube wrote: post #32

How does this work for art though? I mean you want to see the icon/graphic/design/whatever before you pay for it. Also - once you've been redirected to the page, what's to stop you taking the link and sharing it yourself? Also also: if I've got something to sell, can't I just bung it on ebay?

I'd like to think that this has lower overhead than eBay. Nothing is there to stop you for now - I think this is more for casual use than building an entire business on top of. Yes, I'm thinking about adding in a preview option with cluttering up the experience.

[deleted]

Re: Show HN: my weekend project, Gumroad

#116

Post by sahillavingia » Mon, Apr 04, 2011, 5:32 PM UTC

jasonlotito wrote: post #81

Things you have to look at fast. * Money laundering. Cap fees now. * You are using Stripe, but you're still collecting CC data. Are you PCI compliant? * Does Stripe allow you to do this? Really? Basically, you're acting as a third party processor, an IPSP. People can sell anything through your service (Think adult content) I'm really interested if Stripe is aware of what you are doing and fine with it.

Yes they're aware. Fees are already capped. I'm not collecting CC data.

Re: Show HN: my weekend project, Gumroad

#117

Post by personalcompute » Mon, Apr 04, 2011, 5:33 PM UTC

stef25 wrote: post #70

retube wrote: post #32

How does this work for art though? I mean you want to see the icon/graphic/design/whatever before you pay for it. Also - once you've been redirected to the page, what's to stop you taking the link and sharing it yourself? Also also: if I've got something to sell, can't I just bung it on ebay?

Thought of this too, I guess you can watermark images. Not sure how you would sell JS scripts since showing a working demo would require the file to be accessible to the user.

That script you make is copyrighted, if they take it without paying you for it (if that is the deal), then they just broke the law.

Re: Show HN: my weekend project, Gumroad

#118

Post by [deleted] » Mon, Apr 04, 2011, 5:33 PM UTC

stef25 wrote: post #70

retube wrote: post #32

How does this work for art though? I mean you want to see the icon/graphic/design/whatever before you pay for it. Also - once you've been redirected to the page, what's to stop you taking the link and sharing it yourself? Also also: if I've got something to sell, can't I just bung it on ebay?

Thought of this too, I guess you can watermark images. Not sure how you would sell JS scripts since showing a working demo would require the file to be accessible to the user.

[deleted]

Re: Show HN: my weekend project, Gumroad

#119

Post by HardyLeung » Mon, Apr 04, 2011, 5:34 PM UTC

gavinballard wrote: post #71

JangoSteve wrote: post #65

Earlier quoted context omitted.

To address the first problem, you should offer a passive solution and not require the user to set up anything special in the way of single-use URLs. In fact, I assumed the issue of payers sharing the end-link was such an obvious problem that the service would have already addressed this and had it built-in by default (but of course, MVP/first-release, I understand). The way I'd see it working is, I give Gumroad a lin…

Sure, that would make sense for content that could be so served (for example, the pencil icon used as the example here) - but not all content is like that. What about content you want people to interact with (a blog post on your site, a special beta registration form)? You also take on all the problems of becoming a content distributor rather than a link distributor.

and I would add that the content distributor problem is also a good one to solve (with your solution). May even be more profitable... a lot of people want to sell stuff, not link.

Re: Show HN: my weekend project, Gumroad

#120

Post by thorax » Mon, Apr 04, 2011, 5:39 PM UTC

JoshTriplett wrote: post #36

Interesting idea, but I see two main issues with this. First, anyone who pays and gets to the resulting link can trivially share that link; of course, you can always ask them nicely not to do so, and in some contexts that will work, but in general the security model just doesn't work unless you authenticate each paid user at the destination. You need to come up with an answer to this. Second, if you market this as a…

I think #1 is a bit of a red herring. The security problem is not what this is solving. It's the ease of getting paid for some content, with less hassle overall.

Keep in mind that this is digital content so anyone could just rehost/resell/redistribute anything they bought or downloaded. But for something low-payment enough or the average silly download, why would they bother?

It's important to tell sellers that it's insecure so they don't assume it's locked, but please don't complicate this by adding DRM or sharing prevention. The most I'd do here is track downloads and let people kill their link and repost it if they sense abuse.